This message was deleted Rancher Users #k3s

Join Slack

This message was deleted.

# k3s

adamant-kite-43734

04/02/2026, 9:17 AM

This message was deleted.

☑️ 1

great-city-74149

04/02/2026, 9:17 AM

On every node, I have edited

/etc/rancher/k3s/registries.yaml

Copy code

mirrors:
  "registry.company.internal":
    endpoint:
      - "<http://registry.company.internal>"
configs:
  "registry.company.internal":
    tls:
      insecure_skip_verify: true

and then run

sudo systemctl restart k3s

. I have also tried specifying the port number like

registry.company.internal:5000

, or using the IP instead of the name.

great-city-74149

04/02/2026, 9:17 AM

All the nodes have access to the registry URL, e.g. they can ping it:

Copy code

ping registry.company.internal
# or
curl -v <http://registry.company.internal/v2/>

great-city-74149

04/02/2026, 9:18 AM

All the nodes' container runtime were "containerd" (not docker), so I thought of editing

/etc/containerd/config.toml

, but apparently that was irrelevant since K3s uses a built-in containerd?

great-city-74149

04/02/2026, 9:18 AM

Gemini suggested to take a look at,

/var/lib/rancher/k3s/agent/etc/containerd/certs.d/registry.company.internal/hosts.toml

which was

Copy code

# File generated by k3s. DO NOT EDIT.

server = "<https://registry.company.internal/v2>"
capabilities = ["pull", "resolve", "push"]

skip_verify = true


[host]
[host."<http://registry.company.internal/v2>"]
  capabilities = ["pull", "resolve"]
  skip_verify = true

and said that the

https

part on line 3 was the problem, as it actually should be

http

. Gemini suggested a few things to try, but after restarting k3s, the "https" would always be the same.

great-city-74149

04/02/2026, 9:18 AM

Does anyone know how to solve this? Any idea would be appreciated!

hundreds-evening-84071

04/02/2026, 11:38 AM

https://docs.rke2.io/install/private_registry#redirects

Copy code

mirrors:
  <http://docker.io|docker.io>:
    endpoint:
      - "<https://registry.company.internal>"
configs:
  "registry.company.internal":
    tls:
      insecure_skip_verify: true

above is what I have and seems to work

great-city-74149

04/03/2026, 2:59 AM

Thanks for your reply! We are not using the private registry as a mirror but as a storage for private images, and we need to pull images from docker hub as well. So in our case, I think we don't want to redirect docker.io...

great-city-74149

04/07/2026, 8:09 AM

It turned that K3s was not the problem but the registry had a weird bug. I have managed to fix it. Thanks!

23 Views

Open in Slack

Previous Next