What happened:

Problem is that

Seems like an empty username and password for AuthConfig is update for azurecr instead do not have an entry to keep a nil auth context.

But according to the code

So instead of sending this

imageRef, err := m.imageService.PullImage(imgSpec, nil, podSandboxConfig)

we end up sending this

imageRef, err := m.imageService.PullImage(imgSpec, auth, podSandboxConfig)

with an empty auth context.

https://github.com/containerd/cri/blob/6dc2a874470f7489217a7c757da258356b92bfdb/pkg/server/image_pull.go#L190

which matches this error

Aug 27 16:39:37 containerd[4953]: time="2019-08-27T16:39:37.609386516Z" level=error msg="PullImage "repos.azurecr.io/mirror/download-amd64:v1" failed" error="failed to resolve image "repos.azurecr.io/mirror/download-amd64:v1": no available registry endpoint: invalid auth config"

What you expected to happen:

Containerd should successfully download from anonymous ACR

How to reproduce it (as minimally and precisely as possible):

use kubelet to download pod from anonymous ACR with containerd CRI

Anything else we need to know?:

ideally the check should be made if the repo is anonymous, do not add to the config, which is done in MSI case. Worst case atleast add this to Service Principal case, but that would still be a hack

else {
               // Add our entry for each of the supported container registry URLs
               for _, url := range containerRegistryUrls {
                       cred := &credentialprovider.DockerConfigEntry{
                               Username: a.config.AADClientID,
                               Password: a.config.AADClientSecret,
                               Email:    dummyRegistryEmail,
                       }
                       cfg[url] = *cred
               }
               // add ACR anonymous repo support: use empty username and password for anonymous access
                cfg["*.azurecr.*"] = credentialprovider.DockerConfigEntry{
                        Username: "",
                       Password: "",
                       Email:    dummyRegistryEmail,
                }
 
        }

Environment:

• Kubernetes version (use kubectl version): 1.14.6
• Cloud provider or hardware configuration:
• OS (e.g: cat /etc/os-release): ubuntu
• Kernel (e.g. uname -a):
• Install tools:
• Network plugin and version (if this is a network-related bug):
• Others: