Skip to content
This repository was archived by the owner on Mar 9, 2022. It is now read-only.

Commit b1bef15

Browse files
Random-LiuRandom-Liu
authored
Merge pull request #1346 from Random-Liu/cherrypick-#1345-release-1.3
[release/1.3] Add insecure_skip_verify option.
2 parents e5dd805 + 27edfa0 commit b1bef15

3 files changed

Lines changed: 42 additions & 32 deletions

File tree

‎docs/registry.md‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ To configure image registries create/modify the `/etc/containerd/config.toml` as
99
[plugins.cri.registry.mirrors]
1010
[plugins.cri.registry.mirrors."docker.io"]
1111
endpoint = ["https://registry-1.docker.io"]
12-
[plugins.cri.registry.mirrors."test.secure-registry.io"]
12+
[plugins.cri.registry.mirrors."test.https-registry.io"]
1313
endpoint = ["https://HostIP1:Port1"]
14-
[plugins.cri.registry.mirrors."test.insecure-registry.io"]
14+
[plugins.cri.registry.mirrors."test.http-registry.io"]
1515
endpoint = ["http://HostIP2:Port2"]
1616
# wildcard matching is supported but not required.
1717
[plugins.cri.registry.mirrors."*"]
18-
endpoint = ["http://HostIP3:Port3"]
18+
endpoint = ["https://HostIP3:Port3"]
1919
```
2020

2121
The default configuration can be generated by `containerd config default > /etc/containerd/config.toml`.
@@ -38,7 +38,8 @@ After modify this config, you need restart the `containerd` service.
3838

3939
To configure the TLS settings for a specific registry, create/modify the `/etc/containerd/config.toml` as follows:
4040
```toml
41-
# The registry host has to be an FDQN or IP.
41+
# The registry host has to be a domain name or IP. Port number is also
42+
# needed if the default HTTPS or HTTP port is not used.
4243
[plugins.cri.registry.configs."my.custom.registry".tls]
4344
ca_file = "ca.pem"
4445
cert_file = "cert.pem"
@@ -51,19 +52,25 @@ In the config example shown above, TLS mutual authentication will be used for co
5152
`cert_file` and `key_file` are not needed when TLS mutual authentication is unused.
5253

5354
```toml
54-
# The registry host has to be an FDQN or IP.
5555
[plugins.cri.registry.configs."my.custom.registry".tls]
5656
ca_file = "ca.pem"
5757
```
5858

59+
To skip the registry certificate verification:
60+
```
61+
[plugins.cri.registry.configs."my.custom.registry".tls]
62+
insecure_skip_verify = true
63+
```
64+
5965
## Configure Registry Credentials
6066

6167
`cri` plugin also supports docker like registry credential config.
6268

6369
To configure a credential for a specific registry, create/modify the
6470
`/etc/containerd/config.toml` as follows:
6571
```toml
66-
# The registry host has to be an FDQN or IP.
72+
# The registry host has to be a domain name or IP. Port number is also
73+
# needed if the default HTTPS or HTTP port is not used.
6774
[plugins.cri.registry.configs."gcr.io".auth]
6875
username = ""
6976
password = ""

‎pkg/config/config.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,10 @@ type AuthConfig struct {
122122

123123
// TLSConfig contains the CA/Cert/Key used for a registry
124124
type TLSConfig struct {
125-
CAFile string `toml:"ca_file" json:"caFile"`
126-
CertFile string `toml:"cert_file" json:"certFile"`
127-
KeyFile string `toml:"key_file" json:"keyFile"`
125+
InsecureSkipVerify bool `toml:"insecure_skip_verify" json:"insecure_skip_verify"`
126+
CAFile string `toml:"ca_file" json:"caFile"`
127+
CertFile string `toml:"cert_file" json:"certFile"`
128+
KeyFile string `toml:"key_file" json:"keyFile"`
128129
}
129130

130131
// Registry is registry settings configured

‎pkg/server/image_pull.go‎

Lines changed: 25 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -253,39 +253,41 @@ func (c *criService) updateImage(ctx context.Context, r string) error {
253253
// getTLSConfig returns a TLSConfig configured with a CA/Cert/Key specified by registryTLSConfig
254254
func (c *criService) getTLSConfig(registryTLSConfig criconfig.TLSConfig) (*tls.Config, error) {
255255
var (
256-
cert tls.Certificate
257-
err error
256+
tlsConfig = &tls.Config{}
257+
cert tls.Certificate
258+
err error
258259
)
259-
if registryTLSConfig.CertFile != "" && registryTLSConfig.KeyFile != "" {
260-
cert, err = tls.LoadX509KeyPair(registryTLSConfig.CertFile, registryTLSConfig.KeyFile)
261-
if err != nil {
262-
return nil, errors.Wrap(err, "failed to load cert file")
263-
}
264-
}
265260
if registryTLSConfig.CertFile != "" && registryTLSConfig.KeyFile == "" {
266261
return nil, errors.Errorf("cert file %q was specified, but no corresponding key file was specified", registryTLSConfig.CertFile)
267262
}
268263
if registryTLSConfig.CertFile == "" && registryTLSConfig.KeyFile != "" {
269264
return nil, errors.Errorf("key file %q was specified, but no corresponding cert file was specified", registryTLSConfig.KeyFile)
270265
}
271-
272-
caCertPool, err := x509.SystemCertPool()
273-
if err != nil {
274-
return nil, errors.Wrap(err, "failed to get system cert pool")
275-
}
276-
caCert, err := ioutil.ReadFile(registryTLSConfig.CAFile)
277-
if err != nil {
278-
return nil, errors.Wrap(err, "failed to load CA file")
266+
if registryTLSConfig.CertFile != "" && registryTLSConfig.KeyFile != "" {
267+
cert, err = tls.LoadX509KeyPair(registryTLSConfig.CertFile, registryTLSConfig.KeyFile)
268+
if err != nil {
269+
return nil, errors.Wrap(err, "failed to load cert file")
270+
}
271+
if len(cert.Certificate) != 0 {
272+
tlsConfig.Certificates = []tls.Certificate{cert}
273+
}
274+
tlsConfig.BuildNameToCertificate()
279275
}
280-
caCertPool.AppendCertsFromPEM(caCert)
281276

282-
tlsConfig := &tls.Config{
283-
RootCAs: caCertPool,
284-
}
285-
if len(cert.Certificate) != 0 {
286-
tlsConfig.Certificates = []tls.Certificate{cert}
277+
if registryTLSConfig.CAFile != "" {
278+
caCertPool, err := x509.SystemCertPool()
279+
if err != nil {
280+
return nil, errors.Wrap(err, "failed to get system cert pool")
281+
}
282+
caCert, err := ioutil.ReadFile(registryTLSConfig.CAFile)
283+
if err != nil {
284+
return nil, errors.Wrap(err, "failed to load CA file")
285+
}
286+
caCertPool.AppendCertsFromPEM(caCert)
287+
tlsConfig.RootCAs = caCertPool
287288
}
288-
tlsConfig.BuildNameToCertificate()
289+
290+
tlsConfig.InsecureSkipVerify = registryTLSConfig.InsecureSkipVerify
289291
return tlsConfig, nil
290292
}
291293

0 commit comments

Comments
 (0)