<p>I am trying to install Kubernetes 1.9.0 on a cluster of CentOS 7.3 systems running in VMware Workstation on Windows 7, following the "kubernetes-the-hard-way tutorial". When I get to the verification stage in the tutorial and try to start the busybox deployment (<a href="https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/12-dns-addon.md" rel="nofollow noreferrer">https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/12-dns-addon.md</a>), the pod status remains stuck at "ContainerCreating". </p>

<p>The kubelet log for the node that the pod supposed to run on shows these error messages:</p>

<pre><code>failed to get sandbox image \"gcr.io/google_containers/pause:3.0\":
failed to pull image \"gcr.io/google_containers/pause:3.0\":
failed to pull image \"gcr.io/google_containers/pause:3.0\":
httpReaderSeeker: failed open: failed to do request:
Get https://storage.googleapis.com/artifacts.google-containers.appspot.com/containers/images/sha256:f112334343777b75be77ec1f835e3bbbe7d7bd46e27b6a2ae35c6b3cfea0987c: x509: certificate signed by unknown authority
</code></pre>

<p>I added both of those domains to the list of insecure registries in /etc/docker/daemon.json:</p>

<pre><code>{
  "insecure-registries" : ["gcr.io"],
  "insecure-registries" : ["googleapis.com"]
}
</code></pre>

<p>Docker is able to pull the image from the command line:</p>

<pre><code>docker pull gcr.io/google_containers/pause:3.0
Trying to pull repository gcr.io/google_containers/pause ...
3.0: Pulling from gcr.io/google_containers/pause
a3ed95caeb02: Pull complete
f11233434377: Pull complete
Digest: sha256:0d093c962a6c2dd8bb8727b661e2b5f13e9df884af9945b4cc7088d9350cd3ee
</code></pre>

<p>Any ideas why the kubelet is unable to pull the image?</p>

<p>Thanks,
TI</p>

<p>The syntax for this in <code>daemon.json</code> is </p>

<pre><code>"insecure-registries" : ["gcr.io" , "googleapis.com"]
</code></pre>

<p>"Also depending of the registries you are accessing, you may have to perform a "<code>kubectl create secret docker-registry ...</code>" action as  explained <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">here</a></p>

<p>Finally, you may have to define the certificate to <code>docker</code> by creating a new directory in <code>/etc/docker/certs.d</code> containing the certificates as explained <a href="https://docs.docker.com/engine/security/certificates/" rel="nofollow noreferrer">here</a></p>
