Fix containerd config_path mirrors and remove nerdctl insecure_registry

[yckaolalala]

What type of PR is this?

/kind bug
/kind feature

What this PR does / why we need it:

Currently, containerd_use_config_path disable use mirrors config .

Add containerd_registries_mirrors is similar as crio_registries

crio_registries:
  - prefix: docker.io
    insecure: false
    blocked: false
    unqualified: false
    location: registry-1.docker.io
    mirrors:
      - location: mirror.gcr.io
        insecure: false
        
containerd_registries_mirrors:
  - prefix: docker.io
    mirrors:
      - host: https://mirror.gcr.io
        capabilities: ["pull", "resolve"]
        skip_verify: false
      - host: https://registry-1.docker.io
        capabilities: ["pull", "resolve"]
        skip_verify: false

Currently, it appears that nerdctl is not reading the mirrors config in /etc/containerd/config.toml. nerdctl issue#981. However, nerdctl can read the mirrors config if hosts_dir is set in /etc/nerdctl/nerdctl.toml. Therefore, I have removed the check for containerd_use_config_path when writing to hosts.toml.

Remove the nerdctl_extra_flags and insecure_registry settings. Instead, nerdctl can pull from an insecure registry by configuring the containerd_registries_mirrors .

containerd_registries_mirrors:
  - prefix: 172.19.16.11:5000
    mirrors:
      - host: http://172.19.16.11:5000
        capabilities: ["pull", "resolve", "push"]
        skip_verify: true

Which issue(s) this PR fixes:

Fixes #9743

Special notes for your reviewer:

Should change default containerd_use_config_path to true?
Alternatively, can add a variable such as containerd_config_path_required_version: "1.5".

Does this PR introduce a user-facing change?:

[containerd] containerd config_path enable mirrors config using new variable `containerd_registries_mirrors`  (deprecate and remove `containerd_insecure_registries` for containrd and  `nerdctl_extra_flags` and `insecure_registry` setting for nerdctl

[k8s-ci-robot]

Hi @yckaolalala. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yankay]

/ok-to-test

[MrFreezeex]

Hi @yckaolalala could you rebase your PR 🙏? I can't get the CI to pass because of some changes that reaches master :(.

[yckaolalala]

packet_debian11-calico-upgrade test failed, This job used old config.toml and can not use new containerd_registries.
I add new containerd_registries_mirrors and keep containerd_registries

[MrFreezeex]

Thanks! Could you just rewrite the release notes accordingly then? Apart from that looks good, many thanks for this nice contribution 🙏
/lgtm

[MrFreezeex]

Thanks for the rebase 🙏
/lgtm

[yckaolalala]

rebased

[MrFreezeex]

Thanks 🙏
/lgtm

[MrFreezeex]

/lgtm

[floryut]

@yckaolalala Sorry for the delay, thank you for the PR !

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: floryut, MrFreezeex, yckaolalala

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [floryut]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sathieu]

This is a breaking change. Can it me marked as such in the release notes?

[yankay]

This is a breaking change. Can it me marked as such in the release notes?

Thanks @sathieu ,
it has been changed , https://github.com/kubernetes-sigs/kubespray/releases/tag/v2.23.0

[sathieu]

Thanks @yankay. Maybe it should be added to the Deprecation / Removal section too ?

[yankay]

HI @sathieu

I'm not sure, the Deprecation / Removal is used for the software remove in before release.
Adding ⚠️ to make it more noticed

[sathieu]

Thanks @yankay This is great!

[VannTen]

@yankay the releases note is not detailled enough.
In particular, this breaks the usage of container_registries, (not mentioned anywhere). Can you add that to 2.23 release
("Removal of containerd_registries variable, please migrate to containerd_registries_mirrors" + a link to the doc for that).