GKE imagePullBackOff on gcr.io

After reading some of the docs, I manually added access using these instructions: https://cloud.google.com/container-registry/docs/access-control

and that now allows the sample code to deploy. Looks like the automatic access from gke to gcr didn't work.

When creating your GKE cluster, make sure to have Storage RO or https://www.googleapis.com/auth/devstorage.read_only scope for your nodes.

I tripped over this when creating GKE cluster via Terraform and had:

node_config {
    oauth_scopes = [
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
    ]

...

instead of

node_config {
    oauth_scopes = [
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
      "https://www.googleapis.com/auth/devstorage.read_only"
    ]

...