How do I get k3s to authenticate with Docker Hub?

Question

In jornalctl -u k3s, I see a bunch of errors like this

429 Too Many Requests - Server message: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit

When I check the associate pods, I see

Error from server (BadRequest): container "foo" in pod "bar" is waiting to start: trying and failing to pull image

How can I set up k3s to use an authenticate login to DockerHub? I don't see a docker login, and I've tried probably 20 different things none of which worked. I can confirm this username and password works with --creds to either crictl or ctr. But it doesn't work when I try to put it in a config file. I've tried to playing with

• /etc/rancher/k3s/registries.yaml and restarting.
• that seems to generate a new /var/lib/rancher/k3s/agent/etc/containerd/config.toml, I've tried playing with that file too directly

None of this seems to make any difference. I've tried testing with k3s kubectl run and also with k3s crt and k3s crictl without providing --creds, and none of these change the error that's returned.

My token has full access at https://hub.docker.com/settings/security

Answer 1

1. Update your /etc/rancher/k3s/registries.yaml to

   configs:
     registry-1.docker.io:
       auth:
         username: evancarroll
         password: TOKENHIDDEN
   

2. Restart k3s, sudo systemctl force-reload k3s.

You can confirm the changes were accepted by checking that your key exists in /var/lib/rancher/k3s/agent/etc/containerd/config.toml.