Trouble with insecure_registries

[sebastian-philipp]

Trouble with insecure_registries in the conf

(this is an extract of an irc log. sorry for being a bit unstructured)

I guess this is mainly a documentation bug or a user error.

adding insecure_registries = ["192.168.122.1"] to /etc/crio/crio.conf . Did not work for me.

Also insecure_registries = ["192.168.122.1:443"] did not work, as I was getting

Failed to pull image "192.168.122.1:443/ceph/ceph:latest": rpc error: code = Unknown desc = pinging docker registry returned: Get https://192.168.122.1:443/v2/: x509: cannot validate certificate for 192.168.122.1 because it doesn't contain any IP SANs

The documentation did not mention that crio is supposed to try HTTP, that's why I originally removed my HTTP registry on port 5000 with a self-signed registry on 443. According to the sources, it in fact does try http.

My crio.conf that didn't worked: https://paste.opensuse.org/view//27932805

Finally I've tried 192.0.0.0/8 which actually works.

Steps to reproduce the issue:
1.
2.
3.

Describe the results you received:

Describe the results you expected:

Additional information you deem important (e.g. issue happens only occasionally):

Output of crio --version:

1.13.1

(paste your output here)

Additional environment details (AWS, VirtualBox, physical, etc.):

[mrunalp]

@sebastian-philipp Thanks for opening this issue. I think we need to fix up the docs cc: @mtrmac @vrothberg
Also, we are using /etc/containers/registries.conf as the common configuration file for these settings that works for cri-o, podman, buildah and skopeo.

[mtrmac]

Can you clarify precisely

• how the registry is configured: Is it using HTTP or HTTPS (TLS), and on which port (and perhaps if there is anything unusual about the TLS error)
• what is the failing crio.conf configuration
• what is the image name (notably whether it does or does not explicitly include a port) that CRI-O is asked to access

(and if you tried multiple things, which all failed differently, which configurations correspond to which failures), please? Is it using HTTP or HTTPS (TLS), and on which port is it serving the content?

The report seems to say that there is an untrusted TLS-protected registry on …122.1:443, the configuration sets …122.1:443 as insecure, and the request is for an image hosted at …122.1:443; at a first glance that should all match and be treated as TLS not enforced; OTOH I’ve never seen the quoted “cannot validate certificate for 192.168.122.1 because it doesn't contain any IP SANs”, that could be some unexpected code path that behaves differently or outright incorrectly.

At the moment it is, at least, unclear whether this is a bug/user error/documentation error.

(How this should work: for non-CIDR insecure_registries specifications, the host[:port] in that specification must exactly match the host[:port] specification in the image name, including the presence of the port number even if it is the default one.

OTOH the CIDR match code completely ignores ports, so using it may bypass some port mismatches between request/configuration. But, again, AFAICT your configuration has all three matching, so this should not be making a difference.)

[sebastian-philipp]

Ok, after the weekend, I was able to create an insecure registry quite easily. I guess three things went wrong last week:

My first error was a definitely my fault: I used something like this to add the registry:

echo 'insecure_registries = ["192.168.122.1"]' >> /etc/crio/crio.conf

Which obviously doesn't work, as the config file is grouped in sections.

The second problem was being mislead by "List of registries to skip TLS verification for pulling images." in the documentation, which lead me to believe that cri-o only supports HTTPS registries (certificate verified and unverified).

So, I cannot say, if insecure_registries = ["192.168.122.1:443"]' is actually broken or not, because I'm not sure about the real configuration at that point.

And finally: As of today, I don't know if insecure_registries = ["192.168.122.1"]' works or not. Haven't tested it today. Last week, I was not really sure, which formats are accepted by crio, as the documentation doesn't specify any format or schema.

[haircommander]

@sebastian-philipp it seems by your comment that this issue is fixed. as such, I'm closing this. please reopen if you disagree