前提：harbor已搭建完成，并配置了https证书

在node节点上的/etc/containerd/目录下创建certs.d目录

mkdir -p /etc/containerd/certs.d

并在certs.d目录下创建harbor自建证书使用的域名目录

cd /etc/containerd/certs.d/
mkdir harbor.xxx.com

复制harbor上证书文件ca.crt到/etc/containerd/certs.d/harbor.xxx.com目录下，创建hosts.toml文件，写入以下内容

echo -n "username:password" | base64  #其中username:password，分别是harbor的用户名和密码

cat hosts.toml

server = "https://harbor.xxx.com"
[host."https://harbor.xxx.com"]
  capabilities = ["pull", "resolve"]
  ca = "/etc/containerd/certs.d/harbor.xxx.com/ca.crt"
[host."https://harbor.xxx.com".header]
  Authorization = ["Basic EuYWRtaW46Y29tU3pnbGMTIz"]

修改containerd的配置文件config.toml

vim /etc/containerd/config.toml

[plugins."io.containerd.grpc.v1.cri".registry]
  config_path = "/etc/containerd/certs.d"

重启containerd服务

systemctl restart containerd.service

测试

ctr image pull harbor.xxx.com/library/nginx:latest

ctr image pull --user username:password --tlscacert  /etc/containerd/certs.d/harbor.xxx.com/ca.crt  harbor.xxx.com/library/nginx:latest

将 Harbor 的 CA 证书复制到系统信任的证书目录

cp /etc/containerd/certs.d/harbor.xxx.com/ca.crt /etc/ssl/certs/harbor-ca.crt

验证客户端是否信任 Harbor 的证书

openssl verify -CAfile /etc/ssl/certs/harbor-ca.crt  /etc/containerd/certs.d/harbor.xxx.com/ca.crt