<p><strong>tl;dr</strong> How do you reference an image in a Kubernetes <code>Pod</code> when the image is from a private docker registry hosted on the same k8s cluster without a separate DNS entry for the registry?</p>

<p>In an on-premise Kubernetes deployment, I have setup a private Docker registry using the <a href="https://github.com/helm/charts/tree/master/stable/docker-registry" rel="noreferrer">stable/docker-registry</a> helm chart using a self-signed certificate. This is on-premise and I can't setup a DNS record to give the registry it's own URL. I wish to use these manifests as templates, so I don't want to hardcode any environment specific config.</p>

<p>The docker registry service is of type <code>ClusterIP</code> and looks like this:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: docker-registry
  labels:
    app: docker-registry
spec:
  type: ClusterIP
  ports:
    - port: 443
      protocol: TCP
      name: registry
      targetPort: 5000
  selector:
    app: docker-registry
</code></pre>

<p>If I've pushed an image to this registry manually (or in the future via a Jenkins build pipeline), how would I reference that image in a <code>Pod</code> spec?</p>

<p>I have tried:</p>

<pre><code>containers:
- name: my-image
  image: docker-registry.devops.svc.cluster.local/my-image:latest
  imagePullPolicy: IfNotPresent
</code></pre>

<p>But I received an error about the node host not being able to resolve <code>docker-registry.devops.svc.cluster.local</code>. I think the Docker daemon on the k8s node can't resolve that URL because it is an internal k8s DNS record.</p>

<pre><code>Warning  Failed     20s (x2 over 34s)  kubelet, ciabdev01-node3  
Failed to pull image "docker-registry.devops.svc.cluster.local/hadoop-datanode:2.7.3": 
rpc error: code = Unknown desc = Error response from daemon: Get https://docker-registry.devops.svc.cluster.local/v2/: dial tcp: lookup docker-registry.devops.svc.cluster.local: no such host
Warning  Failed     20s (x2 over 34s)  kubelet, node3  Error: ErrImagePull
</code></pre>

<p>So, how would I reference an image on an internally hosted docker registry in this on-premise scenario?</p>

<p>Is my only option to use a service of type <code>NodePort</code>, reference one of the node's hostname in the <code>Pod</code> spec, and then configure each node's docker daemon to ignore the self signed certificate?</p>

<p>Docker uses DNS settings configured on the Node, and, by default, it does not see DNS names declared in the Kubernetes cluster.</p>

<p>You can try to use one of the following solutions:</p>

<ol>
<li><p>Use the IP address from <code>ClusterIP</code> field in "docker-registry" Service description as docker registry name. This address is static until you recreate the service. Also, you can add this IP address to <code>/etc/hosts</code> on each node.</p>

<p>For example, you can add <code>my-docker-registry 10.11.12.13</code> line to <code>/etc/hosts</code> file. Therefore, you can use <code>10.11.12.13:5000</code> or <code>my-docker-registry:5000</code> as docker registry name for <code>image</code> field in Pods description.</p></li>
<li><p>Expose "docker-registry" Service outside the cluster using <code>type: NodePort</code>. Than use <code>localhost:&lt;exposed_port&gt;</code> or <code>&lt;one_of_nodes_name&gt;:&lt;exposed_port&gt;</code> as docker registry name for <code>image</code> field in Pods description.</p></li>
</ol>
