<p>Deploying a manifest in Docker Desktop (v4.21.1) Kubernetes cluster.</p>
<p>The image used in manifest looks like below,</p>
<pre><code>my-local.artifactory.com/docker-images/my-app:v1.0.0
</code></pre>
<p>The secret with docker config is created and referred within the manifest in  <code>imagePullSecrets</code>. The <code>imagePullPolicy</code> is set to <code>Always</code>.</p>
<p>Error message</p>
<pre><code>Failed to pull image &quot;my-local.artifactory.com/docker-images/my-app:v1.0.0&quot;: rpc error: code = Unknown desc = Error response from daemon: Head &quot;https://my-local.artifactory.com/v2/docker-images/my-app/manifests/v1.0.0&quot;: unknown: Authentication is required
</code></pre>
<p>The deployment failed since not able to pull image and indicates <strong>Authentication required</strong>. Odd thing is that the <code>kubelet docker-desktop</code> used the URL that looks like - <code>https://my-local.artifactory.com/v2/myapp/manifests/v1.0.0</code></p>
<p>But not sure how this URL is constructed.</p>
<ul>
<li>Question:
How Docker desktop kubelet know to create this url <code>https://my-local.artifactory.com/v2/myapp/manifests/v1.0.0</code>? Not sure how <code>v2</code> is added to the URL.</li>
</ul>
<p>When hit the URL directly in browser, do get below message.</p>
<pre><code>{&quot;errors&quot;:[{&quot;code&quot;:&quot;UNAUTHORIZED&quot;,&quot;message&quot;:&quot;authentication required&quot;,&quot;detail&quot;:null}]}
</code></pre>

Tim
<p>The URL is specified by the <a href="https://docs.docker.com/registry/spec/api/" rel="nofollow noreferrer">Docker Registry HTTP API V2</a>.</p>
<p>The image name <code>my-local.artifactory.com/docker-images/my-app:v1.0.0</code> breaks down into three parts: the registry name <code>my-local-artifactory.com</code>, the image name <code>docker-images/my-app</code>, and the tag <code>v1.0.0</code>.  To <a href="https://docs.docker.com/registry/spec/api/#pulling-an-image" rel="nofollow noreferrer">pull the image</a>, the kubelet (or anything else) first needs to fetch a piece called the <em>image manifest</em>, and that manifest has a list of the individual <em>layers</em> that need to be downloaded.</p>
<p>The registry API specifies the manifest URL as</p>
<pre class="lang-none prettyprint-override"><code>GET /v2/&lt;name&gt;/manifests/&lt;reference&gt;
</code></pre>
<p>where <code>GET</code> is an HTTP verb, <code>&lt;name&gt;</code> is the image name, and <code>&lt;reference&gt;</code> is either the tag or a digest hash.  This matches the URL in the error message.</p>
