Registry S3 target for Hetzner Object Storage misses required Docker Distribution S3 options

[Vadime]

We configured a QuickStack S3 target for Hetzner Object Storage and selected it as the registry storage location.

Generated registry config:

region: nbg1
bucket: quickstack-registry01
regionendpoint: nbg1.your-objectstorage.com

BuildKit pushes failed with:

failed to push registry-svc.registry-and-build.svc.cluster.local:5000/...: unknown: blob upload invalid

Registry logs showed:

s3aws: AccessDenied
error resolving upload
unknown error completing upload

The same S3 credentials worked for direct S3 PutObject/HeadObject/ListObjects/Multipart tests.

The registry push started working only after patching the registry deployment with:

REGISTRY_STORAGE_S3_V4AUTH=true
REGISTRY_STORAGE_S3_SECURE=true
REGISTRY_STORAGE_S3_FORCEPATHSTYLE=false
REGISTRY_STORAGE_S3_REGIONENDPOINT=https://nbg1.your-objectstorage.com

Problem:
QuickStack recreates the registry deployment when registry settings change, so manual env patches are not durable.

Expected:
QuickStack should allow advanced S3 registry options or generate Docker Distribution-compatible config for S3-compatible providers like Hetzner Object Storage.

Suggested generated config additions:

storage:
s3:
region: nbg1
regionendpoint: https://nbg1.your-objectstorage.com
secure: true
v4auth: true
forcepathstyle: false

[biersoeckli]

Hey @Vadime

This issue could be caused by a incompatible version of the internal registry wich runs in the QuickStack cluster. It handles the storage locaton of the artifacts after building (either in S3 or local disk).

Maybe you could try to redeploy the registry. This may solves the issue.
Go to QuickStack Settings -> Maintenace

However adding advances S3 registry options is a good idea and it will be added in the next release.