Unable to pull images from private registry

I have installed microk8s on Ubuntu 18.04.3 server that is behind the firewall and access to internet is limited. Thus I downloaded snap from another computer

snap download microk8s

and then installed it on that server (with root privileges) and imported sandbox_image (k8s.gcr.io/pause:3.1) that was needed and couldn’t be downloaded because of firewall

snap ack microk8s_989.assert
snap install microk8s_989.snap --classic

microk8s.ctr -n k8s.io image import pause3.1

Then, I have updated file /var/snap/microk8s/current/args/containerd-template.toml according to the tutorial at https://microk8s.io/docs/working#working-with-a-private-registry

    [plugins.cri.registry.configs."registry01*".auth]
      username = "name"
      password = "pwd"
    [plugins.cri.registry]
      [plugins.cri.registry.mirrors]
        [plugins.cri.registry.mirrors."docker.io"]
          endpoint = ["http://registry01:80"]
        [plugins.cri.registry.mirrors."local.insecure-registry.io"]
          endpoint = ["http://registry01:80"]
        [plugins.cri.registry.mirrors."registry01:80"]
          endpoint = ["http://registry01:80"]

Howewer, It seems like it is ignored. When I run command

microk8s.kubectl run name --image=registry01:80/image:tag
microk8s.kubectl describe pod [podname]

the output from describe is as follows

Failed to pull image "registry01:80/image:tag": rpc error: code = Unknown desc = failed to resolve image "registry01:80/image:tag": no available registry endpoint: failed to do request: Head https://registry01:80/v2/image/manifests/tag: http: server gave HTTP response to HTTPS client

Regardless the endpoint property of [plugins.cri.registry.mirrors.“registry01:80”]. When I change it to something else, the result is the same.

[berttejeda]

My scenario:

• Private Registry DNS: my-registry.mydomain
• Private Registry IP: 192.168.1.57

What worked for me was adding both the IP and DNS values to the containerd template.

Here’s the relevant section in my /var/snap/microk8s/current/args/containerd-template.toml:

    [plugins.cri.registry]
      [plugins.cri.registry.mirrors]
        [plugins.cri.registry.mirrors."docker.io"]
          endpoint = ["https://registry-1.docker.io"]
        [plugins.cri.registry.mirrors."localhost:32000"]
          endpoint = ["http://localhost:32000"]
        [plugins.cri.registry.mirrors."192.168.1.57"]
          endpoint = ["http://192.168.1.57"]
        [plugins.cri.registry.mirrors."my-registry.mydomain"]
          endpoint = ["http://my-registry.mydomain"] 

Once I did that, I rebooted the VM for good measure, but I bet this would work as well:

systemctl restart snap.microk8s.daemon-containerd.service && microk8s.stop && microk8s.start

Here’s my /etc/docker/daemon.json for posterity:

{
    "insecure-registries" : ["localhost:32000", "my-registry.mydomain"]
}

Once I did this, the image pull errors went away.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.