0

How to add self-signed certificate to Cloud Foundry (PCFDev), so I would be able to deploy with Docker Image from private Docker Registry?

For this example I'm using PCFDev:

user@work:(0):~/Documents/$ cf push app-ui -o nexus-dev/app/app-ui:latest
Creating app app-ui in org pcfdev-org / space pcfdev-space as user...
OK

Creating route app-ui.local.pcfdev.io...
OK

Binding app-ui.local.pcfdev.io to app-ui...
OK


Starting app app-ui in org pcfdev-org / space pcfdev-space as user...
Creating container
Successfully created container
Staging...
Staging process started ...
Failed to talk to docker registry: Get https://nexus-dev/v2/: x509: certificate signed by unknown authority
Failed getting docker image by tag: Error parsing HTTP response: invalid character '<' looking for beginning of value: "<html>\r\n<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>\r\n<body bgcolor=\"whit
e\">\r\n<center><h1>400 Bad Request</h1></center>\r\n<center>The plain HTTP request was sent to HTTPS port</center>\r\n<hr><center>nginx/1.10.0 (Ubuntu)</center>\r\n</body>\r\n</html>\r\n"
Staging process failed: Exit trace for group:
builder exited with error: failed to fetch metadata from [app/app-ui] with tag [latest] and insecure registries [] due to Error parsing HTTP response: invalid character '<' looking for beginning of value: "<html>\r\n<head><title>
400 The plain HTTP request was sent to HTTPS port</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>400 Bad Request</h1></center>\r\n<center>The plain HTTP request was sent to HTTPS port</center>\r\n<hr><center>nginx/1.10.0
 (Ubuntu)</center>\r\n</body>\r\n</html>\r\n"
Exit status 2
Staging Failed: Exited with status 2
Destroying container
Successfully destroyed container

FAILED
Error restarting application: StagingError

TIP: use 'cf logs app-ui --recent' for more information
luka5z
  • 7,525
  • 6
  • 29
  • 52

1 Answers1

1

You can start pcfdev with -r option, e.g.

cf dev start -r host.pcfdev.io:5000

from Insecure Docker Registries

Anatoly Kern
  • 621
  • 3
  • 8
  • Is there more general way that could be applied to any CF installation? – luka5z Apr 04 '17 at 10:41
  • Opensource CF does not support docker registries without valid ssl certs per https://docs.cloudfoundry.org/adminguide/docker.html#private and https://docs.cloudfoundry.org/adminguide/docker.html#push-docker Pivotal CF supports whitelist for non trusted registries per https://docs.pivotal.io/pivotalcf/1-9/opsguide/docker-registry.html#ert But to clarify - any Docker registry still have to have an SSL endpoint (self-signed aka non truster) and your error points to absent of it. – Anatoly Kern Apr 04 '17 at 20:44