Use a Registry Mirror

Registry mirrors are local copies of images from a public registry that follows (or mirrors) the file structure of a public registry. You can push container images to a local registry from downloaded images or images that you create with the Konvoy Image Builder. If your environment allows Internet access, when an image is not found, the mirror registry pulls it from it would consult its upstream registries. This kind of registry does not contain any images other than the ones requested.

To apply private registry configurations during the create operation, add the appropriate flags to the create cluster command. Only use one image registry per cluster:

Registry configuration	Flag
CA certificate chain to use while communicating with the registry mirror using TLS	`--registry-mirror-cacert file`
URL of a container registry to use as a mirror in the cluster	`--registry-mirror-url string`
Set to a user that has pull access to this registry	`--registry-mirror-username`
Password	`--registry-mirror-password`

This is useful when using an internal registry and when Internet access is not available such as in an air-gapped environment. However, registry mirrors can be used in non-air-gapped environments as well for security and speed.

AWS ECR - Adding the mirror flags to EKS would enable new clusters to also use ECR as image mirror. If you set the --registry-mirror flag, the Kubelet will now send to requests to the dynamic-credential-provider with a different config. You can still pull your own images from ECR directly or use ECR as a mirror.

When the cluster is up and running, you can deploy and test workloads.

Alternative mirror example

CODE

dkp create cluster preprovisioned \
    --cluster-name ${CLUSTER_NAME} \
    --registry-mirror-cacert /tmp/registry.pem \
    --registry-mirror-url https://registry.example.com

More information is found in the Custom Installation and Additional Infrastructure Tools sections under the Create a New Cluster section of each Infrastructure Provider. Mirrors can be used in both air-gapped and non-air-gapped environments by adding the flag to the dkp create cluster command.