如何信任不安全的镜像仓库？

问题描述

托管平台组件镜像的镜像仓库可能不提供 HTTPS 服务，或者没有由公共证书颁发机构签发的有效 TLS 证书。如果您信任此仓库，请按照以下步骤配置容器运行时。

配置对不安全镜像仓库的信任

注意：

所有需要使用镜像的节点（包括新添加的节点）都必须完成配置，并重启 Containerd。
Containerd v1.4/v1.5 与 v1.6 之间的配置略有不同。请根据您的版本执行相应步骤。

在导入集群中的每个节点上运行以下命令：

备份配置文件

mkdir -p '/var/backup-containerd-confs/'
if ! [ -f /etc/containerd/config.toml ]; then
    echo 'Containerd config not found. Please check if containerd is correctly installed. If you still cannot resolve the issue, contact technical support.'
    exit 1
else
    cp /etc/containerd/config.toml /var/backup-containerd-confs/config.toml_$(date +%F_%T)
fi

获取 Containerd 运行时版本

# Get the containerd version
# Compare this version to v1.6. Choose steps accordingly
ctr --version | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+'

Containerd v1.4 v1.5 不安全仓库配置

在导入集群中的每个节点上运行以下命令：

编辑 /etc/containerd/config.toml

# Example content to add to the config file
# Lines in brackets are sections. If the file already has sections with the same name, merge their contents.
[plugins."io.containerd.grpc.v1.cri".registry]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."<registry-address>"]
            endpoint = ["https://<registry-address>", "http://<registry-address>"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.134.43"]
            endpoint = ["https://192.168.134.43", "http://192.168.134.43"]
    [plugins."io.containerd.grpc.v1.cri".registry.configs]
        [plugins."io.containerd.grpc.v1.cri".registry.configs."<registry-address>".tls]
            insecure_skip_verify = true
        [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.134.43".tls]
            insecure_skip_verify = true

重启 Containerd。

systemctl daemon-reload && systemctl restart containerd

Containerd v1.6 不安全仓库配置

在导入集群中的每个节点上运行以下命令：

检查配置中是否存在 config_path。

if ! grep -qF 'config_path' /etc/containerd/config.toml; then
    if grep -qE '\[plugins."io.containerd.grpc.v1.cri".registry.(mirrors|configs)(\.|\])' /etc/containerd/config.toml; then
        echo 'Follow the steps in "Containerd v1.4 v1.5 configuration for insecure registries".'
    else
        cat >> /etc/containerd/config.toml << 'EOF'
[plugins."io.containerd.grpc.v1.cri".registry]
    config_path = "/etc/containerd/certs.d/"
EOF
    fi
fi

config_path_var=$(grep -F '/etc/containerd/certs.d' /etc/containerd/config.toml)
if [ -z "$config_path_var" ]; then
   echo 'The value of config_path in the file is unexpected. Please check!'
   exit 1
fi

创建 hosts.toml 文件。

如果上一条命令输出了 Follow the steps in "Containerd v1.4 v1.5 configuration for insecure registries".，请参阅 Containerd v1.4 v1.5 不安全仓库配置。

REGISTRY='<registry address obtained in the "Get the registry address" section>'    

mkdir -p "/etc/containerd/certs.d/$REGISTRY/"
cat > "/etc/containerd/certs.d/$REGISTRY/hosts.toml" << EOF
server = "$REGISTRY"
[host."http://$REGISTRY"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
[host."https://$REGISTRY"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
EOF

重启 Containerd。

systemctl daemon-reload && systemctl restart containerd

#如何信任不安全的镜像仓库？

#目录

#问题描述

#配置对不安全镜像仓库的信任

如何信任不安全的镜像仓库？

目录

问题描述

配置对不安全镜像仓库的信任