#!/usr/bin/env bash # # JbTecWiz Support Centre -- generated fix script # # Fault : ImagePullBackOff, ErrImagePull and registry rate limits # Fix : Resolve a missing tag or a TLS trust problem # Source: https://jbtecwiz.com/support/lnx-ctr-imagepull # # Run as : Root shell # Expect : 30 minutes # Risk : medium # Reversible : yes # # WHEN THIS IS THE RIGHT FIX # manifest unknown, or an x509 certificate error. # # HOW TO UNDO IT # Remove the certificate from the trust store and re-run # update-ca-certificates. # # Walks the fix one step at a time and asks before each. Steps with no # command are yours to do -- it prints those and waits. DRYRUN=1 prints # without executing; UNATTENDED=1 does not ask. # # -------------------------------------------------------------------- # NO WARRANTY - USE AT YOUR OWN RISK # # This script is provided by JbTecWiz as-is and with no warranty of any # kind, express or implied. You run it entirely at your own risk. # # JbTecWiz accepts no liability for any loss or damage arising from its # use, including but not limited to data loss, downtime, or configuration # changes that turn out to be wrong for your system. # # You are responsible for reading this script before running it, for # satisfying yourself that it suits the machine in front of you, and for # having a working backup first. Some steps cannot be undone. # -------------------------------------------------------------------- set -uo pipefail DRYRUN="${DRYRUN:-0}" UNATTENDED="${UNATTENDED:-0}" failed=0 # - THIS SCRIPT WILL NOT RUN UNTIL YOU EDIT IT - cat >&2 <<'EOF' This script needs editing before it can run. Replace each of these with a real value: example.com (a placeholder domain) Then delete this block near the top of the script. EOF exit 2 if [ "$(id -u)" -ne 0 ]; then echo " This fix is documented as needing root. Re-run with sudo." >&2 exit 3 fi rule() { printf "\n%s\n" "$(printf '-%.0s' $(seq 1 70))"; if [ $# -gt 0 ]; then echo "$1"; fi; } prose() { echo "$1" | fold -s -w 74 | sed "s/^/ /"; } # Returns 0 when the caller should run the command, 1 when it should not. # A manual step always returns 1 -- there is nothing for the caller to run. step() { # step [command lines...] local n="$1" dotext="$2" why="$3" mode="$4"; shift 4 rule " Step $n of 5" prose "$dotext" if [ -n "$why" ]; then echo; prose "$why"; fi if [ "$mode" = "manual" ]; then echo; echo " -> Do this yourself, then press Enter to carry on." if [ "$UNATTENDED" = "0" ] && [ "$DRYRUN" = "0" ]; then read -r _; fi return 1 fi echo; printf " %s\n" "$@"; echo if [ "$DRYRUN" = "1" ]; then echo " (dry run -- not executed)"; return 1; fi if [ "$UNATTENDED" = "0" ]; then read -r -p " Run this step? [Y]es / [S]kip / [Q]uit " a case "$a" in [Qq]*) echo " Stopped at your request."; exit 0 ;; [Ss]*) echo " Skipped."; return 1 ;; esac fi return 0 } rule echo " ImagePullBackOff, ErrImagePull and registry rate limits" echo " Resolve a missing tag or a TLS trust problem" echo echo " Risk: medium Reversible 30 minutes" echo prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' rule echo if [ "$UNATTENDED" = "0" ] && [ "$DRYRUN" = "0" ]; then read -r -p " Ready? [y/N] " go case "$go" in [Yy]*) ;; *) echo " Nothing was changed."; exit 0;; esac fi if step 1 'For manifest unknown, check the tag exists and matches the node'\''s architecture.' '' cmd 'docker manifest inspect myimage:tag | head -30'; then docker manifest inspect myimage:tag | head -30 if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 1 failed. The rest of the fix may depend on it." >&2 fi fi if step 2 'A tag that exists for amd64 but not arm64 fails exactly like a missing tag on a mixed cluster.' 'Mixed-architecture clusters -- a few Raspberry Pi or Graviton nodes alongside x86 -- produce this intermittently, on whichever nodes the scheduler happened to choose.' cmd 'kubectl get nodes -o custom-columns=NAME:.metadata.name,ARCH:.status.nodeInfo.architecture'; then kubectl get nodes -o custom-columns=NAME:.metadata.name,ARCH:.status.nodeInfo.architecture if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 2 failed. The rest of the fix may depend on it." >&2 fi fi if step 3 'For a certificate error, the node does not trust the registry'\''s issuer, usually because of a TLS inspection proxy.' '' cmd 'openssl s_client -connect registry.example.com:443 -servername registry.example.com /dev/null | openssl x509 -noout -issuer -subject'; then openssl s_client -connect registry.example.com:443 -servername registry.example.com /dev/null | openssl x509 -noout -issuer -subject if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 3 failed. The rest of the fix may depend on it." >&2 fi fi if step 4 'Install the issuing certificate on every node, in the system trust store, and restart the container runtime.' '' cmd 'sudo cp corp-root.crt /usr/local/share/ca-certificates/' 'sudo update-ca-certificates' 'sudo systemctl restart containerd'; then sudo cp corp-root.crt /usr/local/share/ca-certificates/ sudo update-ca-certificates sudo systemctl restart containerd if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 4 failed. The rest of the fix may depend on it." >&2 fi fi step 5 'Do not add the registry to insecure-registries as a workaround -- it removes certificate verification for that host entirely.' 'Worth stating plainly because it is the first suggestion in most search results. It turns a trust problem into a permanently unverified connection carrying the images your cluster runs.' manual || true rule " Confirm it worked" prose 'The pull succeeds over TLS with verification intact.' if [ "$DRYRUN" = "0" ]; then sudo crictl pull registry.example.com/myapp:1.2.3 fi rule if [ "$failed" -gt 0 ]; then echo " Finished with $failed failed step(s)." echo " Read the full write-up at https://jbtecwiz.com/support/lnx-ctr-imagepull" else echo " Finished." fi echo prose 'To undo: Remove the certificate from the trust store and re-run update-ca-certificates.' rule