title: Getting ErrImagePull : 401 Unauthorized when creating a Kubernetes Pod with a declarative command
body: <p>I am working through a lab that shows how to set-up Kubernetes and the CLI on IBM Cloud.</p>
  <p>I have the Kubernetes cluster setup, and the container registry. I am logged in to IBM Cloud and the Container Registry on the CLI. The image has been created and pushed.</p>
  <p>I can create a pod using the image with an imperative command using:</p>
  <pre><code>kubectl create -f hello-world-create.yaml
  </code></pre>
  <p>where the <code>yaml</code> file looks like:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
  kind: Pod
  metadata:
    name: hello-world
  spec:
    containers:
    - name: hello-world
      image: us.icr.io/earlyprogramimages/hello-world:1
      ports:
      - containerPort: 80
    imagePullSecrets:
    - name: icr
  
  </code></pre>
  <p>but when I try the declarative command for the same image running</p>
  <pre><code>kubectl apply -f hello-world-apply.yaml
  </code></pre>
  <p>where the <code>yaml</code> file looks like</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    generation: 1
    labels:
      run: hello-world
    name: hello-world
  spec:
    replicas: 3
    selector:
      matchLabels:
        run: hello-world
    strategy:
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 1
      type: RollingUpdate
    template:
      metadata:
        labels:
          run: hello-world
      spec:
        containers:
        - image: us.icr.io/earlyprogramimages/hello-world:1
          imagePullPolicy: Always
          name: hello-world
          ports:
          - containerPort: 80
            protocol: TCP
        imagePullSecrets:
        - name: icr
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        securityContext: {}
        terminationGracePeriodSeconds: 30
  </code></pre>
  <p>I get status of <code>ErrImagePull</code> for each of the pods where the event stack is</p>
  <pre><code>Successfully assigned default/hello-world-6fd8bd67dc-79gbz to xx.xx.xx.xx
  Pulling image &quot;us.icr.io/earlyprogramimages/hello-world:1
  
  Failed to pull image &quot;us.icr.io/earlyprogramimages/hello-world:1&quot;: rpc error: code = Unknown desc = failed to pull and unpack image &quot;us.icr.io/earlyprogramimages/hello-world:1&quot;: failed to resolve reference &quot;us.icr.io/earlyprogramimages/hello-world:1&quot;: failed to authorize: failed to fetch anonymous token: unexpected status: 401 Unauthorized
  
  Error: ErrImagePull
  </code></pre>
  <p>Clearly the command doesn't have read access to image, but I have logged in successfully using</p>
  <pre><code>ibmcloud cr login
  </code></pre>
  <p>and can deploy a pod using the imperative create command.</p>
  <p>I have been through the documentation, but can't determine which step I have overlooked. What are the extra steps needed which grant the appropriate access for the declarative apply command?</p>
  <p>Running</p>
  <pre><code>kubectl get secrets -n default | grep &quot;icr-io&quot;
  </code></pre>
  <p>gives</p>
  <pre><code>kubectl get secrets -n default | grep &quot;icr-io&quot;
  all-icr-io            kubernetes.io/dockerconfigjson        1      167m
  default-au-icr-io     kubernetes.io/dockerconfigjson        1      167m
  default-de-icr-io     kubernetes.io/dockerconfigjson        1      167m
  default-icr-io        kubernetes.io/dockerconfigjson        1      167m
  default-jp-icr-io     kubernetes.io/dockerconfigjson        1      167m
  default-uk-icr-io     kubernetes.io/dockerconfigjson        1      167m
  default-us-icr-io     kubernetes.io/dockerconfigjson        1      167m
  </code></pre>