containerd 使用自建registry

信任自签名的https服务

直接修改 /etc/containerd/config.toml

[root@master2 ~]# grep -C 10 registry.configs /etc/containerd/config.toml
    [plugins."io.containerd.grpc.v1.cri".cni]
      bin_dir = "/opt/cni/bin"
      conf_dir = "/etc/cni/net.d"
      max_conf_num = 1

      conf_template = ""
    [plugins."io.containerd.grpc.v1.cri".registry]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["https://registry-1.docker.io"]
      [plugins."io.containerd.grpc.v1.cri".registry.configs]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."cloud.internal.com"]
          [plugins."io.containerd.grpc.v1.cri".registry.configs."cloud.internal.com".tls]
            insecure_skip_verify = true
    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
      tls_cert_file = ""
      tls_key_file = ""
  [plugins."io.containerd.internal.v1.opt"]
    path = "/opt/containerd"
  [plugins."io.containerd.internal.v1.restart"]
    interval = "10s"
  [plugins."io.containerd.metadata.v1.bolt"]
    content_sharing_policy = "shared"
[root@master2 ~]# 

1.6 以上的版本使用新方法

[root@master2 ~]# grep -C 10 '\/etc\/containerd\/certs.d' /etc/containerd/config.toml
        runtime_type = ""
        sandbox_mode = ""
        snapshotter = ""
        [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]
    [plugins."io.containerd.grpc.v1.cri".image_decryption]
      key_model = "node"
    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = "/etc/containerd/certs.d"
      [plugins."io.containerd.grpc.v1.cri".registry.auths]
      [plugins."io.containerd.grpc.v1.cri".registry.configs]
      [plugins."io.containerd.grpc.v1.cri".registry.headers]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
[root@master2 ~]#
[root@master2 ~]# cd /etc/containerd/certs.d
[root@master2 certs.d]# ls -al
total 0
drwxr-xr-x 4 root root 57 Feb 11 10:09 .
drwxr-xr-x 3 root root 40 Feb 11 10:20 ..
drwxr-xr-x 2 root root 24 Feb 8 10:46 registry.local:5000
drwxr-xr-x 2 root root 24 Feb 11 10:36 cloud.internal.com
[root@master2 certs.d]# tree .
.
├── registry.local:5000
│ └── hosts.toml
└── cloud.internal.com
└── hosts.toml
2 directories, 2 files
[root@master2 ~]# cat  /etc/containerd/certs.d/registry.local\:5000/hosts.toml
server = "http://registry.local:5000"

[host."http://registry.local:5000"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true

[root@master2 ~]# cat  /etc/containerd/certs.d/cloud.internal.com/hosts.toml
server = "http://cloud.internal.com"

[host."http://cloud.internal.com"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true

[root@master2 ~]#