No more working when source image is on docker.io

[mimmus]

Hi,
after many months of good work, k8s-image-swapper is no more working when source image is on docker.io:
unexpected status code [manifests 41]: 401 Unauthorized
Did we run Docker Hub limits? In case, we have a valid account but docs are not clear about setup.

[estahn]

@mimmus Do you still see this issue? Could be Docker Hub rate limit. Have you checked the logs on the master/nodes?

[mimmus]

Hi @estahn ,
I was forced to configure a filter to cache only our internal registry, disabling Docker Hub and others.
As we have a Docker Hub account, how can I configure it on k8s-image-swapper?

Your piece of code is really useful, we still have internal Docker registry on-premises while Kubernetes is on cloud and caching images is really important.

[estahn]

@mimmus There is this https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials but I believe skopeo (which is internally used to pull images) does not use those configured credentials.

#50 was meant to add this feature. Let me come back to you.

[mimmus]

It's not a k8s-image-swapper issue!
I have Docker Hub credentials configured in containerd as:

[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
    endpoint = ["https://registry-1.docker.io","https://registry-1.docker.io"]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."*"]
    endpoint = ["https://registry-1.docker.io"]
[plugins."io.containerd.grpc.v1.cri".registry.configs."registry-1.docker.io".auth]
  username = "myusername"
  password = "mypassword"
  auth = ""
  identitytoken= ""

and it matches "docker.io" also when it is in ECR URLs like:
448945531652.dkr.ecr.eu-central-1.amazonaws.com/docker.io/nginx/nginx:latest
this result in an attempt to authenticate using Docker Hub credentials also on ECR, receiving 401.