<p>I'm running Jenkins on GKE and having issue when running job - it can't download image for slave - anyone met similar issue - it happens whether I use private Container Registry on GCP or official <code>jenkins/jnlp-slave</code> image</p>

<pre><code>jenkins-agent-dz3kg                                            0/1     ErrImagePull   0          66s     x.x.x.x     gke-x-default-pool-xxxxx-x   &lt;none&gt;           &lt;none&gt;
jenkins-agent-dz3kg                                            0/1     ImagePullBackOff   0          73s    x.x.x.x     gke-x-default-pool-xxxxx-x   &lt;none&gt;           &lt;none&gt;
</code></pre>

<p>and the values file of jenkins helm is pretty plain</p>

<pre><code>agent:
  image: "gcr.io/my-image"
  tag: "latest"
  podName: "jenkins-agent"
  TTYEnabled: true
  resources:
    requests:
      cpu: "1"
      memory: "1Gi"
    limits:
      cpu: "4"
      memory: "4Gi"
</code></pre>

<p>jenkins installed with helm 2.13.1 and config above</p>

<pre><code>helm install stable/jenkins --name jenkins -f jenkins.yaml
</code></pre>

<p>and to show that image is there</p>

<pre><code>$ gcloud container images list
NAME
gcr.io/my-project/my-image
</code></pre>

<p>does the jenkins need some special permissons or? </p>

CptDolphin
<p>It happens because the slave is not authenticated within GCP</p>
<p><a href="https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry" rel="nofollow noreferrer">Private registries</a> may require keys to read images from them. Credentials can be provided in several ways:</p>
<ul>
<li>Per-cluster</li>
<li>automatically configured on Google Compute Engine or Google Kubernetes Engine</li>
<li>all pods can read the project’s private registry</li>
</ul>
<p>Those 2 toutorials should be helpful</p>
<ul>
<li><a href="https://itnext.io/setup-jenkins-with-google-container-registry-2f8d39aaa275" rel="nofollow noreferrer">https://itnext.io/setup-jenkins-with-google-container-registry-2f8d39aaa275</a></li>
<li><a href="https://plugins.jenkins.io/google-container-registry-auth" rel="nofollow noreferrer">https://plugins.jenkins.io/google-container-registry-auth</a></li>
</ul>
<p>Specially step 1 and step 2 from the first tutorial.</p>
<blockquote>
<p>1.Create a service account which has full access to GCR in Google Cloud.</p>
<p>2.In jenkins, create a credential for this service account with Google OAuth Credentials plugin.</p>
<p>3.Create a pull/push build step with docker-build-step plugin, and set the registry url to GCR.</p>
<p>4.Google Container Registry Auth plugin will provide the credential created in Step 2 to docker when the build step is executed.</p>
</blockquote>
