# Create and use a private insecure registry inside k8s cluster

**URL:** <https://discuss.kubernetes.io/t/create-and-use-a-private-insecure-registry-inside-k8s-cluster/9338>\
**Category:** General Discussions\
**Created:** [January 16, 2020, 8:26pm UTC](https://discuss.kubernetes.io/t/create-and-use-a-private-insecure-registry-inside-k8s-cluster/9338 "2020-01-16T20:26:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MostafaGazar](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/mostafagazar/32/4409_2.png) [@MostafaGazar](https://discuss.kubernetes.io/u/MostafaGazar)\
**Post date:** [January 16, 2020, 8:26pm UTC](https://discuss.kubernetes.io/t/create-and-use-a-private-insecure-registry-inside-k8s-cluster/9338/1 "2020-01-16T20:26:08Z")

</div>

I tried a few approaches already but all lead to failure. My end goal is to have a docker registry `deployment` and `service` inside a cluster. Build and push images to that registry. And finally create pods from those images. I think this should be doable but feel free to correct me if I am wrong.

I started by creating a `deployment` with one container `registry:2` and then used [`buildah`](https://buildah.io) to build images and push them using `--tls-verify=false` argument, that worked fine. I then tried to add my service url to `daemon.json` under `insecure-registries` but I could not get docker to pick the change.

So I tried creating a self-signed certificate once with openssl and another time with cfssl and added it `/etc/docker/certs.d/my-registry.default.svc.cluster.local:5000/`. I also tried creating htpasswd but I always ran into errors like `Error response from daemon: Get https://my-registry.default.svc.cluster.local:5000/v2/: Service Unavailable` or ssl related errors.

Here is code for some of the stuff I tried:

- A self-signed certificate for the registry + copying it to all nodes, [https://gist.github.com/MostafaGazar/e434e8947055dd856e38c9b4c5cfba15](https://gist.github.com/MostafaGazar/e434e8947055dd856e38c9b4c5cfba15)
- Using htpasswd for auth [https://gist.github.com/MostafaGazar/a00e2440f99d09db334e201d3444550f](https://gist.github.com/MostafaGazar/a00e2440f99d09db334e201d3444550f)

I did most of testing using Docker Desktop on Mac but the end goal is for this to run on GKE.

---

<div class="post-metadata">

**Author:** ![geekbot](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@geekbot](https://discuss.kubernetes.io/u/geekbot)\
**Post date:** [June 25, 2020, 10:40am UTC](https://discuss.kubernetes.io/t/create-and-use-a-private-insecure-registry-inside-k8s-cluster/9338/2 "2020-06-25T10:40:12Z")

</div>

Hello, I am struggling with similar issues, but on microk8s  
Whick k8s installation do you use on your desktop ?

---

<div class="post-metadata">

**Author:** ![cocampbe](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/cocampbe/32/2748_2.png) [@cocampbe](https://discuss.kubernetes.io/u/cocampbe)\
**Post date:** [July 10, 2020, 10:10pm UTC](https://discuss.kubernetes.io/t/create-and-use-a-private-insecure-registry-inside-k8s-cluster/9338/3 "2020-07-10T22:10:33Z")

</div>

your docker instance is not going to be aware of dns in kubernetes. You can verify this by simply trying to ping, or do an nslookup of the k8s dns entry. You will need to expose your registry via a service and ingress. And likely a load balancer. Then you would add the dns exposed by the ingress.