Image pulls from embedded registry fail if --bind-address is set (and not 127.0.0.1) about k3s

[brandond]

I can take a look at addressing this when I bump the embedded spegel version. I will note that this currently only affects servers, as agents do not support the --bind-address flag, so the listener address cannot be configured. Might want to promote that to an agent flag as well I guess.

[achristianson]

Might want to promote that to an agent flag as well I guess.

Having the bind flag on agents would definitely be desirable (and make the overall config options more consistent).

[brandond]

there are already some changes staged in this space in

• #10019

[brandond]

One of the problems here is that spegel needs to be able to identify which requests are from the local containerd instance and should proxy to other nodes, as opposed to those from other nodes that should not be reproxied. Right now this is done by identifying requests to localhost, and I can't think of another really good way to do that without opening more ports. We may just need to set it up so that it binds to localhost plus the configured bind address.

[brandond]

OK, I've modified that PR to always bind the supervisor on the loopback addresses, in addition to the requested address