<p>I would like to use <strong>microk8s</strong> with <strong>private registry</strong>, but pull image is not working (I'm using self-signed cert):</p>
<pre><code>root@master-1:/var/snap/microk8s/common/var/lib/containerd# microk8s.ctr --debug images pull priv.repo:5000/busybox/hellomicrok8s:latest
DEBU[0000] fetching                                      image=&quot;priv.repo:5000/busybox/hellomicrok8s:latest&quot;
DEBU[0000] resolving                                     host=&quot;priv.repo:5000&quot;
DEBU[0000] do request                                    host=&quot;priv.repo:5000&quot; request.header.accept=&quot;application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*&quot; request.header.user-agent=containerd/v1.3.4 request.method=HEAD url=&quot;https://priv.repo:5000/v2/busybox/hellomicrok8s/manifests/latest&quot;
ctr: failed to resolve reference &quot;priv.repo:5000/busybox/hellomicrok8s:latest&quot;: failed to do request: Head &quot;https://priv.repo:5000/v2/busybox/hellomicrok8s/manifests/latest&quot;: x509: certificate signed by unknown authority
</code></pre>
<p>here is my containerd-template.tom:</p>
<pre><code>root@master-1:/var/snap/microk8s/common/var/lib/containerd# cat /var/snap/microk8s/current/args/containerd-template.toml
version = 2
oom_score = 0

[grpc]
  uid = 0
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216

[debug]
  address = &quot;&quot;
  uid = 0
  gid = 0

[metrics]
  address = &quot;127.0.0.1:1338&quot;
  grpc_histogram = false

[cgroup]
  path = &quot;&quot;

[plugins.&quot;io.containerd.grpc.v1.cri&quot;]

  stream_server_address = &quot;127.0.0.1&quot;
  stream_server_port = &quot;0&quot;
  enable_selinux = false
  sandbox_image = &quot;k8s.gcr.io/pause:3.1&quot;
  stats_collect_period = 10
  enable_tls_streaming = false
  max_container_log_line_size = 16384

  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd]
    snapshotter = &quot;${SNAPSHOTTER}&quot;
    no_pivot = false
    default_runtime_name = &quot;${RUNTIME}&quot;

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes.runc]
      runtime_type = &quot;io.containerd.runc.v1&quot;

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes.nvidia-container-runtime]
      runtime_type = &quot;io.containerd.runc.v1&quot;

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.containerd.runtimes.nvidia-container-runtime.options]
        BinaryName = &quot;nvidia-container-runtime&quot;

  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.cni]
    bin_dir = &quot;${SNAP}/opt/cni/bin&quot;
    conf_dir = &quot;${SNAP_DATA}/args/cni-network&quot;

  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]

    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]
      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;docker.io&quot;]
        endpoint = [&quot;https://registry-1.docker.io&quot;, ]
      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;priv.repo:5000&quot;]
        endpoint = [&quot;https://priv.repo:5000&quot;]
</code></pre>
<p>I restarted microk8s via <code>systemctl restart snap.microk8s.daemon-containerd.service &amp;&amp; microk8s.stop &amp;&amp; microk8s.start</code>.
Command <code>docker login docker https://priv.repo:5000</code> is working and I can pull that image via <code>docker pull priv.repo:5000/busybox/hellomicrok8s:latest</code>. Do you know why it is not working?</p>
<p>Thanks in advance!</p>
<p><strong>EDIT</strong>:</p>
<p>This is also set:</p>
<pre><code>root@master-1:/var/snap/microk8s/common/var/lib/containerd# cat /etc/docker/daemon.json
{
    &quot;insecure-registries&quot; : [&quot;priv.repo:5000&quot;]
}
</code></pre>
<p><strong>EDIT1:</strong></p>
<p>This is working: <code>microk8s.ctr --debug images pull -u ???:??? --skip-verify priv.repo:5000/busybox/hellomicrok8s:latest</code>. How should I set --skip-verify, because when I create a pod via <code>microk8s kubectl apply -f ...</code> still getting <code>x509: certificate signed by unknown authority</code>.</p>

Zili
<p>I added my crt file to <code>/etc/ssl/certs</code> (on master node) and it started working.</p>
<p>BTW newly added rows in containerd-template.tom file are not needed for me.</p>
