How do I grant permission to my Kubernetes cluster to pull images from gcr.io?

Question

In Kubernetes container repository I have my permission set to Private:

When I create a pod on my cluster I get the the pod status ending in ImagePullBackOff and when I describe the pod I see:

Failed to pull image "gcr.io/REDACTED": rpc error: code = Unknown desc = Error response from daemon: pull access denied for gcr.io/REDACTED, repository does not exist or may require 'docker login': denied: Permission denied for "v11" from request "/v2/REDACTED/manifests/v11".

I am certainly logged in.

docker login
Authenticating with existing credentials...
Login Succeeded

Now if I enable public access (top image) on my Container Repository things work fine and the pod deploys correctly. But I don't want my repository to be public. What is the correct way to keep my container repository private and still be able to deploy. I'm pretty sure this used to work a couple weeks ago unless I messed up something with my service account although I don't know how to find out which service account is being used for these permissions.

Answer 1

To use gcr.io or any other private artifact registry, you'll need to create a Secret of type docker-registry in k8s cluster. The secret will contain credential details of your registry:

kubectl create secret docker-registry <secret-name> \
  --docker-server=<server-name> \
  --docker-username=<user-name> \
  --docker-password=<user-password> \
  --docker-email=<user-email-id>

After this, you will need to specify the above secret in imagePullSecrets property of your manifest so that k8s able to authenticate and pull the image.

apiVersion: v1
kind: Pod
metadata:
  name: pod1
  namespace: default
spec:
  containers:
    - name: pod1
      image: gcr.io/pod1:latest
  imagePullSecrets:
    - name: myregistrykey

Check out this tutorial from container-solutions and official k8s doc .

Answer 2

If your GKE version is > 1.15, and the Container Registry is in the same project, and GKE uses the default Compute Engine service account (SA) it should work out of the box.

If you are running the registry in another project, or using a different service account, you should give to the SA the right permissions (eg, roles/artifactregistry.reader )

A step by step tutorial, with all the different cases, it is present in the official documentation: https://cloud.google.com/artifact-registry/docs/access-control#gcp

Answer 3

GKE uses the service account attached to the node pools to grant access to the registry, however, you must be sure that the OAuth scope for your cluster is set to https://www.googleapis.com/auth/devstorage.read_only as well.