Versions Compared

Version Old Version 1 New Version 2
Changes made by

Shachar Greenberg

Amit Munwes

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Configuring Mirroring

The registry mirroring configuration may change based on the Kubernetes's container runtime.

...

The mirroring configuration should be added for each one of the worker nodes.

...

There are some methods to automate this configuration. Examples can be found here.

In order to identify the k8s cluster container runtime use the following command:

Code Block
kubectl get nodes -o wide

Example output (see CONTAINER-RUNTIME):

Code Block
# For Docker runtime
NAME         STATUS   VERSION    CONTAINER-RUNTIME
node-1       Ready    v1.16.15   docker://19.3.1
node-2       Ready    v1.16.15   docker://19.3.1

# For containerd runtime
NAME         STATUS   VERSION   CONTAINER-RUNTIME
node-1       Ready    v1.19.6   containerd://1.4.1
node-2       Ready    v1.19.6   containerd://1.4.1

# For CRI-IO runtime
NAME         STATUS   VERSION   CONTAINER-RUNTIME
node-1       Ready    v1.25.11   cri-o://1.25.4
node-2       Ready    v1.25.11   cri-o://1.25.4

Containerd

The containerd Kubernetes's container runtime is used by many k8s providers like Amazon, Google, Microsoft and more.

...

For an extended list, see the following document.

The containerd k8s cluster node configuration is located under /etc/containerd directory.

...

The CRI Registry Configuration is described here.

...

For the containerd CRI configuration changes to take effect, a containerd service restart is required (systemctl restart containerd).

This is an example for the containerd CRI configuration. Change the configuration according to your environment:

  • Add the following attribute config_path = "/etc/containerd/certs.d" to /etc/containerd/config.toml (if not already

...

  • exists):

    Code Block
    [plugins."io.containerd.grpc.v1.cri".registry]
  config_path = "/etc/containerd/certs.d"

  • Create the following directory structure and update the hosts.toml file in each directory:

    Code Block
    $ tree /etc/containerd/certs.d
/etc/containerd/certs.d
└── icr.io
    └── hosts.toml

$ cat /etc/containerd/certs.d/icr.io/hosts.toml
server = "https://icr.io"
[host."https://icr.io/dpod"]
   capabilities = ["pull", "resolve"]
   skip_verify = false 
   override_path = true

CRI deprecated format

Some k8s cloud providers are using a deprecated format of the CRI containerd registry configuration. Although the configuration is deprecated, it was not removed and is still functional. see See configure image registry. For this option DO NOT use the following attribute config_path = "/etc/containerd/certs.d" in /etc/containerd/config.toml and the above directory structure is not needed.
Change the configuration according to your environment:

Code Block
[plugins.cri.registry.mirrors]
  [plugins.cri.registry.mirrors.icr.io"]
    endpoint = ["https://icr.io/dpod"]

Docker, CRI-O

The configuration for these container

...

runtimes is located in /etc/containers/registries.conf.

...

For the CRI configuration changes to take effect, a reboot of each worker node is required (systemctl reboot).

This is an example of the configuration

...

. Change the registry.mirror entries according to your environment:

Code Block
[[registry]]
  prefix = ""
  location = "icr.io/cpopen"
  mirror-by-digest-only = true
  [[registry.mirror]]
    location = "icr.io/dpod"

...