Add registry configuration breakout to containerd/config.toml

[phealy]

Adds a config entry to reference /etc/containerd/certs.d, which can contain per registry configuration files. This will allow customers to drop off config files with a DaemonSet that will modify how containerd acts when it connects to certain registries.

Enabled scenarios:

• Adding a trusted root CA for a given registry, enabling private registry CAs
• Adding a client certificate for mutual TLS against a registry
• Redirecting a registry URL to a pull-through registry proxy seamlessly (so anything going to docker.io actually goes to mydockerproxy.mydomain.com)

Fixes AKS/1940 and helps with some of the people in AKS/2259 for Linux nodepools.

See:

• Containerd registry configuration
• Docker TLS configuration (which is respected by containerd if placed in /etc/containerd/certs.d)

[phealy]

I tested this in a standalone and it seems to work great - the config is now limited to 1.22.x only where we have containerd 1.5, which is where the option support came in.

Only issue I see - none of our actual test cases in AgentBaker seem to build 1.22 clusters right now, so none of the test data includes the config statement. I'm not quite sure what the best way to add that test case in would be.

[alexeldeib]

k8s version is in the describle table tests here:

AgentBaker/pkg/agent/baker_test.go

Lines 23 to 30 in 7a18f18

	DescribeTable("Generated customData and CSE", func(folder, k8sVersion string, configUpdator func(*datamodel.NodeBootstrappingConfiguration)) {
	cs := &datamodel.ContainerService{
	Location: "southcentralus",
	Type: "Microsoft.ContainerService/ManagedClusters",
	Properties: &datamodel.Properties{
	OrchestratorProfile: &datamodel.OrchestratorProfile{
	OrchestratorType: datamodel.Kubernetes,
	OrchestratorVersion: k8sVersion,

a case like this with 1.22+containerd would be good to cover this scenario I think:

AgentBaker/pkg/agent/baker_test.go

Lines 530 to 535 in 7a18f18

	Entry("AKSUbuntu1804 with NoneCNI", "AKSUbuntu1804+NoneCNI", "1.20.7", func(config *datamodel.NodeBootstrappingConfiguration) {
	config.ContainerService.Properties.AgentPoolProfiles[0].KubernetesConfig = &datamodel.KubernetesConfig{
	ContainerRuntime: datamodel.Containerd,
	}
	config.ContainerService.Properties.OrchestratorProfile.KubernetesConfig.NetworkPlugin = datamodel.NetworkPluginNone
	}))

otherwise PR lgtm, appreciate it :)

[alexeldeib]

lgtm, thanks for adding a test case!

[phealy]

@alexeldeib I don't have write access, so would please you merge or help me fix that?