Image pull issue from Harbor registry which is deployed on the same cluster.

[Leela-SR]

Hi Harbor Team,

We plan to have a local container registry in the same cluster where our applications are running. We need this local container registry to support the network disconnections.

I have deployed Harbor in our cluster as local container registry and was able to successfully pull and push images from outside the cluster through nodePort and ingress service types.
However, this is not our use case. We need to pull the images within the cluster for which I am making use of "harbor core" service to access the repositories. Note: I have tried it with image pull secret where un: admin, pw: Harbor12345 url: http://test-harbor-core.harbor.svc:80
example:

When I try to deploy the pod, I get following error:

Could you please let us if we are missing anything? Is any configuration is missing? i am able to ping harbor.core service pod from other pods successfully.

NOTE: When exposed through NodePort or Ingress from cluster, I am successfully pulling the images from Harbor container registry.

Our Configuration:
Kubernetes version: v1.28.9+rke2r1

[Kajot-dev]

That would seem like some DNS issue in your k8s cluster since it fails to lookup the hostname. Connection to the harbor registry is not even made

Also, you're trying to access port 80 over https. I would strongly recommend using harbor's internal tls for this one

[stonezdj]

Please don't use service name to serve Harbor service, because you should always pull image through externalURL

[Leela-SR]

@stonezdj Why we can't access harbor service through service Type Cluster IP (internal to cluster). Generally, if it is ClusterIP, we generally access it through service name right? We don't want to expose registry outside cluster due to security issues.

[stonezdj]

When pulling image from Harbor, it always request the bearer token via <externalURL>/service/token, if you are using the service name, the pull request fail to get the bearer token.

[Leela-SR]

@stonezdj
I have set the EXT_ENDPOINT and deployed harbor with serviceType = clusterIP
https://harbor:443 ( tried with http://harbor:80 as well)
When I try to deploy a pod where the image is pulled from harbor registry, i am getting this error.

It starts referencing the image from docker.io. Could you please let us know why it is pointing to "docker.io/harbor/ix/test/redis:latest

Am I missing any configuration here?

my pod deployment file is:

Created Kubernetes image secret object using following:
registry server: https://harbor:433
un: admin
pw: Harbor12345