Skip to content

[release/2.2] Fix migrated CRI image config when using legacy registry mirrors #12987

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samuelkarp merged 1 commit into from
Mar 7, 2026
+11 −15
Merged

[release/2.2] Fix migrated CRI image config when using legacy registry mirrors #12987

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions internal/cri/config/config_unix.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,7 @@ func DefaultImageConfig() ImageConfig {
Snapshotter: defaults.DefaultSnapshotter,
DisableSnapshotAnnotations: true,
MaxConcurrentDownloads: 3,
Registry: Registry{
ConfigPath: "/etc/containerd/certs.d:/etc/docker/certs.d",
},
Registry: Registry{},
ImageDecryption: ImageDecryption{
KeyModel: KeyModelNode,
},
Expand Down
22 changes: 10 additions & 12 deletions plugins/cri/images/plugin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,16 @@ func init() {
}
mdb := m.(*metadata.DB)

// only set the default value of config path, if both mirrors and
// config path are empty and we are on Linux.
// This also makes sure that if the loaded config already contains both config path and mirrors
// the validation will fail.
if runtime.GOOS == "linux" {
if config.Registry.ConfigPath == "" && len(config.Registry.Mirrors) == 0 {
config.Registry.ConfigPath = "/etc/containerd/certs.d:/etc/docker/certs.d"
}
}

if warnings, err := criconfig.ValidateImageConfig(ic.Context, &config); err != nil {
return nil, fmt.Errorf("invalid cri image config: %w", err)
} else if len(warnings) > 0 {
Expand Down Expand Up @@ -210,18 +220,6 @@ func migrateConfig(dst, src map[string]interface{}) {
dst[key] = val
}
}
if runtime.GOOS == "linux" {
if value, ok := dst["registry"]; ok {
regMap := value.(map[string]any)
if configPath, ok := regMap["config_path"]; ok {
if configPath == "" {
// Fill in default from config_unix.go (DefaultImageConfig)
regMap["config_path"] = "/etc/containerd/certs.d:/etc/docker/certs.d"
}
}
dst["registry"] = regMap
}
}

containerdConf, ok := src["containerd"]
if !ok {
Expand Down