From a040e521b416ed06f8298dfaedf5f7c8209bfd63 Mon Sep 17 00:00:00 2001 From: Samuel Date: Mon, 23 Aug 2021 15:40:00 +0200 Subject: [PATCH] feat(containerd): auth support (#7868) * feat(containerd): auth support * fix(registry-auth): rename variable --- inventory/sample/group_vars/all/containerd.yml | 5 +++++ roles/container-engine/containerd/defaults/main.yml | 6 ++++++ .../containerd/templates/config.toml.j2 | 11 +++++++++++ 3 files changed, 22 insertions(+) diff --git a/inventory/sample/group_vars/all/containerd.yml b/inventory/sample/group_vars/all/containerd.yml index 82c4953db..3f617f206 100644 --- a/inventory/sample/group_vars/all/containerd.yml +++ b/inventory/sample/group_vars/all/containerd.yml @@ -32,3 +32,8 @@ # "docker.io": "https://registry-1.docker.io" # containerd_max_container_log_line_size: -1 + +# containerd_registry_auth: +# - registry: 10.0.0.2:5000 +# username: user +# password: pass diff --git a/roles/container-engine/containerd/defaults/main.yml b/roles/container-engine/containerd/defaults/main.yml index dc9777fc0..0e0bb0d50 100644 --- a/roles/container-engine/containerd/defaults/main.yml +++ b/roles/container-engine/containerd/defaults/main.yml @@ -70,3 +70,9 @@ containerd_fedora_repo_component: "stable" # Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally containerd_extra_args: '' + +# Configure registry auth (if applicable to secure/insecure registries) +containerd_registry_auth: [] +# - registry: 10.0.0.2:5000 +# username: user +# password: pass diff --git a/roles/container-engine/containerd/templates/config.toml.j2 b/roles/container-engine/containerd/templates/config.toml.j2 index a344e4b96..35c4f933a 100644 --- a/roles/container-engine/containerd/templates/config.toml.j2 +++ b/roles/container-engine/containerd/templates/config.toml.j2 @@ -46,6 +46,17 @@ oom_score = {{ containerd_oom_score }} [plugins."io.containerd.grpc.v1.cri".registry.mirrors."{{ registry }}"] endpoint = ["{{ ([ addr ] | flatten ) | join('","') }}"] {% endfor %} +{% for registry in containerd_registry_auth if registry['registry'] is defined %} +{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %} + [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth] +{% if registry['username'] is defined and registry['password'] is defined %} + password = "{{ registry['password'] }}" + username = "{{ registry['username'] }}" +{% else %} + auth = "{{ registry['auth'] }}" +{% endif %} +{% endif %} +{% endfor %} {% if containerd_extra_args is defined %} {{ containerd_extra_args }}