<p>I want to deploy a pod using a Docker image which has been pushed to a private registry.</p>
<p>So far, I've used the following command to install the registry and push the image:</p>
<pre><code># Build the DockerImage file
DOCKER_IMAGE=&quot;truc/tf-http-server:0.1&quot;
cd docker
docker build -t $DOCKER_IMAGE .
cd ..

# Install Registry V2
docker run -d -p 5000:5000 --restart=always --name registry registry:2

# Push image
docker tag $DOCKER_IMAGE localhost:5000/$DOCKER_IMAGE
docker push localhost:5000/$DOCKER_IMAGE

# Add to known repository
sudo bash -c 'cat &lt;&lt; EOF &gt; /etc/docker/daemon.json
{
  &quot;insecure-registries&quot; : [ &quot;192.168.1.37:5000&quot; ]
}
EOF'
sudo systemctl daemon-reload
sudo systemctl restart docker
</code></pre>
<p>Pulling the image works directly from Docker:</p>
<pre><code>$ sudo docker pull 192.168.1.37:5000/truc/tf-http-server:0.1
0.1: Pulling from truc/tf-http-server
Digest: sha256:b09c10375f1e90346f9b0c4bfb2bdfc7df919a4c89aaebfb433f2d845b37a960
Status: Downloaded newer image for 192.168.1.37:5000/truc/tf-http-server:0.1
192.168.1.37:5000/truc/tf-http-server:0.1
</code></pre>
<p>When I want to deploy the image from Kubernetes, I got the following error:</p>
<pre><code>Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  29s                default-scheduler  Successfully assigned default/tf-http-server-nvl9v to worker01
  Normal   Pulling    16s (x2 over 29s)  kubelet            Pulling image &quot;192.168.1.37:5000/truc/tf-http-server:0.1&quot;
  Warning  Failed     16s (x2 over 29s)  kubelet            Failed to pull image &quot;192.168.1.37:5000/truc/tf-http-server:0.1&quot;: rpc error: code = Unknown desc = failed to pull and unpack image &quot;192.168.1.37:5000/truc/tf-http-server:0.1&quot;: failed to resolve reference &quot;192.168.1.37:5000/truc/tf-http-server:0.1&quot;: failed to do request: Head &quot;https://192.168.1.37:5000/v2/truc/tf-http-server/manifests/0.1&quot;: http: server gave HTTP response to HTTPS client
  Warning  Failed     16s (x2 over 29s)  kubelet            Error: ErrImagePull
  Normal   BackOff    3s (x2 over 28s)   kubelet            Back-off pulling image &quot;192.168.1.37:5000/truc/tf-http-server:0.1&quot;
  Warning  Failed     3s (x2 over 28s)   kubelet            Error: ImagePullBackOff
</code></pre>
<p>It seems like if the repository access was forbidden. Is there a way to make it reachable from Kubernetes ?</p>
<p>EDIT: To install Docker registy, run the following commands and follow the checked answer.</p>
<pre><code>mkdir registry &amp;&amp; cd registry &amp;&amp; mkdir certs &amp;&amp; cd certs
openssl genrsa 1024 &gt; domain.key
chmod 400 domain.key
openssl req -new -x509 -nodes -sha1 -days 365 -key domain.key -out domain.crt -subj &quot;/C=FR/ST=France/L=Lannion/O=TGI/CN=OrangeFactoryBox&quot;
cd .. &amp;&amp; mkdir auth
sudo apt-get install apache2-utils -y
htpasswd -Bbn username password &gt; auth/htpasswd
cd ..
docker run -d \
  --restart=always \
  --name registry \
  -v `pwd`/auth:/auth \
  -v `pwd`/certs:/certs \
  -v `pwd`/certs:/certs \
  -e REGISTRY_AUTH=htpasswd \
  -e REGISTRY_AUTH_HTPASSWD_REALM=&quot;Registry Realm&quot; \
  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  -p 5000:5000 \
  registry:2
sudo docker login -u username -p password localhost:5000
</code></pre>

Manitoba
<blockquote>
<p>Assumption: The docker server where you tested it and the kubernetes
nodes are on the same private subnet 192.168.1.0/24</p>
</blockquote>
<blockquote>
<p>http: server gave HTTP response to HTTPS client</p>
</blockquote>
<p>So, apparently your private docker registry is HTTP not HTTPS. Kuberentes prefers the registry to use a valid SSL certificate. On each node in your kubernetes cluster, you will need to explicitly tell the docker to treat this registry as an insecure registry. Following this change you will have to restart the docker service as well.</p>
<p>Kubernetes: Failed to pull image. Server gave HTTP response to HTTPS client.</p>
<pre><code>{ &quot;insecure-registries&quot;:[&quot;192.168.1.37:5000&quot;] }
to the daemon.json file at /etc/docker.
</code></pre>
<p>You will also need to define the imagePullSecrets in your namespace and use it in your deployment/pod spec</p>
<p>First create the secret from your &lt;path/to/.docker/config.json&gt; using:</p>
<pre><code>kubectl create secret generic regcred \
    --from-file=.dockerconfigjson=&lt;path/to/.docker/config.json&gt; \
    --type=kubernetes.io/dockerconfigjson
</code></pre>
<p>Then refer to this secret in your pod yaml</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: &lt;your-private-image&gt;
  imagePullSecrets:
  - name: regcred
</code></pre>
<p>Reference: <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a></p>
