Add custom root CA for pulling images?

[neezer]

I'm hosting my own container registry in my k3os cluster. I'm trying to pull images from that as part of deployments to that cluster, and those pulls consistently fail with x509: certificate signed by unknown authority.

My container registry sits behind an ingress controller that uses cert-manager to issue certificates using my-custom-root.crt. I can push & pull from this registry fine from another computer where that root CA is installed.

I've gone to each of my nodes and added my my-custom-root.crt to /usr/local/share/ca-certificates, then ran sudo update-ca-certificates and rebooted the nodes. No change in behavior.

Not sure what else to try.

[neezer]

After a long and winding trip through documentation & issues on k3os, k3s, & containerd, I think I found my solution.

TL;DR I forgot that most of my manual edits in /etc were not persisting, so I was getting tons of false-negative failures about the CA cert.

I added the following line to /var/lib/rancher/k3os/config.yaml on all three nodes:

run_cmd:
  - "cat /usr/local/share/ca-certificates/my-cusom-root.crt >> /etc/ssl/certs/ca-certificates.crt"

This allowed my custom CA to be persisted and trusted by the OS—which makes containerd happy—which means I didn't end up needing to change anything else. My images are being downloaded now without issue.