<p>I am using google container registry (GCR) to push and pull docker images. I have created a deployment in kubernetes with 3 replicas. The deployment will use a docker image pulled from the GCR.</p>
<p>Out of 3 replicas, 2 are pulling the images and running fine.But the third replica is showing the below error and the pod's status remains &quot;ImagePullBackOff&quot; or &quot;ErrImagePull&quot;</p>
<blockquote>
<p>&quot;Failed to pull image &quot;gcr.io/xxx:yyy&quot;: rpc error: code = Unknown desc
= failed to pull and unpack image &quot;gcr.io/xxx:yyy&quot;: failed to resolve reference &quot;gcr.io/xxx:yyy&quot;: unexpected status code: 401 Unauthorized&quot;</p>
</blockquote>
<p>I am confused like why only one of the replicas is showing the error and the other 2 are running without any issue. Can anyone please clarify this?</p>
<p>Thanks in Advance!</p>

<p><strong>ImagePullBackOff</strong> and <strong>ErrImagePull</strong> indicate that the image used by a container cannot be loaded from the image registry.</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/troubleshooting#401_unauthorized_cannot_pull_images_from_private_container_registry_repository" rel="nofollow noreferrer">401 unauthorized error</a> might occur when you pull an image from a private Container Registry repository. For troubleshooting the error:</p>
<ol>
<li><p>Identify the node that runs the pod by <code>kubectl describe pod POD_NAME | grep &quot;Node:&quot;</code></p>
</li>
<li><p>Verify the node has the storage scope by running the command</p>
<pre><code>gcloud compute instances describe NODE_NAME  --zone=COMPUTE_ZONE --format=&quot;flattened(serviceAccounts[].scopes)&quot;
</code></pre>
</li>
<li><p>The node's access scope should contain at least one of the following:</p>
<p>serviceAccounts[0].scopes[0]: <a href="https://www.googleapis.com/auth/devstorage.read_only" rel="nofollow noreferrer">https://www.googleapis.com/auth/devstorage.read_only</a>
serviceAccounts[0].scopes[0]: <a href="https://www.googleapis.com/auth/cloud-platform" rel="nofollow noreferrer">https://www.googleapis.com/auth/cloud-platform</a></p>
</li>
<li><p>Recreate the node pool that node belongs to with sufficient scope and you cannot modify existing nodes, you must recreate the node with the correct scope.</p>
<ul>
<li><p>Create a new node pool with the gke-default scope by the following command</p>
<pre><code>gcloud container node-pools create NODE_POOL_NAME  --cluster=CLUSTER_NAME  --zone=COMPUTE_ZONE   --scopes=&quot;gke-default&quot;
</code></pre>
</li>
<li><p>Create a new node pool with only storage scope</p>
<pre><code>gcloud container node-pools create NODE_POOL_NAME   --cluster=CLUSTER_NAME  --zone=COMPUTE_ZONE --scopes=&quot;https://www.googleapis.com/auth/devstorage.read_only&quot;
</code></pre>
</li>
</ul>
</li>
</ol>
<p>Refer to the <a href="https://cloud.google.com/kubernetes-engine/docs/troubleshooting#ImagePullBackOff" rel="nofollow noreferrer">link</a> for more information on the troubleshooting process.</p>
