docker-registry | This is * * DEPRECATED * * | Continuous Deployment library

Given the invalid URL error and on the "windows" in the 500, I'm guessing it's a foreign layer for windows images that's getting rejected by validation. I tried figuring out the right syntax to allow that in the past and eventually gave up and turned off the validation with REGISTRY_VALIDATION_DISABLED=true. E.g. here's a command I use to start a registry:

At this time, your will need to use Terraform plus Cloud Build to specify the repository to use. You can then use gcloud --docker-repository in a Cloud Build step.

This document explains how to integrate Terraform with Cloud Build.

Managing infrastructure as code with Terraform, Cloud Build, and GitOps

Helm provides the --create-namespace switch that will create the namespace of the release if it does not already exist.

The secret can be added in your helm chart and you can pass the variables (CI_REGISTRY, CI_DEPLOY_USER, etc.) in as helm chart values either as --set values or via the values.yaml file and using --values

The service account patching you can do as a post-install and/or a post-upgrade job (https://helm.sh/docs/topics/charts_hooks/)

There was one more thing that was not mentioned. I'm using OpenVPN with NordVPN server list on master node, and use a privoxy for worker nodes.

When you install and run OpenVPN before running kubernetes master, OpenVPN add rules that block kubernetes networking. So, coredns does not work and you can't reach any pod via IP as well.

I'm using RPi 4 cluster, so for me it was good enough to just re-install master node, install kubernetes at first and then configure openvpn. Now everything is working as expected.

It's good enough to order your system units by adding After or Before in service definition. I have VPN systemd service that looks like below:

I was able to pull a private image by doing the following:

1. Create a personal token in GitHub with repo access.
2. Build and push the image to GitHub's Container registry (I used okteto build -t ghcr.io/rberrelleza/go-getting-started:0.0.1)
3. Download my kubeconfig credentials from Okteto Cloud by running okteto context update-kubeconfig.
4. Create a secret with my credentials: kubectl create secret docker-registry gh-regcred --docker-server=ghcr.io --docker-username=rberrelleza --docker-password=ghp_XXXXXX
5. Patched the default account to include the secret as an image pull secret: kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "gh-regcred"}]}'
6. Updated the image name in the kubernetes manifest
7. Created the deployment (kubectl apply -f k8s.yaml)

These is what my kubernetes resources looks like, in case it helps:

The sdn was causing this networking issue.

Does Azure support Calico networking?

Calico in VXLAN mode is supported on Azure. However, IPIP packets are blocked by the Azure network fabric.

The above quote from calico reference was the reason this issue was caused. This could be resolved by changing to VXLAN mode in calico config. More details on how to switch can be found here.

For my solution I just switched to the default openshift sdn 'ovs-subnet' from calico in the inventory file.

The secret you generate ($CI_REGISTRY_PASSWORD) is only valid during the specific job. So the moment the job finishes the password is invalid.

Use a deploy token.

Here you can find a complete guide on how to accomplish this in the official kubernetes documentation [1]

[1] https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

You cannot do that with current implements of kubernetes: all container in one pod will startup in same time(except the init container).

One solution is to enhance the code in test container to detect the state of db container, hold on until is ready.