set default config_path in plugin init

akhilerm · samuelkarp · k8s-infra-cherrypick-robot · commit a20dead7cc64 · 2026-03-06T23:31:31.000Z
move setting the config_path from default image config to plugin init.
only set the default value when both mirrors and config_path are empty,
in all other cases retain the existing behaviour

Co-authored-by: Samuel Karp &lt;samuelkarp@google.com&gt;
Signed-off-by: Akhil Mohan &lt;akhilerm@gmail.com&gt;
Signed-off-by: Samuel Karp &lt;samuelkarp@google.com&gt;
diff --git a/internal/cri/config/config_unix.go b/internal/cri/config/config_unix.go
@@ -32,9 +32,7 @@ func DefaultImageConfig() ImageConfig {
 		Snapshotter:                defaults.DefaultSnapshotter,
 		DisableSnapshotAnnotations: true,
 		MaxConcurrentDownloads:     3,
-		Registry: Registry{
-			ConfigPath: "/etc/containerd/certs.d:/etc/docker/certs.d",
-		},
+		Registry:                   Registry{},
 		ImageDecryption: ImageDecryption{
 			KeyModel: KeyModelNode,
 		},
diff --git a/plugins/cri/images/plugin.go b/plugins/cri/images/plugin.go
@@ -61,6 +61,16 @@ func init() {
 			}
 			mdb := m.(*metadata.DB)
 
+			// only set the default value of config path, if both mirrors and
+			// config path are empty and we are on Linux.
+			// This also makes sure that if the loaded config already contains both config path and mirrors
+			// the validation will fail.
+			if runtime.GOOS == "linux" {
+				if config.Registry.ConfigPath == "" && len(config.Registry.Mirrors) == 0 {
+					config.Registry.ConfigPath = "/etc/containerd/certs.d:/etc/docker/certs.d"
+				}
+			}
+
 			if warnings, err := criconfig.ValidateImageConfig(ic.Context, &config); err != nil {
 				return nil, fmt.Errorf("invalid cri image config: %w", err)
 			} else if len(warnings) > 0 {
@@ -210,18 +220,6 @@ func migrateConfig(dst, src map[string]interface{}) {
 			dst[key] = val
 		}
 	}
-	if runtime.GOOS == "linux" {
-		if value, ok := dst["registry"]; ok {
-			regMap := value.(map[string]any)
-			if configPath, ok := regMap["config_path"]; ok {
-				if configPath == "" {
-					// Fill in default from config_unix.go (DefaultImageConfig)
-					regMap["config_path"] = "/etc/containerd/certs.d:/etc/docker/certs.d"
-				}
-			}
-			dst["registry"] = regMap
-		}
-	}
 
 	containerdConf, ok := src["containerd"]
 	if !ok {
