title: AKS. Can't pull image from an acr
body: <p>I try to pull image from an ACR using a secret and I can't do it.</p>
  
  <p>I created resources using azure cli commands:</p>
  
  <pre><code>az login
  az provider register -n Microsoft.Network
  az provider register -n Microsoft.Storage
  az provider register -n Microsoft.Compute
  az provider register -n Microsoft.ContainerService
  
  az group create --name aksGroup --location westeurope
  
  az aks create --resource-group aksGroup --name aksCluster --node-count 1 --generate-ssh-keys -k 1.9.2
  az aks get-credentials --resource-group aksGroup --name aksCluster
  
  az acr create --resource-group aksGroup --name aksClusterRegistry --sku Basic --admin-enabled true
  </code></pre>
  
  <p>After that I logged in and pushed image successfully to created ACR from local machine.</p>
  
  <pre><code>docker login aksclusterregistry.azurecr.io
  docker tag jetty aksclusterregistry.azurecr.io/jetty
  docker push aksclusterregistry.azurecr.io/jetty
  </code></pre>
  
  <p>The next step was creating a secret:</p>
  
  <pre><code>kubectl create secret docker-registry secret --docker-server=aksclusterregistry.azurecr.io --docker-username=aksClusterRegistry --docker-password=&lt;Password from tab ACR/Access Keys&gt; --docker-email=some@email.com
  </code></pre>
  
  <p>And eventually I tried to create pod with image from the ACR:</p>
  
  <pre><code>#pod.yml
  apiVersion: v1
  kind: Pod
  metadata:
    name: jetty
  spec:
    containers:
    - name: jetty
      image: aksclusterregistry.azurecr.io/jetty
    imagePullSecrets:
    - name: secret
  
  kubectl create -f pod.yml
  </code></pre>
  
  <p>In result I have a pod with status ImagePullBackOff:</p>
  
  <pre><code>&gt;kubectl get pods
  NAME                    READY     STATUS             RESTARTS   AGE
  jetty                   0/1       ImagePullBackOff   0          1m
  &gt; kubectl describe pod jetty
  Events:
    Type     Reason                 Age              From                               Message
    ----     ------                 ----             ----                               -------
    Normal   Scheduled              2m               default-scheduler                  Successfully assigned jetty to aks-nodepool1-62963605-0
    Normal   SuccessfulMountVolume  2m               kubelet, aks-nodepool1-62963605-0  MountVolume.SetUp succeeded for volume "default-token-w8png"
    Normal   Pulling                2m (x2 over 2m)  kubelet, aks-nodepool1-62963605-0  pulling image "aksclusterregistry.azurecr.io/jetty"
    Warning  Failed                 2m (x2 over 2m)  kubelet, aks-nodepool1-62963605-0  Failed to pull image "aksclusterregistry.azurecr.io/jetty": rpc error: code = Unknown desc = Error response from daemon: Get https://aksclusterregistry.azurecr.io/v2/jetty/manifests/latest: unauthorized: authentication required
    Warning  Failed                 2m (x2 over 2m)  kubelet, aks-nodepool1-62963605-0  Error: ErrImagePull
    Normal   BackOff                2m (x5 over 2m)  kubelet, aks-nodepool1-62963605-0  Back-off pulling image "aksclusterregistry.azurecr.io/jetty"
    Normal   SandboxChanged         2m (x7 over 2m)  kubelet, aks-nodepool1-62963605-0  Pod sandbox changed, it will be killed and re-created.
    Warning  Failed                 2m (x6 over 2m)  kubelet, aks-nodepool1-62963605-0  Error: ImagePullBackOff
  </code></pre>
  
  <p>What's wrong? Why does approach with secret not work?
  Please don't advice me approach with service principal, because I would like to understand why this aproach doesn't work. I think it must be working. </p>