containerd 1.5开始引入config_path方式，也就是子配置文件的方式
| 对比项 |
老方式（config.toml 内联） |
新方式（config_path + certs.d） |
| 配置组织 |
所有仓库堆在一个 config.toml |
每仓库一个目录，拆成独立 hosts.toml |
| 生效方式 |
改完必须重启 containerd |
读取时生效，不需重启 |
| 故障半径 |
改坏一个字节 → 整个 containerd 起不来 |
改坏只影响对应仓库，其余照常 |
| 配置粒度 |
tls/证书按仓库全局配 |
每个 host 块独立配证书、skip_verify |
| capabilities |
无此概念，mirror 语义只有 pull |
每个 host 可声明 pull/resolve/push |
| push 路由 |
push 固定走真实仓库地址 |
可把 push 也指向内网 host |
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
| 在config.toml中指定config_path，一般都指定certs.d
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = "/etc/containerd/certs.d"
certs.d配置示例
ls /etc/containerd/certs.d/
10.0.0.1:8443/ 10.0.0.2:8443/ 10.0.0.3:8443/ 10.0.0.4:8443/ 10.0.0.5:8443/ 10.0.0.6:8443/
10.0.0.7:8443/ 10.0.0.8:8443/ 10.0.0.9:38088/ 10.0.0.10:8443/ 10.0.0.11:8443/ docker.io/
# 默认仓库：
# 如果k8s中不指定镜像仓库名称，比如k8s-deploy/busybox:1.28即docker.io/k8s-deploy/busybox:1.28
# 就会寻找docker.io默认仓库中的仓库
# 按照host顺序进行尝试
/etc/containerd/certs.d/docker.io/hosts.toml
server = "https://docker.io"
[host."http://10.0.0.9:38088"]
capabilities = ["pull","resolve","push"]
skip_verify = true
[host."https://10.0.0.1:8443"]
capabilities = ["pull","resolve","push"]
skip_verify = true
# 批量生成脚本
REGISTRIES=(
"10.0.0.1:8443"
"10.0.0.2:8443"
"10.0.0.9:38088"
"10.0.0.12:38088"
"10.0.0.6:8443"
"10.0.0.7:8443"
"10.0.0.3:8443"
"10.0.0.4:8443"
"10.0.0.10:8443"
"10.0.0.13:8443"
"10.0.0.14:8443"
"10.0.0.15:8443"
"10.0.0.8:8443"
"10.0.0.16:8443"
)
BASE_DIR="/etc/containerd/certs.d"
for reg in "${REGISTRIES[@]}"; do
TARGET_DIR="${BASE_DIR}/${reg}"
TOML_FILE="${TARGET_DIR}/hosts.toml"
mkdir -p "${TARGET_DIR}"
# 判断 hosts.toml 是否已存在
if [ -f "${TOML_FILE}" ]; then
echo "[SKIP] ${TOML_FILE} 已存在，跳过生成以防覆盖原有证书配置。"
else
cat <<EOF > "${TOML_FILE}"
server = "https://${reg}"
[host."https://${reg}"]
capabilities = ["pull", "resolve", "push"]
skip_verify = true
EOF
echo "[CREATED] 成功创建: ${TOML_FILE}"
fi
done
mkdir -p /etc/containerd/certs.d/docker.io
wget -O /etc/containerd/certs.d/docker.io/hosts.toml 10.0.0.17:8443/xxx/cluster-dockcerio.toml
|
