<p>I am having some real trouble getting my pods to pull images from a private docker registry that I have setup and am able to authenticate to (I can do docker login <a href="https://my.website.com/" rel="nofollow noreferrer">https://my.website.com/</a> and I get Login Succeeded without having to put in my username:password) (I am able to run <code>docker pull my.website.com:5000/human/forum</code> and see all the layers being downloaded.) .</p>

<p>I use <a href="https://github.com/bazelbuild/rules_k8s#aliasing-eg-k8s_deploy" rel="nofollow noreferrer">https://github.com/bazelbuild/rules_k8s#aliasing-eg-k8s_deploy</a> where I specify the namespace to be <code>"default"</code>.</p>

<p>I made sure to put <code>"HTTPS://my.website.com:5000/V2/"</code> (in lowercase) in the auth section in the docker config file before I generated the <code>regcred</code> secret.</p>

<p>Notice that I specify the <code>imagePullSecrets</code> below:</p>

<pre><code># deployment.yaml
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: angular-bazel-example-prod
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: angular-bazel-example-prod
    spec:
      containers:
       - name: angular-bazel-example
         image: human/forum:dev
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
      imagePullSecrets:
       - name: regcred # Notice
</code></pre>

<p>I made sure to update my certificate authority certificates:</p>

<pre><code>cp /etc/docker/certs.d/my.website.com\:5000/ca.crt /usr/local/share/ca-certificates/my.website.registry.com/
sudo update-ca-certificates
</code></pre>

<p>I see <code>sudo curl --user testuser:testpassword --cacert /usr/local/share/ca-certificates/my.website.registry.com/ca.crt -X GET https://mywebsite.com:5000/v2/_catalog</code></p>

<p>> <code>{"repositories":["human/forum"]}</code></p>

<p>I see <code>sudo curl --user testuser:testpassword --cacert /usr/local/share/ca-certificates/mywebsite.registry.com/ca.crt -X GET https://mywebsite.com:5000/v2/human/forum/tags/list</code></p>

<p>> <code>{"name":"a/repository","tags":["dev"]}</code></p>

<p>There must be a way to troubleshoot this but I don't know how.</p>

<p>One thing I am curious about is</p>

<pre><code>kubectl describe pod my-first-pod...
...
Volumes:
  default-token-mtz9g:
    Type:        Secret
</code></pre>

<p>Where can I find this volume? I can't <code>kubectl exec</code> into a container because none is running.. because the pod can't pull the image.</p>

<p>Do you have any ideas on how I could troubleshoot this?</p>

<p>Thank you!</p>

<p>Slackware</p>

Slackware
<p>Create a kubernetes secret to access the custom repository. One way is to provide the server, user and password manually. <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line" rel="nofollow noreferrer">Documentation link</a>. </p>

<pre><code>kubectl create secret docker-registry $YOUR_REGISTRY_NAME --docker-server=https://$YOUR_SERVER_DNS/v2/ --docker-username=$YOUR_USER --docker-password=$YOUR_PASSWORD --docker-email=whatever@gmail.com --namespace=default
</code></pre>

<p>Then use it in your yaml</p>

<pre><code>...
      imagePullSecrets:
       - name: $YOUR_REGISTRY_NAME
</code></pre>

<p>Regarding the default-token that you see mounted, it belongs to the service account that your pod uses to talk to the kubernetes api. You can find the service account by running <code>kubectl get sa</code> and <code>kubectl describe sa $DEFAULT_SERVICE_ACCOUNT_ID</code>. Find the token by running <code>kubectl get secrets</code> and <code>kubectl describe secret $SECRET_ID</code>. To clarify this service account and token have nothing to do with the docker registry unless you specify it. To include the registry in the service account follow this guide <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account" rel="nofollow noreferrer">link</a></p>
