Skip to content

Deprecate insecure_registries config #9278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 1, 2025
Merged

Deprecate insecure_registries config #9278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions completions/fish/crio.fish
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ complete -c crio -n '__fish_crio_no_subcommand' -l imagestore -r -d 'Store newly
complete -c crio -n '__fish_crio_no_subcommand' -f -l included-pod-metrics -r -d 'A list of pod metrics to include. Specify the names of the metrics to include in this list.'
complete -c crio -n '__fish_crio_no_subcommand' -f -l infra-ctr-cpuset -r -d 'CPU set to run infra containers, if not specified CRI-O will use all online CPUs to run infra containers.'
complete -c crio -n '__fish_crio_no_subcommand' -f -l insecure-registry -r -d 'Enable insecure registry communication, i.e., enable un-encrypted and/or untrusted communication.
This option is deprecated. Please use "insecure" in registries.conf instead.
1. List of insecure registries can contain an element with CIDR notation to
specify a whole subnet.
2. Insecure registries accept HTTP or accept HTTPS with certificates from
Expand Down
1 change: 1 addition & 0 deletions docs/crio.8.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -299,6 +299,7 @@ crio [GLOBAL OPTIONS] command [COMMAND OPTIONS] [ARGUMENTS...]
**--infra-ctr-cpuset**="": CPU set to run infra containers, if not specified CRI-O will use all online CPUs to run infra containers.

**--insecure-registry**="": Enable insecure registry communication, i.e., enable un-encrypted and/or untrusted communication.
This option is deprecated. Please use "insecure" in registries.conf instead.
1. List of insecure registries can contain an element with CIDR notation to
specify a whole subnet.
2. Insecure registries accept HTTP or accept HTTPS with certificates from
Expand Down
1 change: 1 addition & 0 deletions docs/crio.conf.5.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,6 +487,7 @@ Controls how image volumes are handled. The valid values are mkdir, bind and ign

**insecure_registries**=[]
List of registries to skip TLS verification for pulling images.
This option is deprecated. Use registries.conf instead.

**big_files_temporary_dir**=""
Path to the temporary directory to use for storing big files, used to store image blobs and data streams related to containers image management.
Expand Down
1 change: 1 addition & 0 deletions internal/criocli/criocli.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -753,6 +753,7 @@ func getCrioFlags(defConf *libconfig.Config) []cli.Flag {
Name: "insecure-registry",
Value: cli.NewStringSlice(defConf.InsecureRegistries...),
Usage: "Enable insecure registry communication, i.e., enable un-encrypted and/or untrusted communication." + `
This option is deprecated. Please use "insecure" in registries.conf instead.
1. List of insecure registries can contain an element with CIDR notation to
specify a whole subnet.
2. Insecure registries accept HTTP or accept HTTPS with certificates from
Expand Down
4 changes: 4 additions & 0 deletions internal/storage/image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1082,6 +1082,10 @@
regexForPinnedImages: CompileRegexpsForPinnedImages(serverConfig.PinnedImages),
}

if len(serverConfig.InsecureRegistries) > 0 {
log.Warnf(ctx, "Insecure registries option is deprecated and will not have any effect in a future release")
}

Check warning on line 1087 in internal/storage/image.go

View check run for this annotation

Codecov / codecov/patch

internal/storage/image.go#L1086-L1087 

Added lines #L1086 - L1087 were not covered by tests

serverConfig.InsecureRegistries = append(serverConfig.InsecureRegistries, "127.0.0.0/8")
Copy link
Contributor Author

@bitoku bitoku Jun 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This 127.0.0.0/8 will be removed when we completely remove the option.
Do we want to have a new option like insecureLoopback and deprecate it separately to reduce the impact as much as possible? or is it too much?

Copy link
Member

@saschagrunert saschagrunert Jun 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't recall who requires this, but I tend to say no, let's deprecate without having a replacement for this for now.

// Split --insecure-registry into CIDR and registry-specific settings.
for _, r := range serverConfig.InsecureRegistries {
Expand Down
1 change: 1 addition & 0 deletions pkg/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,7 @@ type ImageConfig struct {
SignaturePolicyDir string `toml:"signature_policy_dir"`
// InsecureRegistries is a list of registries that must be contacted w/o
// TLS verification.
// Deprecated: use `insecure` in `registries.conf` instead.
InsecureRegistries []string `toml:"insecure_registries"`
// ImageVolumes controls how volumes specified in image config are handled
ImageVolumes ImageVolumesType `toml:"image_volumes"`
Expand Down
1 change: 1 addition & 0 deletions pkg/config/template.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1487,6 +1487,7 @@ const templateStringCrioImageSignaturePolicyDir = `# Root path for pod namespace
const templateStringCrioImageInsecureRegistries = `# List of registries to skip TLS verification for pulling images. Please
# consider configuring the registries via /etc/containers/registries.conf before
# changing them here.
# This option is deprecated. Use registries.conf file instead.
{{ $.Comment }}insecure_registries = [
{{ range $opt := .InsecureRegistries }}{{ $.Comment }}{{ printf "\t%q,\n" $opt }}{{ end }}{{ $.Comment }}]

Expand Down
Loading