Docker harbor authorization failed

[HuckOps]

Description

When i write auth info in /etc/containerd/config.toml，like

    [plugins."io.containerd.grpc.v1.cri".registry]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["https://registry-1.docker.io"]
    	[plugins."io.containerd.grpc.v1.cri".registry.mirrors."ncr.nie.netease.com"]
          endpoint = ["https://ncr.nie.netease.com"]
      [plugins."io.containerd.grpc.v1.cri".registry.configs]
        [plugins."io.containerd.grpc.v1.cri".registry.configs."ncr.nie.netease.com".auth]
          username = "xxx"
          password = "xxx"

and try to another way:

    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = "/etc/containerd/certs.d"

      [plugins."io.containerd.grpc.v1.cri".registry.auths]

      [plugins."io.containerd.grpc.v1.cri".registry.configs]

        [plugins."io.containerd.grpc.v1.cri".registry.configs."ncr.nie.netease.com"]

          [plugins."io.containerd.grpc.v1.cri".registry.configs."ncr.nie.netease.com".auth]
            auth = ""
            identitytoken = ""
            password = "xxx"
            username = "xxx"

tree /etc/containerd/certs.d
/etc/containerd/certs.d
└── ncr.nie.netease.com
    └── hosts.toml

Then i restart the containerd, I try to pull an image named ncr.nie.netease.com/xxx/nginx:v20220801,but command throw an error about 401 Unauthorized

When i try to run this command:

ctr image pull ncr.nie.netease.com/xxx/nginx:v20220801  --http-dump --http-trace

I see，the command request to /service/token but dont have a header named authorization. log like this

INFO[0000] GET /service/token?scope=repository%3Axxx%2Fnginx%3Apull&service=harbor-registry HTTP/1.1
INFO[0000] Host: ncr.nie.netease.com
INFO[0000] User-Agent: containerd/v1.7.0
INFO[0000] Accept-Encoding: gzip
INFO[0000]
INFO[0000] HTTP/1.1 401 Unauthorized
INFO[0000] Content-Length: 72
INFO[0000] Connection: keep-alive
INFO[0000] Content-Type: application/json
INFO[0000] Date: Fri, 01 Mar 2024 04:19:29 GMT
INFO[0000] Ntes-Trace-Id: f91dacbcb7f86a71:f91dacbcb7f86a71:0:1
INFO[0000] Server: nginx
INFO[0000] Via: kong/2.2.1
INFO[0000] X-Kong-Proxy-Latency: 1
INFO[0000] X-Kong-Upstream-Latency: 24

Steps to reproduce the issue

1. upgrade containerd
2. rewrite config file

Describe the results you received and expected

How to resolve this question

What version of containerd are you using?

v1.7.0

Any other relevant information

No response

Show configuration if it is related to CRI plugin.

No response

[dmcgowan]

For v1.7 you would need to use crictl if you want to use any configuration under plugins."io.containerd.grpc.v1.cri". For ctr you would need to provide the -u option to provide authorization. Use crictl though if you are trying to test a configuration for k8s or nerdctl if you want a login + pull flow.