<p>I'm trying to setup GCR with kubernetes</p>

<p>and getting Error: ErrImagePull
Failed to pull image "eu.gcr.io/xxx/nodejs": rpc error: code = Unknown desc = Error response from daemon: pull access denied for eu.gcr.io/xxx/nodejs, repository does not exist or may require 'docker login'</p>

<p>Although I have setup the secret correctly in the service account, and added image pull secrets in the deployment spec</p>

<p>deployment.yml</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    kompose.cmd: kompose convert
    kompose.version: 1.18.0 (06a2e56)
  creationTimestamp: null
  labels:
    io.kompose.service: nodejs
  name: nodejs
spec:
  replicas: 1
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        io.kompose.service: nodejs
    spec:
      containers:
      - env:
        - name: MONGO_DB
          valueFrom:
            configMapKeyRef:
              key: MONGO_DB
              name: nodejs-env
        - name: MONGO_HOSTNAME
          value: db
        - name: MONGO_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mongo-secret
              key: MONGO_PASSWORD
        - name: MONGO_PORT
          valueFrom:
            configMapKeyRef:
              key: MONGO_PORT
              name: nodejs-env
        - name: MONGO_USERNAME
          valueFrom:
            secretKeyRef:
              name: mongo-secret
              key: MONGO_USERNAME
        image: "eu.gcr.io/xxx/nodejs"
        name: nodejs
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        resources: {}
      imagePullSecrets:
        - name: gcr-json-key
      initContainers:
        - name: init-db
          image: busybox
          command: ['sh', '-c', 'until nc -z db:27017; do echo waiting for db; sleep 2; done;']
      restartPolicy: Always
status: {}

</code></pre>

<p>used this to add the secret, and it said created</p>

<pre><code>kubectl create secret docker-registry gcr-json-key --docker-server=eu.gcr.io  --docker-username=_json_key  --docker-password="$(cat mycreds.json)"   --docker-email=mygcpemail@gmail.com
</code></pre>

<p>How can I debug this, any ideas are welcome!</p>

<p>It looks like the issue is caused by lack of permission on the related service account 
XXXXXXXXXXX-compute@XXXXXX.gserviceaccount.com which is missing Editor role.</p>

<p>Also,we need to restrict the scope to assign permissions only to push and pull images from google kubernetes engine, this account will need storage admin view permission which can be assigned by following the instructions mentioned in this article [1].</p>

<p>Additionally, to set the read-write storage scope when creating a Google Kubernetes Engine cluster, use the --scopes option to mention this scope "storage-rw"[2]. </p>

<p>[1] <a href="https://cloud.google.com/container-registry/docs/access-control" rel="nofollow noreferrer">https://cloud.google.com/container-registry/docs/access-control</a>
[2]<a href="https://cloud.google.com/container-registry/docs/using-with-google-cloud-platform#google-kubernetes-engine" rel="nofollow noreferrer">https://cloud.google.com/container-registry/docs/using-with-google-cloud-platform#google-kubernetes-engine</a>”</p>
