Shulou(Shulou.com)06/01 Report--

This article shows you how to configure the image warehouse in containerd. The content is concise and easy to understand, which will definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

About K3s and containerd

K3s is a lightweight Kubernetes distribution with a binary size smaller than 100MB and requires less than half the memory of Kubernetes. In order to reduce resource consumption, K3s modifies the default runtime to containerd, and also has built-in Kubernetes CLI tools crictl and ctr.

The default containerd configuration file directory for K3s is / var/lib/rancher/k3s/agent/etc/containerd/config.toml, but directly manipulating the containerd configuration file to set up the image repository or accelerator is much more complicated than operating docker. In order to simplify the complexity of configuring containerd image repository, K3s will check whether the registries.yaml file exists in / etc/rancher/k3s/ at startup. If this file exists, it will be converted to containerd configuration according to the content of registries.yaml and stored to / var/lib/rancher/k3s/agent/etc/containerd/config.toml, thus reducing the complexity of configuring containerd image repository.

Configure a private image repository using K3s

The K3s image repository configuration file consists of two parts: mirrors and configs:

Mirrors is an instruction that defines the name and endpoint of a dedicated image repository

The Configs section defines the TLS and certificate configuration for each mirror. For each mirror, you can define auth and / or tls

Containerd uses concepts similar to those of svc and endpoint in K8S. Svc can be understood as an access name, which is resolved to the corresponding endpoint. It can also be understood that the mirror configuration is a reverse proxy that proxies client requests to the back-end mirror repository of the endpoint configuration. The mirror name can be filled in at will, but it must conform to the definition rules of IP or domain name. And multiple endpoint can be configured to resolve to the first endpoint by default, if the first endpoint does not return data, automatically switch to the second endpoint, and so on.

For example, the following configuration example:

Mirrors: "172.31.6.200https://registry-1.docker.io" 5000": endpoint:-"http://172.31.6.200:5000"" rancher.ksd.top:5000 ": endpoint: -" http://172.31.6.200:5000"docker.io": endpoint:-"https://fogjl973.mirror.aliyuncs.com" -" https://registry-1.docker.io"

Images can be obtained through crictl pull 172.31.6.200:5000/library/alpine and crictl pull rancher.ksd.top:5000/library/alpine, but all images are obtained from the same repository.

Root@rancher-server:/etc/rancher/k3s# systemctl restart k3s.serviceroot@rancher-server:/etc/rancher/k3s# crictl pull 172.31.6.200:5000/library/alpineImage is up to date for sha256:a24bb4013296f61e89ba57005a7b3e52274d8edd3ae2077d04395f806b63d83eroot@rancher-server:/etc/rancher/k3s# crictl pull rancher.ksd.top:5000/library/alpineImage is up to date for sha256:a24bb4013296f61e89ba57005a7b3e52274d8edd3ae2077d04395f806b63d83eroot@rancher-server:/etc/rancher/k3s# non-secure (http) private repository configuration

To configure an insecure (http) private repository, you only need to specify the address of the http protocol header in the endpoint.

In the absence of TLS communication, you need to specify a http:// for endpoints, otherwise it will default to https.

No authentication

If you are using a non-secure (http) private repository, you can configure K3s to connect to the private repository with the following parameters:

Root@ip-172-31-13-117 cat > > / etc/rancher/k3s/registries.yaml / etc/rancher/k3s/registries.yaml / etc/rancher/k3s/registries.yaml

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.