Error: "x509: certificate signed by unknown authority" when containerd fails to pull images from Harbor

Products

• VMware Telco Cloud Automation

Issue/Introduction

• Application deployments fail to pull images from a private Harbor registry instance.
• Component pods remain permanently stalled in ImagePullBackOff or ErrImagePull states.
• Curl returns status 200 with the --cacert flag:
  

  curl --cacert /etc/ssl/certs/<Your-Harbor-Certificate>.crt  https://<Harbor-Fqdn>
  
  

• Manually executing image pulls via the crictl tool returns an explicit TLS authorization exception:
  

  sudo crictl pull <REDACTED_HOSTNAME>/<project>/<tag>
  
  PullImage from image service failed" err="rpc error: code = Unknown desc = failed to pull and unpack image \"<Harbor-Fqdn>/<Project>\": failed to resolve reference \"<Harbor-Fqdn>/<Project>\": failed to do request: Head \"<Harbor-Fqdn>/<Project>\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

Environment

TCA: 3.3

 

Cause

• The containerd runtime service retains a stale in-memory validation cache and does not automatically hot-reload or process newly appended certificate blocks located inside the host operating system's trust paths.

Resolution

1. Ssh into the affected cluster node
2. Verify that the correct Certificate Authority (CA) chain is present within the node's configuration payload:
   

   openssl x509 -in /etc/ssl/certs/<Your-Harbor-Certificate>.crt -text -noout

3. Restart the container runtime daemon to clear stale caches and force a reload of the certificate file structures:
   

   sudo systemctl restart containerd

4. Re-execute the image pull test to confirm successful TLS handshake resolution:

   sudo crictl pull <REDACTED_HOSTNAME>/<project>/<tag>