<p>My pod can't be created because of the following problem:</p>
<pre><code>Failed to pull image &quot;europe-west3-docker.pkg.dev/&lt;PROJECT_ID&gt;/&lt;REPO_NAME&gt;/my-app:1.0.0&quot;: rpc error: code = Unknown desc = Error response from daemon: Get https://europe-west3-docker.pkg.dev/v2/&lt;PROJECT_ID&gt;/&lt;REPO_NAME&gt;/my-app/manifests/1.0.0: denied: Permission &quot;artifactregistry.repositories.downloadArtifacts&quot; denied on resource &quot;projects/&lt;PROJECT_ID&gt;/locations/europe-west3/repositories/&lt;REPO_NAME&gt;&quot; (or it may not exist)
</code></pre>
<p>I've never experienced anything like it. Maybe someone can help me out.</p>
<p>Here is what I did:</p>
<ol>
<li>I set up a standrd Kubernetes cluster on Google Cloud in the Zone <code>europe-west-3-a</code></li>
<li>I started to follow the steps described here <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app</a></li>
<li>I built the docker imager and pushed it to the Artifcats repository</li>
<li>I can confirm the repo and the image are present, both in the Google Console as well as pulling the image with docker</li>
<li>Now I want to deploy my app, here is the deployment file:</li>
</ol>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  labels:
    app: my-app
spec:
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: europe-west3-docker.pkg.dev/&lt;PROJECT_ID&gt;/&lt;REPO_NAME&gt;/my-app:1.0.0
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
</code></pre>
<ol start="6">
<li>The pod fails to create due to the error mentioned above.</li>
</ol>
<p>What am I missing?</p>

<p>I encountered the same problem, and was able to get it working by executing:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud projects add-iam-policy-binding ${PROJECT} \
--member=serviceAccount:${EMAIL} \
--role=roles/artifactregistry.reader
</code></pre>
<p>with <code>${PROJECT}</code> = the project name and <code>${EMAIL}</code> = the default service account, e.g. something like <code>123456789012-compute@developer.gserviceaccount.com</code>.</p>
<p>I suspect I may have removed some &quot;excess permissions&quot; too eagerly in the past.</p>
