<p>I've been trying to create a deployment of docker image to Kubernetes cluster without luck, my deployment.yaml looks like:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: application-deployment
  labels:
    app: application
spec:
  serviceAccountName: gitlab
  automountServiceAccountToken: false
  containers:
  - name: application
    image: example.org:port1/foo/bar:latest
    ports:
      - containerPort: port2
  volumes:
    - name: foo
      secret:
        secretName: regcred
</code></pre>

<p>But it fails to get the image.</p>

<blockquote>
  <p>Failed to pull image "example.org:port1/foo/bar:latest": rpc error: code = Unknown desc = Error response from daemon: Get <a href="https://example.org:port1/v2/foo/bar/manifests/latest" rel="nofollow noreferrer">https://example.org:port1/v2/foo/bar/manifests/latest</a>: denied: access forbidden</p>
</blockquote>

<p>The secret used in <code>deployment.yaml</code>, was created like this:</p>

<pre><code>kubectl create secret docker-registry regcred --docker-server=${CI_REGISTRY} --docker-username=${CI_REGISTRY_USER} --docker-password=${CI_REGISTRY_PASSWORD} --docker-email=${GITLAB_USER_EMAIL}
</code></pre>

<p><strong>Attempt #1: adding imagePullSecrets</strong></p>

<pre><code>...
imagePullSecrets:
  - name: regcred
</code></pre>

<p>results in:</p>

<blockquote>
  <p>Failed to pull image "example.org:port1/foo/bar:latest": rpc error: code = Unknown desc = Error response from daemon: Get <a href="https://example.org:port1/v2/foo/bar/manifests/latest" rel="nofollow noreferrer">https://example.org:port1/v2/foo/bar/manifests/latest</a>: unauthorized: HTTP Basic: Access denied</p>
</blockquote>

<p><strong>Solution:</strong></p>

<p>I've created deploy token under <em>Settings > Repository > Deploy Tokens > (created one with read_registry scope)</em></p>

<p>And added given values to environment variables and an appropriate line now looks like:</p>

<pre><code>kubectl create secret docker-registry regcred --docker-server=${CI_REGISTRY} --docker-username=${CI_DEPLOY_USER} --docker-password=${CI_DEPLOY_PASSWORD}
</code></pre>

<p>I've got the problematic line from tutorials &amp; Gitlab docs, where they've described deploy tokens but further used problematic line in examples.</p>

<p>I reproduced your issue and the problem is with password you used while creating a repository's secret. When creating a secret for gitlab repository you have to use personal token created in gitlab instead of a password. </p>

<p>You can create a token by going to <code>Settings -&gt; Access Tokens</code>. Then you have to pick a name for your token, expiration date and token's scope. </p>

<p>Then create a secret as previously by running </p>

<pre><code>kubectl create secret docker-registry regcred --docker-server=$docker_server --docker-username=$docker_username --docker-password=$personal_token
</code></pre>

<p>While creating a pod you have to include </p>

<pre><code>  imagePullSecrets:
  - name: regcred
</code></pre>
