<p>In Kubernetes container repository I have my permission set to Private:
<a href="https://i.stack.imgur.com/K1iNY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/K1iNY.png" alt="enter image description here" /></a></p>
<p>When I create a pod on my cluster I get the the pod status ending in <code>ImagePullBackOff</code> and when I describe the pod I see:</p>
<pre><code>Failed to pull image &quot;gcr.io/REDACTED&quot;: rpc error: code = Unknown desc = Error response from daemon: pull access denied for gcr.io/REDACTED, repository does not exist or may require 'docker login': denied: Permission denied for &quot;v11&quot; from request &quot;/v2/REDACTED/manifests/v11&quot;.
</code></pre>
<p>I am certainly logged in.</p>
<pre><code>docker login
Authenticating with existing credentials...
Login Succeeded
</code></pre>
<p>Now if I enable public access (top image) on my Container Repository things work fine and the pod deploys correctly. But I don't want my repository to be public. What is the correct way to keep my container repository private and still be able to deploy. I'm pretty sure this used to work a couple weeks ago unless I messed up something with my service account although I don't know how to find out which service account is being used for these permissions.</p>

<p>GKE uses the service account attached to the node pools to grant access to the registry, however, you must be sure that the OAuth scope for your cluster is set to <code>https://www.googleapis.com/auth/devstorage.read_only</code> as well.</p>
