<p>I am trying to deploy an image from my private registry (harbor) to my Kubernetes environment. The registry was set up successfully and already contains my image. </p>

<p>To give context this is my deployment file:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    name: sps-app
  name: sps-app
spec:
  replicas: 1
  template:
    metadata:
      labels:
        name: sps-app
    spec:
      containers:
      - image: repo-harbor.test.com/sps_project/spsapp:23
        env:
        - name: MONGODB_URL
          value: "mongodb://mongo.default.svc.cluster.local:27017/user"
        name: sps-app
        ports:
        - containerPort: 4000
          name: sps-app
      imagePullSecrets:
      - name: harbor 
</code></pre>

<p>I already had create my harbor secret using the below command</p>

<pre><code>kubectl create secret docker-registry harbor \
--docker-server=https://repo-harbor.test.com \
--docker-username=admin \
--docker-password='xxxxxx!'
</code></pre>

<p>However, when I do a <code>kubectl apply -f</code> of my deployment, it always goes into an image pull backoff. </p>

<p>Upon further investigation, I checked the logs of the pod and it states there is a x509 certification error. </p>

<p>Kubernetes events:</p>

<pre><code>Events:
  Type     Reason          Age              From                                           Message
  ----     ------          ----             ----                                           -------
  Normal   Scheduled       3m               default-scheduler                              Successfully assigned default/private-image-test-1 to df56bd02-5e0e-4644-a565-c233ac2404fe
  Normal   Pulling         2m (x3 over 3m)  kubelet, df56bd02-5e0e-4644-a565-c233ac2404fe  pulling image "jur01-harbor.acepod.com/sps_project/spsapp:2"
  Warning  Failed          2m (x3 over 3m)  kubelet, df56bd02-5e0e-4644-a565-c233ac2404fe  Failed to pull image "jur01-harbor.acepod.com/sps_project/spsapp:2": rpc error: code = Unknown desc = Error response from daemon: Get https://jur01-harbor.acepod.com/v2/: x509: certificate signed by unknown authority
  Warning  Failed          2m (x3 over 3m)  kubelet, df56bd02-5e0e-4644-a565-c233ac2404fe  Error: ErrImagePull
  Warning  Failed          2m (x4 over 3m)  kubelet, df56bd02-5e0e-4644-a565-c233ac2404fe  Error: ImagePullBackOff
  Normal   SandboxChanged  2m (x7 over 3m)  kubelet, df56bd02-5e0e-4644-a565-c233ac2404fe  Pod sandbox changed, it will be killed and re-created.
  Normal   BackOff         2m (x5 over 3m)  kubelet, df56bd02-5e0e-4644-a565-c233ac2404fe  Back-off pulling image "jur01-harbor.acepod.com/sps_project/spsapp:2"
</code></pre>

<p>At this point, I'm not sure how to resolve this. Would anyone how to resolve this?</p>

<h3>Root cause</h3>

<p>The image registry at <code>jur01-harbor.acepod.com</code> uses a self-signed certificate, which Docker does not trust.</p>

<h3>Solution</h3>

<p>Copy the custom CA certificate presented by that image registry to all your Kubernetes nodes', in a directory called <code>/etc/docker/certs.d/jur01-harbor.acepod.com/</code>.</p>

<p>Reference: <a href="https://docs.docker.com/registry/insecure/#use-self-signed-certificates" rel="nofollow noreferrer">Docker docs / Test an insecure registry</a>.</p>
