<p>I'm trying to pull some container in my private gitlab registry but when I try I get the following error:</p>
<pre><code>Failed to pull image &quot;registry.mygitlab.com/name/container-backend:nginx&quot;: rpc error: code = Unknown desc = Error response from daemon: Get https://registry.mygitlab.com/v2/: x509: certificate is valid for ingress.local, not registry.mygitlab.com
</code></pre>
<p>In the deployment.yml I've added:</p>
<pre><code>imagePullSecrets:
- name: registry-secret
</code></pre>
<p>and the <code>registry-secret</code> has been created with:</p>
<pre><code>kubectl create \
—namespace=myns \
secret docker-registry registry2-secret \
--docker-server=registry.mygitlab.com \
--docker-username=myname \
--docker-password=mypassword
</code></pre>
<p>One month ago it worked and now it doesnt anymore.. and the credentials are correct :/</p>

<p>Problem lays in TLS certificate on the server, not the login credential on the client.
Check if you have following record in  <code>daemon.json</code> file:</p>
<pre><code>&quot;insecure-registries&quot; : [&quot;registry.mygitlab.com&quot;]

</code></pre>
<p>&quot;Also depending of the registries you are accessing, you may have to perform a &quot;<code>kubectl create secret docker-registry ...</code>&quot; action as explained  <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">here</a>.
To create secret you should execute command:</p>
<pre><code>$ kubectl create secret docker-registry registry-secret --docker-server=registry.gitlab.com --docker-username=&lt;username&gt; --docker-password=&lt;password&gt; --docker-email=&lt;email
</code></pre>
<p>In <code>deployment.yaml</code> file you have used
secret named  <code>registry-secret</code> not
<code>registry2-secret</code> as you have used in command while creating secret -you had created wrong named secret.</p>
<p>Finally, you may have to define the certificate to  <code>docker</code>  by creating a new directory in  <code>/etc/docker/certs.d</code>  containing the certificates as explained  <a href="https://docs.docker.com/engine/security/certificates/" rel="nofollow noreferrer">here</a>.</p>
<p>Take a look: <a href="https://stackoverflow.com/questions/48611756/kubelet-failed-to-pull-image-x509-certificate-signed-by-unknown-authority">x509-certificate-signed-by-unknown-authority</a>, <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-that-holds-your-authorization-token" rel="nofollow noreferrer">create-a-secret-that-holds-your-authorization-token</a>.</p>
<p>Also take a look: <a href="https://docs.gitlab.com/runner/configuration/tls-self-signed.html" rel="nofollow noreferrer">gitlab-tls</a>.</p>
