Istio installation failed with private docker registry

[sachithmuhandiram]

Bug description

Installation gets timeout errors and in kubectl get pods -n istio-system shows ImagePullBackOff

kubectl describe pod istiod-xxx-xxx -n istio-system

Failed to pull image "our-registry:5000/pilot:1.10.3": rpc error: code = Unknown desc = Error response from daemon: Head https://our-registry:5000/v2/pilot/manifests/1.10.3: no basic auth credentials

Affected product area (please put an X in all that apply)

[x ] Installation

Expected behavior

Successful installation with istioctl install --set profile=demo --set hub=our-registry:5000

Steps to reproduce the bug

• Create istio-system namespace.

• Set docker-registry user credentials for istio-system namespace.

• istioctl manifest generate --set profile=demo --set hub=our-registry:5000 > new-generated-manifest.yaml

• Verify it has proper images with our-registry:5000

• Pull and push required images to our-registry:5000

• istioctl install --set profile=demo --set hub=our-registry:5000

Version

Kubernetes : v1.21

Istio : 1.10.3 / 1.7.3

How was Istio installed?

istioctl install --set profile=demo --set hub=our-registry:5000

[References]

1. Tried to setup imagePullSecrets as described here, but it gives

Json object error

2. Here describe about using it in charts, but dont know how they applied it.

[su225]

The error message indicates that the private registry requires credentials. In your istioctl install command I don't see it anywhere. You can check the deployment manifest rendered with istioctl manifest generate command. If pulling images requires credentials then imagePullSecrets have to be specified. This is a Kubernetes thing. See here. You have to use overlays to specify imagePullSecrets in the pod template. As mentioned before you can check if manifests are being rendered correctly with istioctl manifest generate command.

EDIT: Read entire issue now. I see you have tried setting with charts. If none of it works, then you can use overlays.

[tiggerlee2]

istioctl install --set profile=demo --set hub=our-registry:5000 --set "values.global.imagePullSecrets[-1]=secretName" --set "values.global.imagePullSecrets[-1]=secretName2"  --dry-run  

[sachithmuhandiram]

Thanks for the suggestions. I have solved the issue using

istioctl install --set profile=demo --set values.global.imagePullSecrets[0]=<auth-secret>

Here <auth-secret> was the docker registry password created for istio-system namespace.

SO thread