Use quay.io as default to mitigate dockerhub rate limit errors

[samip5]

Expected Behavior

You can freely download the calico container images on a fresh cluster

Current Behavior

Due to Docker Hub ratelimits, re-building a cluster and having many containers pull from Docker Hub might result in hitting rate-limits.

Possible Solution

Push Calico containers to Github Container Registry (ghcr) or quay.io

Context

https://docs.docker.com/docker-hub/download-rate-limit/

[onedr0p]

It would be nice to cover the following images on a separate registry.

docker.io/calico/typha
docker.io/calico/node
docker.io/calico/kube-controllers

[caseydavenport]

@onedr0p @samip5 all of those images are also available on quay.io already.

Another solution would be to download once to a local registry and serve the images locally - this is definitely the best solution for production clusters as it (1) reduces dependency on external infrastructure and (2) reduces ingress traffic to the cluster to download new images (once, rather than once per-node).

[caseydavenport]

I'm going to leave this open, since we should probably consider switching to quay.io as our default registry (again).

[onedr0p]

I did not know these were all on Quay, that's awesome! Seems like you need to modify some pipelines to push the multiarch images to quay and you'll be mostly set 👍🏼

[caseydavenport]

Seems like you need to modify some pipelines to push the multiarch images to quay and you'll be mostly set 👍🏼

I'll need to check if quay has finally started supporting multiarch images. We used to use quay as the default and swapped to dockerhub because at the time quay did not support multi-arch.

If that's changed that would be great, otherwise we have a tradeoff: ratelimit vs multi-arch support.

[caseydavenport]

haha, looks like you already found https://github.com/projectcalico/calico/issues/3520 and informed me that quay does now support multi-arch.

Yeah, we should probably start pushing multi-arch to quay and change our default.

[mkumatag]

any further progress made here?

[caseydavenport]

This might be all that is required: https://github.com/projectcalico/go-build/pull/351

[caseydavenport]

Multi-arch images are on quay now, changing the default still hasn't happened but for anyone finding this you should just be able to switch to images from quay.io/calico/

[macropin]

you should just be able to switch to images from quay.io/calico/

This may be daft question, but how is this done? Installing the tigera-operator using the helm chart doesn't appear to have this as a configuration option, only the following:

# Configuration for the tigera operator
tigeraOperator:
  image: tigera/operator
  version: v1.25.7
  registry: quay.io
calicoctl:
  image: docker.io/calico/ctl
  tag: v3.22.2

Is .Values.tigeraOperator.registry used as the registry for all the component images? Or can it only be configured after installation by editing the Installation custom resource.

[macropin]

Answering my own question above: The following values.yaml is required to use quay.io as the registry source for the operator.

installation:
  registry: quay.io/