Docker pull image without ssl in Kubernetes with docker private registry

1
votes

When I try to deploy something with docker registry I every time view errors:

x509: cannot validate certificate for 10.2.10.7 because it doesn't contain any IP SANs

Question: How I can disable ssl from deploy image in docker registry to Kubernetes ?

3
dockerkubernetes
Are you using private docker registry ? – Kamol Hasan
yes I use docker private registry – noute
Are you using self signed certificate? – Kamol Hasan
Yes. I used that comand openssl req -newkey rsa:2048 -nodes -sha256 -x509 -days 365 -keyout /etc/pki/tls/private/registry.key -out /etc/pki/tls/registry.crt – noute
What exactly command have you used? – PjoterS

3 Answers

1
votes

As you're using self signed TLS certificate, you need to add the certificate to the known certificates list.

Grab you .crt file and cope it to the client machine's ssl certificates directory.

For ubuntu:

$ sudo cp registry.crt /usr/local/share/ca-certificates/registry.crt 
$ sudo update-ca-certificates

Now restart docker:

$ sudo systemctl restart docker

For CentOS 7:

  1. copy the certificate inside /etc/pki/ca-trust/source/anchors/
  2. Use update-ca-trust command
1
votes

Assuming relaxed security is OK for your environment, a way to accomplish in Kubernetes what you want is to configure Docker to connect to the private registry as an insecure registry.

Per the doc here:

With insecure registries enabled, Docker goes through the following steps:

  • First, try using HTTPS. If HTTPS is available but the certificate is invalid, ignore the error about the certificate.
  • If HTTPS is not available, fall back to HTTP.

Notice that the change to /etc/docker/daemon.json described in that doc - adding "insecure-registries" configuration - has to be applied to all nodes in the Kubernetes cluster on which pods/containers can be scheduled to run. Plus, Docker has to be restarted for the change to take effect.

It is also to note that the above assumes the cluster uses the Docker container runtime and not some other runtime (e.g. CRI-O) that supports the Docker image format and registry.

1
votes

My problem was with certificates because I used self-signed TLS certificates. It is not good idea. You might encounter with known certificates list and you will need to add certificates each time and use command update-ca-certificates (if you are using Centos 7). However, you might encounter another issue with certificates with another error code.

To resolve this issue i've used 3rd party Certificate Authority called Let'sEncrypt.