containerd拉取私有仓库镜像报错x509: certificate signed by unknown authority

报错

原因分析

私有仓库使用的是harbor，由于harbor连接默认需要https认证，crictl拉取镜像默认不带证书访问，所以会报错

解决

#下载证书并放到指定目录，证书如何下载看下图
mkdir /etc/containerd/core.harbor.domain
cp ca.crt  /etc/containerd/core.harbor.domain/

修改containerd配置文件

vim /etc/containerd/config.toml
#配置endpoint连接地址
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."core.harbor.domain"]
    endpoint = ["https://core.harbor.domain"]

#配置ca文件路径和用户名密码
[plugins."io.containerd.grpc.v1.cri".registry.configs]
  [plugins."io.containerd.grpc.v1.cri".registry.configs."core.harbor.domain".tls]
    ca_file = "/etc/containerd/core.harbor.domain/ca.crt"
  [plugins."io.containerd.grpc.v1.cri".registry.configs."core.harbor.domain".auth]
    username = "admin"
    password = "Harbor12345"

重启containerd

#重新加载配置
systemctl daemon-reload
#重启containerd
systemctl restart containerd

拉取镜像

crictl pull core.harbor.domain/library/nginx:v1.0

拉取镜像成功。