<p>I have setup a private registry (Kubernetes) using the following configuration based on this repo <a href="https://github.com/sleighzy/k8s-docker-registry" rel="nofollow noreferrer">https://github.com/sleighzy/k8s-docker-registry</a>:</p>
<p>Create the password file, see the Apache htpasswd documentation for more information on this command.</p>
<pre><code>htpasswd -b -c -B htpasswd docker-registry registry-password!
Adding password for user docker-registry
</code></pre>
<p>Create namespace</p>
<pre><code>kubectl create namespace registry
</code></pre>
<p>Add the generated password file as a Kubernetes secret.</p>
<pre><code>kubectl create secret generic basic-auth --from-file=./htpasswd -n registry
secret/basic-auth created
</code></pre>
<p><em>registry-secrets.yaml</em></p>
<pre><code>---
# https://kubernetes.io/docs/concepts/configuration/secret/
apiVersion: v1
kind: Secret
metadata:
  name: s3
  namespace: registry
data:
  REGISTRY_STORAGE_S3_ACCESSKEY: Y2hlc0FjY2Vzc2tleU1pbmlv
  REGISTRY_STORAGE_S3_SECRETKEY: Y2hlc1NlY3JldGtleQ==
</code></pre>
<p><em>registry-service.yaml</em></p>
<pre><code>---
apiVersion: v1
kind: Service
metadata:
  name: registry
  namespace: registry

spec:
  ports:
    - protocol: TCP
      name: registry
      port: 5000
  selector:
    app: registry
</code></pre>
<p>I am using my MinIO (already deployed and running)</p>
<p><em>registry-deployment.yaml</em></p>
<pre><code>---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: registry
  name: registry
  labels:
    app: registry
spec:
  replicas: 1
  selector:
    matchLabels:
      app: registry
  template:
    metadata:
      labels:
        app: registry
    spec:
      containers:
        - name: registry
          image: registry:2
          ports:
            - name: registry
              containerPort: 5000
          volumeMounts:
            - name: credentials
              mountPath: /auth
              readOnly: true
          env:
            - name: REGISTRY_LOG_ACCESSLOG_DISABLED
              value: &quot;true&quot;
            - name: REGISTRY_HTTP_HOST
              value: &quot;https://registry.mydomain.io:5000&quot;
            - name: REGISTRY_LOG_LEVEL
              value: info
            - name: REGISTRY_HTTP_SECRET
              value: registry-http-secret
            - name: REGISTRY_AUTH_HTPASSWD_REALM
              value: homelab
            - name: REGISTRY_AUTH_HTPASSWD_PATH
              value: /auth/htpasswd
            - name: REGISTRY_STORAGE
              value: s3
            - name: REGISTRY_STORAGE_S3_REGION
              value: ignored-cos-minio
            - name: REGISTRY_STORAGE_S3_REGIONENDPOINT
              value: charity.api.com -&gt; This is the valid MinIO API
            - name: REGISTRY_STORAGE_S3_BUCKET
              value: &quot;charitybucket&quot; 
            - name: REGISTRY_STORAGE_DELETE_ENABLED
              value: &quot;true&quot;
            - name: REGISTRY_HEALTH_STORAGEDRIVER_ENABLED
              value: &quot;false&quot;
            - name: REGISTRY_STORAGE_S3_ACCESSKEY
              valueFrom:
                secretKeyRef:
                  name: s3
                  key: REGISTRY_STORAGE_S3_ACCESSKEY
            - name: REGISTRY_STORAGE_S3_SECRETKEY
              valueFrom:
                secretKeyRef:
                  name: s3
                  key: REGISTRY_STORAGE_S3_SECRETKEY
      volumes:
        - name: credentials
          secret:
            secretName: basic-auth
</code></pre>
<p>I have created an entry in /etc/hosts</p>
<blockquote>
<p>192.168.xx.xx   registry.mydomain.io</p>
</blockquote>
<p><em>registry-IngressRoute.yaml</em></p>
<pre><code>---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: registry
  namespace: registry
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`registry.mydomain.io`)
    kind: Rule
    services:
      - name: registry
        port: 5000
  tls:
    certResolver: tlsresolver
</code></pre>
<p>I have accees to the private registry using <code>http://registry.mydomain.io:5000/</code> and it obviously returns a blank page.</p>
<p>I have already pushed some images and <code>http://registry.mydomain.io:5000/v2/_catalog</code> returns:</p>
<blockquote>
<p>{&quot;repositories&quot;:[&quot;console-image&quot;,&quot;hello-world&quot;,&quot;hello-world-2&quot;,&quot;hello-world-ha&quot;,&quot;myfirstimage&quot;,&quot;ubuntu-my&quot;]}</p>
</blockquote>
<p>Above configuration seems to work.</p>
<p>Then I tried to add a registry-ui provide by joxit with the following configuration:</p>
<p><em>registry-ui-service.yaml</em></p>
<pre><code>---
apiVersion: v1
kind: Service
metadata:
  name: registry-ui
  namespace: registry

spec:
  ports:
    - protocol: TCP
      name: registry-ui
      port: 80
  selector:
    app: registry-ui
</code></pre>
<p><em>registry-ui-deployment.yaml</em></p>
<pre><code>---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: registry
  name: registry-ui
  labels:
    app: registry-ui
spec:
  replicas: 1
  selector:
    matchLabels:
      app: registry-ui
  template:
    metadata:
      labels:
        app: registry-ui
    spec:
      containers:
        - name: registry-ui
          image: joxit/docker-registry-ui:1.5-static
          ports:
            - name: registry-ui
              containerPort: 80
          env:
            - name: REGISTRY_URL
              value: https://registry.mydomain.io
            - name: SINGLE_REGISTRY
              value: &quot;true&quot;
            - name: REGISTRY_TITLE
              value: &quot;CHARITY Registry UI&quot;
            - name: DELETE_IMAGES
              value: &quot;true&quot;
</code></pre>
<p><em>registry-ui-ingress-route.yaml</em></p>
<pre><code>---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: registry-ui
  namespace: registry
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`registry.mydomain.io`) &amp;&amp; PathPrefix(`/ui/`)
    kind: Rule
    services:
      - name: registry-ui
        port: 80
    middlewares:
      - name: stripprefix
  tls:
    certResolver: tlsresolver
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: registry
spec:
  stripPrefix:
    prefixes:
      - /ui/
</code></pre>
<p>I have access to the browser ui at <code>https://registry.mydomain.io/ui/</code>, however it returns nothing.</p>
<p>Am I missing something here?</p>

e7lT2P
<p>As the owner of that repository there may be something missing here. Your <code>IngressRoute</code> rule has an <code>entryPoint</code> of <code>websecure</code> and <code>certResolver</code> of <code>tlsresolver</code>. This is intended to be the https entrypoint for Traefik, see my other repository <a href="https://github.com/sleighzy/k3s-traefik-v2-kubernetes-crd" rel="nofollow noreferrer">https://github.com/sleighzy/k3s-traefik-v2-kubernetes-crd</a> and associated Traefik document of which this Docker Registry repo is based on.</p>
<p>Can you review your Traefik deployment to ensure that you have this entrypoint, and you also have this certificate resolver along with a generated https certificate that this is using. Can you also check the traefik logs to see if there are any errors there during startup, e.g. missing certs etc. and any access log information in there as well which may indicate why this is not routing to there.</p>
<p>If you don't have these items setup you could help narrow this down further by changing this <code>IngressRoute</code> config to use just the <code>web</code> entrypoint and remove the <code>tls</code> section as well in your <code>registry-ui-ingress-route.yaml</code> manifest file and then reapply that. This will mean you can access this over http to at least rule out any https issues.</p>
