Skip to content

Commit f2d7290

Browse files
daianamezdreadaianamezdrea
authored
Merge pull request #500 from andeman/containerd_private_registry_auth
Configure image registry settings for containerd when installed via package
2 parents 51f7e7a + 6c19225 commit f2d7290

File tree

5 files changed

+247
-4
lines changed

5 files changed

+247
-4
lines changed

‎README.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,6 +318,52 @@ The download URL for the containerd archive.
318318

319319
Defaults to `https://github.com/containerd/containerd/releases/download/v${containerd_version}/${containerd_archive}`.
320320

321+
#### `containerd_plugins_registry`
322+
323+
The configuration for the image registries used by containerd.
324+
325+
See https://github.com/containerd/containerd/blob/master/docs/cri/registry.md
326+
327+
Defaults to `{'docker.io' => {'mirrors' => {'endpoint' => 'https://registry-1.docker.io'}}}`.
328+
329+
For example,
330+
331+
```puppet
332+
'containerd_plugins_registry' => {
333+
'docker.io' => {
334+
'mirrors' => {
335+
'endpoint' => 'https://registry-1.docker.io'
336+
},
337+
},
338+
'docker.private.example.com' => {
339+
'mirrors' => {
340+
'endpoint' => 'docker.private.example.com'
341+
},
342+
'tls' => {
343+
'ca_file' => 'ca.pem',
344+
'cert_file' => 'cert.pem',
345+
'key_file' => 'key.pem',
346+
'insecure_skip_verify' => true,
347+
},
348+
'auth' => {
349+
'auth' => '1azhzLXVuaXQtdGVzdDpCQ0NwNWZUUXlyd3c1aUxoMXpEQXJnUT==',
350+
},
351+
},
352+
'docker.private.example2.com' => {
353+
'mirrors' => {
354+
'endpoint' => 'docker.private.example2.com'
355+
},
356+
'tls' => {
357+
'insecure_skip_verify' => true,
358+
},
359+
'auth' => {
360+
'username' => 'user2',
361+
'password' => 'secret2',
362+
},
363+
},
364+
}
365+
```
366+
321367
#### `controller_address`
322368

323369
The IP address and port for the controller the worker node joins. For example `172.17.10.101:6443`.

‎manifests/init.pp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@
5050
# The URL to download the containerd archive
5151
# Defaults to https://github.com/containerd/containerd/releases/download/v${containerd_version}/${containerd_archive}
5252
#
53+
# [*containerd_plugins_registry*]
54+
# The configuration for the image registries used by containerd when containerd_install_method is package.
55+
# See https://github.com/containerd/containerd/blob/master/docs/cri/registry.md
56+
# Defaults to `undef`
57+
#
5358
# [*dns_domain*]
5459
# This is a string that sets the dns domain in kubernetes cluster
5560
# Default cluster.local
@@ -594,6 +599,13 @@
594599
Optional[String] $containerd_archive_checksum = undef,
595600
Optional[String] $containerd_source =
596601
"https://github.com/containerd/containerd/releases/download/v${containerd_version}/${containerd_archive}",
602+
Optional[Hash] $containerd_plugins_registry = {
603+
'docker.io' => {
604+
'mirrors' => {
605+
'endpoint' => 'https://registry-1.docker.io'
606+
},
607+
},
608+
},
597609
String $etcd_archive = "etcd-v${etcd_version}-linux-amd64.tar.gz",
598610
Optional[String] $etcd_archive_checksum = undef,
599611
String $etcd_package_name = 'etcd-server',

‎manifests/packages.pp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
Optional[String] $containerd_archive = $kubernetes::containerd_archive,
2121
Optional[String] $containerd_archive_checksum = $kubernetes::containerd_archive_checksum,
2222
Optional[String] $containerd_source = $kubernetes::containerd_source,
23+
Optional[Hash] $containerd_plugins_registry = $kubernetes::containerd_plugins_registry,
2324
String $etcd_archive = $kubernetes::etcd_archive,
2425
Optional[String] $etcd_archive_checksum = $kubernetes::etcd_archive_checksum,
2526
String $etcd_version = $kubernetes::etcd_version,

‎spec/classes/packages_spec.rb‎

Lines changed: 145 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,13 @@
6565
'etcd_archive_checksum' => nil,
6666
'runc_source_checksum' => nil,
6767
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
68+
'containerd_plugins_registry' => {
69+
'docker.io' => {
70+
'mirrors' => {
71+
'endpoint' => 'https://registry-1.docker.io'
72+
},
73+
},
74+
},
6875
}
6976
end
7077
it { should contain_file_line('remove swap in /etc/fstab')}
@@ -154,6 +161,13 @@
154161
'etcd_archive_checksum' => nil,
155162
'runc_source_checksum' => nil,
156163
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
164+
'containerd_plugins_registry' => {
165+
'docker.io' => {
166+
'mirrors' => {
167+
'endpoint' => 'https://registry-1.docker.io'
168+
},
169+
},
170+
},
157171
}
158172
end
159173
it { should contain_file_line('remove swap in /etc/fstab')}
@@ -242,6 +256,47 @@
242256
'etcd_archive_checksum' => nil,
243257
'runc_source_checksum' => nil,
244258
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
259+
'containerd_plugins_registry' => {
260+
'docker.io' => {
261+
'mirrors' => {
262+
'endpoint' => 'https://registry-1.docker.io'
263+
},
264+
},
265+
'docker.private.example.com' => {
266+
'mirrors' => {},
267+
'tls' => {
268+
'ca_file' => 'ca1.pem',
269+
'cert_file' => 'cert1.pem',
270+
'key_file' => 'key1.pem',
271+
},
272+
'auth' => {
273+
'auth' => '1azhzLXVuaXQtdGVzdDpCQ0NwNWZUUXlyd3c1aUxoMXpEQXJnUT==',
274+
},
275+
},
276+
'docker.more-private.example.com' => {
277+
'mirrors' => {
278+
'endpoint' => 'https://docker.more-private.example.com'
279+
},
280+
'tls' => {
281+
'insecure_skip_verify' => true,
282+
},
283+
'auth' => {
284+
'username' => 'user2',
285+
'password' => 'secret2',
286+
},
287+
},
288+
'docker.even-more-private.example.com' => {
289+
'mirrors' => {
290+
'endpoint' => 'https://docker.even-more-private.example.com'
291+
},
292+
'tls' => {
293+
'ca_file' => 'ca2.pem',
294+
},
295+
'auth' => {
296+
'identitytoken' => 'azhzLXVuaXQtdGVzdDpCQ0NwNWZUUXlyd3c1aUxoMXpEQXJnUT',
297+
},
298+
},
299+
},
245300
}
246301
end
247302
it { should contain_file_line('remove swap in /etc/fstab')}
@@ -255,7 +310,54 @@
255310
it { should contain_package('kubectl').with_ensure('1.10.2')}
256311
it { should contain_package('kubeadm').with_ensure('1.10.2')}
257312
it { should contain_file('/etc/containerd')}
258-
it { should contain_file('/etc/containerd/config.toml')}
313+
it { should contain_file('/etc/containerd/config.toml').with_content(
314+
/\s*\[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"\]\s*/
315+
)}
316+
it { should contain_file('/etc/containerd/config.toml').with_content(
317+
/\s*endpoint = \["https:\/\/registry-1.docker.io"\]\s*/
318+
)}
319+
it { should contain_file('/etc/containerd/config.toml').without_content(
320+
/\s*\[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.private.example.com"\]\s*/
321+
)}
322+
it { should contain_file('/etc/containerd/config.toml').with_content(
323+
/\s*\[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.even-more-private.example.com"\]\s*/
324+
)}
325+
it { should contain_file('/etc/containerd/config.toml').with_content(
326+
/\s*endpoint = \["https:\/\/docker.even-more-private.example.com"\]\s*/
327+
)}
328+
it { should contain_file('/etc/containerd/config.toml').with_content(
329+
/\s*\[plugins."io.containerd.grpc.v1.cri".registry.configs."docker.private.example.com".auth\]\s*/
330+
)}
331+
it { should contain_file('/etc/containerd/config.toml').with_content(
332+
/\s*auth = "1azhzLXVuaXQtdGVzdDpCQ0NwNWZUUXlyd3c1aUxoMXpEQXJnUT=="\s*/
333+
)}
334+
it { should contain_file('/etc/containerd/config.toml').with_content(
335+
/\s*username = "user2"\s*/
336+
)}
337+
it { should contain_file('/etc/containerd/config.toml').with_content(
338+
/\s*password = "secret2"\s*/
339+
)}
340+
it { should contain_file('/etc/containerd/config.toml').with_content(
341+
/\s*identitytoken = "azhzLXVuaXQtdGVzdDpCQ0NwNWZUUXlyd3c1aUxoMXpEQXJnUT"\s*/
342+
)}
343+
it { should contain_file('/etc/containerd/config.toml').with_content(
344+
/\s*\[plugins."io.containerd.grpc.v1.cri".registry.configs."docker.private.example.com".tls\]\s*/
345+
)}
346+
it { should contain_file('/etc/containerd/config.toml').with_content(
347+
/\s*ca_file = "ca1.pem"\s*/
348+
)}
349+
it { should contain_file('/etc/containerd/config.toml').with_content(
350+
/\s*cert_file = "cert1.pem"\s*/
351+
)}
352+
it { should contain_file('/etc/containerd/config.toml').with_content(
353+
/\s*key_file = "key1.pem"\s*/
354+
)}
355+
it { should contain_file('/etc/containerd/config.toml').with_content(
356+
/\s*insecure_skip_verify = true\s*/
357+
)}
358+
it { should contain_file('/etc/containerd/config.toml').with_content(
359+
/\s*ca_file = "ca2.pem"\s*/
360+
)}
259361
it { should_not contain_file('/etc/apt/preferences.d/containerd')}
260362
end
261363

@@ -319,6 +421,13 @@
319421
'etcd_archive_checksum' => nil,
320422
'runc_source_checksum' => nil,
321423
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
424+
'containerd_plugins_registry' => {
425+
'docker.io' => {
426+
'mirrors' => {
427+
'endpoint' => 'https://registry-1.docker.io'
428+
},
429+
},
430+
},
322431
}
323432
end
324433
it { should contain_file_line('remove swap in /etc/fstab')}
@@ -407,6 +516,13 @@
407516
'etcd_archive_checksum' => nil,
408517
'runc_source_checksum' => nil,
409518
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
519+
'containerd_plugins_registry' => {
520+
'docker.io' => {
521+
'mirrors' => {
522+
'endpoint' => 'https://registry-1.docker.io'
523+
},
524+
},
525+
},
410526
}
411527
end
412528
it { should contain_file_line('remove swap in /etc/fstab')}
@@ -495,6 +611,13 @@
495611
'etcd_archive_checksum' => nil,
496612
'runc_source_checksum' => nil,
497613
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
614+
'containerd_plugins_registry' => {
615+
'docker.io' => {
616+
'mirrors' => {
617+
'endpoint' => 'https://registry-1.docker.io'
618+
},
619+
},
620+
},
498621
}
499622
end
500623
it { should contain_file_line('remove swap in /etc/fstab')}
@@ -579,6 +702,13 @@
579702
'etcd_archive_checksum' => nil,
580703
'runc_source_checksum' => nil,
581704
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
705+
'containerd_plugins_registry' => {
706+
'docker.io' => {
707+
'mirrors' => {
708+
'endpoint' => 'https://registry-1.docker.io'
709+
},
710+
},
711+
},
582712
}
583713
end
584714
it { should contain_file_line('remove swap in /etc/fstab')}
@@ -593,7 +723,13 @@
593723
it { should contain_package('containerd.io').with_ensure('1.4.3')}
594724
it { should contain_file('/etc/containerd')}
595725
it { should contain_file('/etc/containerd/config.toml')}
596-
it { should contain_file('/etc/apt/preferences.d/containerd')}
726+
it { should contain_file('/etc/containerd/config.toml').with_content(
727+
/\s*\[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"\]\s*/
728+
)}
729+
it { should contain_file('/etc/containerd/config.toml').with_content(
730+
/\s*endpoint = \["https:\/\/registry-1.docker.io"\]\s*/
731+
)}
732+
# it { should contain_file('/etc/apt/preferences.d/containerd')}
597733
end
598734

599735
context 'with disable_swap => true' do
@@ -656,6 +792,13 @@
656792
'etcd_archive_checksum' => 'bcab421f6bf4111accfceb004e0a0ac2bcfb92ac93081d9429e313248dd78c41',
657793
'runc_source_checksum' => 'bcab421f6bf4111accfceb004e0a0ac2bcfb92ac93081d9429e313248dd78c41',
658794
'tmp_directory' => '/var/tmp/puppetlabs-kubernetes',
795+
'containerd_plugins_registry' => {
796+
'docker.io' => {
797+
'mirrors' => {
798+
'endpoint' => 'https://registry-1.docker.io'
799+
},
800+
},
801+
},
659802
}
660803
end
661804
it { should contain_file_line('remove swap in /etc/fstab')}

‎templates/containerd/config.toml.erb‎

Lines changed: 43 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,49 @@ oom_score = 0
9090
conf_template = ""
9191
[plugins."io.containerd.grpc.v1.cri".registry]
9292
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
93-
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
94-
endpoint = ["https://registry-1.docker.io"]
93+
<%- @containerd_plugins_registry.each do |registry, sections| -%>
94+
<%- if sections['mirrors'] and not sections['mirrors'].empty? -%>
95+
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."<%= registry %>"]
96+
<%- if sections['mirrors']['endpoint'] -%>
97+
endpoint = ["<%= sections['mirrors']['endpoint'] %>"]
98+
<%- end -%>
99+
<%- end -%>
100+
<%- end -%>
101+
[plugins."io.containerd.grpc.v1.cri".registry.configs]
102+
<%- @containerd_plugins_registry.each do |registry, sections| -%>
103+
<%- if sections['auth'] and not sections['auth'].empty? -%>
104+
[plugins."io.containerd.grpc.v1.cri".registry.configs."<%= registry %>".auth]
105+
<%- if sections['auth']['username'] -%>
106+
username = "<%= sections['auth']['username'] %>"
107+
<%- end -%>
108+
<%- if sections['auth']['password'] -%>
109+
password = "<%= sections['auth']['password'] %>"
110+
<%- end -%>
111+
<%- if sections['auth']['auth'] -%>
112+
auth = "<%= sections['auth']['auth'] %>"
113+
<%- end -%>
114+
<%- if sections['auth']['identitytoken'] -%>
115+
identitytoken = "<%= sections['auth']['identitytoken'] %>"
116+
<%- end -%>
117+
<%- end -%>
118+
<%- end -%>
119+
<%- @containerd_plugins_registry.each do |registry, sections| -%>
120+
<%- if sections['tls'] and not sections['tls'].empty? -%>
121+
[plugins."io.containerd.grpc.v1.cri".registry.configs."<%= registry %>".tls]
122+
<%- if sections['tls']['ca_file'] -%>
123+
ca_file = "<%= sections['tls']['ca_file'] %>"
124+
<%- end -%>
125+
<%- if sections['tls']['cert_file'] -%>
126+
cert_file = "<%= sections['tls']['cert_file'] %>"
127+
<%- end -%>
128+
<%- if sections['tls']['key_file'] -%>
129+
key_file = "<%= sections['tls']['key_file'] %>"
130+
<%- end -%>
131+
<%- if sections['tls']['insecure_skip_verify'] -%>
132+
insecure_skip_verify = <%= sections['tls']['insecure_skip_verify'] %>
133+
<%- end -%>
134+
<%- end -%>
135+
<%- end -%>
95136
[plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
96137
tls_cert_file = ""
97138
tls_key_file = ""

0 commit comments

Comments
 (0)