---
name: containers-ts-cluster-icr-pull-img
title: Why can't the cluster pull images from IBM Cloud Container Registry during creation?
description: '[Virtual Private Cloud] [Classic infrastructure]'
last-updated: 2026-07-30
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why can't the cluster pull images from IBM Cloud Container Registry during creation?
{: #ts_image_pull_create}
{: support}

[Virtual Private Cloud]{: tag-vpc} [Classic infrastructure]{: tag-classic-inf}


When you created a cluster, you received an error message similar to the following example.
{: tsSymptoms}


```sh
Your cluster can't pull images from the 'icr.io' domains because an IAM access policy could not be created. Make sure that you have the IAM Administrator platform access role to. Then, create an image pull secret with IAM credentials to the registry by running 'ibmcloud ks cluster pull-secret apply'.
```
{: screen}


During cluster creation, a service ID is created for your cluster and assigned the **Reader** service access policy to IBM Cloud Container Registry.
{: tsCauses}

Then, an API key for this service ID is generated and stored in [an image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registry&format=markdown#cluster_registry_auth) to authorize the cluster to pull images from IBM Cloud Container Registry.

To successfully assign the **Reader** service access policy to the service ID during cluster creation, you must have the **Administrator** platform access policy to IBM Cloud Container Registry.
{: tsResolve}

Steps:
1. Make sure that the account owner gives you the **Administrator** role to IBM Cloud Container Registry.
    ```sh
    ibmcloud iam user-policy-create <your_user_email> --service-name container-registry --roles Administrator
    ```
    {: pre}

2. [Use the `ibmcloud ks cluster pull-secret apply` command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#cluster-pull-secret-apply-cli) to re-create an image pull secret with the appropriate registry credentials.