cert-manager & docker-registry unknown authority

[emichaf]

Using cert-manager, docker-registry and NGINX in Kubernetes.

Created CA according to:
https://docs.cert-manager.io/en/latest/tasks/issuers/setup-ca.html

Setting up self signing Issuers according to:
https://docs.cert-manager.io/en/latest/tasks/issuers/setup-selfsigned.html

Certificates issued for my domainname.

Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal CertIssued 1m (x174857 over 19h) cert-manager Certificate issued successfully

Status:
Conditions:
Last Transition Time: 2019-04-30T06:01:19Z
Message: Signing CA verified
Reason: KeyPairVerified
Status: True
Type: Ready

The NGINX ingress annotations for the docker-registry are updated:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/proxy-body-size: "0"
certmanager.k8s.io/issuer: ca-issuer
kubernetes.io/tls-acme: "true"

When trying to access the docker-registry:

from POD within the cluster:
Docker login:

Error response from daemon: Get https://registry.example.com/v1/users/: x509: certificate signed by unknown authority

From my laptop:
Error response from daemon: Get https://registry.example.com/v2/: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"

Any ideas?

[terunoly]

I have the same problem.

Docker login:

Error response from daemon: Get https://registry.example.com/v2/: x509: certificate is valid for ingress.local, not registry.example.com

When you try to search, the following URL:
https://luhaoyuan.com/archives/84

It would have worked if added to args of nginx-ingress-controller, but it remains an error.
extraArgs:
default-ssl-certificate: default/registry.example.com-tls

thank you

[terunoly]

solved.

https://github.com/docker/distribution/issues/1874#issuecomment-237194314

The following settings have been made on the host where Docker is running.

1. Create or modify /etc/docker/daemon.json
   {"insecure-registries": ["registry.example.com"]}
2. Restart docker daemon
   sudo service docker restart

thank you

[retest-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[retest-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale

[retest-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

[jetstack-bot]

@retest-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k-ayache]

I have the same problem.

Docker login:

Error response from daemon: Get https://registry.example.com/v2/: x509: certificate is valid for ingress.local, not registry.example.com

When you try to search, the following URL:
https://luhaoyuan.com/archives/84

It would have worked if added to args of nginx-ingress-controller, but it remains an error.
extraArgs:
default-ssl-certificate: default/registry.example.com-tls

thank you

I've got the same issue, and i don't want to use the --insecure-repositories, did you fix it? if yes how? Thanks