<p>I've set up a private container registry that it is integrated with bitbucket successfully. However, I am not able to pull the images from my GKE Cluster.</p>
<p>I created a service account with the role &quot;Project Viewer&quot;, and a json key for this account. Then I created the secret in the cluster/namespace running</p>
<pre><code>kubectl create secret docker-registry gcr-json-key \
 --docker-server=gcr.io \
 --docker-username=_json_key \
 --docker-password=&quot;$(cat ~/code/bitbucket/miappsrl/miappnodeapi/secrets/registry/miapp-staging-e94050365be1.json)&quot; \
 --docker-email=agusmiappgcp@gmail.com
</code></pre>
<p>And in the deployment file I added</p>
<pre><code>...
      imagePullSecrets:
    - name: gcr-json-key
...
</code></pre>
<p>But when I apply the deployment I get</p>
<pre><code> ImagePullBackOff
</code></pre>
<p>And when I do a <code>kubectl describe pod &lt;pod_name&gt;</code> I see</p>
<pre><code>Failed to pull image &quot;gcr.io/miapp-staging/miappnodeapi&quot;: rpc error: code = Unknown desc = Error response from daemon: Get https://gcr.io/v2/: dial tcp: lookup gcr.io on 169.254.169.254:53: no such host
</code></pre>
<p>I can't realize what I am missing, I understand it can resolve the dns inside the cluster, but not sure what I should add</p>

agusgambina
<p>If a GKE Cluster is setup as private you need to setup the DNS to reach container Registry, from <a href="https://cloud.google.com/vpc-service-controls/docs/set-up-gke#configure-dns" rel="nofollow noreferrer">documentation</a>:</p>
<blockquote>
<p>To support GKE private clusters that use Container Registry or Artifact Registry inside a service perimeter, you first need to configure your DNS server so requests to registry addresses resolve to restricted.googleapis.com, the restricted VIP. You can do so using Cloud DNS private DNS zones.</p>
</blockquote>
<p>Verify if you setup your cluster as private.</p>
