Set [plugins."io.containerd.grpc.v1.cri".registry].config_path by default

[evankanderson]

What is the problem you're trying to solve

I'm trying to add a new private registry (with a self-signed CA) to an existing Kubernetes cluster, where I may not have ssh access (but I do have cluster-admin).

Describe the solution you'd like

When using docker, something like the following suffices to add a selfsigned CA:

echo "${PEM_ENCODED_CERT}" > /etc/docker/certs.d/${REGISTRY_NAME}/ca.crt

According the containerd documentation, loading registry certificates after startup requires the following key to be set in config.toml:

[plugins."io.containerd.grpc.v1.cri".registry]
   config_path = "/etc/containerd/certs.d"

Adding this entry isn't sufficient, however, because you also need to restart containerd. Users end up with solutions like this:

http://hypernephelist.com/2021/03/23/kubernetes-containerd-certificate.html

Note that this solution is debian (update-ca-certificates) / systemd (systemctl) specific, and actually modifies the entire set of trust roots for the host, rather than modifying the config.toml programatically (because that seems dangerous)

It would be much cleaner if [plugins."io.containerd.grpc.v1.cri".registry].config_path defaulted to either:

1. "/etc/containerd/certs.d"
2. "/etc/containerd/certs.d:/etc/docker/certs.d"

My preference would be for 2, because it would allow scripts that worked with Docker to also work with containerd, but would still prefer certs in /etc/containerd if present.

Additional context

No response

[dims]

cc @adisky

[cpuguy83]

This is not defaulted because it is a new option which is replacing older options.
We could see if the older options are set and set a default if they are not, maybe?
Alternatively, depending on your situation, ask your k8s provider to set a default value for new nodes.

[evankanderson]

Would it be reasonable to default it if older options are not set? I'd be happy to do a PR proposal if that would make it easier.

I'm trying to write up provider-independent directions and tutorials for an on-cluster or local build chain, so I'm hoping for a default that would work across providers. 😁

[cpuguy83]

Would it be reasonable to default it if older options are not set? I'd be happy to do a PR proposal if that would make it easier.

That seems reasonable to me.

[sparr]

Discussion in #6488 includes "We could probably wait for 2.0 for this (should be release after 1.7)." from @cpuguy83
Can this issue be removed from milestone 1.7?