https://rancher.com/ logo
Join Slack
Powered by
Hi I'm trying to do a fresh air-gap k3s install wi...
# k3s
h
Hi I'm trying to do a fresh air-gap k3s install with private registry. I loaded the images with this step. Any help is appreciated! deploy step -
Copy code
K3S_SYSTEM_DEFAULT_REGISTRY=10.3.13.101:5000 INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC='server --token=k3s_secret --cluster-init --disable=servicelb --selinux --data-dir=/data/k3s' /usr
/local/bin/install.sh
I'm getting this error when pulling all images.
Copy code
failed to pull image \"10.3.13.101:5000/rancher/mirrored-pause:3.6\": failed to pull and unpack image \"10.3.13.101:50
00/rancher/mirrored-pause:3.6\": failed to resolve reference \"10.3.13.101:5000/rancher/mirrored-pause:3.6\": failed to do request: Head \"<https://10.3.13.101:5000/v2/rancher/mirrored-pause/manifests/3.6>\": htt
p: server gave HTTP response to HTTPS client
and I'm able to search my insecure internal registry for the images to confirm they are there.
Copy code
[root@bumblebee ~]# podman search 10.3.13.101:5000/ --tls-verify=false 
NAME                                              DESCRIPTION 
10.3.13.101:5000/rancher/klipper-helm 
10.3.13.101:5000/rancher/klipper-lb 
10.3.13.101:5000/rancher/local-path-provisioner 
10.3.13.101:5000/rancher/mirrored-coredns-coredns 
10.3.13.101:5000/rancher/mirrored-library-busybox 
10.3.13.101:5000/rancher/mirrored-library-traefik 
10.3.13.101:5000/rancher/mirrored-metrics-server
My /etc/rancher/k3s/registries.yaml
Copy code
mirrors: 
 10.3.13.101:5000: 
   endpoint: 
     - "<http://10.3.13.101:5000>" 
configs: 
 "*": 
   tls: 
     insecure_skip_verify: true
c
The system default registry must be https
The pause image isn't pulled via CRI so the registries.yaml CRI mirror config isn't used for it
h
Ah okay, that makes sense. How is it pulled? I thought it was CRI because 
crictl images
would list images after k3s was setup.
I'm in the process of redeploying a secure registry.
c
The runtime pulls it implicitly if it's not present when a pod is started.
It's kind of a deficiency in the whole model, the same issue affects kubelet credential plugins because they are never invoked to pull the pause image either
So basically the pause image needs to be available anonymously, on a registry that uses https
Or you can preload it
h
I understand, thank you for explaining. So the easiest solution would be to enable tls on my internal registry?
Would preloading be putting the 
k3s-airgap-images-amd64.ar.zst
bundle in 
/var/lib/rancher/k3s/agent/images
?
I was going to go that route, but I need the registries to be available to other nodes internally.
c
https://github.com/k3s-io/k3s/issues/3463#issuecomment-1030173992 Maybe that's been fixed, honestly it's been a while since I checked.
CRI has added an interface to let the kubelet query the runtime to see what the pause image is, maybe it explicitly pulls it now. I can check tomorrow.
In general you're best off using https if at all possible though
👍 2
h
No don't worry about it...I'm just going to setup a secure registry.
I appreciate your time and help.
237 Views
Open in Slack
PreviousNext
Powered by