<p>I found a solution. The problem is actual for Kubernetes version <code>1.19+</code> and <code>COS</code>/<code>Ubuntu</code> images based on <code>containerd</code> for GKE nodes. Before the 1.19 version Kubernetes used to use <code>Docker</code> for building images, but now it uses <code>containerd</code>. More details could be found in the official <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/using-containerd" rel="nofollow noreferrer">Google Cloud documentation</a>.</p>
<p>You need to create and put an CA certificate to each GKE node. Here you can find an answer how to do it correctly <a href="https://stackoverflow.com/a/67724696/3319341">https://stackoverflow.com/a/67724696/3319341</a>.</p>
<p>But for <code>containerd</code> solution you should replace command</p>
<pre><code>nsenter --target 1 --mount systemctl restart docker
</code></pre>
<p>by</p>
<pre><code>nsenter --target 1 --mount systemctl restart containerd
</code></pre>
<p>A more detailed answer: <a href="https://stackoverflow.com/a/67990395/3319341">https://stackoverflow.com/a/67990395/3319341</a></p>

CC BY-SA 4.0
2021-06-15T12:26:53.353Z
2021-06-17T05:56:17.380Z
2021-06-17T05:56:17.380Z
Max Koshel
<p>If your on Standard Mode for your GKE cluster, go into Computer Engine &gt; SSH into every node and put into /etc/docker/certs.d/&lt;ip:port&gt;/ca.cert. Create folder if it does not exists.</p>
<p>This works for me. The method will not work for Autopilot Mode.</p>
<p>My exact steps on each node:</p>
<pre><code>mkdir -p /etc/docker/certs.d/1.2.3.4:5000  
cd /etc/docker/certs.d/1.2.3.4:5000  
vi /etc/docker/certs.d/1.2.3.4:5000/ca.crt  
</code></pre>
<p>Lastly, create and use the imagepullsecrets in your deployment</p>
<pre><code>kubectl create secret docker-registry my-secret \ 
--docker-server=1.2.3.4:5000 \
--docker-username='testuser' \
--docker-password='testpassword' \
--docker-email='test@example.com'

cat &lt;&lt;EOF | kubectl apply -f 
...
 spec:  
   containers:  
   - name: hello  
     image: 1.2.3.4:5000/test:7.12.0  
   imagePullSecrets:  
   - name: my-secret   
EOF
</code></pre>

CC BY-SA 4.0
2021-06-07T15:12:30.307Z
2021-06-08T01:20:30.930Z
2021-06-08T01:20:30.930Z
Ming
<p>You can now use the DaemonSet to load self-signed CAs when using containerd: <a href="https://github.com/samos123/gke-node-ca-importer" rel="nofollow noreferrer">https://github.com/samos123/gke-node-ca-importer</a></p>
<p>Credit to @nstogner: <a href="https://github.com/samos123/gke-node-ca-importer/commit/756674ee595e1cf86df4b3181bb3cf687bd72c97" rel="nofollow noreferrer">https://github.com/samos123/gke-node-ca-importer/commit/756674ee595e1cf86df4b3181bb3cf687bd72c97</a></p>

CC BY-SA 4.0
2022-01-06T02:12:56.837Z
2022-01-06T02:12:56.837Z
Sam Stoelinga
<p>I generated a CA certificate, then issued a certificate based on it for a private registry, that located in the same GKE cluster. Put the server certificates to the private registry and the CA certificate to all GKE nodes and run:</p>
<pre><code>update-ca-certificates &amp;&amp; systemctl restart docker
</code></pre>
<p>Images are building and putting into the private registry without problems. When a pod tries to pull the an image from the repository I get an error:</p>
<pre><code>x509: certificate signed by unknown authority
</code></pre>
<p>Also I tried to put the CA certificate to the docker <code>certs.d</code> directory (10.3.240.100:3000 — the IP address of the private registry) and restart the docker on each node of the GKE cluster, but it doesn't help, too:</p>
<pre><code>/etc/docker/certs.d/10.3.240.100:3000/ca.cert
</code></pre>
<p>How to solve this problem? Am I understand correctly that the GKE nodes' docker is responsible for pulling images when creating a pod?</p>

<docker><kubernetes><google-cloud-platform><ssl><google-kubernetes-engine>
How to resolve a problem "certificate signed by unknown authority" in GKE on pulling image (a private registry) when a pod is created?
Max Koshel
# How to resolve a problem "certificate signed by unknown authority" in GKE on pulling image (a private registry) when a pod is created?

(Asked by: username_0 on 2021-06-02)

I generated a CA certificate, then issued a certificate based on it for a private registry, that located in the same GKE cluster. Put the server certificates to the private registry and the CA certificate to all GKE nodes and run:
update-ca-certificates && systemctl restart docker

Images are building and putting into the private registry without problems. When a pod tries to pull the an image from the repository I get an error:
x509: certificate signed by unknown authority

Also I tried to put the CA certificate to the docker certs.d directory (10.3.240.100:3000 — the IP address of the private registry) and restart the docker on each node of the GKE cluster, but it doesn't help, too:
/etc/docker/certs.d/10.3.240.100:3000/ca.cert

How to solve this problem? Am I understand correctly that the GKE nodes' docker is responsible for pulling images when creating a pod?

**Tags:** docker, kubernetes, google-cloud-platform, ssl, google-kubernetes-engine


---

## 3 answers

### Answer by username_0 on 2021-06-15. Score: 1 | Accepted answer

I found a solution. The problem is actual for Kubernetes version 1.19+ and COS/Ubuntu images based on containerd for GKE nodes. Before the 1.19 version Kubernetes used to use Docker for building images, but now it uses containerd. More details could be found in the official Google Cloud documentation.
You need to create and put an CA certificate to each GKE node. Here you can find an answer how to do it correctly https://stackoverflow.com/a/67724696/3319341.
But for containerd solution you should replace command
nsenter --target 1 --mount systemctl restart docker

by
nsenter --target 1 --mount systemctl restart containerd

A more detailed answer: https://stackoverflow.com/a/67990395/3319341


---

### Answer by username_1 on 2021-06-07. Score: 1

If your on Standard Mode for your GKE cluster, go into Computer Engine > SSH into every node and put into /etc/docker/certs.d//ca.cert. Create folder if it does not exists.
This works for me. The method will not work for Autopilot Mode.
My exact steps on each node:
mkdir -p /etc/docker/certs.d/1.2.3.4:5000  
cd /etc/docker/certs.d/1.2.3.4:5000  
vi /etc/docker/certs.d/1.2.3.4:5000/ca.crt  

Lastly, create and use the imagepullsecrets in your deployment
kubectl create secret docker-registry my-secret \ 
--docker-server=1.2.3.4:5000 \
--docker-username='testuser' \
--docker-password='testpassword' \
--docker-email='test@example.com'

cat <


---

### Answer by username_2 on 2022-01-06. Score: 0

You can now use the DaemonSet to load self-signed CAs when using containerd: <https://github.com/samos123/gke-node-ca-importer>

Credit to @nstogner: <https://github.com/samos123/gke-node-ca-importer/commit/756674ee595e1cf86df4b3181bb3cf687bd72c97>


---

