<p>I am new to Kubernetes, I am using Google Container Registry to store my private images, I created a secret key named grc-puller-key</p>

<p>When I use the command:
<code>kubectl apply -f deployment.yaml</code>
I encountered an unexpected behavior. Sometimes pods are successfully spin up, sometimes those don't. When I failed, I describe the logs and see that I have no credential to pull image, but sometimes it does work.</p>

<p>Here is my deployment</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: portfolio
  labels:
    app: portfolio
spec:
  selector:
    matchLabels:
      app: portfolio
  template:
    metadata:
      labels:
        app: portfolio
    spec:
      containers:
      - name: portfolio
        image: gcr.io/phuong-devops/portfolio:v1
        ports: 
        - containerPort: 3000 
          protocol: TCP
      imagePullSecrets:
      - name: grc-puller-key
</code></pre>

<p>I am sure that the secret named <strong>grc-puller-key</strong> was created. I am providing a screen shot as below:  </p>

<p><a href="https://ibb.co/ZKqLMDK" rel="nofollow noreferrer">https://ibb.co/ZKqLMDK</a></p>

<p>Thanks for your helps, It turned out when I changed my service account permission to StorageAdmin, everything worked. But I don't know why it leads to such behavior. If I am not authorized to my container registry, It should had been failed all the time. Right? But in fact, It did not.</p>
