Attempting to pull missing image from insecure registry fails

[Joseph Borg]

Accumulating:
    https://github.com/containerd/cri/issues/1201
    https://discourse.jujucharms.com/t/cant-create-pod-with-container-from-a-custom-registry

Containerd via CRI fails to pull from a plain HTTP or plain HTTP with basic auth registry. This seems to be a bug in containerd.

Error:
    Failed to pull image "172.31.55.16:5000/nginx:latest": rpc error: code = Unknown desc = failed to resolve image "172.31.55.16:5000/nginx:latest": no available registry endpoint: failed to do request: Head https://172.31.55.16:5000/v2/nginx/manifests/latest: http: server gave HTTP response to HTTPS client

[Joseph Borg (joeborg)]

Should be fixed in https://github.com/containerd/cri/pull/1227

[Joseph Borg (joeborg)]

This is still affecting us on 1.3.3.

[Joseph Borg (joeborg)]

Once this is fixed, we need to look at the docker-registry relation to make sure the URL is set correctly, as well as the username, password and TLS details.

[Brett Milford (brettmilford)]

I believe this is fixed with: https://github.com/charmed-kubernetes/charm-containerd/pull/43

[Joseph Borg (joeborg)]

Hi Brett, the PR you've linked is for a similar, but distinct, issue. We're currently waiting for containerd 1.3.7 to make it into apt as this has been fixed in that version and tested by us.