How I can add root CA to minikube?

Question

My company uses it's own root CA and when I'm trying to pull images. Even from a private registry I'm getting error:

1h 3m 22 {kubelet minikube} Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for gcr.io/google_containers/pause-amd64:3.0, this may be because there are no credentials on this request.

details: (Error response from daemon: Get https://gcr.io/v1/_ping: x509: certificate signed by unknown authority)" 1h 10s 387 {kubelet minikube} Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "POD" with ImagePullBackOff: "Back-off pulling image \"gcr.io/google_containers/pause-amd64:3.0\""

How I can install root CA to minkube or avoid this message i.e. Use only private registry, and don't pull anything from gcr.io ?

Answer 1

To address:

x509: certificate signed by unknown authority

Could you please try the following suggestion from Minikube repo?

copy the cert into the VM. The location should be:

/etc/docker/certs.d/

from here: https://docs.docker.com/engine/security/certificates/

ref

That thread also includes the following one-liner:

cat <certificatefile> \
  | minikube ssh "sudo mkdir -p /etc/docker/certs.d/<domain> && sudo tee /etc/docker/certs.d/<domain>/ca.crt"

The issue here is the CA Trust chain of the Linux host that needs to be updated. The easiest way is to reboot the Linux host after copying the certs into the VM, if rebooting is not an option - look for a way to update-ca-certificates.

Just restarting the Docker Daemon will most likely not solve this issue

Note: allowing the Docker daemon to use insecure registries means certificates aren't verified.. while this may help, it does not solve the question asked here

Answer 2

The only solution I've found so far is adding --insecure-registry gcr.io option to the minikube.