MongoDB images seem to be pulled from quay.io although custom registry is configured

[andreas-hempel]

Hello,

we are using the mongodb-kubernetes-operator in our Rancher-managed Kubernetes cluster.
The operator itself is successfully pulled from our internal Harbor registry, and we have adjusted all registry-related values in the values.yaml accordingly.

mongodb-kubernetes:
  registry:
    operator: harbor.mydomain.net/quayio/mongodb

registry:
  # Specify if images are pulled from private registry
  operator: harbor.mydomain.net/quayio/mongodb
  database: harbor.mydomain.net/quayio/mongodb
  initDatabase: harbor.mydomain.net/quayio/mongodb
  initOpsManager: harbor.mydomain.net/quayio/mongodb
  opsManager: harbor.mydomain.net/quayio/mongodb
  initAppDb: harbor.mydomain.net/quayio/mongodb
  agent: harbor.mydomain.net/quayio/mongodb
  versionUpgradeHook: harbor.mydomain.net/quayio/mongodb
  readinessProbe: harbor.mydomain.net/quayio/mongodb

community:
  mongodb:
    repo: harbor.mydomain.net/quayio/mongodb
  registry:
    agent: harbor.mydomain.net/quayio/mongodb

search:
  repo: harbor.mydomain.net/quayio/mongodb

However, we are seeing unexpected behavior regarding the MongoDB Pods:

• In Rancher, the MongoDB Pods are shown as using images from quay.io
• At the same time, in our Rancher proxy repository (pointing to Harbor), the MongoDB image is visible
• The push and pull timestamps in Harbor match the time of our deployment and configuration changes

Because of this, it is unclear to us from which registry the MongoDB image is actually pulled at runtime:

• directly from quay.io, or
• via our internal Harbor registry / proxy repository

What we have done so far:

• Configured all image registry settings in values.yaml to point to our Harbor registry
• Verified that the operator image itself is pulled from Harbor
• Checked Rancher UI, which still shows quay.io as the image source for MongoDB Pods
• Verified that the image exists in Harbor and that pull activity is visible there

Question / Help needed:

• How can we reliably verify which registry the MongoDB image is actually pulled from?
• Is the image name shown in Rancher (e.g. quay.io/...) only cosmetic, while the real pull happens via the configured registry/proxy?
• Are there additional settings in the operator or Helm chart that control the MongoDB image registry independently of the operator image?

Any guidance on how to validate this or pointers to relevant configuration options would be greatly appreciated.
Thank you!

[MohamadTahir]

Hello, we are attempting to configure a custom image registry on our end as well..... have largely been successful in updating the image registry for all components using the following configuration:

community:
  mongodb:
    repo: <your image registry>/mongodb
    name: mongodb-community-server
    imageType: ubi8
  agent:
    name: mongodb-agent
    version: 108.0.2.8729-1
  registry:
    agent: <your image registry>/mongodb

registry:
  pullPolicy: Always
  operator: <your image registry>/mongodb
  database: <your image registry>/mongodb
  initDatabase: <your image registry>/mongodb
  initOpsManager: <your image registry>/mongodb
  opsManager: <your image registry>/mongodb
  agent: <your image registry>/mongodb

  # This is only used by the MongoDBCommunity resource reconciler - START
  versionUpgradeHook: <your image registry>/mongodb
  readinessProbe: <your image registry>/mongodb

However, we are still encountering issues. While investigating, I reviewed the source code and found the following logic:

var OfficialMongodbRepoUrls = []string{"docker.io/mongodb", "quay.io/mongodb"}
func getMongoDBImage(repoUrl, mongodbImage, mongodbImageType, version string) string {
	if strings.HasSuffix(repoUrl, "/") {
		repoUrl = strings.TrimRight(repoUrl, "/")
	}
	mongoImageName := mongodbImage
	for _, officialUrl := range construct.OfficialMongodbRepoUrls {
		if repoUrl == officialUrl {
			return fmt.Sprintf("%s/%s:%s-%s", repoUrl, mongoImageName, version, mongodbImageType)
		}
	}

	// This is the old images backwards compatibility code path.
	return fmt.Sprintf("%s/%s:%s", repoUrl, mongoImageName, version)
}

Issue

Based on this implementation, when using an official MongoDB registry (e.g., docker.io/mongodb or quay.io/mongodb), the image tag format is:

<version>-<imageType>   (e.g., 8.0.17-ubi8)

However, when switching to a custom registry, the logic falls back to the “backwards compatibility” path, resulting in the tag format:

<version>   (e.g., 8.0.17)

This behavior is unexpected. Even when mirroring the exact same images (including tags such as 8.0.17-ubi8) in a custom registry, the operator alters the tag format solely based on the registry URL.

Question

Could you clarify the rationale behind this behavior? Specifically:

1. Why does changing the image registry implicitly change the expected image tag format?
2. Is there a way to preserve the - tag format when using a custom registry?
3. If this is intentional, is there a recommended approach for users who mirror official images but want to retain the same tagging convention?

While the comment mentions backward compatibility, the current behavior makes it difficult to use a private registry that mirrors the official images without retagging them.