Kubernetes containerd - failed to pull image from private registry

Question

I setup kubernetes V1.20.1 with containerd instead of Docker. Now I failed to pull Docker images from my private registry (Harbor).

I already changed the /etc/containerd/config.toml like this:

[plugins."io.containerd.grpc.v1.cri".registry]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
      endpoint = ["https://registry-1.docker.io"]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.foo.com"]
      endpoint = ["https://registry.foo.com"]
  [plugins."io.containerd.grpc.v1.cri".registry.configs]
    [plugins."io.containerd.grpc.v1.cri".registry.configs."registry.foo.com"]
      [plugins."io.containerd.grpc.v1.cri".registry.configs."registry.foo.com".auth]
        username = "admin"
        password = "Harbor12345"

But this did not work. The pull failed with the message:

Failed to pull image "registry.foo.com/library/myimage:latest": rpc error: code = Unknown
desc = failed to pull and unpack image "registry.foo.com/library/myimage:latest": failed to 
resolve reference "registry.foo.com/library/myimage:latest": unexpected status code 
[manifests latest]: 401 Unauthorized

My Harbor registry is available via HTTPS with a Let's Encrypt certificate. So https should not be the problem here.

Even if I try to create a docker-secret this did not work:

kubectl create secret docker-registry registry.foo.com --docker-server=https://registry.foo.com --docker-username=admin --docker-password=Harbor12345 --docker-email=info@foo.com

Can anybody give me an example how to configure a private registry in Kubernetes with containerd?

score 3 · Accepted Answer · answered Jan 05 '21 at 10:41

3

Set imagePullSecrets in the pod/deployment specification:

apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: <your-private-image>
  imagePullSecrets:
  - name: registry.foo.com

More info: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

answered Jan 05 '21 at 10:41

Dávid Molnár

10,673
7
30
55

I get this working with a 'Pod'. But it did not work with a 'Deployment'. – Ralph Jan 05 '21 at 11:31
ok - it worked after I created the secret for the corresponding namespace. Is there any way to add the imagePullScrets on a global area, so that I do not need a secret for every namespace? – Ralph Jan 05 '21 at 11:35
Secrets can only be referenced by Pods in that same namespace: https://kubernetes.io/docs/concepts/configuration/secret/#details However if you use solutions like Rancher, you could configure the secret on the project level and all namespaces in that project would have access to the secret.. – Dávid Molnár Jan 05 '21 at 11:43

Ömer Sezer · Answer 2 · 2022-07-11T17:22:58.300

Create file, put username:password in it and get the base64 code of it:

touch pass.txt 
nano pass.txt
# write like that => username:password 
base64 pass.txt
# get the base64 code: cmxxxxxxxxyyyyyyCg==

nano /etc/containerd/config.toml (use auth="", instead of using username/password):

[plugins."io.containerd.grpc.v1.cri".registry]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
      endpoint = ["https://registry-1.docker.io"]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.foo.com"]
      endpoint = ["https://registry.foo.com"]
  [plugins."io.containerd.grpc.v1.cri".registry.configs]
    [plugins."io.containerd.grpc.v1.cri".registry.configs."registry.foo.com".tls] 
       insecure_skip_verify=true
  [plugins."io.containerd.grpc.v1.cri".registry.configs."registry.foo.com".auth]
        auth ="cmxxxxxxxxyyyyyyCg=="

Restart containerd service:

sudo systemctl restart containerd.service

Pull image directly from node:

sudo crictl pull registry.foo.com/imageName:Tag

Kubernetes containerd - failed to pull image from private registry

2 Answers2