Platform Center
Home / Platform management / Clusters / Clusters / FAQ / How to Trust Insecure Image Registry?

How to Trust Insecure Image Registry?

Description of the problem

The repository providing platform component images may not offer HTTPS service or may not provide a legitimate TLS certificate authenticated by a public certification authority. If you trust this repository, please refer to the following steps to configure the container runtime.

Insecure Image Registry Configuration

The steps to configure repository trust vary depending on the container runtime you are using. The documentation supports both Docker and containerd runtimes.

Docker runtime

Procedure of operation

  1. Execute the following commands on all nodes that are added to the cluster:

    • Backup the Docker configuration file.
    mkdir -p '/var/backup-docker-confs/'
if ! [ -f /etc/docker/daemon.json ]; then
    echo 'Not Found docker Configuration File，Please Check docker Installed Correctly。If Troubleshooting Still Fails，Technical Support Available。'
    exit 1
else
    cp /etc/docker/daemon.json "/var/backup-docker-confs/daemon.json_$(date -u +%F_%R)"
fi
    • Modify the /etc/docker/daemon.json file.

    Make sure that the insecure-registries parameter exists in the file and add the repository address obtained in the first step.

    Taking the scenario of configuring multiple image addresses as an example, the reference configuration is as follows:

    {
    "insecure-registries": [
        "<repositoryaddress>",
        "192.168.134.43"
    ],
    "registry-mirrors": ["https://6telrzl8.mirror.aliyuncs.com"],
    "log-opts": {
      "max-size": "100m",
      "max-file": "2"
    },
    "live-restore": true,
    "metrics-addr": "0.0.0.0:9323",
    "experimental": true,
    "storage-driver": "overlay2"
}

  2. (Optional) Use the jq command to check the syntax of the Docker configuration file.

    Tip: Please make sure that jq is installed on the host. You can refer to the command: yum install jq -y.

    jq . < /etc/docker/daemon.json

  3. Restart Docker service on all nodes.

    systemctl daemon-reload
systemctl restart docker

Containerd Runtime

Note:

  1. Execute the following commands on all nodes that are joined to the cluster:

    • Backup configuration files
    mkdir -p '/var/backup-containerd-confs/'
if ! [ -f /etc/containerd/config.toml ]; then
    echo 'Not Found containerd Configuration File，Please Check containerd Whether Installed Correctly。If Still Unable to Troubleshoot，Technical Support Available。'
    exit 1
else
    cp /etc/containerd/config.toml /var/backup-containerd-confs/config.toml_$(date +%F_%T)
fi
    • Get the version of the Containerd container runtime.
    # Get the version on the environment containerd version
# Please compare if the version number is less than v1.6，and choose the appropriate steps in the following document
ctr --version | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+'

Containerd v1.4 v1.5 Insecure Repository Configuration

  1. Execute the following commands on all nodes that are joined to the cluster:

    • Modify the /etc/containerd/config.toml configuration file.
    # Example of content to be added to the configuration file
# Lines enclosed in square brackets are called nodes，When adding the following content to the configuration file，Please check if there are nodes with the same name in the configuration file
# If nodes with the same name already exist，Please merge the content under the node
[plugins."io.containerd.grpc.v1.cri".registry]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors]  # To write multiple repository addresses under this configurationendpoint
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."<repositoryAddress>"]
            endpoint = ["https://<repositoryAddress>", "http://<repositoryAddress>"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.134.43"]
            endpoint = ["https://192.168.134.43", "http://192.168.134.43"]
    [plugins."io.containerd.grpc.v1.cri".registry.configs]
        [plugins."io.containerd.grpc.v1.cri".registry.configs."<repositoryAddress>".tls]
            insecure_skip_verify = true
        [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.134.43".tls]
            insecure_skip_verify = true
    • Restart the Containerd service.
    systemctl daemon-reload && systemctl restart containerd

Containerd v1.6 Insecure Repository Configuration

  1. Execute the following commands on all nodes that are joined to the cluster:

    • Check if the config_path field exists in the configuration file.
    if ! grep -qF 'config_path' /etc/containerd/config.toml; then
    if grep -qE '\[plugins."io.containerd.grpc.v1.cri".registry.(mirrors|configs)(\.|\])' /etc/containerconfig.toml; then
        echo 'Please follow“Containerd v1.4 v1.5 insecurerepositoryconfiguration”the instructions in the section。'
    else
        cat >> /etc/containerd/config.toml << 'EOF'
[plugins."io.containerd.grpc.v1.cri".registry]
    config_path = "/etc/containerd/certs.d/"
EOF
    fi
fi

config_path_var=$(grep -F '/etc/containerd/certs.d' /etc/containerd/config.toml)
if [ -z "$config_path_var" ]; then
   echo ' the config_path in the configuration file, value of the field is unexpected，Please check！'
   exit 1
fi
    • Create the hosts.toml file.

    If the command executed in the previous step prompts “Please follow the instructions in the section ‘Containerd v1.4 v1.5 Insecure Repository Configuration’.”

    Please refer to the section Containerd v1.4 v1.5 Unsafe Repository Configuration.

    REGISTRY=<“getrepositoryaddress”obtained in one sectionrepositoryaddress>

mkdir -p "/etc/containerd/certs.d/$REGISTRY/"
cat > "/etc/containerd/certs.d/$REGISTRY/hosts.toml" << EOF
server = "$REGISTRY"
[host."http://$REGISTRY"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
[host."https://$REGISTRY"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
EOF
    • Restart the Containerd service.
    systemctl daemon-reload && systemctl restart containerd