Answers: <p>I just got this working with Harbor Version v2.10.0-6abb4eab using <code>mirror</code> and a tweaked URL instead of trying to rewrite image names on the fly:</p>
  <ol>
  <li>Follow the docs at <a href="https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/" rel="nofollow noreferrer">https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/</a> to create a project called <code>proxy_cache</code>, setup security or make the mirror public</li>
  <li>If using your own CA copy the <code>pem</code> file somewhere on each k3s node</li>
  <li><code>registries.yaml</code> should look something like this. I have robot user and my own CA.</li>
  </ol>
  <pre class="lang-yaml prettyprint-override"><code>mirrors:
    docker.io:
      endpoint:
        - &quot;https://harbor.example.com/v2/proxy_cache&quot;
  configs:
    &quot;harbor.example.com&quot;:
      auth:
        username: &quot;robot$k3s&quot; # this is the registry username
        password: &quot;thisisaverysecurepasswordtoaccesspublicfiles&quot; # this is the registry password
      tls:
        # cert_file: # path to the cert file used in the registry (mTLS)
        # key_file:  # path to the key file used in the registry (mTLS)
        ca_file: &quot;/etc/rancher/k3s/ca.pem&quot;  # path to the ca file used in the registry (if using TLS)
  </code></pre>
  <ol start="4">
  <li>Restart k3s</li>
  <li>Reference images as normal, eg</li>
  </ol>
  <pre class="lang-yaml prettyprint-override"><code>      containers:
        - image: docker.io/kong/httpbin:0.1.0
  </code></pre>
  <p>or</p>
  <pre class="lang-yaml prettyprint-override"><code>      containers:
        - image: kong/httpbin:0.1.0
  </code></pre>
  <p>I automated the copying the CA and the registry.yaml to my k3s servers with some ansibles like this:</p>
  <pre class="lang-yaml prettyprint-override"><code>- name: registries
    hosts: server
    become: true
    become_user: root
    tasks:
    - name: registries.yaml
      ansible.builtin.copy:
        src: registries.yaml 
        dest: /etc/rancher/k3s/registries.yaml
        owner: root
        group: root
        mode: '0600'
  
    - name: ca.pem
      ansible.builtin.copy:
        src: ~/ca/ca.pem
        dest: /etc/rancher/k3s/ca.pem
        owner: root
        group: root
        mode: '0600'
  
    - name: k3s
      ansible.builtin.systemd_service:
        state: restarted
        name: k3s
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-10-22T19:34:49.670Z
Answers: this is the only answer that works. I lost a whole afternoon searching how to use my harbor proxy repositories in rancher, and use endpoint like this, works like a charm. thanks!!
Answers: Kross
Answers: CC BY-SA 4.0
Answers: 2024-02-04T11:18:10.787Z
Answers: 2024-02-04T17:24:41.707Z
Answers: 2024-02-04T17:24:41.707Z
Answers: Geoff Williams
Body: <p>I have configured a <strong><a href="https://goharbor.io" rel="nofollow noreferrer">Harbor</a></strong> (with SSL and FQDN: harbor.example.com) as a <em>proxy cache</em> for several docker registries (docker.io, quay.io and k8s.gcr.io). I can pull any images without any problem from any PC/VM which can access the Harbor netowrk, i.e.:</p>
  <pre><code># From hub.docker.com
  docker pull harbor.example.com/dockerhub/library/ubuntu:20.04
  # From quay.com
  docker pull harbor.example.com/q/metallb/speaker:v0.12.1
  # From k8s.gcr.com
  docker pull harbor.example.com/g/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
  </code></pre>
  <p>I want to use this Harbor to, from a local <strong>k3s</strong> cluster (which was an airgap installation) and its only way to pull images is using the previously mentioned <strong>Harbor</strong> registry (because it has no way to reach the internet), pull images from every docker proxy cache created with, for example, and following the lasts examples:</p>
  <pre><code>k3s crictl pull ubuntu:20.04
  k3s crictl pull quay.io/metallb/controller:v0.12.1
  k3s crictl pull k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
  </code></pre>
  <p>In order to get it done, and following the instructions from the <a href="https://docs.rke2.io/install/containerd_registry_configuration/" rel="nofollow noreferrer">rke2 official docx</a>, I'm trying to modify the <code>/etc/rancher/k3s/registries.yaml</code> to rewrite the link , i.e., from <strong>docker.io</strong> to <em>harbor.example.com/dockerhub</em>, and/or from <strong>quay.io</strong> to <em>harbor.example.com/q</em> and or <strong>k8s.grc.io</strong> to <em>harbor.example.com/g</em> but I can't find a way to achieve correctly... I guess it should be something like the folowing (but for every Harbor's cache proxy):</p>
  <pre><code>mirrors:
    quay.io:
      endpoint:
        - &quot;https://harbor.virtalus.com&quot;
      rewrite:
        &quot;\/(.*)&quot;: &quot;q/$1&quot;
  </code></pre>
  <p><strong>So the question is: how to properly configure containerd's <code>registries.yaml</code> to point it to several <strong>Harbor</strong>'s proxy cache?</strong></p>
  
Comments: CC BY-SA 4.0
Comments: 2023-09-23T10:40:29.263Z
Comments: Were you able to solve this?
Comments: Kartik Shah
Tags: <kubernetes><docker-registry><registry><containerd>
Title: How to configure registries.yaml to point to several Harbor proxy cache registry?
UserDisplayName: k.Cyborg
ThreadText: # How to configure registries.yaml to point to several Harbor proxy cache registry?
  
  (Asked by: username_0 on 2022-04-25)
  
  I have configured a **[Harbor](https://goharbor.io)** (with SSL and FQDN: harbor.example.com) as a *proxy cache* for several docker registries (docker.io, quay.io and k8s.gcr.io). I can pull any images without any problem from any PC/VM which can access the Harbor netowrk, i.e.:
  
  ```
  # From hub.docker.com
  docker pull harbor.example.com/dockerhub/library/ubuntu:20.04
  # From quay.com
  docker pull harbor.example.com/q/metallb/speaker:v0.12.1
  # From k8s.gcr.com
  docker pull harbor.example.com/g/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
  
  ```
  
  I want to use this Harbor to, from a local **k3s** cluster (which was an airgap installation) and its only way to pull images is using the previously mentioned **Harbor** registry (because it has no way to reach the internet), pull images from every docker proxy cache created with, for example, and following the lasts examples:
  
  ```
  k3s crictl pull ubuntu:20.04
  k3s crictl pull quay.io/metallb/controller:v0.12.1
  k3s crictl pull k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
  
  ```
  
  In order to get it done, and following the instructions from the [rke2 official docx](https://docs.rke2.io/install/containerd_registry_configuration/), I'm trying to modify the `/etc/rancher/k3s/registries.yaml` to rewrite the link , i.e., from **docker.io** to *harbor.example.com/dockerhub*, and/or from **quay.io** to *harbor.example.com/q* and or **k8s.grc.io** to *harbor.example.com/g* but I can't find a way to achieve correctly... I guess it should be something like the folowing (but for every Harbor's cache proxy):
  
  ```
  mirrors:
    quay.io:
      endpoint:
        - "https://harbor.virtalus.com"
      rewrite:
        "\/(.*)": "q/$1"
  
  ```
  
  **So the question is: how to properly configure containerd's `registries.yaml` to point it to several **Harbor**'s proxy cache?**
  
  **Tags:** kubernetes, docker-registry, registry, containerd
  
  > **Comments:**
  > **username_1**: Were you able to solve this?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2024-02-04. Score: 1
  
  I just got this working with Harbor Version v2.10.0-6abb4eab using `mirror` and a tweaked URL instead of trying to rewrite image names on the fly:
  
  1. Follow the docs at <https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/> to create a project called `proxy_cache`, setup security or make the mirror public
  2. If using your own CA copy the `pem` file somewhere on each k3s node
  3. `registries.yaml` should look something like this. I have robot user and my own CA.
  
  ```yaml
  mirrors:
    docker.io:
      endpoint:
        - "https://harbor.example.com/v2/proxy_cache"
  configs:
    "harbor.example.com":
      auth:
        username: "robot$k3s" # this is the registry username
        password: "thisisaverysecurepasswordtoaccesspublicfiles" # this is the registry password
      tls:
        # cert_file: # path to the cert file used in the registry (mTLS)
        # key_file:  # path to the key file used in the registry (mTLS)
        ca_file: "/etc/rancher/k3s/ca.pem"  # path to the ca file used in the registry (if using TLS)
  
  ```
  
  4. Restart k3s
  5. Reference images as normal, eg
  
  ```yaml
        containers:
        - image: docker.io/kong/httpbin:0.1.0
  
  ```
  
  or
  
  ```yaml
        containers:
        - image: kong/httpbin:0.1.0
  
  ```
  
  I automated the copying the CA and the registry.yaml to my k3s servers with some ansibles like this:
  
  ```yaml
  - name: registries
    hosts: server
    become: true
    become_user: root
    tasks:
    - name: registries.yaml
      ansible.builtin.copy:
        src: registries.yaml 
        dest: /etc/rancher/k3s/registries.yaml
        owner: root
        group: root
        mode: '0600'
  
    - name: ca.pem
      ansible.builtin.copy:
        src: ~/ca/ca.pem
        dest: /etc/rancher/k3s/ca.pem
        owner: root
        group: root
        mode: '0600'
  
    - name: k3s
      ansible.builtin.systemd_service:
        state: restarted
        name: k3s
  
  ```
  
  > **Comments:**
  > **username_3**: this is the only answer that works. I lost a whole afternoon searching how to use my harbor proxy repositories in rancher, and use endpoint like this, works like a charm. thanks!!  
  
  ---
  
  