Failed to install Calico CNI

[Kiddinglife]

curl https://raw.githubusercontent.com/rancher/k3d/main/docs/usage/guides/calico.yaml > calico.yaml
k3d cluster create --k3s-server-arg '--flannel-backend=none' --volume "$(pwd)/k3d-manifests/calico.yaml:/var/lib/rancher/k3s/server/manifests/calico.yaml"

Events:
  Type     Reason     Age                  From               Message
  ----     ------     ----                 ----               -------
  Normal   Scheduled  2m17s                default-scheduler  Successfully assigned kube-system/calico-node-z64q5 to k3d-k3s-default-server-0
  Normal   Pulling    56s (x3 over 2m10s)  kubelet            Pulling image "calico/cni:v3.15.0"
  Warning  Failed     41s (x3 over 114s)   kubelet            Error: ErrImagePull
  Warning  Failed     41s (x3 over 114s)   kubelet            Failed to pull image "calico/cni:v3.15.0": rpc error: code = Unknown desc = failed to pull and unpack image "docker.io/calico/cni:v3.15.0": failed to copy: httpReaderSeeker: failed open: unexpected status code https://registry-1.docker.io/v2/calico/cni/manifests/sha256:0534a6ec32a1a8790f7762437ec2eda62e58ef1cef88fde67cf894016817fddc: 429 Too Many Requests - Server message: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit
  Warning  Failed     4s (x5 over 113s)    kubelet            Error: ImagePullBackOff
  Normal   BackOff    4s (x5 over 113s)    kubelet            Back-off pulling image "calico/cni:v3.15.0"

k3d --version
k3d version v4.4.4
k3s version v1.20.6-k3s1 (default)

docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
  scan: Docker Scan (Docker Inc., v0.8.0)

Server:
 Containers: 2
  Running: 2
  Paused: 0
  Stopped: 0
 Images: 3
 Server Version: 20.10.7
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: d71fcd7d8303cbf684402823e425e9dd2e99285d
 runc version: b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: default
 Kernel Version: 5.11.0-7614-generic
 Operating System: Pop!_OS 20.10
 OSType: linux
 Architecture: x86_64
 CPUs: 24
 Total Memory: 19.51GiB
 Name: pop-os
 ID: TGF2:ZKDR:NQ4F:NKQT:Z4BC:O4OG:EI44:X4ZU:2TXJ:NB6T:2UIF:TIYD
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

[iwilltry42]

Hi @Kiddinglife , thanks for starting this discussion!
Actually the message says it all:

You have reached your pull rate limit. You may increase the limit by authenticating and upgrading

So you ran into Docker Hub's pull rate limitation (see https://www.docker.com/increase-rate-limits).
Unless you can wait for a while, you can authenticate containerd by creating a registries.yaml file (see https://k3d.io/usage/guides/registries/#authenticated-registries & https://rancher.com/docs/k3s/latest/en/installation/private-registry/ )

[Kiddinglife]

still not working. plus k3d image import also not working.cannot see the loaded image from the worker node.
k3d from beginning to give up....I spent two days on k3d and cannot get it work following the document. will switch back to kinD. Thank you foryour time. please review and test the doc manually instead of in an automated way.

[iwilltry42]

Hi @Kiddinglife , sorry for your experience here, but this is absolutely not an issue with k3d but with DockerHub rate limiting.
Can you please comment on what your issues are with configuring it to use your authenticated, not rate-limited user?

k3d image import also not working.cannot see the loaded image from the worker node.

What is not working there? Any log output or terminal screenshot or anything would greatly help us to help you.

please review and test the doc manually instead of in an automated way.

What do you mean by this? There is no automated testing for this and the docs are written after real use cases.

Not going to stop you from switching back to kind, if it suits your needs better though.

[iwilltry42]

UPDATE:

So I just followed the docs again to authenticate against a registry:

1. Create the registry configuration file for containerd:

configs:
  "docker.io":
    auth:
      username: $USER
      password: $PASSWORD

2. Create a new k3d cluster using this config (saved as registries.yaml in current workdir):

k3d cluster create --registry-config registries.yaml

3. Verify that it works to authenticate against DockerHub (DockerHub has a pull rate limit of 100 pulls per hour for anonymous and 200 pulls/h for authenticated users; and unlimited for paying customers):

$ docker exec -it k3d-k3s-default-server-0 sh
/ # for i in $(seq 1 120); do
/ #   echo "pull #$i"
/ #   ctr image pull docker.io/calico/cni:v3.15.0
/ # done

3.1 I also did this with an image I own to ensure that the pull numbers are going up.

4. Ensure there was no error raised.

So that means, that containerd is authenticated against DockerHub and doesn't hit the "anonymous user" pull rate limit of 100 pulls per hour (it would hit 200 though since I'm not a paying customer.

Note: All images pulled by default in k3d/k3s are owned by the rancher org on DockerHub and for them, the rate limit does not apply.