为何配置insecure_skip_verify后crictl拉取私有镜像仍报证书错误？

环境信息 #

• K8s版本：1.24
• 容器运行时：containerd 1.5.9
• 操作系统：Ubuntu 20.04
• 私有仓库：myPvtRepo.com:5028（Docker已配置可正常拉取）

问题现象 #

Docker通过/etc/docker/daemon.json配置私有仓库后，docker pull myPvtRepo.com:5028/centos:latest可正常拉取镜像，但使用crictl执行相同拉取操作时报错：

E0819 06:49:01.200489 162610 remote_image.go:218] "PullImage from
image service failed" err="rpc error: code = Unknown desc = failed to
pull and unpack image "myPvtRepo.com:5028/centos:latest": failed to
resolve reference "myPvtRepo.com:5028/centos:latest": failed to do
request: Head https://myPvtRepo.com::5028/v2/centos/manifests/latest:
x509: certificate signed by unknown authority"
image="myPvtRepo.com::5028/centos:latest" FATA[0000] pulling image:
rpc error: code = Unknown desc = failed to pull and unpack image
"myPvtRepo.com::5028/centos:latest": failed to resolve reference
"myPvtRepo.com:5028/centos:latest": failed to do request: Head
https://myPvtRepo.com::5028/v2/centos/manifests/latest: x509:
certificate signed by unknown authority

已做配置 #

修改/etc/containerd/config.toml如下：

version = 2

[plugin."io.containerd.grpc.v1.cri".registry.configs."myPvtRepo.com:5028".tls]
    insecure_skip_verify = true

[plugins."io.containerd.grpc.v1.cri".registry.mirrors]

[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
     endpoint = ["https://myPvtRepo.com:5028", "https://myPvtRepo.com:5038", "https://myPvtRepo.com:5037",
 "https://myPvtRepo.com:5039"]

[plugins."io.containerd.grpc.v1.cri".registry.mirrors."IP:5000"]
     endpoint = ["http://IP:5000"]

[plugins."io.containerd.grpc.v1.cri".registry.mirrors."IP:5000"]
     endpoint = ["http://IP:5000"]

已将containerd端点指向套接字并重启服务，但问题未解决。

问题分析与修复方案 #

1. 核心问题 #

当前containerd配置存在两个关键问题：

• 私有仓库myPvtRepo.com:5028仅配置了TLS跳过验证，但未在mirrors中添加对应的HTTP端点映射，导致containerd仍默认尝试HTTPS访问
• 存在重复的IP:5000镜像配置，可能引发解析冲突

2. 修正后的/etc/containerd/config.toml #

version = 2

[plugins."io.containerd.grpc.v1.cri".registry]
  config_path = ""

[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
  # 为私有仓库添加HTTP端点映射
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."myPvtRepo.com:5028"]
    endpoint = ["http://myPvtRepo.com:5028"]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
    endpoint = ["https://myPvtRepo.com:5028", "https://myPvtRepo.com:5038", "https://myPvtRepo.com:5037", "https://myPvtRepo.com:5039"]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."IP:5000"]
    endpoint = ["http://IP:5000"]

[plugins."io.containerd.grpc.v1.cri".registry.configs]
  [plugins."io.containerd.grpc.v1.cri".registry.configs."myPvtRepo.com:5028".tls]
    insecure_skip_verify = true

3. 后续验证步骤 #

1. 确保crictl配置文件/etc/crictl.yaml正确指向containerd套接字：

runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false

2. 重启containerd服务：

systemctl restart containerd

3. 验证镜像拉取：

crictl pull myPvtRepo.com:5028/centos:latest

内容的提问来源于stack exchange，提问作者Adarsh kumar yadav