<p>I am working through a lab that shows how to set-up Kubernetes and the CLI on IBM Cloud.</p>
<p>I have the Kubernetes cluster setup, and the container registry. I am logged in to IBM Cloud and the Container Registry on the CLI. The image has been created and pushed.</p>
<p>I can create a pod using the image with an imperative command using:</p>
<pre><code>kubectl create -f hello-world-create.yaml
</code></pre>
<p>where the <code>yaml</code> file looks like:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: hello-world
spec:
  containers:
  - name: hello-world
    image: us.icr.io/earlyprogramimages/hello-world:1
    ports:
    - containerPort: 80
  imagePullSecrets:
  - name: icr

</code></pre>
<p>but when I try the declarative command for the same image running</p>
<pre><code>kubectl apply -f hello-world-apply.yaml
</code></pre>
<p>where the <code>yaml</code> file looks like</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  generation: 1
  labels:
    run: hello-world
  name: hello-world
spec:
  replicas: 3
  selector:
    matchLabels:
      run: hello-world
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        run: hello-world
    spec:
      containers:
      - image: us.icr.io/earlyprogramimages/hello-world:1
        imagePullPolicy: Always
        name: hello-world
        ports:
        - containerPort: 80
          protocol: TCP
      imagePullSecrets:
      - name: icr
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      securityContext: {}
      terminationGracePeriodSeconds: 30
</code></pre>
<p>I get status of <code>ErrImagePull</code> for each of the pods where the event stack is</p>
<pre><code>Successfully assigned default/hello-world-6fd8bd67dc-79gbz to xx.xx.xx.xx
Pulling image &quot;us.icr.io/earlyprogramimages/hello-world:1

Failed to pull image &quot;us.icr.io/earlyprogramimages/hello-world:1&quot;: rpc error: code = Unknown desc = failed to pull and unpack image &quot;us.icr.io/earlyprogramimages/hello-world:1&quot;: failed to resolve reference &quot;us.icr.io/earlyprogramimages/hello-world:1&quot;: failed to authorize: failed to fetch anonymous token: unexpected status: 401 Unauthorized

Error: ErrImagePull
</code></pre>
<p>Clearly the command doesn't have read access to image, but I have logged in successfully using</p>
<pre><code>ibmcloud cr login
</code></pre>
<p>and can deploy a pod using the imperative create command.</p>
<p>I have been through the documentation, but can't determine which step I have overlooked. What are the extra steps needed which grant the appropriate access for the declarative apply command?</p>
<p>Running</p>
<pre><code>kubectl get secrets -n default | grep &quot;icr-io&quot;
</code></pre>
<p>gives</p>
<pre><code>kubectl get secrets -n default | grep &quot;icr-io&quot;
all-icr-io            kubernetes.io/dockerconfigjson        1      167m
default-au-icr-io     kubernetes.io/dockerconfigjson        1      167m
default-de-icr-io     kubernetes.io/dockerconfigjson        1      167m
default-icr-io        kubernetes.io/dockerconfigjson        1      167m
default-jp-icr-io     kubernetes.io/dockerconfigjson        1      167m
default-uk-icr-io     kubernetes.io/dockerconfigjson        1      167m
default-us-icr-io     kubernetes.io/dockerconfigjson        1      167m
</code></pre>

<p>Here's what I did and worked as expected,</p>
<p>As you can see <code>all-icr-io</code> is the default image pull secret provided in your cluster. <em>Not sure why you were using <code>icr</code></em></p>
<blockquote>
<p>By default, the IBM Cloud Kubernetes cluster is set up to pull images
from only your account’s namespace in IBM Cloud Container Registry by
using the secret <code>all-icr-io</code> in the default namespace.</p>
</blockquote>
<p>Check the <a href="https://cloud.ibm.com/docs/containers?topic=containers-registry#other" rel="noreferrer">documentation here</a> to copy the existing image pull secret to a non-default namespace</p>
<p>So, my <code>hello-world-create</code> looks like this</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: hello-world
spec:
  containers:
  - name: hello-world
    image: us.icr.io/mods15/hello-world:1
    ports:
    - containerPort: 80
  imagePullSecrets:
  - name: all-icr-io
</code></pre>
<p>and my <code>hello-world-apply.yaml</code> is</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  generation: 1
  labels:
    run: hello-world
  name: hello-world
spec:
  replicas: 3
  selector:
    matchLabels:
      run: hello-world
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        run: hello-world
    spec:
      containers:
      - image: us.icr.io/mods15/hello-world:1
        imagePullPolicy: Always
        name: hello-world
        ports:
        - containerPort: 80
          protocol: TCP
      imagePullSecrets:
      - name: all-icr-io
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      securityContext: {}
      terminationGracePeriodSeconds: 30
</code></pre>
<p>Here's the outcome once the <code>yaml</code> files are configured successfully
<a href="https://i.stack.imgur.com/IfUrp.png" rel="noreferrer"><img src="https://i.stack.imgur.com/IfUrp.png" alt="enter image description here" /></a></p>
