AKS Containerd localhost behavior different than upstream?

[jeff-mccoy]

Zarf uses a NodePort bound to 127.0.0.1 to connect to a local registry. On all other containerd-based clusters this allows us to point to 127.0.0.1 and containerd will use http instead of https. It seems there is something different happening on the azure version of containerd, even running crictl pull in a debug node on AKS demonstrates this behavior. Previously, this was not on an issue on AKS, but that was early this year. Is there something special that the Azure version of containerd is doing with localhost that differs from the upstream? Also is there a way to change this behavior or specify an insecure registry for localhost?

Related issues for zarf:

• Zarf Init against AKS cloud giving ERROR: Unable to estbalish tunnel after 3 attempts  defenseunicorns/zarf#718
• Zarf-Seed-Registry Installation Fails on Init with Deployment is not ready: zarf/zarf-docker-registry error defenseunicorns/zarf#592

[jeff-mccoy]

Update: looks like this was a bug that is now fixed in Containerd.

containerd/containerd#7438

[ghost]

Action required from @Azure/aks-pm

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[jeff-mccoy]

Also may be a security concern: GHSA-2qjp-425j-52j9.

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[microsoft-github-policy-service]

This issue has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs within 15 days of this comment.

[microsoft-github-policy-service]

Issue needing attention of @Azure/aks-leads

[microsoft-github-policy-service]

This issue will now be closed because it hasn't had any activity for 7 days after stale. jeff-mccoy feel free to comment again on the next 7 days to reopen or open a new issue after that time if you still have a question/issue or suggestion.