Patch: Generic Containerd mirror support

[dkoshkin]

Extend the image registries API to also enable Containerd mirror.

spec:
  topology:
    variables:
      - name: clusterConfig
        value:
          imageRegistries:
            credentials: 
              - url: https://my-registry.io
                secretRef:
                    name: <optional ref to a Secret that holds the credentials>
                mirror:
                    caSecretRef:
                      name: <optional ref to a Secret that holds a self signed CA>   

A an image registry can either be configured to pass credentials (already implemented), a Containerd mirror or both.

1. Just a Containerd mirror, see here. Note how the server is removed since we want to still fallback to upstream registry if image not found in the mirror:

$ tree /etc/containerd/certs.d
/etc/containerd/certs.d
└── _default
    └── hosts.toml

$ cat /etc/containerd/certs.d/_default/hosts.toml

[host."https://my-registry.io"]
  capabilities = ["pull", "resolve"]

2. Both a Containerd mirror and credentials provider:
   Configure same as above for 1 and after here add

          mirror:
            endpoint: "my-registry.io"
            credentialsStrategy: MirrorCredentialsOnly

Pay special attention to the format the URL is expected in, e.g. with port, with path, etc.

[supershal]

assigned to myself.

[supershal]

@dkoshkin are we adding caSecretRef as part of this issue? if so, what would be format of the secret ref and suggested path on the host to store the secret?

[dkoshkin]

Yes @supershal we should add the caSecretRef. Maybe we can just be super generic and read all keys from the Secret and set them as files in /etc/containerd/? Here is what the config looks like https://github.com/containerd/containerd/blob/main/docs/hosts.md#ca-field

[supershal]

updated description of the issue to reflect current schema for image registry. https://github.com/d2iq-labs/capi-runtime-extensions/blob/main/docs/content/customization/generic/image-registries.md

[jimmidyson]

Can we close this now @dkoshkin @supershal ?

[dkoshkin]

Yes closed with #292