<p>I have a simple <code>docker-compose</code> file like the following:</p>

<pre><code>version: "3.7"
services: 
  mongo:
    image: asia.gcr.io/myproj/mymongo:latest
    hostname: mongo
    volumes: 
      - type: bind
        source: $MONGO_DB_DATA
        target: /data/db
    command: [ "--bind_ip_all", "--replSet", "rs0", "--wiredTigerCacheSizeGB", "1.5"]
</code></pre>

<p>I am launching it in Kubernetes using the following command</p>

<pre><code>docker-compose config | docker stack deploy    --orchestrator kubernetes --compose-file - mystack
</code></pre>

<p>However, when the pod fails with this error</p>

<pre><code>Failed to pull image "asia.gcr.io/myproj/mymongo:latest": rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication
</code></pre>

<p>My private registry is the gcloud one. I have already logged in docker like the following using the service account keyfile.</p>

<pre><code>docker login  -u _json_key -p "$(cat keyfile.json)" https://asia.gcr.io
</code></pre>

<p>The image is pulled correctly when I run</p>

<pre><code>docker-compose pull
</code></pre>

<p>From this link <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a>, I found that I need to create <code>ImagePullSecrets</code> </p>

<p>I have two questions.</p>

<ol>
<li><p>How can I write the <code>ImagePullSecrets</code> syntax in my docker-compose so that it is referred correctly.</p></li>
<li><p>The method that the links mentions asks you to use <code>.docker/config.json</code> file. However, my config.json has</p>

<p>"auths": {
        "asia.gcr.io": {},
    },
It doesn't include the username and password since I configured it using the keyfile. How can I do this?</p></li>
<li><p>Or is there any simpler way to do this?</p></li>
</ol>

<p>I solved this issue by first creating a secret like this</p>

<pre><code>kubectl create secret docker-registry regcred --docker-server https://&lt;docker registry&gt;  --docker-username _json_key --docker-password &lt;json key&gt; --docker-email=&lt;email&gt;
</code></pre>

<p>and then adding it to the default service account </p>

<pre><code>kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "regcred"}]}'
</code></pre>
