What I'd like:
When configuring registry mirrors, I'd like to be able to ensure "only the mirror is utilised and the upstream not consulted" as in the example in the containerd docs.
On AL2023, I can manage this by configuring /etc/containerd/certs.d/ exactly how I want it, via user data. On Bottlerocket, however, I'm limited to what's supported by settings.container-registry.mirrors, which at the time of writing behaves as follows.
The runtime will still try the default registry URL if the mirrors fail.
Any alternatives you've considered:
It's a nonstarter practically, but it would be technically possible to replace every image in every manifest on every cluster with the appropriate mirrors.
I would probably need a little hand-holding, but I'd be happy to open a PR (or two) for this if agreeable. I've found the similar (in area) PR bottlerocket-os/bottlerocket-settings-sdk#134 and I figure thar-be-registries needs to be updated in https://github.com/bottlerocket-os/bottlerocket-core-kit too.
What I'd like:
When configuring registry mirrors, I'd like to be able to ensure "only the mirror is utilised and the upstream not consulted" as in the example in the containerd docs.
On AL2023, I can manage this by configuring
/etc/containerd/certs.d/exactly how I want it, via user data. On Bottlerocket, however, I'm limited to what's supported bysettings.container-registry.mirrors, which at the time of writing behaves as follows.Any alternatives you've considered:
It's a nonstarter practically, but it would be technically possible to replace every
imagein every manifest on every cluster with the appropriate mirrors.I would probably need a little hand-holding, but I'd be happy to open a PR (or two) for this if agreeable. I've found the similar (in area) PR bottlerocket-os/bottlerocket-settings-sdk#134 and I figure thar-be-registries needs to be updated in https://github.com/bottlerocket-os/bottlerocket-core-kit too.