<p>I just got this working with Harbor Version v2.10.0-6abb4eab using <code>mirror</code> and a tweaked URL instead of trying to rewrite image names on the fly:</p>
<ol>
<li>Follow the docs at <a href="https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/" rel="nofollow noreferrer">https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/</a> to create a project called <code>proxy_cache</code>, setup security or make the mirror public</li>
<li>If using your own CA copy the <code>pem</code> file somewhere on each k3s node</li>
<li><code>registries.yaml</code> should look something like this. I have robot user and my own CA.</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>mirrors:
  docker.io:
    endpoint:
      - &quot;https://harbor.example.com/v2/proxy_cache&quot;
configs:
  &quot;harbor.example.com&quot;:
    auth:
      username: &quot;robot$k3s&quot; # this is the registry username
      password: &quot;thisisaverysecurepasswordtoaccesspublicfiles&quot; # this is the registry password
    tls:
      # cert_file: # path to the cert file used in the registry (mTLS)
      # key_file:  # path to the key file used in the registry (mTLS)
      ca_file: &quot;/etc/rancher/k3s/ca.pem&quot;  # path to the ca file used in the registry (if using TLS)
</code></pre>
<ol start="4">
<li>Restart k3s</li>
<li>Reference images as normal, eg</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>      containers:
      - image: docker.io/kong/httpbin:0.1.0
</code></pre>
<p>or</p>
<pre class="lang-yaml prettyprint-override"><code>      containers:
      - image: kong/httpbin:0.1.0
</code></pre>
<p>I automated the copying the CA and the registry.yaml to my k3s servers with some ansibles like this:</p>
<pre class="lang-yaml prettyprint-override"><code>- name: registries
  hosts: server
  become: true
  become_user: root
  tasks:
  - name: registries.yaml
    ansible.builtin.copy:
      src: registries.yaml 
      dest: /etc/rancher/k3s/registries.yaml
      owner: root
      group: root
      mode: '0600'

  - name: ca.pem
    ansible.builtin.copy:
      src: ~/ca/ca.pem
      dest: /etc/rancher/k3s/ca.pem
      owner: root
      group: root
      mode: '0600'

  - name: k3s
    ansible.builtin.systemd_service:
      state: restarted
      name: k3s
</code></pre>

CC BY-SA 4.0
2024-10-22T19:34:49.670Z
this is the only answer that works. I lost a whole afternoon searching how to use my harbor proxy repositories in rancher, and use endpoint like this, works like a charm. thanks!!
Kross
CC BY-SA 4.0
2024-02-04T11:18:10.787Z
2024-02-04T17:24:41.707Z
2024-02-04T17:24:41.707Z
Geoff Williams
<p>I have configured a <strong><a href="https://goharbor.io" rel="nofollow noreferrer">Harbor</a></strong> (with SSL and FQDN: harbor.example.com) as a <em>proxy cache</em> for several docker registries (docker.io, quay.io and k8s.gcr.io). I can pull any images without any problem from any PC/VM which can access the Harbor netowrk, i.e.:</p>
<pre><code># From hub.docker.com
docker pull harbor.example.com/dockerhub/library/ubuntu:20.04
# From quay.com
docker pull harbor.example.com/q/metallb/speaker:v0.12.1
# From k8s.gcr.com
docker pull harbor.example.com/g/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
</code></pre>
<p>I want to use this Harbor to, from a local <strong>k3s</strong> cluster (which was an airgap installation) and its only way to pull images is using the previously mentioned <strong>Harbor</strong> registry (because it has no way to reach the internet), pull images from every docker proxy cache created with, for example, and following the lasts examples:</p>
<pre><code>k3s crictl pull ubuntu:20.04
k3s crictl pull quay.io/metallb/controller:v0.12.1
k3s crictl pull k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
</code></pre>
<p>In order to get it done, and following the instructions from the <a href="https://docs.rke2.io/install/containerd_registry_configuration/" rel="nofollow noreferrer">rke2 official docx</a>, I'm trying to modify the <code>/etc/rancher/k3s/registries.yaml</code> to rewrite the link , i.e., from <strong>docker.io</strong> to <em>harbor.example.com/dockerhub</em>, and/or from <strong>quay.io</strong> to <em>harbor.example.com/q</em> and or <strong>k8s.grc.io</strong> to <em>harbor.example.com/g</em> but I can't find a way to achieve correctly... I guess it should be something like the folowing (but for every Harbor's cache proxy):</p>
<pre><code>mirrors:
  quay.io:
    endpoint:
      - &quot;https://harbor.virtalus.com&quot;
    rewrite:
      &quot;\/(.*)&quot;: &quot;q/$1&quot;
</code></pre>
<p><strong>So the question is: how to properly configure containerd's <code>registries.yaml</code> to point it to several <strong>Harbor</strong>'s proxy cache?</strong></p>

CC BY-SA 4.0
2023-09-23T10:40:29.263Z
Were you able to solve this?
Kartik Shah
<kubernetes><docker-registry><registry><containerd>
How to configure registries.yaml to point to several Harbor proxy cache registry?
k.Cyborg
# How to configure registries.yaml to point to several Harbor proxy cache registry?

(Asked by: username_0 on 2022-04-25)

I have configured a Harbor (with SSL and FQDN: harbor.example.com) as a proxy cache for several docker registries (docker.io, quay.io and k8s.gcr.io). I can pull any images without any problem from any PC/VM which can access the Harbor netowrk, i.e.:
# From hub.docker.com
docker pull harbor.example.com/dockerhub/library/ubuntu:20.04
# From quay.com
docker pull harbor.example.com/q/metallb/speaker:v0.12.1
# From k8s.gcr.com
docker pull harbor.example.com/g/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c

I want to use this Harbor to, from a local k3s cluster (which was an airgap installation) and its only way to pull images is using the previously mentioned Harbor registry (because it has no way to reach the internet), pull images from every docker proxy cache created with, for example, and following the lasts examples:
k3s crictl pull ubuntu:20.04
k3s crictl pull quay.io/metallb/controller:v0.12.1
k3s crictl pull k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c

In order to get it done, and following the instructions from the rke2 official docx, I'm trying to modify the /etc/rancher/k3s/registries.yaml to rewrite the link , i.e., from docker.io to harbor.example.com/dockerhub, and/or from quay.io to harbor.example.com/q and or k8s.grc.io to harbor.example.com/g but I can't find a way to achieve correctly... I guess it should be something like the folowing (but for every Harbor's cache proxy):
mirrors:
  quay.io:
    endpoint:
      - "https://harbor.virtalus.com"
    rewrite:
      "\/(.*)": "q/$1"

So the question is: how to properly configure containerd's registries.yaml to point it to several Harbor's proxy cache?

**Tags:** kubernetes, docker-registry, registry, containerd

> **Comments:**
> **username_1**: Were you able to solve this?  

---

## 1 answers

### Answer by username_2 on 2024-02-04. Score: 1

I just got this working with Harbor Version v2.10.0-6abb4eab using mirror and a tweaked URL instead of trying to rewrite image names on the fly:

Follow the docs at https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/ to create a project called proxy_cache, setup security or make the mirror public
If using your own CA copy the pem file somewhere on each k3s node
registries.yaml should look something like this. I have robot user and my own CA.

mirrors:
  docker.io:
    endpoint:
      - "https://harbor.example.com/v2/proxy_cache"
configs:
  "harbor.example.com":
    auth:
      username: "robot$k3s" # this is the registry username
      password: "thisisaverysecurepasswordtoaccesspublicfiles" # this is the registry password
    tls:
      # cert_file: # path to the cert file used in the registry (mTLS)
      # key_file:  # path to the key file used in the registry (mTLS)
      ca_file: "/etc/rancher/k3s/ca.pem"  # path to the ca file used in the registry (if using TLS)


Restart k3s
Reference images as normal, eg

      containers:
      - image: docker.io/kong/httpbin:0.1.0

or
      containers:
      - image: kong/httpbin:0.1.0

I automated the copying the CA and the registry.yaml to my k3s servers with some ansibles like this:
- name: registries
  hosts: server
  become: true
  become_user: root
  tasks:
  - name: registries.yaml
    ansible.builtin.copy:
      src: registries.yaml 
      dest: /etc/rancher/k3s/registries.yaml
      owner: root
      group: root
      mode: '0600'

  - name: ca.pem
    ansible.builtin.copy:
      src: ~/ca/ca.pem
      dest: /etc/rancher/k3s/ca.pem
      owner: root
      group: root
      mode: '0600'

  - name: k3s
    ansible.builtin.systemd_service:
      state: restarted
      name: k3s

> **Comments:**
> **username_3**: this is the only answer that works. I lost a whole afternoon searching how to use my harbor proxy repositories in rancher, and use endpoint like this, works like a charm. thanks!!  

---

