Answers: <p>It seems that you need to add a pull-secret in the same namespace (seems that you work with default)</p>
  <p>Command:</p>
  <pre><code>kubectl create secret docker-registry &lt;your secret name like myregistry-docker-secret&gt; --docker-server=&lt;your-registry-server like us-central1-docker.pkg.dev&gt; --docker-username=&lt;your registry username&gt; --docker-password=&lt;your registry password&gt; --docker-email=&lt;your-email&gt;
  </code></pre>
  <p>Ref:
  <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a></p>
  <p>Then your manifest should look like</p>
  <pre><code>.....
      spec:
        imagePullSecrets:
          - name: &lt;your secret name like myregistry-docker-secret&gt;
        containers:
          - env:
  ......
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2022-05-26T12:31:59.500Z
Answers: 2022-05-26T12:31:59.500Z
Answers: Alexey Kolesaev
Body: <p>I am trying to pull a private image from Artifact Registry repo in Google Cloud from a kubernetes cluster running in a different Google Cloud project using kubectl.</p>
  <pre><code>kubernetes version 1.20.15-gke.1000 
  </code></pre>
  <p>The service account for the kubernetes has already been given artifactregistry.reader and storageobject.viewer permissions as the image is in a different project from the kubernetes service account</p>
  <p>I apply the below yaml to the kubectl command.</p>
  <p>kubectl apply -f proxy_with_workload_identity.yaml</p>
  <pre><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: test-app
  spec:
    selector:
      matchLabels:
        app: app-project
    strategy:
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 1
      type: RollingUpdate
    template:
      metadata:
        labels:
          app: app-project
      spec:
        containers:
          - env:
              - name: DB_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: db-credentials
              - name: DB_PASS
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: db-credentials
              - name: DB_NAME
                value: postgres
            image: &quot;us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1&quot; 
            name: app-project
            ports:
              - containerPort: 9376
                protocol: TCP
          - command:
              - /cloud_sql_proxy 
              - &quot;-instances=demo-dev:us-central1:1-sql-1=tcp:5432&quot;
            image: &quot;gcr.io/cloudsql-docker/gce-proxy:latest&quot;
            name: cloud-sql-proxy
            resources:
              requests:
                cpu: 200m
                memory: 32Mi
            securityContext:
              runAsNonRoot: true
        serviceAccountName: testapp
  </code></pre>
  <p>The cloud-sql-proxy image is getting pulled and the container is running , but the image in the private-repository is not getting pulled &quot;us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1&quot;</p>
  <p>when i check the pods i am shown this error:</p>
  
Tags: <docker><kubernetes><google-cloud-platform><google-kubernetes-engine>
Title: ImagePullBackOff err while pulling docker image in different project in Google Cloud
UserDisplayName: user1403505
ThreadText: # ImagePullBackOff err while pulling docker image in different project in Google Cloud
  
  (Asked by: username_0 on 2022-04-17)
  
  I am trying to pull a private image from Artifact Registry repo in Google Cloud from a kubernetes cluster running in a different Google Cloud project using kubectl.
  
  ```
  kubernetes version 1.20.15-gke.1000 
  
  ```
  
  The service account for the kubernetes has already been given artifactregistry.reader and storageobject.viewer permissions as the image is in a different project from the kubernetes service account
  
  I apply the below yaml to the kubectl command.
  
  kubectl apply -f proxy\_with\_workload\_identity.yaml
  
  ```
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: test-app
  spec:
    selector:
      matchLabels:
        app: app-project
    strategy:
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 1
      type: RollingUpdate
    template:
      metadata:
        labels:
          app: app-project
      spec:
        containers:
          - env:
              - name: DB_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: db-credentials
              - name: DB_PASS
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: db-credentials
              - name: DB_NAME
                value: postgres
            image: "us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1" 
            name: app-project
            ports:
              - containerPort: 9376
                protocol: TCP
          - command:
              - /cloud_sql_proxy 
              - "-instances=demo-dev:us-central1:1-sql-1=tcp:5432"
            image: "gcr.io/cloudsql-docker/gce-proxy:latest"
            name: cloud-sql-proxy
            resources:
              requests:
                cpu: 200m
                memory: 32Mi
            securityContext:
              runAsNonRoot: true
        serviceAccountName: testapp
  
  ```
  
  The cloud-sql-proxy image is getting pulled and the container is running , but the image in the private-repository is not getting pulled "us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1"
  
  when i check the pods i am shown this error:
  
  **Tags:** docker, kubernetes, google-cloud-platform, google-kubernetes-engine
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-05-26. Score: 0
  
  It seems that you need to add a pull-secret in the same namespace (seems that you work with default)
  
  Command:
  
  ```
  kubectl create secret docker-registry <your secret name like myregistry-docker-secret> --docker-server=<your-registry-server like us-central1-docker.pkg.dev> --docker-username=<your registry username> --docker-password=<your registry password> --docker-email=<your-email>
  
  ```
  
  Ref:
  <https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/>
  
  Then your manifest should look like
  
  ```
  .....
      spec:
        imagePullSecrets:
          - name: <your secret name like myregistry-docker-secret>
        containers:
          - env:
  ......
  
  ```
  
  
  ---
  
  