{"action":"created","issue":{"url":"https://api.github.com/repos/containerd/containerd/issues/3071","repository_url":"https://api.github.com/repos/containerd/containerd","labels_url":"https://api.github.com/repos/containerd/containerd/issues/3071/labels{/name}","comments_url":"https://api.github.com/repos/containerd/containerd/issues/3071/comments","events_url":"https://api.github.com/repos/containerd/containerd/issues/3071/events","html_url":"https://github.com/containerd/containerd/issues/3071","id":417825522,"node_id":"MDU6SXNzdWU0MTc4MjU1MjI=","number":3071,"title":"Create a way to provide the CA of a self signed certificate to containerd without restarting it","user":{"login":"mnitchev","id":15073922,"node_id":"MDQ6VXNlcjE1MDczOTIy","avatar_url":"https://avatars3.githubusercontent.com/u/15073922?v=4","gravatar_id":"","url":"https://api.github.com/users/mnitchev","html_url":"https://github.com/mnitchev","followers_url":"https://api.github.com/users/mnitchev/followers","following_url":"https://api.github.com/users/mnitchev/following{/other_user}","gists_url":"https://api.github.com/users/mnitchev/gists{/gist_id}","starred_url":"https://api.github.com/users/mnitchev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mnitchev/subscriptions","organizations_url":"https://api.github.com/users/mnitchev/orgs","repos_url":"https://api.github.com/users/mnitchev/repos","events_url":"https://api.github.com/users/mnitchev/events{/privacy}","received_events_url":"https://api.github.com/users/mnitchev/received_events","type":"User","site_admin":false},"labels":[{"id":606698412,"node_id":"MDU6TGFiZWw2MDY2OTg0MTI=","url":"https://api.github.com/repos/containerd/containerd/labels/help-wanted","name":"help-wanted","color":"c5def5","default":false},{"id":347599657,"node_id":"MDU6TGFiZWwzNDc1OTk2NTc=","url":"https://api.github.com/repos/containerd/containerd/labels/kind/feature","name":"kind/feature","color":"AAB3AB","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-03-06T14:17:05Z","updated_at":"2019-05-25T08:42:32Z","closed_at":null,"author_association":"NONE","body":"**Description**\r\nUsing a private registry which has a self-signed certificate cases a `x509: certificate signed by unknown authority` error when pulling an image. We have tried to add the certificate CA in `/usr/local/share/ca-certificates` like #2940 suggests but we cannot restart the containerd daemon as it is running on a Kubernetes node, to which we do not have access (it is running on the cloud provider's infrastructure).\r\n\r\n**Proposal**\r\nCreate a way to provide the CA of a self signed certificate to containerd without restarting it, similar to how adding it to `/etc/docker/certs.d/` works for the Docker daemon.\r\n\r\n**Steps to reproduce the issue:**\r\n1. Start a private docker registry with a self-signed certificate\r\n2. Try to pull image from the registry\r\n3. See it fail\r\n\r\n**Describe the results you received:**\r\nPulling an image causes a `x509: certificate signed by unknown authority` error\r\n\r\n**Describe the results you expected:**\r\nSuccessfully pulling the image\r\n\r\n**Output of `containerd --version`:**\r\nAs containerd is running on the node, only thing we can provide is `containerd://1.1.4` \r\n\r\nBestRegards,\r\n@mnitchev && @alex-slynko \r\n"},"comment":{"url":"https://api.github.com/repos/containerd/containerd/issues/comments/495888127","html_url":"https://github.com/containerd/containerd/issues/3071#issuecomment-495888127","issue_url":"https://api.github.com/repos/containerd/containerd/issues/3071","id":495888127,"node_id":"MDEyOklzc3VlQ29tbWVudDQ5NTg4ODEyNw==","user":{"login":"yylt","id":34183906,"node_id":"MDQ6VXNlcjM0MTgzOTA2","avatar_url":"https://avatars0.githubusercontent.com/u/34183906?v=4","gravatar_id":"","url":"https://api.github.com/users/yylt","html_url":"https://github.com/yylt","followers_url":"https://api.github.com/users/yylt/followers","following_url":"https://api.github.com/users/yylt/following{/other_user}","gists_url":"https://api.github.com/users/yylt/gists{/gist_id}","starred_url":"https://api.github.com/users/yylt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yylt/subscriptions","organizations_url":"https://api.github.com/users/yylt/orgs","repos_url":"https://api.github.com/users/yylt/repos","events_url":"https://api.github.com/users/yylt/events{/privacy}","received_events_url":"https://api.github.com/users/yylt/received_events","type":"User","site_admin":false},"created_at":"2019-05-25T08:42:32Z","updated_at":"2019-05-25T08:42:32Z","author_association":"NONE","body":"Hi, can I implement client commands to complete this feature ? "}}
{"actor":{"display_login":"yylt"}}