如何解决Minikube拉取Docker私有镜像时的x509证书遗留通用名称字段问题？

Got it, let's break down why your GODEBUG export didn't work and get that image deployed properly. The core issue here is that the certificate validation happens inside the Minikube node's container runtime (Docker/containerd), not your local shell—so setting GODEBUG on your machine doesn't affect the process that's actually pulling the image. Since you can pull via local Docker, your local setup is already trusting the registry, but Minikube's runtime isn't.

Here are three actionable solutions, ordered from quick temporary fixes to the recommended long-term approach:

1. Trust the Registry Certificate in Minikube's Container Runtime #

This replicates your local Docker's trusted certificate setup inside the Minikube node.

Steps (for Docker runtime, most common in Minikube): #

• First, locate your local trusted certificate for the registry. It's usually stored at /etc/docker/certs.d/docker-registry.localdomain/ca.crt (if you added it manually for local Docker).
• Copy this certificate into the Minikube node's Docker trust directory:

  minikube cp /etc/docker/certs.d/docker-registry.localdomain/ca.crt /etc/docker/certs.d/docker-registry.localdomain/ca.crt
  

• Restart Docker inside Minikube to apply the change:

  minikube ssh -- sudo systemctl restart docker
  

• Now try your deployment command again:

  kubectl run test --image=docker-registry.localdomain/others/test:latest --port=8077 --generator=run/v1
  

If Minikube uses containerd instead of Docker, copy the certificate to /etc/containerd/certs.d/docker-registry.localdomain/ca.crt and restart containerd with minikube ssh -- sudo systemctl restart containerd.

2. Temporary: Set GODEBUG in Minikube's Container Runtime (Not Recommended for Production) #

If you just need a quick fix without updating certificates, you can configure the Minikube node's Docker/containerd to use the GODEBUG=x509ignoreCN=0 flag.

For Docker: #

• SSH into the Minikube node:

  minikube ssh
  

• Edit Docker's systemd service file to add the environment variable:

  sudo vi /lib/systemd/system/docker.service
  

• Add this line above the ExecStart line:

  Environment="GODEBUG=x509ignoreCN=0"
  

• Reload systemd and restart Docker:

  sudo systemctl daemon-reload
  sudo systemctl restart docker
  

• Exit the Minikube node and re-run your deployment command.

3. Long-Term Fix: Update Registry Certificate to Use SANs #

The error message is pointing out a deprecated TLS practice—using the Common Name (CN) field instead of Subject Alternative Names (SANs). This is the most sustainable solution.

Steps: #

• Regenerate your registry's certificate signing request (CSR) and include a SANs extension that specifies docker-registry.localdomain as a valid domain.
• Use your CA to re-sign the CSR with the SANs included.
• Update your private registry to use the new certificate.
• Replace the old certificate in both your local Docker trust store and the Minikube node's trust store (using the method from Solution 1).
• After this, the certificate will comply with modern TLS standards, and you won't hit this error again.

Quick DNS Check #

Before trying any of the above, make sure the Minikube node can resolve your registry's domain:

minikube ssh -- nslookup docker-registry.localdomain

If it fails, add a hosts entry in the Minikube node:

minikube ssh -- sudo echo "YOUR_REGISTRY_IP docker-registry.localdomain" >> /etc/hosts

内容的提问来源于stack exchange，提问作者bin381