how to affective K3s registry mirroring

[mertcangokgoz]

As you know, k3s has a registry mirror feature. Normally we expect it to cache all used OCIs and sync them between nodes in a P2P manner, but I noticed that I can't fully use this feature for some reason.

How can I effectively use the registry mirror feature in a k3s cluster configured as a NAT gateway?

[vitobotta]

Hi, what problem are you having with it? Did you enable it in the cluster config file? I have had it enabled on my clusters for a while, and it seems to be working fine. Can you tell me about your setup and the issue you're having?

[mertcangokgoz]

I apologize for seeing your message late. I'm getting the error below and have to close it. "Not found" errors occur frequently, even though the image exists in both Docker and alternative OCI repositories.

Failed to pull image "opencti/worker:6.7.8": rpc error: code = NotFound desc = failed to pull and unpack image "[docker.io/opencti/worker:6.7.7](http://docker.io/opencti/worker:6.7.7)": failed to copy: httpReadSeeker: failed open: content at https://127.0.0.1:6443/v2/opencti/worker/manifests/sha256:737adf34b3c30003073670e9cf8fa86f7286b5b60ce2468b75f58778be44d3c5?ns=docker.io not found: not found

I wanted to try installing Spegel as an alternative, but in this case, it gave errors on P2P ports. However, I'm using a NAT gateway, the machines have private IPs, and all ports are allowed, so there's no possibility of blocking.

There seems to be an issue but I can't pinpoint it. Because I'm using a NAT gateway, I'm hitting Docker rate limits. I'm using alternatives, but sometimes this doesn't solve it either.

[vitobotta]

I see. I have not tried that kind of setup with a NAT gateway myself.

[mertcangokgoz]

Logically, there should be no difference because NAT gateway is essentially the centralization of internet access through private IPs, but I don't understand how it can affect registry mirror processes. How can I solve this? I've researched but couldn't find a solution.

[vitobotta]

No idea, to be honest. I use a more regular setup and I haven't had any problems with the registry mirroring.