Using ImaeSpec with private docker registry

[mattv-neXenio]

With the ImageSpec I plan on pulling the base flytekit images from my private docker registry. Once they are built with envd I want to push them there too.

The image build fails with x509 certificate signed by unknown authority, most likely because the registry's CA-certificates haven't been added to the envd_buildkitd container. The docker/config.json has been provided.

Is there an option equivalent to --no-check-certificate that can be passed to the ImageSpec or to envd bootstrap?

[dosubot[bot]]

🤖

Hello @mattv-neXenio! I'm Dosu, a friendly bot created to assist you with your issues, answer your questions, and guide you through contributing to our repository. While we're waiting for a human maintainer, I'm here to help. Let's get your problems sorted out together!

Based on the provided context, it seems that you're encountering an issue with the envd_buildkitd container not recognizing your private Docker registry's CA-certificates. This is likely causing the x509 certificate signed by unknown authority error you're seeing.

While Flyte's ImageSpec does support the use of private Docker registries through the imagePullSecrets field in the ServiceAccount configuration file, there doesn't appear to be a direct way to pass additional options or flags, such as --no-check-certificate, to the ImageSpec or envd bootstrap based on the information available in the repository.

The envd tool in Flyte doesn't directly handle Docker registry authentication. Instead, it uses Kubernetes Secrets to store Docker registry credentials. When a Pod that uses a Docker image from this registry is created, Kubernetes uses the credentials stored in the Secret to authenticate with the Docker registry and pull the image.

If you've already provided the docker/config.json and are still encountering this issue, it might be necessary to manually add your registry's CA-certificates to the envd_buildkitd container. This would involve creating a Dockerfile that uses envd_buildkitd as a base image, adding the CA-certificates, and then using this new image for your builds.

Here's a basic example of what this Dockerfile might look like:

FROM envd_buildkitd:latest

# Add your CA-certificates
ADD ca-certificates.crt /etc/ssl/certs/

# Rest of your Dockerfile...

You would then build this Dockerfile and use the resulting image for your builds.

Please note that this is a workaround and might not be the best solution. It's possible that there's a better way to handle this that I wasn't able to find in the repository. If you have any additional information or context that could help, please provide it.

Sources

• flyteadmin/pkg/clusterresource/testdata/imagepullsecrets.yaml
• flyteadmin/sampleresourcetemplates/docker.yaml

---

This response is meant to be useful and save you time. It is not meant to be a precise solution, but rather a starting point for your own research.

Help me be more useful! Please leave a 👍 if this is helpful and 👎 if it is irrelevant.

If you want to continue the conversation, start your reply with @dosu-bot.

[Future-Outlier]

Hi, @mattv-neXenio

I am not sure about how to solve it, but maybe you can use run commands feature in the ImageSpec, this can help you download things to your building image.

flyteorg/flytekit#1909