creating docker clusters behind corporate firewall with ssl dpi fails

[displacedbuck]

Bug Report

In an environment with a firewall the performs ssl dpi, the control plane fails to initialize. It fails trying to pull the image kindest/haproxy:[tag]. If the same machine is connected to a different network without the ssl dpi the cluster creates.

Expected Behavior

Docker cluster should be able to created

Steps to Reproduce the Bug

Tested on macbook

1. install firewall cert in system trust
2. connect to network with firewall and ssl dpi
3. run tanzu standalone-cluster create -i docker randomname
4. inspect logs for capd-system controlplane and see errors

Environment Details

• Build version (tanzu version): v1.4.0-pre-alpha-2
• Operating System (client): macos bigsur

[joshrosso]

@displacedbuck, any chance you could provide those logs from capd-system control plane as you mentioned?

[displacedbuck]

@joshrosso repetitious error starts at line 144 .
capd-controller.txt

[joshrosso]

Got it! Thanks for the extra detail.

Adding a note here that when we move away from dockerhub for CAPD's HA Proxy, this issue should go away.

• Use a (VMware) Harbor hosted ha-proxy image for CAPD installations #897

However, I'd welcome any guidance folks have on this behavior when SSL DPI is in place.