Ensures that images are pulled from the insecure registry with http #3161

essobedo · 2023-04-07T16:05:21Z

Related to #110

Motivation

Inside k8s, the images are pulled from the insecure registry using HTTPS while they should be pulled with HTTP.

Modifications:

Modifies the registry mirrors' configuration to ensure that images pulled from kind-registry are pulled using HTTP
Defines the value of hostFromClusterNetwork of the localRegistryHosting
Updates the documentation consequently

linux-foundation-easycla · 2023-04-07T16:05:24Z

The committers listed above are authorized under a signed CLA.

✅ login: essobedo / name: Nicolas Filotto (8b67b61)

k8s-ci-robot · 2023-04-07T16:05:28Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: essobedo
Once this PR has been reviewed and has the lgtm label, please assign bentheelder for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2023-04-07T16:05:29Z

Welcome @essobedo!

It looks like this is your first PR to kubernetes-sigs/kind 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/kind has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2023-04-07T16:05:30Z

Hi @essobedo. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

BenTheElder · 2023-04-20T21:03:51Z

site/static/examples/kind-with-registry.sh

@@ -36,6 +36,7 @@ metadata:
 data:
  localRegistryHosting.v1: |
    host: "localhost:${reg_port}"
+    hostFromClusterNetwork: "${reg_name}:5000"


BenTheElder · 2023-04-20T21:04:30Z

Catching up after being on vacation for a week and some other kubernetes priorities ... Thanks for the PR!

Unfortunately we can't merge anything without the CNCF's CLA 😅

essobedo · 2023-04-24T18:03:30Z

@BenTheElder The CLA is signed now, it took me some time

aojea · 2023-04-24T18:54:28Z

/ok-to-test

BenTheElder · 2023-04-24T19:14:02Z

site/content/docs/user/local-registry.md

@@ -25,7 +25,7 @@ The registry can be used like this.
 1. First we'll pull an image `docker pull gcr.io/google-samples/hello-app:1.0`
 2. Then we'll tag the image to use the local registry `docker tag gcr.io/google-samples/hello-app:1.0 localhost:5001/hello-app:1.0`
 3. Then we'll push it to the registry `docker push localhost:5001/hello-app:1.0`
-4. And now we can use the image `kubectl create deployment hello-server --image=localhost:5001/hello-app:1.0`
+4. And now we can use the image `kubectl create deployment hello-server --image=kind-registry:5000/hello-app:1.0`


this change is unrelated and localhost:5001 should work.

the goal is to ensure that a consistent name is used for the images across hosts to avoid confusion for users.

BenTheElder · 2023-04-24T19:14:13Z

site/static/examples/kind-with-registry.sh

@@ -16,7 +16,7 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 containerdConfigPatches:
 - |-
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."localhost:${reg_port}"]
+  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."${reg_name}:5000"]


this change is wrong

this configuration as-is allows us to remap pulls for images at localhost:$registry_port to the registry container, for a consistent reference between host and nodes

you can remap anything to anything, this is remapping is performed in the image resolution code in containerd.

so containerd sees localhost:5001/foo and instead it pulls from the endpoint we specify here.

BenTheElder · 2023-04-24T19:15:52Z

site/content/docs/user/local-registry.md


 If you build your own image and tag it like `localhost:5001/image:foo` and then use
-it in kubernetes as `localhost:5001/image:foo`. And use it from inside of your cluster application as `kind-registry:5000`.
+it in kubernetes as `kind-registry:5000/image:foo`. And use it from inside of your cluster application as `kind-registry:5000`.


same here: this doesn't need to change. the only time you need to use kind-registry instead is if you're in the docker network and not using the node container runtime

BenTheElder · 2023-04-24T19:17:39Z

Inside k8s, the images are pulled from the insecure registry using HTTPS while they should be pulled with HTTP.

looking at the config again now, they are not, it is configured as http

kind/site/static/examples/kind-with-registry.sh

Line 20 in 5cb68df

endpoint = ["http://${reg_name}:5000"]

I think there may be some confusion here either about how the containerd feature works or about pulling images from something other than the node runtimes.

essobedo · 2023-04-25T09:08:46Z

I confirm that the current code works for the use case provided in the article https://kind.sigs.k8s.io/docs/user/local-registry/ but not in my use case where I need to be able to push an image from a pod with this approach we can access the local registry in the exact same manner inside the k8s cluster but I understand that it is probably too specific.

BenTheElder · 2023-04-25T14:17:44Z

To push from a pod you have to use kind-registry:$port and the docs mention this? That line may need clarifying, but doing that doesn't require altering the containerd configuration

Ensures that images are pulled from the insecure registry with http

8b67b61

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Apr 7, 2023

k8s-ci-robot requested review from aojea and neolit123 April 7, 2023 16:05

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Apr 7, 2023

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Apr 7, 2023

essobedo mentioned this pull request Apr 7, 2023

Support insecure-registries for container runtime running inside of kind container #110

Closed

BenTheElder reviewed Apr 20, 2023

View reviewed changes

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Apr 24, 2023

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 24, 2023

BenTheElder reviewed Apr 24, 2023

View reviewed changes

essobedo closed this Apr 25, 2023

essobedo deleted the fix-insecure-registry-script branch April 25, 2023 09:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ensures that images are pulled from the insecure registry with http #3161

Ensures that images are pulled from the insecure registry with http #3161

essobedo commented Apr 7, 2023

linux-foundation-easycla bot commented Apr 7, 2023 •

edited

Loading

k8s-ci-robot commented Apr 7, 2023

k8s-ci-robot commented Apr 7, 2023

k8s-ci-robot commented Apr 7, 2023

BenTheElder Apr 20, 2023

BenTheElder commented Apr 20, 2023

essobedo commented Apr 24, 2023

aojea commented Apr 24, 2023

BenTheElder Apr 24, 2023

BenTheElder Apr 24, 2023

BenTheElder Apr 24, 2023

BenTheElder Apr 24, 2023

BenTheElder Apr 24, 2023

BenTheElder commented Apr 24, 2023

essobedo commented Apr 25, 2023

BenTheElder commented Apr 25, 2023

Ensures that images are pulled from the insecure registry with http #3161

Ensures that images are pulled from the insecure registry with http #3161

Conversation

essobedo commented Apr 7, 2023

Motivation

Modifications:

linux-foundation-easycla bot commented Apr 7, 2023 • edited Loading

k8s-ci-robot commented Apr 7, 2023

k8s-ci-robot commented Apr 7, 2023

k8s-ci-robot commented Apr 7, 2023

BenTheElder Apr 20, 2023

Choose a reason for hiding this comment

BenTheElder commented Apr 20, 2023

essobedo commented Apr 24, 2023

aojea commented Apr 24, 2023

BenTheElder Apr 24, 2023

Choose a reason for hiding this comment

BenTheElder Apr 24, 2023

Choose a reason for hiding this comment

BenTheElder Apr 24, 2023

Choose a reason for hiding this comment

BenTheElder Apr 24, 2023

Choose a reason for hiding this comment

BenTheElder Apr 24, 2023

Choose a reason for hiding this comment

BenTheElder commented Apr 24, 2023

essobedo commented Apr 25, 2023

BenTheElder commented Apr 25, 2023

linux-foundation-easycla bot commented Apr 7, 2023 •

edited

Loading