<p>I have set up a Kubernetes cluster on gcloud via gitlab.</p>

<p>I have some trouble pulling my images when I deploy my application.</p>

<p>I use a gcloud cluster with a registry on the same gcloud project. Normally, I'm able to pull my image directly without any modification (supposed to use the <strong>Compute Engine default service account?</strong>).</p>

<p>But I get a unauthorized on my pod when he try to pull the image : </p>

<pre><code>  Warning  Failed                 3m (x2 over 3m)  kubelet, gke-production-default-pool-********-****  Failed to pull image "eu.gcr.io/[My-Project]/services-identity:715bfffa": rpc error: code = Unknown desc = unauthorized: authentication required
  Warning  Failed                 3m (x2 over 3m)  kubelet, gke-production-default-pool-********-****  Error: ErrImagePull
  Normal   BackOff                2m (x6 over 3m)  kubelet, gke-production-default-pool-********-****  Back-off pulling image "eu.gcr.io/[My-Project]/services-identity:715bfffa"
  Warning  Failed                 2m (x6 over 3m)  kubelet, gke-production-default-pool-********-****  Error: ImagePullBackOff
  Normal   Pulling                2m (x3 over 3m)  kubelet, gke-production-default-pool-********-****  pulling image "eu.gcr.io/[My-Project]/services-identity:715bfffa"
</code></pre>

<p>I deploy via gitlab-ci with the following command line: </p>

<pre><code>helm upgrade --install services-identity -f ./deploy/env/production-values.yml ./deploy/ --set image.tag=${CI_COMMIT_SHA:0:8} --namespace=production --wait
</code></pre>

<p>For information, I can pull the registry when this one is public, I can also pull the image locally via a docker login(using my gcloud account).</p>

<p>Thanks in advance for your advice.</p>

Alexandre Cys
<p>This is very similar to this: <a href="https://stackoverflow.com/questions/53008125/whats-the-minimal-permissions-i-need-to-configure-for-a-gke-node-pool-to-pull-f/53018981#53018981">What&#39;s the minimal permissions I need to configure for a GKE node pool to pull from a private GCR repo in the same project?</a>, except that you are not mentioning that it's on GKE so I assume is on GCE.</p>

<p>You can use a <a href="https://cloud.google.com/container-registry/docs/advanced-authentication#json_key_file" rel="nofollow noreferrer"><code>json_key_file</code></a>.</p>

<p>On all your nodes (assuming you are using Docker):</p>

<pre><code>$ docker login -u _json_key --password-stdin https://gcr.io
</code></pre>

<p>Or the same json_key_file using <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer"><code>ImagePullSecrets</code></a> in the pod spec as described <a href="https://container-solutions.com/using-google-container-registry-with-kubernetes/" rel="nofollow noreferrer">here</a>.</p>

<p>Or you can use on all your Kubernetes nodes:</p>

<pre><code>$ gcloud auth configure-docker
</code></pre>
