Unable to pull images from Harbor from kubernetes

[AllardKrings]

Hello,

I have installed Harbor on my kubernetes cluster (microk8s running on ubuntu lunar)

I can pull and push images to and from Harbor.

However when i do a kubectl apply -f of a yaml file containing one of the pushed images I get and ImagePullBackoff with the following error in the logs:

Normal Pulling 25s (x2 over 39s) kubelet Pulling image "core.harbor.xxx.yy/library/openliberty:arm64v8"
Warning Failed 25s (x2 over 38s) kubelet Failed to pull image "core.harbor.alldcs.nl/library/openliberty:arm64v8": rpc error: code = Unknown desc = failed to pull and unpack image "core.harbor.xxx.yy/library/openliberty:arm64v8": failed to resolve reference "core.harbor.xxx.yy./library/openliberty:arm64v8": failed to do request: Head "https://core.harbor.xxx.yy/v2/library/openliberty/manifests/arm64v8": x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "harbor-ca")

I have followed the instructions from : https://microk8s.io/docs/registry-private

1. the ca.crt from harbor is in /etc/docker/certs.d/core.harbor.xxx.yy/

2. the ca.crt from harbor is in /etc/docker/certs.d/core.harbor.xxx.yy/ on every node

3. I configured /var/snap/microk8s/current/args/certs.d/core.harbor.xxx.yy/host.toml on every node as follows:

server = "http://core.harbor.xxx.yy"

[host."http://core.harbor.xxx.yy"]
capabilities = ["pull", "resolve"]

What else can I try?

Help/advise appreciated!

[chlins]

Please refer to the microk8s documents to configure the self-signed cert, it should be in the section Using a custom CA of https://microk8s.io/docs/registry-private. It seems your configuration is not completely.

The example from microk8s. The configuration you provided seems to be missing the last line "ca=...".

# /var/snap/microk8s/current/args/certs.d/10.141.241.175:32000/hosts.toml
server = "https://10.141.241.175:32000"

[host."https://10.141.241.175:32000"]
capabilities = ["pull", "resolve"]
ca = "/var/snap/microk8s/current/args/certs.d/10.141.241.175:32000/ca.crt"

[sombek]

I have a question do I need to create the
/var/snap/microk8s/current/args/certs.d/MY_SECURE_PRIVATE_REG
on every node? Is there a way to automate this?