通过HA Proxy代理GCP容器镜像仓库拉取镜像报错排查

我有一个存储Docker镜像和Helm Chart的GCP Container Registry，不想直接暴露该仓库，希望通过HA Proxy服务器拉取Docker镜像和Helm Chart。

我的HA Proxy配置如下：

frontend myfrontend
  bind 0.0.0.0:8080
  use_backend maven-repo if { path_beg -i /repository }
  use_backend gcp-repo if { path_beg -i /dev-registry }
  default_backend gcp-repo

backend maven-repo
  server maven-repo mvn01-ashok-dev.net:443 ssl verify none check inter 5s

backend gcp-repo
  server gcp-repo dev-docker.pkg.dev:443 ssl verify none check inter 5s

但通过HA Proxy拉取Docker镜像时出现如下错误：

ashok@ubuntu:~$ docker pull localhost:8080/dev-registry/gateway-cluster-images/nextgen-nativebridge:1.1.0
Error response from daemon: error parsing HTTP 404 response body: invalid character '<' looking for beginning of value: "<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content=\"initial-scale=1, minimum-scale=1, width=device-width\">
  <title>Error 404 (Not Found)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>404.</b> <ins>That’s an error.</ins>
  <p>The requested URL <code>/v2/gateway-images/gateway-cluster-images/nextgen-nativebridge/manifests/1.1.0</code> was not found on this server.  <ins>That’s all we know.</ins>
"

请问我遗漏了什么配置或步骤？

问题源于两个关键配置缺失：

1. 路径重写错误 #

Docker客户端会自动在请求路径前添加/v2前缀，当你请求localhost:8080/dev-registry/xxx时，实际转发到GCP Registry的路径变成了/dev-registry/v2/xxx，但GCP Registry的正确路径格式应为/v2/[仓库命名空间]/xxx，也就是/v2/dev-registry/xxx。

2. Host头未正确设置 #

GCP Container Registry依赖请求的Host头识别目标仓库，转发时需要将Host头设置为GCP Registry的域名dev-docker.pkg.dev。

修改后的HAProxy配置 #

frontend myfrontend
  bind 0.0.0.0:8080
  use_backend maven-repo if { path_beg -i /repository }
  use_backend gcp-repo if { path_beg -i /dev-registry }
  default_backend gcp-repo

backend maven-repo
  server maven-repo mvn01-ashok-dev.net:443 ssl verify none check inter 5s

backend gcp-repo
  # 重写路径：移除开头的/dev-registry，将/v2前置
  http-request replace-path ^/dev-registry(/v2/.*)$ \1
  # 设置GCP Registry的Host头
  http-request set-header Host dev-docker.pkg.dev
  server gcp-repo dev-docker.pkg.dev:443 ssl verify none check inter 5s

补充说明 #

• 如果你的HAProxy版本低于1.6，不支持http-request replace-path，可以用reqrep指令替代：reqrep ^([^\ ]*\ /)dev-registry(/v2/.*)$ \1\2
• Helm的OCI拉取请求遵循Docker Registry API规范，上述配置同样兼容Helm Chart的拉取
• 可以查看HAProxy日志确认转发后的路径是否正确，便于后续排查问题

内容的提问来源于stack exchange，提问作者Ashok Kumar