<p>Any idea why I keep getting this annoying and unhelpful error code/description?</p>

<pre><code>Failed to pull image myapidemodocker.azurecr.io/apidemo:v4.0: rpc error: code = Unknown desc = unknown blob
</code></pre>

<p>I thought of incorrect secret and followed this documentation from Microsoft with no success! [<a href="https://learn.microsoft.com/en-us/azure/container-registry/container-registry-auth-aks][1]" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/container-registry/container-registry-auth-aks][1]</a>.</p>

<p>Context:</p>

<ul>
<li>I am using Visual Studio with Docker for Windows to create Windows
Container image.</li>
<li>Image is pushed to Azure Container Register (ACR) and Deployed as
Azure Container Instance. Unfortunately, I can't use ACI as
production application because it is not connected to a private vNET.
Can't use public IP for security reason but that's what is done just
for poc!</li>
<li>Next step, Created Kubernetes cluster in Azure and trying to deploy
the same image (Windows container) into Kubernetes POD but it is not
working.</li>
<li>Let me share my yml definition and event logs</li>
</ul>

<p>Here is my yml definition:</p>

<pre><code>apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: apidemo
spec:
  template:
    metadata:
      labels:
        app: apidemo
    spec:
      containers:
      - name: apidemo
        image: myapidemodocker.azurecr.io/apidemo:v4.0
      imagePullSecrets:
      - name: myapidemosecret
      nodeSelector:
       beta.kubernetes.io/os: windows


Event logs:
Events:
  Type     Reason                 Age               From                               Message
  ----     ------                 ----              ----                               -------
  Normal   Scheduled              4m                default-scheduler                  Successfully assigned apidemo-57b5fc58fb-zxk86 to aks-agentp
ool-18170390-1
  Normal   SuccessfulMountVolume  4m                kubelet, aks-agentpool-18170390-1  MountVolume.SetUp succeeded for volume "default-token-gsjhl"
  Normal   SandboxChanged         2m                kubelet, aks-agentpool-18170390-1  Pod sandbox changed, it will be killed and re-created.
  Normal   Pulling                2m (x2 over 4m)   kubelet, aks-agentpool-18170390-1  pulling image "apidemodocker.azurecr.io/apidemo:v4.0"
  Warning  Failed                 20s (x2 over 2m)  kubelet, aks-agentpool-18170390-1  Failed to pull image "apidemodocker.azurecr.io/apidemo:v4
.0": [rpc error: code = Unknown desc = unknown blob, rpc error: code = Unknown desc = unknown blob]
  Warning  Failed                 20s (x2 over 2m)  kubelet, aks-agentpool-18170390-1  Error: ErrImagePull
  Normal   BackOff                10s               kubelet, aks-agentpool-18170390-1  Back-off pulling image "apidemodocker.azurecr.io/apidemo:
v4.0"
  Warning  Failed                 10s               kubelet, aks-agentpool-18170390-1  Error: ImagePullBackOff
</code></pre>

<p>(5) I don't understand why Kubernetes is still using <code>/var/run/secrets/kubernetes.io/serviceaccount</code> from <code>default-token-gsjhl</code> as secrete  while I specified my own!</p>

<p>Thanks for taking time to provide feedback.</p>

<p>I was able to resolve the issue. It had nothing to do with error message! The actual problem was, I was trying to use Windows Container image and Kubernetes in Azure only support Linux Container images.</p>

<p>This are the actions I had to do:</p>

<ul>
<li>Configured Ubuntu (<a href="https://tutorials.ubuntu.com/tutorial/tutorial-windows-ubuntu-hyperv-containers#0" rel="nofollow noreferrer">Linux Container on Windows 10</a>) </li>
<li>Configured Docker to use Linux (Switch to Linux Container).</li>
<li>Converted ASP.NET MVC project to ASP.NET Core using Visual Studio 2017. This was a big change to support multiple platforms including Linux.</li>
<li>Updated the dockerfile and docker-compose project.</li>
<li>Created new docker image (Linux Container).</li>
<li>Pushed the image to Azure Container Registry.</li>
<li>Created a new deployment in Kubernetes with same credential. It worked!</li>
<li>Created a new <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Service to expose the app in Kubernetes</a>. This step created an endpoint that client can use.</li>
<li>My Kubernetes cluster is vNET joined and all IP's are private. So, I exposed the Kubernetes endpoint (service) via Azure API Gateway. Just for the sake of demo, I allowed anonymous access to API (API Key and jwt token are must for production app).</li>
<li>Here is the application flow: Client App -> Azure API Gateway -> Kubernetes Endpoint(private IP) -> Kubernetes PODs -> My Linux Container</li>
</ul>

<p>There are lots of complexities and technology specifications are changing rapidly. So, it took me lots of reading to get it right! I am sure you can do it. Try my API from Azure Kubernetes Service here-</p>

<ul>
<li><a href="https://gdtapigateway.azure-api.net/containerdemo/aks/api/address/GetTop10Cities?StateProvince=Texas&amp;CountryRegion=United%20States" rel="nofollow noreferrer">https://gdtapigateway.azure-api.net/containerdemo/aks/api/address/GetTop10Cities?StateProvince=Texas&amp;CountryRegion=United%20States</a></li>
<li><a href="https://gdtapigateway.azure-api.net/containerdemo/aks/api/address/GetAddressById?addressID=581" rel="nofollow noreferrer">https://gdtapigateway.azure-api.net/containerdemo/aks/api/address/GetAddressById?addressID=581</a></li>
</ul>

<p>Here are some the configurations that I used for your information-</p>

<p><strong>Dockerfile:</strong>
<pre><code></p>

<pre><code>FROM microsoft/aspnetcore:2.0
ARG source
WORKDIR /app
ENV ASPNETCORE_URLS=http://+:80
EXPOSE 80
COPY ${source:-obj/Docker/publish} .
ENTRYPOINT ["dotnet", "gdt.api.demo.dotnetcore.dll"]
</code></pre>

<p></pre></code></p>

<p><strong>Docker-compose:</strong>
<pre><code>
version: '3'</p>

<p>services:
  gdt-api-demo:
    image: gdt.api.demo.dotnetcore
    build:
      context: .\gdt.api.demo.dotnetcore
      dockerfile: Dockerfile
</pre></code></p>

<p><strong>Kubernetes Deployment Definition:</strong>
<pre><code>
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: gdtapidemo
spec:
  template:
    metadata:
      labels:
        app: gdtapidemo
    spec:
      containers:
      - name: gdtapidemo
        image: gdtapidemodocker.azurecr.io/gdtapidemo-ubuntu:v1.0
      imagePullSecrets:
      - name: gdtapidemosecret
</pre></code></p>

<p><strong>Kubernetes Service Definition:</strong>
<pre><code>
kind: Service
apiVersion: v1
metadata:
  name: gdtapidemo-service
spec:
  selector:
    app: gdtapidemo-app
  ports:
  - protocol: TCP
    port: 80
    targetPort: 9200
</pre></code></p>

<p><a href="https://i.stack.imgur.com/sPyOb.png" rel="nofollow noreferrer">Service as Deployed in Kubernetes</a></p>
