Answers: <p>I found a solution. The problem is actual for Kubernetes version <code>1.19+</code> and <code>COS</code>/<code>Ubuntu</code> images based on <code>containerd</code> for GKE nodes. Before the 1.19 version Kubernetes used to use <code>Docker</code> for building images, but now it uses <code>containerd</code>. More details could be found in the official <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/using-containerd" rel="nofollow noreferrer">Google Cloud documentation</a>.</p>
  <p>You need to create and put an CA certificate to each GKE node. Here you can find an answer how to do it correctly <a href="https://stackoverflow.com/a/67724696/3319341">https://stackoverflow.com/a/67724696/3319341</a>.</p>
  <p>But for <code>containerd</code> solution you should replace command</p>
  <pre><code>nsenter --target 1 --mount systemctl restart docker
  </code></pre>
  <p>by</p>
  <pre><code>nsenter --target 1 --mount systemctl restart containerd
  </code></pre>
  <p>A more detailed answer: <a href="https://stackoverflow.com/a/67990395/3319341">https://stackoverflow.com/a/67990395/3319341</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-06-15T12:26:53.353Z
Answers: 2021-06-17T05:56:17.380Z
Answers: 2021-06-17T05:56:17.380Z
Answers: Max Koshel
Answers: <p>If your on Standard Mode for your GKE cluster, go into Computer Engine &gt; SSH into every node and put into /etc/docker/certs.d/&lt;ip:port&gt;/ca.cert. Create folder if it does not exists.</p>
  <p>This works for me. The method will not work for Autopilot Mode.</p>
  <p>My exact steps on each node:</p>
  <pre><code>mkdir -p /etc/docker/certs.d/1.2.3.4:5000  
  cd /etc/docker/certs.d/1.2.3.4:5000  
  vi /etc/docker/certs.d/1.2.3.4:5000/ca.crt  
  </code></pre>
  <p>Lastly, create and use the imagepullsecrets in your deployment</p>
  <pre><code>kubectl create secret docker-registry my-secret \ 
  --docker-server=1.2.3.4:5000 \
  --docker-username='testuser' \
  --docker-password='testpassword' \
  --docker-email='test@example.com'
  
  cat &lt;&lt;EOF | kubectl apply -f 
  ...
   spec:  
     containers:  
     - name: hello  
       image: 1.2.3.4:5000/test:7.12.0  
     imagePullSecrets:  
     - name: my-secret   
  EOF
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-06-07T15:12:30.307Z
Answers: 2021-06-08T01:20:30.930Z
Answers: 2021-06-08T01:20:30.930Z
Answers: Ming
Answers: <p>You can now use the DaemonSet to load self-signed CAs when using containerd: <a href="https://github.com/samos123/gke-node-ca-importer" rel="nofollow noreferrer">https://github.com/samos123/gke-node-ca-importer</a></p>
  <p>Credit to @nstogner: <a href="https://github.com/samos123/gke-node-ca-importer/commit/756674ee595e1cf86df4b3181bb3cf687bd72c97" rel="nofollow noreferrer">https://github.com/samos123/gke-node-ca-importer/commit/756674ee595e1cf86df4b3181bb3cf687bd72c97</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2022-01-06T02:12:56.837Z
Answers: 2022-01-06T02:12:56.837Z
Answers: Sam Stoelinga
Body: <p>I generated a CA certificate, then issued a certificate based on it for a private registry, that located in the same GKE cluster. Put the server certificates to the private registry and the CA certificate to all GKE nodes and run:</p>
  <pre><code>update-ca-certificates &amp;&amp; systemctl restart docker
  </code></pre>
  <p>Images are building and putting into the private registry without problems. When a pod tries to pull the an image from the repository I get an error:</p>
  <pre><code>x509: certificate signed by unknown authority
  </code></pre>
  <p>Also I tried to put the CA certificate to the docker <code>certs.d</code> directory (10.3.240.100:3000 — the IP address of the private registry) and restart the docker on each node of the GKE cluster, but it doesn't help, too:</p>
  <pre><code>/etc/docker/certs.d/10.3.240.100:3000/ca.cert
  </code></pre>
  <p>How to solve this problem? Am I understand correctly that the GKE nodes' docker is responsible for pulling images when creating a pod?</p>
  
Tags: <docker><kubernetes><google-cloud-platform><ssl><google-kubernetes-engine>
Title: How to resolve a problem "certificate signed by unknown authority" in GKE on pulling image (a private registry) when a pod is created?
UserDisplayName: Max Koshel
ThreadText: # How to resolve a problem "certificate signed by unknown authority" in GKE on pulling image (a private registry) when a pod is created?
  
  (Asked by: username_0 on 2021-06-02)
  
  I generated a CA certificate, then issued a certificate based on it for a private registry, that located in the same GKE cluster. Put the server certificates to the private registry and the CA certificate to all GKE nodes and run:
  
  ```
  update-ca-certificates && systemctl restart docker
  
  ```
  
  Images are building and putting into the private registry without problems. When a pod tries to pull the an image from the repository I get an error:
  
  ```
  x509: certificate signed by unknown authority
  
  ```
  
  Also I tried to put the CA certificate to the docker `certs.d` directory (10.3.240.100:3000 — the IP address of the private registry) and restart the docker on each node of the GKE cluster, but it doesn't help, too:
  
  ```
  /etc/docker/certs.d/10.3.240.100:3000/ca.cert
  
  ```
  
  How to solve this problem? Am I understand correctly that the GKE nodes' docker is responsible for pulling images when creating a pod?
  
  **Tags:** docker, kubernetes, google-cloud-platform, ssl, google-kubernetes-engine
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2021-06-15. Score: 1 | Accepted answer
  
  I found a solution. The problem is actual for Kubernetes version `1.19+` and `COS`/`Ubuntu` images based on `containerd` for GKE nodes. Before the 1.19 version Kubernetes used to use `Docker` for building images, but now it uses `containerd`. More details could be found in the official [Google Cloud documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/using-containerd).
  
  You need to create and put an CA certificate to each GKE node. Here you can find an answer how to do it correctly <https://stackoverflow.com/a/67724696/3319341>.
  
  But for `containerd` solution you should replace command
  
  ```
  nsenter --target 1 --mount systemctl restart docker
  
  ```
  
  by
  
  ```
  nsenter --target 1 --mount systemctl restart containerd
  
  ```
  
  A more detailed answer: <https://stackoverflow.com/a/67990395/3319341>
  
  
  ---
  
  ### Answer by username_1 on 2021-06-07. Score: 1
  
  If your on Standard Mode for your GKE cluster, go into Computer Engine > SSH into every node and put into /etc/docker/certs.d/<ip:port>/ca.cert. Create folder if it does not exists.
  
  This works for me. The method will not work for Autopilot Mode.
  
  My exact steps on each node:
  
  ```
  mkdir -p /etc/docker/certs.d/1.2.3.4:5000  
  cd /etc/docker/certs.d/1.2.3.4:5000  
  vi /etc/docker/certs.d/1.2.3.4:5000/ca.crt  
  
  ```
  
  Lastly, create and use the imagepullsecrets in your deployment
  
  ```
  kubectl create secret docker-registry my-secret \ 
  --docker-server=1.2.3.4:5000 \
  --docker-username='testuser' \
  --docker-password='testpassword' \
  --docker-email='test@example.com'
  
  cat <<EOF | kubectl apply -f 
  ...
   spec:  
     containers:  
     - name: hello  
       image: 1.2.3.4:5000/test:7.12.0  
     imagePullSecrets:  
     - name: my-secret   
  EOF
  
  ```
  
  
  ---
  
  ### Answer by username_2 on 2022-01-06. Score: 0
  
  You can now use the DaemonSet to load self-signed CAs when using containerd: <https://github.com/samos123/gke-node-ca-importer>
  
  Credit to @nstogner: <https://github.com/samos123/gke-node-ca-importer/commit/756674ee595e1cf86df4b3181bb3cf687bd72c97>
  
  
  ---
  
  