title: How to use private registry provider, Service Account - from Kubernertes deployments
body: <p><strong>Update</strong> I suspect this to be a google issue, I have created a new more clean question <a href="https://stackoverflow.com/questions/55416886/authentication-methods-using-a-json-key-file-unauthorized-gcr-login-failed">here</a>.</p>
  
  <p><strong>Update</strong>: yes this is different than the suggested "This question may already have an answer here:", as this is about a "Service Account" - not a "User accounts".</p>
  
  <p>Do you now how to use a private registry like Google Container Registry from DigitalOcean or any other Kubernetes not running on the same provider?</p>
  
  <p>I tried following <a href="http://docs.heptio.com/content/private-registries/pr-gcr.html" rel="nofollow noreferrer">this</a>, but unfortunately it did not work for me.<br></p>
  
  <p><strong>Update</strong>: I suspect it to be a Google SA issue, I will go and try using Docker Hub and get back if that succeeds. I am still curious to see the solution for this, so please let me know - thanks!<br>
  <strong>Update</strong>: Also tried <a href="https://docs.openstack.org/kolla-kubernetes/0.3.0/private-registry.html" rel="nofollow noreferrer">this</a>
  <strong>Update</strong>: tried to activate <a href="https://cloud.google.com/sdk/gcloud/reference/auth/activate-service-account" rel="nofollow noreferrer">Google</a> Service Account<br>
  <strong>Update</strong>: tried to <a href="https://container-solutions.com/using-google-container-registry-with-kubernetes/" rel="nofollow noreferrer">download</a> Google Service Account key<br>
  <strong>Update</strong>: in the linked description is says: </p>
  
  <pre><code>kubectl create secret docker-registry $SECRETNAME \
    --docker-server=https://gcr.io \
    --docker-username=_json_key \
    --docker-email=user@example.com \
    --docker-password="$(cat k8s-gcr-auth-ro.json)"
  </code></pre>
  
  <p>Is the <code>--docker-password="$(cat k8s-gcr-auth-ro.json)"</code> really the password?</p>
  
  <p>If I do <code>cat k8s-gcr-auth-ro.json</code> the format is:</p>
  
  <pre><code>{
    "type": "service_account",
    "project_id": "&lt;xxx&gt;",
    "private_key_id": "&lt;xxx&gt;",
    "private_key": "-----BEGIN PRIVATE KEY-----\&lt;xxx&gt;\n-----END PRIVATE KEY-----\n",
    "client_email": "k8s-gcr-auth-ro@&lt;xxx&gt;.iam.gserviceaccount.com",
    "client_id": "&lt;xxx&gt;",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/k8s-gcr-auth-ro%&lt;xxx&gt;.iam.gserviceaccount.com"
  }
  </code></pre>
  
  <p><strong>kubectl get pods</strong>
  I get: .<code>..is waiting to start: image can't be pulled</code></p>
  
  <p>from a deployment with:</p>
  
  <pre><code>image: gcr.io/&lt;project name&gt;/&lt;image name&gt;:v1
  </code></pre>
  
  <p>deployment.yaml</p>
  
  <pre><code># K8s - Deployment
  apiVersion: extensions/v1beta1
  kind: Deployment
  metadata:
    name: &lt;image-name&gt;-deployment-v1
  spec:
    replicas: 1
    template:
      metadata:
        labels:
          app: &lt;image-name&gt;-deployment
          version: v1
      spec:
        containers:
        - name: &lt;image-name&gt;
          image: gcr.io/&lt;project-name&gt;/&lt;image-name&gt;:v1
          imagePullPolicy: Always
          ports:
          - containerPort: 80
        imagePullSecrets:
          - name: &lt;name-of-secret&gt;
  </code></pre>
  
  <p>I can see from the following that it logs: <code>repository does not exist or may require 'docker login'</code></p>
  
  <p>kubectl describe pod :</p>
  
  <pre><code>k describe pod &lt;image-name&gt;-deployment-v1-844568c768-5b2rt
  
  Name:               &lt;image-name&gt;-deployment-v1-844568c768-5b2rt
  Namespace:          default
  Priority:           0
  PriorityClassName:  &lt;none&gt;
  Node:               my-cluster-digitalocean-1-7781/10.135.153.236
  Start Time:         Mon, 25 Mar 2019 15:51:37 +0100
  Labels:             app=&lt;image-name&gt;-deployment
                      pod-template-hash=844568c768
                      version=v1
  Annotations:        &lt;none&gt;
  Status:             Pending
  IP:                 &lt;ip address&gt;
  Controlled By:      ReplicaSet/&lt;image-name&gt;-deployment-v1-844568c768
  Containers:
    chat-server:
      Container ID:   
      Image:          gcr.io/&lt;project-name/&lt;image-name&gt;:v1
      Image ID:       
      Port:           80/TCP
      Host Port:      0/TCP
      State:          Waiting
        Reason:       ImagePullBackOff
      Ready:          False
      Restart Count:  0
      Environment:    &lt;none&gt;
      Mounts:
        /var/run/secrets/kubernetes.io/serviceaccount from default-token-dh8dh (ro)
  Conditions:
    Type              Status
    Initialized       True 
    Ready             False 
    ContainersReady   False 
    PodScheduled      True 
  Volumes:
    default-token-dh8dh:
      Type:        Secret (a volume populated by a Secret)
      SecretName:  default-token-dh8dh
      Optional:    false
  QoS Class:       BestEffort
  Node-Selectors:  &lt;none&gt;
  Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                   node.kubernetes.io/unreachable:NoExecute for 300s
  Events:
    Type     Reason          Age                From                                        Message
    ----     ------          ----               ----                                        -------
    Normal   Scheduled       50s                default-scheduler                           Successfully assigned default/&lt;image-name&gt;-deployment-v1-844568c768-5b2rt to my-cluster-digitalocean-1-7781
    Normal   Pulling         37s (x2 over 48s)  kubelet, my-cluster-digitalocean-1-7781  pulling image "gcr.io/&lt;project-name&gt;&lt;image-name&gt;:v1"
    Warning  Failed          37s (x2 over 48s)  kubelet, my-cluster-digitalocean-1-7781  Failed to pull image "gcr.io/&lt;project-name&gt;/&lt;image-name&gt;:v1": rpc error: code = Unknown desc = Error response from daemon: pull access denied for gcr.io/&lt;project-name&gt;/&lt;image-name&gt;, repository does not exist or may require 'docker login'
    Warning  Failed          37s (x2 over 48s)  kubelet, my-cluster-digitalocean-1-7781  Error: ErrImagePull
    Normal   SandboxChanged  31s (x7 over 47s)  kubelet, my-cluster-digitalocean-1-7781  Pod sandbox changed, it will be killed and re-created.
    Normal   BackOff         29s (x6 over 45s)  kubelet, my-cluster-digitalocean-1-7781  Back-off pulling image "gcr.io/&lt;project-name&gt;/&lt;image-name&gt;:v1"
    Warning  Failed          29s (x6 over 45s)  kubelet, my-cluster-digitalocean-1-7781  Error: ImagePullBackOff
  </code></pre>
  
  <p>Just a note: docker pull on local machine pulls the image alright</p>