[Release-1.28] - Allow disabling containerd registry mirror default endpoint fallback

[brandond]

Backport fix for Allow disabling containerd registry mirror default endpoint fallback

• Allow disabling containerd registry mirror default endpoint fallback #8975

[aganesh-suse]

Validated on release-1.28 branch with rc version v1.28.6-rc1+k3s1

Environment Details

Infrastructure

• Cloud
• Hosted

Node(s) CPU architecture, OS, and Version:

$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.2 LTS"

$ uname -m
x86_64

Cluster Configuration:

1 server/ 1 agent

Config.yaml:

$ cat /etc/rancher/k3s/config.yaml

Compare configs:

token: xxxx
disable-default-registry-endpoint: true
debug: true
write-kubeconfig-mode: "0644"

vs

token: xxxx
debug: true
write-kubeconfig-mode: "0644"

registries.yaml:

mirrors:
  docker.io:

Testing Steps

1. Copy files:
   config.yaml

$ sudo mkdir -p /etc/rancher/k3s && sudo cp config.yaml /etc/rancher/k3s

Copy registries.yaml to /etc/rancher/k3s/registries.yaml
copy ca.pem to the user home directory (as per path provided in the registries.yaml file).
copy k3s onto /usr/local/bin and do a chmod +x to make it executable.
copy the https://github.com/k3s-io/k3s/releases/download/v1.28.6-rc1%2Bk3s1/k3s-airgap-images-amd64.tar onto /var/lib/rancher/k3s/agent/images directory on the server node.

2. Install k3s: copy the install.sh script from "https://get.k3s.io/install.sh" and then run:

INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh

3. Check/Compare the hosts.toml file content (with/without disable option in config.yaml file):

sudo cat /var/lib/rancher/k3s/agent/etc/containerd/certs.d/docker.io/hosts.toml

Validation Results:

• k3s version used for validation:

$ k3s -v
k3s version v1.28.6-rc1+k3s1 (c236c9ff)
go version go1.20.13

With disable-default-registry-endpoint: true in config.yaml:

$ sudo cat /var/lib/rancher/k3s/agent/etc/containerd/certs.d/docker.io/hosts.toml
# File generated by k3s. DO NOT EDIT.

Without disable entry in config.yaml:

$ sudo cat /var/lib/rancher/k3s/agent/etc/containerd/certs.d/docker.io/hosts.toml 
# File generated by k3s. DO NOT EDIT.
server = "https://registry-1.docker.io"

Additional context / logs: