<p>Apologies if this is a duplicate, I haven't found a solution in similar questions.
I'm trying to upload a docker image to Google Kubernetes Engine.
I've did it successfully before, but I can't seem to find my luck this time around.</p>
<p>I have Google SDK set up locally with kubectl and my Google Account, which is project owner and has all required permissions.
When I use</p>
<pre><code>kubectl create deployment hello-app --image=gcr.io/{project-id}/hello-app:v1
</code></pre>
<p>I see the deployment on my GKE console, consistently crashing as it &quot;cannot pull the image from the repository.ErrImagePull Cannot pull image '' from the registry&quot;.</p>
<p>It provides 4 recommendations, which I have by now triple checked:</p>
<ul>
<li>Check for spelling mistakes in the image names.</li>
<li>Check for errors when pulling the images manually (all fine in Cloud Shell)</li>
<li>Check the image pull secret settings
So, based on this <a href="https://blog.container-solutions.com/using-google-container-registry-with-kubernetes" rel="nofollow noreferrer">https://blog.container-solutions.com/using-google-container-registry-with-kubernetes</a>, I manually added 'gcr-json-key' from a new service account with project view permissions as well as 'gcr-access-token' to kubectl default service account.</li>
<li>Check the firewall for the cluster to make sure the cluster can connect to the ''. Afaik, this should not be an issue with a newly set up cluster.</li>
</ul>
<p>The pods themselve provide the following error code:</p>
<pre><code>Failed to pull image &quot;gcr.io/{project id}/hello-app:v1&quot;: 
[rpc error: code = Unknown desc = Error response from daemon: 
Get https://gcr.io/v2/{project id}/hello-app/manifests/v1: unknown: Unable to parse json key., 
rpc error: code = Unknown desc = Error response from daemon: 
Get https://gcr.io/v2/{project id}/hello-app/manifests/v1: 
unauthorized: Not Authorized., rpc error: code = Unknown desc = Error response from daemon: 
pull access denied for gcr.io/{project id}/hello-app, 
repository does not exist or may require 'docker login': denied: 
Permission denied for &quot;v1&quot; from request &quot;/v2/{project id}/hello-app/manifests/v1&quot;.]
</code></pre>
<p>My question now, what am I doing wrong or how can I find out why my pods can't pull my image?</p>
<hr />
<p>Kubernetes default serviceaccount spec:</p>
<pre><code>kubectl get serviceaccount -o json
{
    &quot;apiVersion&quot;: &quot;v1&quot;,
    &quot;imagePullSecrets&quot;: [
        {
            &quot;name&quot;: &quot;gcr-json-key&quot;
        },
        {
            &quot;name&quot;: &quot;gcr-access-token&quot;
        }
    ],
    &quot;kind&quot;: &quot;ServiceAccount&quot;,
    &quot;metadata&quot;: {
        &quot;creationTimestamp&quot;: &quot;2020-11-25T15:49:16Z&quot;,
        &quot;name&quot;: &quot;default&quot;,
        &quot;namespace&quot;: &quot;default&quot;,
        &quot;resourceVersion&quot;: &quot;6835&quot;,
        &quot;selfLink&quot;: &quot;/api/v1/namespaces/default/serviceaccounts/default&quot;,
        &quot;uid&quot;: &quot;436bf59a-dc6e-49ec-aab6-0dac253e2ced&quot;
    },
    &quot;secrets&quot;: [
        {
            &quot;name&quot;: &quot;default-token-5v5fb&quot;
        }
    ]
}
</code></pre>

Niels Uitterdijk
<p>It does take several steps and the blog post you referenced appears to have them correctly. So, I suspect your error is in one of the steps.</p>
<p>Couple of things:</p>
<ul>
<li><p>The error message says <code>Failed to pull image &quot;gcr.io/{project id}/hello-app:v1&quot;</code>. Did you edit the error message to remove your <code>{project id}</code>? If not, that's one problem.</p>
</li>
<li><p>My next concern is the second line: <code>Unable to parse json key</code>. This suggests that you created the secret incorrectly:</p>
</li>
</ul>
<ol>
<li>Create the service account and generate a key</li>
<li>Create the Secret <strong>exactly</strong> as shown: <code>kubectl create secret docker-registry gcr-json-key...</code> (in the <code>default</code> namespace unless <code>--namespace=...</code> differs)</li>
<li>Update the Kubernetes spec with <code>ImagePullSecrets</code></li>
</ol>
<p>Because of the <code>ImagePullSecrets</code> requirement, I'm not aware of an alternative <code>kubectl run</code> equivalent but, you can try accessing your image using Docker from your host:</p>
<p>See: <a href="https://cloud.google.com/container-registry/docs/advanced-authentication#json-key" rel="nofollow noreferrer">https://cloud.google.com/container-registry/docs/advanced-authentication#json-key</a></p>
<p>And then try <code>docker pull gcr.io/{project id}/hello-app:v1</code> ensuring that <code>{project id}</code> is replaced with the correct GCP Project ID.</p>
<p>This proves:</p>
<ul>
<li>The Service Account &amp; Key are correct</li>
<li>The Container Image is correct</li>
</ul>
<p>That leaves, your creation of the Secret and your Kubernetes spec to test.</p>
<blockquote>
<p><strong>NOTE</strong> The Service Account IAM permission of <code>Project Viewer</code> is overly broad for GCR access, see the <a href="https://cloud.google.com/container-registry/docs/access-control#permissions_and_roles" rel="nofollow noreferrer">permissions</a></p>
<p>Use <code>StorageObject Viewer</code> (<code>roles/storage.objectViewer</code>) if the Service Account needs only to pull images.</p>
</blockquote>
