<p>I am receiving this error when starting a Pod</p>
<pre><code>Failed to pull image &quot;docker-username/docker-private-repository:latest&quot;: rpc error: code = Unknown desc = Error response from daemon: pull access denied for docker-username/docker-private-repository, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
</code></pre>
<p>My setup is as follow:</p>
<p>Ceated a Secret service using command line</p>
<pre><code>kubectl create secret docker-registry docker-keys --docker-username=docker-username --docker-password=password --docker-email=docker-email@gmail.com --docker-server=https://index.docker.io/v1
</code></pre>
<p>which generates the following data inside secrets</p>
<pre><code>kubectl get secret docker-keys -o json | jq '.data | map_values(@base64d)'
{
  &quot;.dockerconfigjson&quot;: &quot;{\&quot;auths\&quot;:{\&quot;https://index.docker.io/v1\&quot;:{\&quot;username\&quot;:\&quot;docker-username\&quot;,\&quot;password\&quot;:\&quot;password\&quot;,\&quot;email\&quot;:\&quot;docker-email@gmail.com\&quot;,\&quot;auth\&quot;:\&quot;base64encodedtoken\&quot;}}}&quot;
}

</code></pre>
<p>Then in deployment I am using <code>docker-keys</code> secrets</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: docker-private-repository
  labels:
    app: docker-private-repository
spec:
  replicas: 1
  selector:
    matchLabels:
      app: docker-private-repository
  template:
    metadata:
      labels:
        app: docker-private-repository
    spec:
      imagePullSecrets:
        - name: docker-keys
      containers:
        - name: docker-private-repository
          image: docker-username/docker-private-repository:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 3000
</code></pre>
<p>I did tried to search for a solution, but always ended up with the above setup.</p>
<p><strong>Update1:</strong>
Secrets service and pod are running in the same namespace <code>default</code>.
Pulling manually from docker-hub works</p>
<pre><code>docker pull docker-username/docker-private-repository:latest
latest: Pulling from docker-username/docker-private-repository
0ecb575e629c: Already exists 
...
7467d1831b69: Already exists 
Digest: sha256:153643ecb19c2ce54635839ce9393b2e256ce6c34a2fe75b91c7a41525a6a535
Status: Downloaded newer image for docker-username/docker-private-repository:latest
docker.io/docker-username/docker-private-repository:latest

</code></pre>
<p><strong>Update2</strong> <code>kubectl describe pod</code></p>
<p>I have 2 sercrets services, one for dockerhub credentials and another is <code>token-rzlx6</code> for whatever reason.
Thing is when I run describe pod, I don't see the secrets for dockerhub to be mounted as <code>token-rzlx6</code>, could this be the reason? And why it is not mounted?</p>
<pre><code>...
Volumes:
  default-token-rzlx6:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-rzlx6
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  &lt;none&gt;
...
</code></pre>

<p>So the problem was the docker-server value. Based on tutorials I've watched I was using api V1, while my image was pushed/created to dockerhub with V2, may be it's not relevant and V1 was deprecated. When I create a secret service I need to use V2 server <code>https://index.docker.io/v2/</code>, like:</p>
<pre><code>kubectl create secret docker-registry docker-keys \
  --docker-username=yyyyyy \
  --docker-password=xxxxx \
  --docker-email=my@mail.com \
  --docker-server=https://index.docker.io/v2/
</code></pre>
<p>A simple thing, that took days to discover, as many articles have V1 or it's not showing it at all or using private docker registry. Docs are here. <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a></p>
<p><strong>Update:</strong></p>
<p>One more thing why I wasn't paying attention to API version is <code>docker config</code> file, that has V1 as API and from here I took the endpoint to create secret service, while it worked with V2 only.</p>
<pre><code>cat ~/.docker/config.json                                                 
{
    &quot;auths&quot;: {
        &quot;https://index.docker.io/v1/&quot;: {}
    },
    &quot;credsStore&quot;: &quot;osxkeychain&quot;
}%                              
</code></pre>
<p><strong>Update 2:</strong>
However, when I pulled image locally with <code>docker pull</code> command, image was pulled successfully using v1 url. Assumption is, api V1 works within docker, but not in kubernetes.</p>
