Skip to content

Commit 17bc80d

Browse files
jimmidysonjimmidyson
committed
fix: Correctly configure non-mirror registry certificates
CA certificates are now written to `/etc/containerd/certs.d/<registryHost>/ca.crt` as required. Remove non-mirror registry config from `/etc/containerd/certs.d/_default/hosts.toml` which was causing all registries to be configured as mirror registry.
1 parent fe93e85 commit 17bc80d

File tree

5 files changed

+20
-40
lines changed

5 files changed

+20
-40
lines changed

‎pkg/handlers/generic/mutation/mirrors/containerd_files.go‎

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ var (
2626
//go:embed templates/hosts.toml.gotmpl
2727
containerdHostsConfiguration []byte
2828

29-
containerdHostsConfigurationTemplate = template.Must(
29+
containerdDefaultHostsConfigurationTemplate = template.Must(
3030
template.New("").Parse(string(containerdHostsConfiguration)),
3131
)
3232

@@ -36,7 +36,7 @@ var (
3636
"registry-config.toml",
3737
)
3838

39-
mirrorCACertPathOnRemoteFmt = "/etc/certs/%s.pem"
39+
caCertPathOnRemoteFmt = "/etc/containerd/certs.d/%s/ca.crt"
4040
)
4141

4242
type containerdConfig struct {
@@ -54,14 +54,7 @@ func (c containerdConfig) filePathFromURL() (string, error) {
5454
return "", fmt.Errorf("failed parsing registry URL: %w", err)
5555
}
5656

57-
registryHostWithPath := registryURL.Host
58-
if registryURL.Path != "" {
59-
registryHostWithPath = path.Join(registryURL.Host, registryURL.Path)
60-
}
61-
62-
replaced := strings.ReplaceAll(registryHostWithPath, "/", "-")
63-
64-
return fmt.Sprintf(mirrorCACertPathOnRemoteFmt, replaced), nil
57+
return fmt.Sprintf(caCertPathOnRemoteFmt, registryURL.Host), nil
6558
}
6659

6760
// Return true if configuration is a mirror or has a CA certificate.
@@ -76,7 +69,7 @@ func (c containerdConfig) needContainerdConfiguration() bool {
7669
// https://github.com/containerd/containerd/blob/main/docs/hosts.md#setup-default-mirror-for-all-registries
7770
//
7871
// 2. Setting CA certificate for global image registry mirror and image registries.
79-
func generateContainerdHostsFile(
72+
func generateContainerdDefaultHostsFile(
8073
configs []containerdConfig,
8174
) (*cabpkv1.File, error) {
8275
if len(configs) == 0 {
@@ -86,13 +79,12 @@ func generateContainerdHostsFile(
8679
type templateInput struct {
8780
URL string
8881
CACertPath string
89-
Mirror bool
9082
}
9183

9284
inputs := make([]templateInput, 0, len(configs))
9385

9486
for _, config := range configs {
95-
if !config.needContainerdConfiguration() {
87+
if !config.Mirror {
9688
continue
9789
}
9890

@@ -102,14 +94,12 @@ func generateContainerdHostsFile(
10294
}
10395

10496
input := templateInput{
105-
URL: formattedURL,
106-
Mirror: config.Mirror,
97+
URL: formattedURL,
10798
}
10899
// CA cert is optional for mirror registry.
109100
// i.e. registry is using signed certificates. Insecure registry will not be allowed.
110101
if config.CACert != "" {
111-
var registryCACertPathOnRemote string
112-
registryCACertPathOnRemote, err = config.filePathFromURL()
102+
registryCACertPathOnRemote, err := config.filePathFromURL()
113103
if err != nil {
114104
return nil, fmt.Errorf(
115105
"failed generating CA certificate file path from URL: %w",
@@ -123,7 +113,7 @@ func generateContainerdHostsFile(
123113
}
124114

125115
var b bytes.Buffer
126-
err := containerdHostsConfigurationTemplate.Execute(&b, inputs)
116+
err := containerdDefaultHostsConfigurationTemplate.Execute(&b, inputs)
127117
if err != nil {
128118
return nil, fmt.Errorf("failed executing template for Containerd hosts.toml file: %w", err)
129119
}

‎pkg/handlers/generic/mutation/mirrors/containerd_files_test.go‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111
cabpkv1 "sigs.k8s.io/cluster-api/bootstrap/kubeadm/api/v1beta1"
1212
)
1313

14-
func Test_generateContainerdHostsFile(t *testing.T) {
14+
func Test_generateContainerdDefaultHostsFile(t *testing.T) {
1515
t.Parallel()
1616
tests := []struct {
1717
name string
@@ -85,7 +85,7 @@ func Test_generateContainerdHostsFile(t *testing.T) {
8585
Append: false,
8686
Content: `[host."https://mymirror.com/v2"]
8787
capabilities = ["pull", "resolve"]
88-
ca = "/etc/certs/mymirror.com.pem"
88+
ca = "/etc/containerd/certs.d/mymirror.com/ca.crt"
8989
# don't rely on Containerd to add the v2/ suffix
9090
# there is a bug where it is added incorrectly for mirrors with a path
9191
override_path = true
@@ -118,14 +118,10 @@ func Test_generateContainerdHostsFile(t *testing.T) {
118118
Append: false,
119119
Content: `[host."https://mymirror.com/v2"]
120120
capabilities = ["pull", "resolve"]
121-
ca = "/etc/certs/mymirror.com.pem"
121+
ca = "/etc/containerd/certs.d/mymirror.com/ca.crt"
122122
# don't rely on Containerd to add the v2/ suffix
123123
# there is a bug where it is added incorrectly for mirrors with a path
124124
override_path = true
125-
[host."https://myregistry.com/v2"]
126-
ca = "/etc/certs/myregistry.com.pem"
127-
[host."https://172.100.0.10:5000/v2/myproject"]
128-
ca = "/etc/certs/172.100.0.10:5000-myproject.pem"
129125
`,
130126
},
131127
wantErr: nil,
@@ -144,8 +140,7 @@ func Test_generateContainerdHostsFile(t *testing.T) {
144140
Permissions: "0600",
145141
Encoding: "",
146142
Append: false,
147-
Content: `[host."https://myregistry.com/v2"]
148-
ca = "/etc/certs/myregistry.com.pem"
143+
Content: `
149144
`,
150145
},
151146
wantErr: nil,
@@ -155,7 +150,7 @@ func Test_generateContainerdHostsFile(t *testing.T) {
155150
tt := tests[idx]
156151
t.Run(tt.name, func(t *testing.T) {
157152
t.Parallel()
158-
file, err := generateContainerdHostsFile(tt.configs)
153+
file, err := generateContainerdDefaultHostsFile(tt.configs)
159154
require.ErrorIs(t, err, tt.wantErr)
160155
assert.Equal(t, tt.want, file)
161156
})
@@ -190,7 +185,7 @@ func Test_generateRegistryCACertFiles(t *testing.T) {
190185
},
191186
want: []cabpkv1.File{
192187
{
193-
Path: "/etc/certs/registry.example.com.pem",
188+
Path: "/etc/containerd/certs.d/registry.example.com/ca.crt",
194189
Owner: "",
195190
Permissions: "0600",
196191
Encoding: "",

‎pkg/handlers/generic/mutation/mirrors/inject.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ func generateFiles(
239239
) ([]bootstrapv1.File, error) {
240240
var files []bootstrapv1.File
241241
// generate default registry mirror file
242-
containerdHostsFile, err := generateContainerdHostsFile(registriesWithOptionalCA)
242+
containerdHostsFile, err := generateContainerdDefaultHostsFile(registriesWithOptionalCA)
243243
if err != nil {
244244
return nil, err
245245
}

‎pkg/handlers/generic/mutation/mirrors/inject_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ var _ = Describe("Generate Global mirror patches", func() {
9999
"path", "/etc/containerd/certs.d/_default/hosts.toml",
100100
),
101101
gomega.HaveKeyWithValue(
102-
"path", "/etc/certs/registry.example.com.pem",
102+
"path", "/etc/containerd/certs.d/registry.example.com/ca.crt",
103103
),
104104
gomega.HaveKeyWithValue(
105105
"path", "/etc/caren/containerd/patches/registry-config.toml",
@@ -166,7 +166,7 @@ var _ = Describe("Generate Global mirror patches", func() {
166166
"path", "/etc/containerd/certs.d/_default/hosts.toml",
167167
),
168168
gomega.HaveKeyWithValue(
169-
"path", "/etc/certs/registry.example.com.pem",
169+
"path", "/etc/containerd/certs.d/registry.example.com/ca.crt",
170170
),
171171
gomega.HaveKeyWithValue(
172172
"path", "/etc/caren/containerd/patches/registry-config.toml",
@@ -244,7 +244,7 @@ var _ = Describe("Generate Global mirror patches", func() {
244244
"path", "/etc/containerd/certs.d/_default/hosts.toml",
245245
),
246246
gomega.HaveKeyWithValue(
247-
"path", "/etc/certs/registry.example.com.pem",
247+
"path", "/etc/containerd/certs.d/registry.example.com/ca.crt",
248248
),
249249
gomega.HaveKeyWithValue(
250250
"path", "/etc/caren/containerd/patches/registry-config.toml",
@@ -299,7 +299,7 @@ var _ = Describe("Generate Global mirror patches", func() {
299299
capitest.VariableWithValue(
300300
v1alpha1.ClusterConfigVariableName,
301301
[]v1alpha1.ImageRegistry{{
302-
URL: "https://registry.example.com",
302+
URL: "https://registry.example.com:5050",
303303
Credentials: &v1alpha1.RegistryCredentials{
304304
SecretRef: &v1alpha1.LocalObjectReference{
305305
Name: validMirrorCASecretName,
@@ -327,7 +327,7 @@ var _ = Describe("Generate Global mirror patches", func() {
327327
"path", "/etc/containerd/certs.d/_default/hosts.toml",
328328
),
329329
gomega.HaveKeyWithValue(
330-
"path", "/etc/certs/registry.example.com.pem",
330+
"path", "/etc/containerd/certs.d/registry.example.com:5050/ca.crt",
331331
),
332332
gomega.HaveKeyWithValue(
333333
"path", "/etc/caren/containerd/patches/registry-config.toml",

‎pkg/handlers/generic/mutation/mirrors/templates/hosts.toml.gotmpl‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
{{- range . }}
2-
{{- if .Mirror }}
32
[host."{{ .URL }}"]
43
capabilities = ["pull", "resolve"]
54
{{- if .CACertPath }}
@@ -8,8 +7,4 @@
87
# don't rely on Containerd to add the v2/ suffix
98
# there is a bug where it is added incorrectly for mirrors with a path
109
override_path = true
11-
{{- else }}
12-
[host."{{ .URL }}"]
13-
ca = "{{ .CACertPath }}"
14-
{{- end }}
1510
{{- end }}

0 commit comments

Comments
 (0)