Error pulling images, unauthorized

[diit]

Issues without logs and details are more complicated to fix.
Please help us!

Expected behavior

• Pulls image down and starts pods/etc.

Actual behavior

Failed to pull image "gcr.io/xx/yy:latest": rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

Information

I have run gcloud docker -a as well as can pull image locally with no issue.

Skaffold version: master
Operating system: Ubuntu 16.04

Content of skaffold.yaml:

apiVersion: skaffold/v1alpha2
kind: Config
build:
  artifacts:
  - imageName: gcr.io/xxx/yyy
    workspace: .
  local: {}
deploy:
  kubectl:
    manifests:
      - kubernetes/stage/* 

Steps to reproduce the behavior

1. ...
2. ...

[dcherniv]

@diit Did you authenticate your docker to gcr?
https://cloud.google.com/container-registry/docs/pushing-and-pulling
Which skaffold version are you using?

[r2d4]

@diit any update here? Can you try running with -v debug?

[cch0]

Ran into the same issue today and found out that the issue is coming from kubectl deployment and due to the image you are using is not publicly accessible.

Follow the instruction here at Serving images publicly should resolve your issue as it did for me.

[dgageot]

Closing as this doesn't seem to be strictly related to Skaffold

[BezVezeE]

Hey i have this issue aswell,

I have local kubernetes cluster and when i try to pull the image with docker pull gcr;//xx.xx.xx it works but when i try to create a deployment in kubernetes it gives the error,

besides gcloud auth configure-docker i also tried with configuring secrets with json file

this is my deployment configuration

apiVersion: apps/v1 
kind: Deployment
metadata:
  name: logstash
spec:
  selector:
    matchLabels:
      app: logstash
  replicas:
  template:
    metadata:
      labels:
        app: logstash
    spec:
      containers:
      - name: logstash
        image: us.gcr.io/xx/xx/xxx
        ports:
        - containerPort: 12201
      imagePullSecrets:
      - name: gcr-json-key 

has anybody have any idea

[haf]

yes, I think this is a skaffold issue since these images can be pulled with docker pull ... on the host

[markkohdev]

We're experiencing the same issue. Has anyone found a viable solution to this?

[steevee]

I had the same issue, and upgrading from v0.26 (via snap) to the v0.29 as per release info did the trick.

[eswidler]

For anyone running into this issue on a Docker-optimized OS:

I also had this issue, and it was due to me messing around with permissions for the "Compute Engine default service account" on IAM. By default, the service account has "Editor" permissions, and you may see this error if you revoke whatever permission gave the service account access to pull from the registry.

[fabio-rigato]

Hi all,
I have the same issue.
Any news about that?
Regards
Fabio

[banshee]

Don't know if this is related, but I saw the problem when I ran the commands under sudo - and didn't get the same error without the sudo.