Configuring Mirroring
The registry mirroring configuration may change based on the Kubernetes's container runtime.
The mirroring configuration should be added for each one of the worker nodes.
There are some methods to automate this configuration. Examples can be found here
In order to identify the k8s cluster container runtime use the following command
kubectl get nodes -o wide
Example output (see CONTAINER-RUNTIME):
# For Docker runtime NAME STATUS VERSION CONTAINER-RUNTIME node-1 Ready v1.16.15 docker://19.3.1 node-2 Ready v1.16.15 docker://19.3.1 # For containerd runtime NAME STATUS VERSION CONTAINER-RUNTIME node-1 Ready v1.19.6 containerd://1.4.1 node-2 Ready v1.19.6 containerd://1.4.1 # For CRI-IO runtime NAME STATUS VERSION CONTAINER-RUNTIME node-1 Ready v1.25.11 cri-o://1.25.4 node-2 Ready v1.25.11 cri-o://1.25.4
Containerd
The containerd Kubernetes's container runtime is used by many k8s providers like Amazon, Google, Microsoft and more. for extended list see following document
The containerd k8s cluster node configuration is located under /etc/containerd directory.
The CRI Registry Configuration is described here.
For the containerd CRI configuration changes take effect a containerd service restart is required systemctl restart containerd .
This is an example for the containerd CRI configuration. Change the configuration according to your environment:
Add the following attribute config_path = "/etc/containerd/certs.d" to /etc/containerd/config.toml (if not already exist):
[plugins."io.containerd.grpc.v1.cri".registry] config_path = "/etc/containerd/certs.d"
Create the following directory structure and update the hosts.toml file in each directory:
$ tree /etc/containerd/certs.d
/etc/containerd/certs.d
└── icr.io
└── hosts.toml
$ cat /etc/containerd/certs.d/icr.io/hosts.toml
server = "https://icr.io"
[host."https://icr.io/dpod"]
capabilities = ["pull", "resolve"]
skip_verify = false
override_path = true
CRI deprecated format
Some k8s cloud providers are using deprecated format of CRI containerd registry configuration. Although the configuration is deprecated it was not removed and still functional. see configure image registry
For this option DO NOT use the following attribute config_path = "/etc/containerd/certs.d" in /etc/containerd/config.toml and the above directory structure is not needed.
Change the configuration according to your environment:
[plugins.cri.registry.mirrors]
[plugins.cri.registry.mirrors.icr.io"]
endpoint = ["https://icr.io/dpod"]
Docker , CRI-O
The configuration for these container runtime is located in /etc/containers/registries.conf .
For the CRI configuration changes take effect a reboot of each worker node is required systemctl reboot .
This is an example of the configuration, change the registry.mirror entries according to your environment:
[[registry]]
prefix = ""
location = "icr.io/cpopen"
mirror-by-digest-only = true
[[registry.mirror]]
location = "icr.io/dpod"