Skaffold: Error pulling images, unauthorized

Created on 4 Apr 2018 · 11Comments · Source: GoogleContainerTools/skaffold

Issues without logs and details are more complicated to fix.
Please help us!

Expected behavior

Pulls image down and starts pods/etc.

Actual behavior

Failed to pull image "gcr.io/xx/yy:latest": rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

Information

I have run gcloud docker -a as well as can pull image locally with no issue.

Skaffold version: master
Operating system: Ubuntu 16.04

Content of skaffold.yaml:

apiVersion: skaffold/v1alpha2
kind: Config
build:
  artifacts:
  - imageName: gcr.io/xxx/yyy
    workspace: .
  local: {}
deploy:
  kubectl:
    manifests:
      - kubernetes/stage/*

Steps to reproduce the behavior

arebuild kinbug prioritawaiting-more-evidence

Source

diit

Most helpful comment

Hey i have this issue aswell,

I have local kubernetes cluster and when i try to pull the image with docker pull gcr;//xx.xx.xx it works but when i try to create a deployment in kubernetes it gives the error,

besides gcloud auth configure-docker i also tried with configuring secrets with json file

this is my deployment configuration


apiVersion: apps/v1 
kind: Deployment
metadata:
  name: logstash
spec:
  selector:
    matchLabels:
      app: logstash
  replicas:
  template:
    metadata:
      labels:
        app: logstash
    spec:
      containers:
      - name: logstash
        image: us.gcr.io/xx/xx/xxx
        ports:
        - containerPort: 12201
      imagePullSecrets:
      - name: gcr-json-key

has anybody have any idea

BezVezeE on 13 Sep 2018

👍6

All 11 comments

@diit Did you authenticate your docker to gcr?
https://cloud.google.com/container-registry/docs/pushing-and-pulling
Which skaffold version are you using?

dcherniv on 6 Apr 2018

👎1 👍1

@diit any update here? Can you try running with -v debug?

r2d4 on 23 Apr 2018

Ran into the same issue today and found out that the issue is coming from kubectl deployment and due to the image you are using is not publicly accessible.

Follow the instruction here at Serving images publicly should resolve your issue as it did for me.

cch0 on 7 Jun 2018

Closing as this doesn't seem to be strictly related to Skaffold

dgageot on 26 Jun 2018

Hey i have this issue aswell,

I have local kubernetes cluster and when i try to pull the image with docker pull gcr;//xx.xx.xx it works but when i try to create a deployment in kubernetes it gives the error,

besides gcloud auth configure-docker i also tried with configuring secrets with json file

this is my deployment configuration


apiVersion: apps/v1 
kind: Deployment
metadata:
  name: logstash
spec:
  selector:
    matchLabels:
      app: logstash
  replicas:
  template:
    metadata:
      labels:
        app: logstash
    spec:
      containers:
      - name: logstash
        image: us.gcr.io/xx/xx/xxx
        ports:
        - containerPort: 12201
      imagePullSecrets:
      - name: gcr-json-key

has anybody have any idea

BezVezeE on 13 Sep 2018

👍6

yes, I think this is a skaffold issue since these images can be pulled with docker pull ... on the host

haf on 28 Feb 2019

👍2

We're experiencing the same issue. Has anyone found a viable solution to this?

markkohdev on 6 May 2019

I had the same issue, and upgrading from v0.26 (via snap) to the v0.29 as per release info did the trick.

steevee on 13 May 2019

For anyone running into this issue on a Docker-optimized OS:

I also had this issue, and it was due to me messing around with permissions for the "Compute Engine default service account" on IAM. By default, the service account has "Editor" permissions, and you may see this error if you revoke whatever permission gave the service account access to pull from the registry.