<p>I have a k3s cluster with calico pods <code>calico-node-xxx</code> &amp; <code>calico-kube-controllers-xxx</code> running in kube-system namespace. I am using <a href="https://docs.projectcalico.org/manifests/calico.yaml" rel="nofollow noreferrer">calico.yaml</a> config in my project.</p>
<p>Now, I want these images in calico.yaml to be pulled from my ACR repo instead of <code>docker.io</code> repo.  So I tagged &amp; pushed these images in my ACR repo and changed the images path in calico manifest yaml file (for e.g. <code>myacrrepo.io/calico/node:v3.17.1</code> ), so that pods can pull image from ACR repo.</p>
<p>But where should I mention credentials of ACR repo in calico manifest file, as without credential (username/password/hostname) the pod is failing with error <code>x509: certificate signed by unknown authority</code>.</p>
<p>Can someone let me know that where in <a href="https://docs.projectcalico.org/manifests/calico.yaml" rel="nofollow noreferrer">calico.yaml</a>, ACR repo credential shall I add (and what is the syntax for providing credential in <code>calico.yaml</code> because for dockr.io images no credentials are mentioned in <code>calico.yaml</code> which I can replace with my ACR repo credentials) ?</p>

Thor
<p>If you want to use a private container registry then you have to create an imagePullSecret. Microsoft explained <a href="https://learn.microsoft.com/en-us/azure/container-registry/container-registry-auth-kubernetes" rel="nofollow noreferrer">here</a> on how to do that for ACR.</p>
<p>Once you have created the imagePullSecret add it to the <code>pod spec</code> as outlined the section 'Use the image pull secret' of the documenation.</p>
<p>This imagePullSecret is not necessary for docker.io, since docker.io is a public registry and imagePullSecrets are only needed for private registries.</p>
