<p><a href="https://microk8s.io/docs/registry-private" rel="nofollow noreferrer">microk8s document &quot;Working with a private registry&quot;</a> leaves me unsure what to do. The <strong>Secure registry</strong> portion says <strong>Kubernetes</strong> does it one way (no indicating whether or not Kubernetes' way applies to microk8), and <strong>microk8s</strong> uses <strong>containerd</strong> inside its implementation.</p>
<p>My YAML file contains a reference to a private container on dockerhub.</p>
<pre><code>apiVersion: apps/v1 
kind: Deployment
metadata:
  name: blaw
spec:
  replicas: 1
  selector:
    matchLabels:
      app: blaw
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: blaw
    spec:
      containers:
        - image: johngrabner/py_blaw_service:v0.3.10
          name: py-transcribe-service
</code></pre>
<p>When I <strong>microk8s kubectl apply</strong> this file and do a <strong>microk8s kubectl describe</strong>, I get:</p>
<pre><code>Warning  Failed     16m (x4 over 18m)     kubelet            Failed to pull image &quot;johngrabner/py_blaw_service:v0.3.10&quot;: rpc error: code = Unknown desc = failed to pull and unpack image &quot;docker.io/johngrabner/py_blaw_service:v0.3.10&quot;: failed to resolve reference &quot;docker.io/johngrabner/py_blaw_service:v0.3.10&quot;: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
</code></pre>
<p>I have verified that I can download this repo from a console doing a docker pull command.</p>
<p>Pods using public containers work fine in microk8s.</p>
<p>The file <strong>/var/snap/microk8s/current/args/containerd-template.toml</strong> already contains something to make dockerhub work since public containers work. Within this file, I found</p>
<pre><code>  # 'plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry' contains config related to the registry
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]

    # 'plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors' are namespace to mirror mapping for all namespaces.
    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]
      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;docker.io&quot;]
        endpoint = [&quot;https://registry-1.docker.io&quot;, ]
      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;localhost:32000&quot;]
        endpoint = [&quot;http://localhost:32000&quot;]
</code></pre>
<p>The above does not appear related to authentication.</p>
<p>On the internet, I found instructions to create a secret to store credentials, but this does not work either.</p>
<pre><code>microk8s kubectl create secret generic regcred --from-file=.dockerconfigjson=/home/john/.docker/config.json --type=kubernetes.io/dockerconfigjson
</code></pre>

<p>While you have created the secret you have to then setup your deployment/pod to use that secret in order to download the image. This can be achieved with <code> imagePullSecrets</code> as described on the microk8s document you mentioned.</p>
<p>Since you already created your secret you just have reference it in your deployment:</p>
<pre class="lang-yaml prettyprint-override"><code>...
    spec:
      containers:
        - image: johngrabner/py_blaw_service:v0.3.10
          name: py-transcribe-service
        imagePullSecrets:
        - name: regcred
...
</code></pre>
<p>For more reading check how to <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret" rel="nofollow noreferrer">Pull an Image from a Private Registry.</a></p>
