title: kubectl can't connect to docker registry to download image
body: <p>I'm stepping through Kubernetes in Action to get more than just familiarity with Kubernetes.</p>
  
  <p>I already had a Docker Hub account that I've been using for Docker-specific experiments.</p>
  
  <p>As described in chapter 2 of the book, I built the toy "kubia" image, and I was able to push it to Docker Hub.  I verified this again by logging into Docker Hub and seeing the image.</p>
  
  <p>I'm doing this on Centos7.</p>
  
  <p>I then run the following to create the replication controller and pod running my image:</p>
  
  <pre><code>kubectl run kubia --image=davidmichaelkarr/kubia --port=8080 --generator=run/v1
  </code></pre>
  
  <p>I waited a while for statuses to change, but it never finishes downloading the image, when I describe the pod, I see something like this:</p>
  
  <pre><code>  Normal   Scheduled              24m                 default-scheduler  Successfully assigned kubia-25th5 to minikube
    Normal   SuccessfulMountVolume  24m                 kubelet, minikube  MountVolume.SetUp succeeded for volume "default-token-x5nl4"
    Normal   Pulling                22m (x4 over 24m)   kubelet, minikube  pulling image "davidmichaelkarr/kubia"
    Warning  Failed                 22m (x4 over 24m)   kubelet, minikube  Failed to pull image "davidmichaelkarr/kubia": rpc error: code = Unknown desc = Error response from daemon: Get https://registry-1.docker.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  </code></pre>
  
  <p>So I then constructed the following command:</p>
  
  <pre><code>curl -v -u 'davidmichaelkarr:**' 'https://registry-1.docker.io/v2/'
  </code></pre>
  
  <p>Which uses the same password I use for Docker Hub (they should be the same, right?).</p>
  
  <p>This gives me the following:</p>
  
  <pre><code>* About to connect() to proxy *** port 8080 (#0)
  *   Trying **.**.**.**...
  * Connected to *** (**.**.**.**) port 8080 (#0)
  * Establish HTTP proxy tunnel to registry-1.docker.io:443
  * Server auth using Basic with user 'davidmichaelkarr'
  &gt; CONNECT registry-1.docker.io:443 HTTP/1.1
  &gt; Host: registry-1.docker.io:443
  &gt; User-Agent: curl/7.29.0
  &gt; Proxy-Connection: Keep-Alive
  &gt;
  &lt; HTTP/1.1 200 Connection established
  &lt;
  * Proxy replied OK to CONNECT request
  * Initializing NSS with certpath: sql:/etc/pki/nssdb
  *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
    CApath: none
  * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  * Server certificate:
  *       subject: CN=*.docker.io
  *       start date: Aug 02 00:00:00 2017 GMT
  *       expire date: Sep 02 12:00:00 2018 GMT
  *       common name: *.docker.io
  *       issuer: CN=Amazon,OU=Server CA 1B,O=Amazon,C=US
  * Server auth using Basic with user 'davidmichaelkarr'
  &gt; GET /v2/ HTTP/1.1
  &gt; Authorization: Basic ***
  &gt; User-Agent: curl/7.29.0
  &gt; Host: registry-1.docker.io
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 401 Unauthorized
  &lt; Content-Type: application/json; charset=utf-8
  &lt; Docker-Distribution-Api-Version: registry/2.0
  &lt; Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io"
  &lt; Date: Wed, 24 Jan 2018 18:34:39 GMT
  &lt; Content-Length: 87
  &lt; Strict-Transport-Security: max-age=31536000
  &lt;
  {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}
  * Connection #0 to host *** left intact
  </code></pre>
  
  <p>I don't understand why this is failing auth.</p>
  
  <p><strong>Update</strong>:</p>
  
  <p>Based on the first answer and the info I got from this <a href="https://stackoverflow.com/questions/40288077/how-to-pass-image-pull-secret-while-using-kubectl-run-command">other question</a>, I edited the description of the service account, adding the "imagePullSecrets" key, then I deleted the replicationcontroller again and recreated it.  The result appeared to be identical.</p>
  
  <p>This is the command I ran to create the secret:</p>
  
  <pre><code>kubectl create secret docker-registry regsecret --docker-server=registry-1.docker.io --docker-username=davidmichaelkarr --docker-password=** --docker-email=**
  </code></pre>
  
  <p>Then I obtained the yaml for the serviceaccount, added the key reference for the secret, then set that yaml as the settings for the serviceaccount.</p>
  
  <p>This are the current settings for the service account:</p>
  
  <pre><code>$ kubectl get serviceaccount default -o yaml
  apiVersion: v1
  imagePullSecrets:
  - name: regsecret
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2018-01-24T00:05:01Z
    name: default
    namespace: default
    resourceVersion: "81492"
    selfLink: /api/v1/namespaces/default/serviceaccounts/default
    uid: 38e2882c-009a-11e8-bf43-080027ae527b
  secrets:
  - name: default-token-x5nl4
  </code></pre>
  
  <p>Here's the updated events list from the describe of the pod after doing this:</p>
  
  <pre><code>Events:
    Type     Reason                 Age               From               Message
    ----     ------                 ----              ----               -------
    Normal   Scheduled              7m                default-scheduler  Successfully assigned kubia-f56th to minikube
    Normal   SuccessfulMountVolume  7m                kubelet, minikube  MountVolume.SetUp succeeded for volume "default-token-x5nl4"
    Normal   Pulling                5m (x4 over 7m)   kubelet, minikube  pulling image "davidmichaelkarr/kubia"
    Warning  Failed                 5m (x4 over 7m)   kubelet, minikube  Failed to pull image "davidmichaelkarr/kubia": rpc error: code = Unknown desc = Error response from daemon: Get https://registry-1.docker.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
    Normal   BackOff                4m (x6 over 7m)   kubelet, minikube  Back-off pulling image "davidmichaelkarr/kubia"
    Warning  FailedSync             2m (x18 over 7m)  kubelet, minikube  Error syncing pod
  </code></pre>
  
  <p>What else might I be doing wrong?</p>
  
  <p><strong>Update</strong>:</p>
  
  <p>I think it's likely that all these issues with authentication are unrelated to the real issue.  The key point is what I see in the pod description (breaking into multiple lines to make it easier to see):</p>
  
  <pre><code>Warning  Failed                 22m (x4 over 24m)   kubelet, 
  minikube  Failed to pull image "davidmichaelkarr/kubia": rpc error: code = 
  Unknown desc = Error response from daemon: Get https://registry-1.docker.io/v2/:
  net/http: request canceled while waiting for connection
  (Client.Timeout exceeded while awaiting headers)
  </code></pre>
  
  <p>The last line seems like the most important piece of information at this point.  It's not failing authentication, it's timing out the connection.  In my experience, something like this is usually caused by issues getting through a firewall/proxy.  We do have an internal proxy, and I have those environment variables set in my environment, but what about the "serviceaccount" that kubectl is using to make this connection?  Do I have to somehow set a proxy configuration in the serviceaccount description?</p>