Using DO k8s container registry: authentication required

Posted July 6, 2020 3.6k views

I am trying to use for my k8s images.

I’ve created an image, tagged it, logged into the registry successfully (using doctl registry login) then pushed the image to the registry.

However, when starting the service it’s not creating pods successfully and giving :

Failed to pull image "": rpc error: code = Unknown desc = Error response from daemon
Get unauthorized: authentication required

The pod status is “ImagePullBackOff” and it can’t pull the image.

Does anyone have any idea what might be causing this? My understanding was that if I was logged into the registry OK with doctl, then everything should be authed to pull the image from the registry.

Any help would be gratefully appreciated.

1 comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
3 answers

I had missed out a couple of steps in the guide DigitalOcean Container Registry Quickstart specifically the steps:

Use the kubernetes-manifest command to store an authentication token for your registry as a secret in your cluster:

doctl registry kubernetes-manifest | kubectl apply -f -
Instruct the default service account to use the authentication token as an imagePullSecret. Be sure to replace <my-registry> in the name field in the below command while keeping the registry- prefix:

kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "registry-<my-registry>"}]}'

In my case, the problem was with “Download Docker Credentials” I used in the UI. I created a k8s secret using that downloaded files, and spent a couple of hours to finally dig out that doctl registry kubernetes-manifest gives another credentials. Surprisingly, the credentials downloaded from the UI were valid for pushing/pulling from the local machine, but not for pulling images inside the cluster. Strange!

I have follow all the steps and I am getting the same Authentication error. It is driving me crazy! Is someone else having the same problem?

  • Having the same issue.
    Strange thing is.

    I first pulled an image successfully but my others fail.
    The only thing I changed was the Namespace I am using.
    I thought this caused the issue but I confirmed that both the secrets and serviceaccount are added to that namespace

    • Yes exactly, I did the same!
      in the end I discovered that the namespace is the problem!
      In fact, the command showed in the documentation is using the “default” namespace.
      I solved it by doing this:

      First get the registry yaml file

      doctl registry kubernetes-manifest > registry.yaml

      then change the namespace in the generated file to your namespace, and finally apply the new yaml file:

      kubectl -n NAMESPACE apply -f registry.yaml

      I hope it solve your problem!

      • Hey thanks for the response. Just figured it myself ....

        while in the default namespace I used

        edit secret registry-<my-repo>

        then I copied the contents and replaced all default namespaces to my own, and saved the file for later reference when I need more namespaces.

        I also applied the saved file as well to apply the secret to my namespace

      • Hello! How can I find my namespace to replace in the registry.yaml file?

        • if your run

          kubectl get namespaces

          you will see your current namespaces in kubernetes.
          If you never created a new one for your deployments that you are probably just on “default”.

          To see in what namespace you are operating right now you can run the following command:

          kubectl config view --minify | grep namespace:

          There are 2 ways to fix this issue but I eventually chose to do the following:

          1. create namespace to run my pods
          2. switch to that namespace
          3. create the pull secret in that namespace (if you follow the DO instructions it is automatically created in the default namespace). If you followed the guide you can probably run kubectl edit secret registry-<your-registry> -n default Copy the contents of the file and save them in a yaml file on your pc. In this file change the word DEFAULT to the name of your namespace and apply the file.
          4. Now you either have to set the pull secret as default for the service account in your namespace or you can add the secret to your deployments so that they know what secret to use. imagePullSecrets: - name: registry-<your-registry>

          If this is still a bit to vague just let me know.
          It took me some time to figure out as well.

          • Thank you so much! I’m at step 3 but when I tried applying the file with kubectl -n NAMESPACE apply -f registry.yaml I got for: "registry.yaml": Operation cannot be fulfilled on secrets: the object has been modified; please apply your changes to the latest version and try again

            Can you tell me how to apply it properly? Thank you!

        • Hi, try removing “-n NAMESPACE”, I will fix my previous post.

          kubectl apply -f registry.yaml

          Sorry for that, it was my fault!

  • Sorry to hear you’re having troubles. The two commands in my answer solved this for me :shrugs:

    • The thing is that serviceaccount is namespaced, so if you are trying to pull the images from a pod running inside a namespace, you have to add the secret to the default service account of that namespace.