<p>It seems that you need to add a pull-secret in the same namespace (seems that you work with default)</p>
<p>Command:</p>
<pre><code>kubectl create secret docker-registry &lt;your secret name like myregistry-docker-secret&gt; --docker-server=&lt;your-registry-server like us-central1-docker.pkg.dev&gt; --docker-username=&lt;your registry username&gt; --docker-password=&lt;your registry password&gt; --docker-email=&lt;your-email&gt;
</code></pre>
<p>Ref:
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a></p>
<p>Then your manifest should look like</p>
<pre><code>.....
    spec:
      imagePullSecrets:
        - name: &lt;your secret name like myregistry-docker-secret&gt;
      containers:
        - env:
......
</code></pre>

CC BY-SA 4.0
2022-05-26T12:31:59.500Z
2022-05-26T12:31:59.500Z
Alexey Kolesaev
<p>I am trying to pull a private image from Artifact Registry repo in Google Cloud from a kubernetes cluster running in a different Google Cloud project using kubectl.</p>
<pre><code>kubernetes version 1.20.15-gke.1000 
</code></pre>
<p>The service account for the kubernetes has already been given artifactregistry.reader and storageobject.viewer permissions as the image is in a different project from the kubernetes service account</p>
<p>I apply the below yaml to the kubectl command.</p>
<p>kubectl apply -f proxy_with_workload_identity.yaml</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-app
spec:
  selector:
    matchLabels:
      app: app-project
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: app-project
    spec:
      containers:
        - env:
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: db-credentials
            - name: DB_PASS
              valueFrom:
                secretKeyRef:
                  key: password
                  name: db-credentials
            - name: DB_NAME
              value: postgres
          image: &quot;us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1&quot; 
          name: app-project
          ports:
            - containerPort: 9376
              protocol: TCP
        - command:
            - /cloud_sql_proxy 
            - &quot;-instances=demo-dev:us-central1:1-sql-1=tcp:5432&quot;
          image: &quot;gcr.io/cloudsql-docker/gce-proxy:latest&quot;
          name: cloud-sql-proxy
          resources:
            requests:
              cpu: 200m
              memory: 32Mi
          securityContext:
            runAsNonRoot: true
      serviceAccountName: testapp
</code></pre>
<p>The cloud-sql-proxy image is getting pulled and the container is running , but the image in the private-repository is not getting pulled &quot;us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1&quot;</p>
<p>when i check the pods i am shown this error:</p>

<docker><kubernetes><google-cloud-platform><google-kubernetes-engine>
ImagePullBackOff err while pulling docker image in different project in Google Cloud
user1403505
# ImagePullBackOff err while pulling docker image in different project in Google Cloud

(Asked by: username_0 on 2022-04-17)

I am trying to pull a private image from Artifact Registry repo in Google Cloud from a kubernetes cluster running in a different Google Cloud project using kubectl.
kubernetes version 1.20.15-gke.1000 

The service account for the kubernetes has already been given artifactregistry.reader and storageobject.viewer permissions as the image is in a different project from the kubernetes service account
I apply the below yaml to the kubectl command.
kubectl apply -f proxy_with_workload_identity.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-app
spec:
  selector:
    matchLabels:
      app: app-project
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: app-project
    spec:
      containers:
        - env:
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: db-credentials
            - name: DB_PASS
              valueFrom:
                secretKeyRef:
                  key: password
                  name: db-credentials
            - name: DB_NAME
              value: postgres
          image: "us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1" 
          name: app-project
          ports:
            - containerPort: 9376
              protocol: TCP
        - command:
            - /cloud_sql_proxy 
            - "-instances=demo-dev:us-central1:1-sql-1=tcp:5432"
          image: "gcr.io/cloudsql-docker/gce-proxy:latest"
          name: cloud-sql-proxy
          resources:
            requests:
              cpu: 200m
              memory: 32Mi
          securityContext:
            runAsNonRoot: true
      serviceAccountName: testapp

The cloud-sql-proxy image is getting pulled and the container is running , but the image in the private-repository is not getting pulled "us-central1-docker.pkg.dev/myproject/docker-repo/test-app:v1"
when i check the pods i am shown this error:

**Tags:** docker, kubernetes, google-cloud-platform, google-kubernetes-engine


---

## 1 answers

### Answer by username_1 on 2022-05-26. Score: 0

It seems that you need to add a pull-secret in the same namespace (seems that you work with default)
Command:
kubectl create secret docker-registry  --docker-server= --docker-username= --docker-password= --docker-email=

Ref:
https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
Then your manifest should look like
.....
    spec:
      imagePullSecrets:
        - name: 
      containers:
        - env:
......


---

