Local docker registry with self-signed certificate

Hello,

We are trying to set-up binderhub with our own docker registry in a local network as stated here. We first tried with a http registry, the problem is that docker forces us to use https connection so it is not reliable. So we tried to use https with a self-signed certificate, the issue is that binderhub just allows pulling from registry with a CA certificate. There are two solutions :

1. Change this line to allow for untrusted certificate with validate_cert=False => Fast and easy but maybe more insecure
2. Adding the self-signed certificate to /etc/docker/certs.d like here but should be inside the building pod, with proper mounting options => lot more “complicated” but secure

Do you have some ideas about this ?

ps: Using a public registry is not ideal for us since we sould need to buy a floating ip, a domain name, and it is far less optimal in term of pushing/pulling time (pull binderhub -> registry on local network VS pull binderhub -> DNS -> registry on public network)

Thanks,

[betatim]

(I’ve never used Pod presets myself, so this is a bit “the blind leading the blind”)

One idea could be that the preset only works if the pod doesn’t already have volumes/mounts defined. It would be weird but who knows. I’d define a volume and mount in your test pod to see if it still works. The other thing to double check is if the selector works correctly and that the preset is in the right namespace. Other than that I am a bit stumped too 😕

[ltetrel]

I found the k8s certificates, there are here but seems to be self-signed /etc/kubernetes/pki/ca.crt. Your second suggestion seems to be feasible, I will try it and give feedbacks