Firewall blocks access to endpoints represented by registry.k8s.io

[sharonkimchi]

Is there an existing issue for this?

• [X] I have searched the existing issues

What did you expect to happen?

My environment is behind firewall, where I need to request specific FQDN/IP to be opened. However, registry.k8s.io redirects its backend hosts dynamically, sometimes on specific docker image layers.

$ sudo docker pull registry.k8s.io/ingress-nginx/controller:v0.35.0

v0.35.0: Pulling from ingress-nginx/controller Get https://us-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/ingress-nginx/controller/manifests/sha256:09b1dd9beada71f80e4cb39f46de84a3272adaf1222c5c5a0e1c79104c73c99a: read tcp :51212->209.85.146.82:443: read: connection reset by peer

Debugging Information

curl -v https://registry.k8s.io/v2/

• About to connect() to registry.k8s.io port 443 (#0)
• Trying 34.96.108.209...
• Connected to registry.k8s.io (34.96.108.209) port 443 (#0)
• Initializing NSS with certpath: sql:/etc/pki/nssdb
• CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none
• SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• Server certificate:
• subject: CN=registry.k8s.io
• start date: Jul 08 04:12:31 2023 GMT
• expire date: Oct 06 05:08:26 2023 GMT
• common name: registry.k8s.io
• issuer: CN=GTS CA 1D4,O=Google Trust Services LLC,C=US

  GET /v2/ HTTP/1.1 User-Agent: curl/7.29.0 Host: registry.k8s.io Accept: /

  < HTTP/1.1 200 OK < docker-distribution-api-version: registry/2.0 < x-cloud-trace-context: 1d72e47c740b944ad5508c106ba89105 < date: Mon, 10 Jul 2023 14:51:41 GMT < content-type: text/html < server: Google Frontend < Content-Length: 0 < via: 1.1 google < Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 <

• Connection #0 to host registry.k8s.io left intact

Anything else?

No response

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

[mrbobbytables]

Please see the stability guarantees - https://github.com/kubernetes/registry.k8s.io#stability

If you are behind a firewall that limits your outbound connections, your best option is to mirror the images you need.

/close

[k8s-ci-robot]

@mrbobbytables: Closing this issue.

In response to [this](https://github.com/kubernetes/registry.k8s.io/issues/256#issuecomment-1629153840): >Please see the stability guarantees - https://github.com/kubernetes/registry.k8s.io#stability > >If you are behind a firewall that limits your outbound connections, your best option is to mirror the images you need. > >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.