Securing K3s (public KB)

If the cluster has been deployed before January 2023, most probably it will come across this issue at some point.

If cluster runs a pod that uses a public image that hasn’t yet been copied to our public repo, error ErrImagePull with the message Failed to pull image will arise.

To address this issue this configuration file needs to be added, /etc/rancher/k3s/registries.yaml with the following contents:

mirrors:
  "*":
    endpoint:
      - "https://images.master.k3s.getvisibility.com"
    rewrite:
      "(.*)": "gv-public/$1"
  "images.master.k3s.getvisibility.com":
    endpoint:
      - "https://images.master.k3s.getvisibility.com"

This file instructs K3s to rewrite all images (except images.master.k3s.getvisibility.com) and redirect them to Getvisibility’s public repository.