Answers: <p>First of all 404 error is resource error in kubernetes. It means your container in the pod is not created by your first script. Even if it is created and you can see it then your labeling is wrong in the second script. </p>
  
  <p>I would suggest you check matchlabels of both YAML scripts. So in your case I can see that matchlabel is docker-registry in the spec section of the first script, but I don't see any docker-registry in the second script. I believe that in your metadata part of ingress script should have "name = docker-registry" instead of "name=docker-ingress".</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-23T16:04:54.310Z
Answers: 2019-08-23T16:04:54.310Z
Answers: saddique
Body: <p>I try to setup <code>docker-registry</code> in <code>Kubernetes</code> cluster behind the <code>nginx-ingress</code> controller.
  The issue is, when I try to push the image into private registry, it tells me:</p>
  
  <blockquote>
    <p>Get <a href="https://registry.local/v2/" rel="noreferrer">https://registry.local/v2/</a>: x509: certificate is valid for ingress.local, not registry.local</p>
  </blockquote>
  
  <p>When I <code>curl</code> it, I get response from ingress' backend - 404.</p>
  
  <p>Here's ingress' manifest:</p>
  
  <pre><code>kind: Ingress
  apiVersion: extensions/v1beta1
  metadata:
    name: docker-ingress
    annotations:
      kubernetes.io/ingress.class: "nginx"
  spec:
    tls:
    - hosts: [ 'registry.local' ]
    - secretName: registry
    rules:
    - host: registry.local
      http:
        paths:
        - backend:
            serviceName: docker-registry
            servicePort: 5000
          path: /
  </code></pre>
  
  <p>And here's docker-registry manifest:</p>
  
  <pre><code>kind: Deployment
  apiVersion: extensions/v1beta1
  metadata:
    labels:
      app: docker-registry
    name: docker-registry
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: docker-registry
    template:
      metadata:
        labels:
          app: docker-registry
      spec:
        containers:
        - command:
          - /bin/registry
          - serve
          - /etc/docker/registry/config.yml
          env:
          - name: REGISTRY_HTTP_ADDR
            value: 0.0.0.0:5000
          - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
            value: /var/lib/registry
          - name: REGISTRY_HTTP_TLS_CERTIFICATE
            value: /certs/ca.crt
          - name: REGISTRY_HTTP_TLS_KEY
            value: /certs/domain.key
          image: registry:2.6.2
          imagePullPolicy: IfNotPresent
          name: docker-registry
          ports:
          - containerPort: 5000
            name: http
            protocol: TCP
          volumeMounts:
          - mountPath: /var/lib/registry
            name: image-store
          - mountPath: /certs
            name: certs
        volumes:
        - name: image-store
          emptyDir: {}
        - name: certs
          configMap:
            name: certs
  ---
  kind: Service
  apiVersion: v1
  metadata:
    labels:
      app: docker-registry
    name: docker-registry
  spec:
    ports:
    - name: http
      port: 5000
      protocol: TCP
      targetPort: 5000
    selector:
      app: docker-registry
    type: ClusterIP
  </code></pre>
  
  <hr>
  
  <p>Separetly, nginx-ingress and docker-registry, work fine, but don't together.</p>
  
  <p>Nothing valuabe from the ingress controller logs can be found.</p>
  
Comments: CC BY-SA 4.0
Comments: 2018-12-21T13:56:36.047Z
Comments: I know this may seem obvious, but does the certificate actually exist?
Comments: Cyclic3
Comments: CC BY-SA 4.0
Comments: 2018-12-22T14:06:19.153Z
Comments: Thank you, dude, for your response. But they did exist. Otherwise, it wouldn't tell `certificate is valid...`. The only thing about them, they're self-signed.
Comments: acd
Comments: CC BY-SA 4.0
Comments: 2018-12-25T00:49:02.977Z
Comments: @acd `certificate is valid for ingress.local, not registry.local` indicates that the default fake ingress certificate is used. You have to add a valid certificate, i.e. one that matches the FQDN and has been issued by a trusted CA.
Comments: 030
Comments: CC BY-SA 4.0
Comments: 2018-12-26T07:49:58.653Z
Comments: @030
  Thank you for your suggestion, but it's not relevant. Because the cert I've generated (locally) was specifically issued to `registry.local` address. And, as I mentioned above, with that same cert `docker registry`, without `nginx` in front, works fine. And, with that same, another web service works fine behind that same `nginx`. The issue is with `nginx+docker`.
Comments: acd
Tags: <kubernetes><ssl><ingress><docker-registry>
Title: Kubernets docker registry behind nginx-ingress
UserDisplayName: acd
ThreadText: # Kubernets docker registry behind nginx-ingress
  
  (Asked by: username_0 on 2018-07-30)
  
  I try to setup `docker-registry` in `Kubernetes` cluster behind the `nginx-ingress` controller.
  The issue is, when I try to push the image into private registry, it tells me:
  
  > Get <https://registry.local/v2/>: x509: certificate is valid for ingress.local, not registry.local
  
  When I `curl` it, I get response from ingress' backend - 404.
  
  Here's ingress' manifest:
  
  ```
  kind: Ingress
  apiVersion: extensions/v1beta1
  metadata:
    name: docker-ingress
    annotations:
      kubernetes.io/ingress.class: "nginx"
  spec:
    tls:
    - hosts: [ 'registry.local' ]
    - secretName: registry
    rules:
    - host: registry.local
      http:
        paths:
        - backend:
            serviceName: docker-registry
            servicePort: 5000
          path: /
  
  ```
  
  And here's docker-registry manifest:
  
  ```
  kind: Deployment
  apiVersion: extensions/v1beta1
  metadata:
    labels:
      app: docker-registry
    name: docker-registry
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: docker-registry
    template:
      metadata:
        labels:
          app: docker-registry
      spec:
        containers:
        - command:
          - /bin/registry
          - serve
          - /etc/docker/registry/config.yml
          env:
          - name: REGISTRY_HTTP_ADDR
            value: 0.0.0.0:5000
          - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
            value: /var/lib/registry
          - name: REGISTRY_HTTP_TLS_CERTIFICATE
            value: /certs/ca.crt
          - name: REGISTRY_HTTP_TLS_KEY
            value: /certs/domain.key
          image: registry:2.6.2
          imagePullPolicy: IfNotPresent
          name: docker-registry
          ports:
          - containerPort: 5000
            name: http
            protocol: TCP
          volumeMounts:
          - mountPath: /var/lib/registry
            name: image-store
          - mountPath: /certs
            name: certs
        volumes:
        - name: image-store
          emptyDir: {}
        - name: certs
          configMap:
            name: certs
  ---
  kind: Service
  apiVersion: v1
  metadata:
    labels:
      app: docker-registry
    name: docker-registry
  spec:
    ports:
    - name: http
      port: 5000
      protocol: TCP
      targetPort: 5000
    selector:
      app: docker-registry
    type: ClusterIP
  
  ```
  
  ---
  
  Separetly, nginx-ingress and docker-registry, work fine, but don't together.
  
  Nothing valuabe from the ingress controller logs can be found.
  
  **Tags:** kubernetes, ssl, ingress, docker-registry
  
  > **Comments:**
  > **username_1**: I know this may seem obvious, but does the certificate actually exist?  
  > **username_0**: Thank you, dude, for your response. But they did exist. Otherwise, it wouldn't tell `certificate is valid...`. The only thing about them, they're self-signed.  
  > **username_2**: @username_0 `certificate is valid for ingress.local, not registry.local` indicates that the default fake ingress certificate is used. You have to add a valid certificate, i.e. one that matches the FQDN and has been issued by a trusted CA.  
  > **username_0**: @username_2 Thank you for your suggestion, but it's not relevant. Because the cert I've generated (locally) was specifically issued to `registry.local` address. And, as I mentioned above, with that same cert `docker registry`, without `nginx` in front, works fine. And, with that same, another web service works fine behind that same `nginx`. The issue is with `nginx+docker`.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2019-08-23. Score: 2
  
  First of all 404 error is resource error in kubernetes. It means your container in the pod is not created by your first script. Even if it is created and you can see it then your labeling is wrong in the second script.
  
  I would suggest you check matchlabels of both YAML scripts. So in your case I can see that matchlabel is docker-registry in the spec section of the first script, but I don't see any docker-registry in the second script. I believe that in your metadata part of ingress script should have "name = docker-registry" instead of "name=docker-ingress".
  
  
  ---
  
  