Dockershim deprecation: Private registries support with Containerd

[SergeyKanzhelev]

This is a Feature Request

For the dockershim deprecation migration guide this https://kubernetes.io/docs/concepts/containers/images/#configuring-nodes-to-authenticate-to-a-private-registry needs to be updated for other runtimes.

Why is this needed

As dockershim is deprecated, migration guides are needed (see #104878).

KEP: kubernetes/enhancements#2221

/sig node

[adisky]

@SergeyKanzhelev I guess the existing docker cfg will work for other container runtimes as well, as credential provider is Kubelet mechanism, if it works only reference of docker runtime needs to be removed from here and need to point the additional available options from container runtimes like https://github.com/containerd/containerd/blob/main/docs/cri/registry.md ?

[SergeyKanzhelev]

@SergeyKanzhelev I guess the existing docker cfg will work for other container runtimes as well, as credential provider is Kubelet mechanism, if it works only reference of docker runtime needs to be removed from here and need to point the additional available options from container runtimes like https://github.com/containerd/containerd/blob/main/docs/cri/registry.md ?

I didn't look deep in creds provider, will it still look for docker config for creds if docker is not installed?

Also we might extend this issue (or maybe create another one) explaining how to configure registry mirrors. If one has it configured for Docker, it is different for other runtimes.

[sftim]

/triage accepted
/priority important-longterm
/language en

[sftim]

@SergeyKanzhelev would you be willing to open an issue about the mirroring task? I think we should take it at least as far as an issue so we can formally triage it and decide on a course of action.

[SergeyKanzhelev]

Filed: #30843

[chris-short]

How is this issue any different than #30951?

I'm open to splitting up work but this is confusing. Can we capture what we need here and add it to #30951?

[SergeyKanzhelev]

No, this is different. Issue #30951 just updates the information on how to use image pull secret and such. Needs to be updated, but works somehow the same on all runtimes.

What we need specifically for dockershim migration - informaiton on how to translate docker registry settings into containerd registry settings.

Examples:

• If mirror registry is configured for dockerhub, how to configure the same in containerd
• if private registry is configured as insecure using docker command line or config file, how to configure the same in containerd
• if http proxy is set up for the registry using docker-specific config file, how to translate this setting into the containerd setting

Those are typical questions customers have on migration

[KelvinAkpobome]

/assign

[chrisnegus]

/close

[k8s-ci-robot]

@chrisnegus: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.