AAKE deployment fails in restricted environments: 'wait-for-jcp-ws' pod pulls busybox from public Docker Hub

Products

• CA Automic Workload Automation - Automation Engine

Issue/Introduction

During a fresh deployment of Automic Automation Kubernetes Edition (AAKE) v24.4.4 HF1 in a restricted or air-gapped environment, the deployment fails to complete.

The pod wait-for-jcp-ws enters an ImagePullBackOff or ErrImagePull state. Upon inspecting the pod details (kubectl describe pod wait-for-jcp-ws), the events show:

Back-off pulling image "docker.io/library/busybox:latest"

Environment

Automic Automation Kubernetes Edition (AAKE) Version: v24.4.4 HF1 

Cause

The helper pod wait-for-jcp-ws has a hardcoded reference to the public Docker Hub registry (docker.io). It does not correctly inherit the private registry settings configured in the values.yaml (such as global.imageRegistry). In environments where public internet access is restricted, the cluster cannot reach Docker Hub to pull the required busybox image.

This issue is being tracked under Engineering defect: DE189085.

Resolution

The issue will be fixed in the future release of AAKE (for more details contact Broadcom Support) You can follow below workaround meantime.

Workaround :

To resolve the deployment block in the current version, manually update the image reference to point to your internal registry:

1. Identify your local registry path for the busybox image (e.g., my-internal-registry.com/library/busybox:latest).
2. Edit the deployment YAML or the specific pod configuration to replace the public reference:
3. Delete the failing pod to trigger a recreation with the updated image path: kubectl delete pod wait-for-jcp-ws -n [namespace]
4. Verify the pod successfully pulls the image from the internal registry and reaches a Running or Completed state.