DIUN on K8S Cluster with private registry
reddit / selfhosted

----------------------------------------------------------------------
neulon · 2023-12-16 10:21

Hello,

I'm trying to make DIUN check over a private registry but I'm getting
stuck with the TLS validation.

I didn't went to the way of inject the certificate (maybe is the
correct way also here?) but rather skipping the TLS validation for an
specific registry.

my deployment contains the following env:

                - name: DIUN_REGISTRY_0_NAME
                  value: registry.local.domain
                - name: DIUN_REGISTRY_0_TLS_INSECURE_SKIP_VERIFY
                  value: "true"

However when checking the image I do still get the TLS error:

    cannot get image digest from HEAD request: pinging container
registry registry.akula.lab: Get
\"https://registry.local.domain/v2/\": tls: failed to verify
certificate: x509: certificate signed by unknown authority

Someone have this implementation done to see what I could be missing?

----------------------------------------------------------------------
ElevenNotes · 2023-12-16 10:30

A valid TLS cert. Put your private registry behind a reverse proxy and
terminate there with a valid TLS cert.

----------------------------------------------------------------------
thekrautboy · 2023-12-16 11:22

https://crazymax.dev/diun/config/regopts/?h=insecure#insecuretls

----------------------------------------------------------------------
neulon · 2023-12-16 11:24

I went over the official documentation and already implemented the ENV
in the deployment - posted in the initial post.

However I do still get the error related to TLS

----------------------------------------------------------------------
neulon · 2023-12-16 11:27

It's a internal certificate signed by non public root ca but our
internal root ca.

The implementation of the registry is already as you stated, SSL
termination is done at the reverse proxy, but since certificate is not
trusted by Diun simply fail.

----------------------------------------------------------------------
thekrautboy · 2023-12-16 11:28

Your post:

> DIUN_REGISTRY_0_TLS_INSECURE_SKIP_VERIFY

Documentation:

> DIUN_REGOPTS__INSECURETLS

----------------------------------------------------------------------
neulon · 2023-12-16 11:35

Oh sorry, you're right.
I did multiple attempts with other ENVs while troubleshooting. In fact
I tried also

            - name: DIUN_REGOPTS_Local_NAME
              value: registry.local.domain
            - name: DIUN_REGOPTS_Local_INSECURETLS
              value: "true"
    -------------
            - name: DIUN_REGOPTS_0_NAME
              value: registry.local.domain
            - name: DIUN_REGOPTS_0_INSECURETLS
              value: "true"

----------------------------------------------------------------------
ElevenNotes · 2023-12-16 11:35

Get a valid cert, not an internal one or make a PR on the DIUN repo to
add insecure certificates which something that pulls images IMHO
should not do.

----------------------------------------------------------------------
thekrautboy · 2023-12-16 11:47

https://github.com/crazy-max/diun/discussions

----------------------------------------------------------------------
cac2573 · 2023-12-16 15:27

Are you pointing diun at the internal k8s service or at the ingress
endpoint of the registry?

----------------------------------------------------------------------
neulon · 2023-12-16 19:31

It's pointing to our internal reverse proxy, due its restricted
registry because business requirements cannot be public and either
external pki unfortunately

----------------------------------------------------------------------
onedr0p · 2023-12-17 12:46

Why don't you check your manifests into Git and then hook up renovate
to your repo? This way you'll get pull requests for containers, helm
chart, kustomize, etc.. updates

----------------------------------------------------------------------
cac2573 · 2023-12-17 18:38

sorry that's not what I meant. I meant are you using the k8s-internal
service name or the "public" (external) ingress