Versions Compared

Version Old Version 2 New Version Current
Changes made by

Amit Munwes

Amit Munwes

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Configuring Mirroring

The registry mirroring configuration may change based on the Kubernetes's container runtime. The mirroring configuration should be added for each one of the worker nodes. There are some methods to automate this configuration. Examples can be found here.

...

Code Block
# For Docker runtime
NAME         STATUS   VERSION    CONTAINER-RUNTIME
node-1       Ready    v1.16.15   docker://19.3.1
node-2       Ready    v1.16.15   docker://19.3.1

# For containerd runtime
NAME         STATUS   VERSION   CONTAINER-RUNTIME
node-1       Ready    v1.19.6   containerd://1.4.1
node-2       Ready    v1.19.6   containerd://1.4.1

# For CRI-IO runtime
NAME         STATUS   VERSION   CONTAINER-RUNTIME
node-1       Ready    v1.25.11   cri-o://1.25.4
node-2       Ready    v1.25.11   cri-o://1.25.4

Containerd

The containerd Kubernetes's container runtime is used by many k8s providers like Amazon, Google, Microsoft and more. For an extended list, see the following document.

...

  • Add the following attribute config_path = "/etc/containerd/certs.d" to /etc/containerd/config.toml (if not already exists):

    Code Block
    [plugins."io.containerd.grpc.v1.cri".registry]
  config_path = "/etc/containerd/certs.d"

  • Create the following directory structure and update the hosts.toml file in each directory:

    Code Block
    $ tree /etc/containerd/certs.d
/etc/containerd/certs.d
└── icr.io
    └── hosts.toml

$ cat /etc/containerd/certs.d/icr.io/hosts.toml
server = "https://icr.io"
[host."https://icr.io/dpod"]
   capabilities = ["pull", "resolve"]
   skip_verify = false 
   override_path = true

CRI deprecated format

Some k8s cloud providers are using a deprecated format of the CRI containerd registry configuration. Although the configuration is deprecated, it was not removed and is still functional. See configure image registry. For this option DO NOT use the following attribute config_path = "/etc/containerd/certs.d" in /etc/containerd/config.toml and the above directory structure is not needed.
Change the configuration according to your environment:

Code Block
[plugins.cri.registry.mirrors]
  [plugins.cri.registry.mirrors.icr.io"]
    endpoint = ["https://icr.io/dpod"]

Docker, CRI-O

The configuration for these container runtimes is located in /etc/containers/registries.conf. For the CRI configuration changes to take effect, a reboot of each worker node is required (systemctl reboot).

...