How to install Trusted CA everywhere? Docker pull rancher/pause fails without Trusted CA

[ericis]

Internally, k3d and kubernetes gives me the error: failed to do request: Head "https://registry-1.docker.io/v2/rancher/pause/manifests/3.1": x509: certificate signed by unknown authority.

I believe this is because zScaler is running and has it's own root CA that needs to be installed on every system with network communications.

So, I've tried:

• Creating the cluster with the zScaler certificate with the argument k3d cluster create ... --volume zscaler_root_ca.pem:/etc/ssl/certs/zscaler_root_ca.pem
• I've also tried adding the zScaler certificate to a "ca-additional.pem" file and then registering it as a Kubernetes secret with kubectl -n kube-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem.

However, I still get the error:

Events:
  Type     Reason                  Age               From               Message
  ----     ------                  ----              ----               -------
  Normal   Scheduled               20s               default-scheduler  Successfully assigned default/poc-omni-app-ionic-6db558948c-gh44p to k3d-poc-omni-agent-1
  Warning  FailedCreatePodSandBox  5s (x2 over 20s)  kubelet            Failed to create pod sandbox: rpc error: code = Unknown desc = failed to get sandbox image "rancher/pause:3.1": failed to pull image "rancher/pause:3.1": failed to pull and unpack image "docker.io/rancher/pause:3.1": failed to resolve reference "docker.io/rancher/pause:3.1": failed to do request: Head "https://registry-1.docker.io/v2/rancher/pause/manifests/3.1": x509: certificate signed by unknown authority

[ericis]

The above were the correct steps. However, I was using a relative path --volume argument and docker wants absolute paths. Once I set the absolute path, it worked perfectly. There was also another issue regarding "docker in docker" setup for VS Code "Remote Development" and the interplay between Windows and Linux paths, but technically unrelated to this specific question.

[Wizmll]

Hey Ericis, I wonder if you can help with this (knowing that im working on Debian) I have successfully downloaded the self-signed certificate from our corporate proxy, which is integrated into the firewall. However, during the installation of the K3s master node, I encountered an issue where the Kubernetes pods are stuck on the "ContainerCreating" status and do not progress further. Based on my investigation, I suspect that Kubernetes is not trusting the self-signed certificate from the corporate proxy. This might be causing communication errors between the master node and the pods, resulting in the "ContainerCreating" status.
I kindly request your guidance and expertise to help me resolve this issue.

[iwilltry42]

@MalikaML we'll be following up over here: #535 (reply in thread)