Skip to content

Commit d4be6aa

Browse files
mikebrowmikebrow
committed
rm mirror defaults; doc registry deprecations
Signed-off-by: Mike Brown <[email protected]>
1 parent 8b00eaf commit d4be6aa

4 files changed

Lines changed: 43 additions & 38 deletions

File tree

‎docs/cri/config.md‎

Lines changed: 28 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -225,23 +225,6 @@ version = 2
225225
# See the "CNI Config Template" section for more details.
226226
conf_template = ""
227227

228-
# 'plugins."io.containerd.grpc.v1.cri".registry' contains config related to the registry
229-
[plugins."io.containerd.grpc.v1.cri".registry]
230-
# Specifies a directory to look for registry configs in.
231-
# Dir can be used just like /etc/docker/certs.d OR can contain a hosts.toml with more specific configurations.
232-
#
233-
# NOTE: Specifying this will cause the cri plugin to ignore any other registry configs specified in this configuration file.
234-
config_path = "/etc/containerd/certs.d"
235-
236-
# 'plugins."io.containerd.grpc.v1.cri.registry.headers sets the http request headers to send for all registry requests
237-
[plugins."io.containerd.grpc.v1.cri".registry.headers]
238-
Foo = ["bar"]
239-
240-
# 'plugins."io.containerd.grpc.v1.cri".registry.mirrors' are namespace to mirror mapping for all namespaces.
241-
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
242-
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
243-
endpoint = ["https://registry-1.docker.io", ]
244-
245228
# 'plugins."io.containerd.grpc.v1.cri".image_decryption' contains config related
246229
# to handling decryption of encrypted container images.
247230
[plugins."io.containerd.grpc.v1.cri".image_decryption]
@@ -263,6 +246,34 @@ version = 2
263246
# * Stream processors: https://github.com/containerd/containerd/blob/master/docs/stream_processors.md
264247
# * Containerd imgcrypt: https://github.com/containerd/imgcrypt
265248
key_model = "node"
249+
250+
# 'plugins."io.containerd.grpc.v1.cri".registry' contains config related to
251+
# the registry
252+
[plugins."io.containerd.grpc.v1.cri".registry]
253+
# config_path specifies a directory to look for the registry hosts configuration.
254+
#
255+
# The cri plugin will look for and use config_path/host-namespace/hosts.toml
256+
# configs if present OR load certificate files as laid out in the Docker/Moby
257+
# specific layout https://docs.docker.com/engine/security/certificates/
258+
#
259+
# If config_path is not provided defaults are used.
260+
#
261+
# *** registry.configs and registry.mirrors that were a part of containerd 1.4
262+
# are now DEPRECATED and will only be used if the config_path is not specified.
263+
config_path = "/etc/containerd/certs.d"
264+
```
265+
Here is a simple example for a default registry hosts configuration when specifying config_path:
266+
```
267+
$ tree /etc/containerd/certs.d
268+
/etc/containerd/certs.d
269+
└── docker.io
270+
└── hosts.toml
271+
272+
$ cat /etc/containerd/certs.d/docker.io/hosts.toml
273+
server = "https://docker.io"
274+
275+
[host."https://registry-1.docker.io"]
276+
capabilities = ["pull", "resolve"]
266277
```
267278

268279
## Untrusted Workload

‎docs/cri/registry.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22

33
This document describes the method to configure the image registry for `containerd` for use with the `cri` plugin.
44

5+
*** registry.mirrors and registry.configs as described in this document
6+
have been DEPRECATED. As described in [the cri config](./config.md) you
7+
should now use the form
8+
```toml
9+
[plugins."io.containerd.grpc.v1.cri".registry]
10+
config_path = "/etc/containerd/certs.d"
11+
```
12+
513
## Configure Registry Endpoint
614

715
With containerd, `docker.io` is the default image registry. You can also set up other image registries similar to docker.

‎pkg/cri/config/config_unix.go‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -54,17 +54,10 @@ func DefaultConfig() PluginConfig {
5454
TLSKeyFile: "",
5555
TLSCertFile: "",
5656
},
57-
SandboxImage: "k8s.gcr.io/pause:3.5",
58-
StatsCollectPeriod: 10,
59-
SystemdCgroup: false,
60-
MaxContainerLogLineSize: 16 * 1024,
61-
Registry: Registry{
62-
Mirrors: map[string]Mirror{
63-
"docker.io": {
64-
Endpoints: []string{"https://registry-1.docker.io"},
65-
},
66-
},
67-
},
57+
SandboxImage: "k8s.gcr.io/pause:3.5",
58+
StatsCollectPeriod: 10,
59+
SystemdCgroup: false,
60+
MaxContainerLogLineSize: 16 * 1024,
6861
MaxConcurrentDownloads: 3,
6962
DisableProcMount: false,
7063
TolerateMissingHugetlbController: true,

‎pkg/cri/config/config_windows.go‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,9 @@ func DefaultConfig() PluginConfig {
5454
TLSKeyFile: "",
5555
TLSCertFile: "",
5656
},
57-
SandboxImage: "k8s.gcr.io/pause:3.5",
58-
StatsCollectPeriod: 10,
59-
MaxContainerLogLineSize: 16 * 1024,
60-
Registry: Registry{
61-
Mirrors: map[string]Mirror{
62-
"docker.io": {
63-
Endpoints: []string{"https://registry-1.docker.io"},
64-
},
65-
},
66-
},
57+
SandboxImage: "k8s.gcr.io/pause:3.5",
58+
StatsCollectPeriod: 10,
59+
MaxContainerLogLineSize: 16 * 1024,
6760
MaxConcurrentDownloads: 3,
6861
IgnoreImageDefinedVolumes: false,
6962
// TODO(windows): Add platform specific config, so that most common defaults can be shared.

0 commit comments

Comments
 (0)