<p>I'm running Microk8s on an EC2 instance. I fail to pull containers from our private registry. When trying to run such a container <code>kubectl describe pod</code> shows:</p>

<blockquote>
  <p>Failed to pull image "docker.xxx.com/import:v1": rpc
  error: code = Unknown desc = failed to resolve image
  "docker.xxx.com/import:v1": no available registry
  endpoint: failed to fetch anonymous token: unexpected status: 401
  Unauthorized</p>
</blockquote>

<p>I can <code>docker login</code> and <code>docker pull</code> from that machine. The yaml I used to deploy the container is working fine on another (non containerd) cluster. It refers to a pull secret, which is identical to the one used in the other cluster and working fine there.</p>

<p>I added the following entry to the containerd-template.toml of Microk8s:</p>

<pre><code>   [plugins.cri.registry]
      [plugins.cri.registry.mirrors]
        ...
        [plugins.cri.registry.mirrors."docker.xxx.com"]
          endpoint = ["https://docker.xxx.com"]
</code></pre>

<p>I have no idea what else I might be missing.</p>

Achim
<p>If you are getting an error <code>401</code> probably something is wrong with the authentication. E.g. you are missing credentials to your private registry. </p>

<p>To make sure that microk8s would use proper credentials, in addition of <code>mirrors</code> sections within the configuration you have to specify <code>auths</code> section where you would put your docker registry credentials.</p>

<pre><code>[plugins.cri.registry.auths]
  [plugins.cri.registry.auths."https://gcr.io"]
    username = ""
    password = ""
    auth = ""
    identitytoken = ""
</code></pre>

<p>Attributes within that section are compatible with configuration which you can find in your <code>.docker/config.json</code>.</p>

<p>Notice that this is section on the same level as <code>mirrors</code> it should not be part of <code>mirrors</code> entry but added as new section. 
Another important part is to make sure that the <code>auth</code> hosts match yours registry host (e.g. https vs http). </p>

<p>For more details check reference: <a href="https://github.com/containerd/cri/blob/master/docs/registry.md" rel="nofollow noreferrer">https://github.com/containerd/cri/blob/master/docs/registry.md</a></p>

<p>p.s. Keep in mind that <code>containerd</code> is supported from microk8s[1] <code>v1.14</code> if you use older version you should check other options like official kubernates documentation[2]</p>

<p>[1] <a href="https://microk8s.io/docs/working" rel="nofollow noreferrer">https://microk8s.io/docs/working</a></p>

<p>[2] <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/</a> </p>
