<p>I have a private docker registry hosted on gitlab and I would like to use this repository to pull images for my local kubernetes cluster:</p>
<pre><code>NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    &lt;none&gt;        443/TCP   68m
</code></pre>
<p>K8s is on <code>v1.22.5</code> and is a single-node cluster that comes 'out of the box' with Docker Desktop. I have already built and deployed an image to the gitlab container registry <code>registry.gitlab.com</code>. What I have done already:</p>
<ol>
<li>Executed the command <code>docker login -u &lt;username&gt; -p &lt;password&gt; registry.gitlab.com</code></li>
<li>Modified the <code>~/.docker/config.json</code> file to the following:
<pre><code>{
    &quot;auths&quot;: {
        &quot;registry.gitlab.com&quot;: {}
    },
    &quot;credsStore&quot;: &quot;osxkeychain&quot;
}
</code></pre>
</li>
<li>Created and deployed a secret to the cluster with the file:
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: registry-key
data:
  .dockerconfigjson: &lt;base-64-encoded-.config.json-file&gt;
type: kubernetes.io/dockerconfigjson
</code></pre>
</li>
<li>Deployed an app with the following file:
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-deployment 
  labels:
    app: test-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test-app
  template:
    metadata:
      labels:
        app: test-app
    spec:
      imagePullSecrets:
      - name: registry-key
      containers:
      - name: test-app
        image: registry.gitlab.com/&lt;image-name&gt;:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 80
</code></pre>
</li>
</ol>
<hr />
<p>The deployment is created successfully but upon inspection of the pod (<code>kubectl describe pod</code>) I find the following events:</p>
<pre><code>Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  21s               default-scheduler  Successfully assigned default/test-deployment-87b5747b5-xdsl9 to docker-desktop
  Normal   BackOff    19s               kubelet            Back-off pulling image &quot;registry.gitlab.com/&lt;image-name&gt;:latest&quot;
  Warning  Failed     19s               kubelet            Error: ImagePullBackOff
  Normal   Pulling    7s (x2 over 20s)  kubelet            Pulling image &quot;registry.gitlab.com/&lt;image-name&gt;:latest&quot;
  Warning  Failed     7s (x2 over 19s)  kubelet            Failed to pull image &quot;registry.gitlab.com/&lt;image-name&gt;:latest&quot;: rpc error: code = Unknown desc = Error response from daemon: Head &quot;https://registry.gitlab.com/v2/&lt;image-name&gt;/manifests/latest&quot;: denied: access forbidden
  Warning  Failed     7s (x2 over 19s)  kubelet            Error: ErrImagePull
</code></pre>
<hr />
<p>Please provide any information that might be causing these errors.</p>

<p>I managed to solve the issue by editing the default <code>config.json</code> produced by <code>$ docker login</code>:</p>
<pre><code>{
    &quot;auths&quot;: {
        &quot;registry.gitlab.com&quot;: {}
    },
    &quot;credsStore&quot;: &quot;osxkeychain&quot;
}
</code></pre>
<p>becomes</p>
<pre><code>{
    &quot;auths&quot;: {
        &quot;registry.gitlab.com&quot;: {
            &quot;auth&quot;:&quot;&lt;access-token-in-plain-text&gt;&quot;
        }
    }
}
</code></pre>
<p>Thanks Bala for suggesting this in the comments. I realise storing the access token in plain text in the file may not be secure but this can be changed to use a path if needed.</p>
<p>I also created the secret as per OzzieFZI's suggestion:</p>
<pre><code>$ kubectl create secret docker-registry registry-key \
  --docker-server=registry.gitlab.com \
  --docker-username=&lt;username&gt; \
  --docker-password=&quot;$(cat /path/to/token.txt)&quot;
</code></pre>
