update images for registry and cicd modules and add ability to set registry mirrors for orchestrator

.gitlab-ci.yml

@@ -5,7 +5,7 @@ variables:
   KANIKO_CONTEXT: ${CI_PROJECT_DIR}
   RELEASE_CLI_IMAGE: harbor.kvazaric.ru/kube-forge/release-cli:v0.18.0
   CICD_MULTITOOL: harbor.kvazaric.ru/postgres-tasks/cicd-multitool:2.4
-  BINARY_BUILDER_IMAGE: golang:alpine
+  BINARY_BUILDER_IMAGE: harbor.kvazaric.ru/mirror/library/golang:alpine
 
   PREPARE_RELEASE:
     options:

build/docker/Dockerfile

@@ -1,5 +1,5 @@
 ## Install dependencies
-FROM python:3.12 as deps
+FROM harbor.kvazaric.ru/mirror/library/python:3.12 as deps
 
 WORKDIR /application
 COPY ./requirements.txt ./
@@ -9,7 +9,7 @@ RUN apt-get update -y && \
     pip3 install -r requirements.txt
 
 ## Build executable
-FROM golang:alpine as builder
+FROM harbor.kvazaric.ru/mirror/library/golang:alpine as builder
 
 WORKDIR /application
 COPY go.mod go.sum ./

config.sample.yaml

@@ -21,6 +21,11 @@ orchestrator:
   ping_access_ip: true
   auto_renew_certificates: true
   pod_security_policy_enabled: true
+  registry_mirrors:
+    - host: https://mirror.gcr.io
+      skip_verify: false
+    - host: https://quay.io
+      skip_verify: false
 
 modules:
   admin_password: changeit

internal/config/modules_cicd.go

@@ -28,16 +28,57 @@ type Cicd struct {
 			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"`
 			ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
 		} `yaml:"service_ingress"`
+		Global struct {
+			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
+			Tag   string `yaml:"tag" env-default:"latest"`
+		} `yaml:"global"`
+		Server struct {
+			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
+			Tag   string `yaml:"tag" env-default:"latest"`
+		} `yaml:"server"`
+		Redis struct {
+			Image    string `yaml:"image" env-default:"public.ecr.aws/docker/library/redis"`
+			Tag      string `yaml:"tag" env-default:"7.2.4-alpine"`
+			Exporter struct {
+				Image string `yaml:"image" env-default:"public.ecr.aws/bitnami/redis-exporter"`
+				Tag   string `yaml:"tag" env-default:"1.58.0"`
+			} `yaml:"exporter"`
+		} `yaml:"redis"`
+		ApplicationSet struct {
+			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
+			Tag   string `yaml:"tag" env-default:"latest"`
+		} `yaml:"application_set"`
+		Dex struct {
+			Image string `yaml:"image" env-default:"ghcr.io/dexidp/dex"`
+			Tag   string `yaml:"tag" env-default:"v2.38.0"`
+		} `yaml:"dex"`
+		RepoServer struct {
+			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
+			Tag   string `yaml:"tag" env-default:"latest"`
+		} `yaml:"repo_server"`
+		Notifications struct {
+			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
+			Tag   string `yaml:"tag" env-default:"latest"`
+		} `yaml:"notifications"`
+		Controller struct {
+			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
+			Tag   string `yaml:"tag" env-default:"latest"`
+		} `yaml:"controller"`
 	} `yaml:"argo_cd"`
 	UpdatesOperator struct {
 		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/keel"`
 		ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
 		Enabled      bool   `yaml:"enabled"`
+		Image        string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
+		Tag          string `yaml:"tag" env-default:"latest"`
 	} `yaml:"updates_operator"`
 	Rollouts struct {
 		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"`
 		ChartVersion string `yaml:"chart_version" env-default:"2.35.1"`
 		Enabled      bool   `yaml:"enabled"`
+		Registry     string `yaml:"registry" env-default:"quay.io"`
+		Repository   string `yaml:"repository" env-default:"argoproj/argo-rollouts"`
+		Tag          string `yaml:"tag" env-default:"latest"`
 		Ha           struct {
 			Enabled bool `yaml:"enabled"`
 		} `yaml:"ha"`

internal/config/modules_registry.go

@@ -6,7 +6,6 @@ type Registry struct {
 	Enabled       bool   `yaml:"enabled"`
 	AdminPassword string
 	Namespace     string `yaml:"namespace" env-default:"registry"`
-	Version       string `yaml:"version" env-default:"v2.10.1"`
 	Expose        struct {
 		Type          string `yaml:"type" env-default:"nodePort"`
 		Domain        string `yaml:"domain" env-default:""`
@@ -30,4 +29,38 @@ type Registry struct {
 		TrivySize      string `yaml:"trivy_size" env-default:"5Gi"`
 	} `yaml:"persistence"`
 	EnabledScanner bool `yaml:"enabled_scanner"`
+	Portal         struct {
+		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal"`
+		Tag   string `yaml:"tag" env-default:"v2.10.1"`
+	} `yaml:"portal"`
+	Core struct {
+		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-core"`
+		Tag   string `yaml:"tag" env-default:"v2.10.1"`
+	} `yaml:"core"`
+	Jobservice struct {
+		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice"`
+		Tag   string `yaml:"tag" env-default:"v2.10.1"`
+	} `yaml:"jobservice"`
+	Registry struct {
+		Registry struct {
+			Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/registry-photon"`
+			Tag   string `yaml:"tag" env-default:"v2.10.1"`
+		} `yaml:"registry"`
+		Controller struct {
+			Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl"`
+			Tag   string `yaml:"tag" env-default:"v2.10.1"`
+		} `yaml:"controller"`
+	} `yaml:"registry"`
+	Trivy struct {
+		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon"`
+		Tag   string `yaml:"tag" env-default:"v2.10.1"`
+	} `yaml:"trivy"`
+	Database struct {
+		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-db"`
+		Tag   string `yaml:"tag" env-default:"v2.10.1"`
+	} `yaml:"database"`
+	Redis struct {
+		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/redis-photon"`
+		Tag   string `yaml:"tag" env-default:"v2.10.1"`
+	} `yaml:"redis"`
 }

internal/config/orchestrator.go

@@ -5,6 +5,11 @@ type Dns struct {
 	DisableHostNameservers bool     `yaml:"disable_host_nameservers"`
 }
 
+type RegistryMirror struct {
+	Host       string `yaml:"host"`
+	SkipVerify bool   `yaml:"skip_verify"`
+}
+
 type Orchestrator struct {
 	Version                   string `yaml:"version" env-default:"v1.29.0"`
 	ClusterName               string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
@@ -28,4 +33,5 @@ type Orchestrator struct {
 		ServiceAddresses string `yaml:"service_addresses" env-default:"10.233.0.0/18"`
 		PodsSubnet       string `yaml:"pods_subnet" env-default:"10.233.64.0/18"`
 	} `yaml:"network"`
+	RegistryMirrors []RegistryMirror `yaml:"registry_mirrors"`
 }

internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl

@@ -12,7 +12,14 @@
     crds:
       install: true
 
+    global:
+      repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
+      tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
+
     server:
+      image:
+        repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
+        tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
       certificateSecret:
         enabled: false
       {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
@@ -37,12 +44,23 @@
           enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
     redis:
+      image:
+        repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
+        tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
+      exporter:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        image:
+          repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
+          tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
       metrics:
         enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
         serviceMonitor:
           enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
     controller:
+      image:
+        repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
+        tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
       replicas: 1
       metrics:
         enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
@@ -50,6 +68,9 @@
           enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
     applicationSet:
+      image:
+        repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
+        tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
       {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
       replicas: 2
       {{- end }}
@@ -59,6 +80,9 @@
           enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
     dex:
+      image:
+        repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
+        tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
       metrics:
         enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
         ## check later
@@ -66,6 +90,9 @@
           enabled: false
 
     repoServer:
+      image:
+        repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
+        tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
       {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
       {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
       autoscaling:
@@ -81,6 +108,9 @@
           enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
     notifications:
+      image:
+        repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
+        tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
       metrics:
         enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
         serviceMonitor:

internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl

@@ -77,11 +77,11 @@
       {{- end }}
       image:
         # -- Registry to use
-        registry: quay.io
+        registry: {{ .Modules.Cicd.Rollouts.Registry }}
         # -- Repository to use
-        repository: argoproj/argo-rollouts
+        repository: {{ .Modules.Cicd.Rollouts.Repository }}
         # -- Overrides the image tag (default is the chart appVersion)
-        tag: ""
+        tag: {{ .Modules.Cicd.Rollouts.Tag }}
         # -- Image pull policy
         pullPolicy: IfNotPresent
 

internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl

@@ -9,8 +9,8 @@
   {{- end }}
   values:
     image:
-      repository: keelhq/keel
+      repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
-      tag: null
+      tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
       pullPolicy: Always
 
     # Enable insecure registries

internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl

@@ -134,8 +134,8 @@
 
     portal:
       image:
-        repository: harbor.kvazaric.ru/kube-forge/harbor-portal
+        repository: {{ .Modules.Registry.Portal.Image }}
-        tag: {{ .Modules.Registry.Version }}
+        tag: {{ .Modules.Registry.Portal.Tag }}
       serviceAccountName: ""
       automountServiceAccountToken: false
       replicas: 1
@@ -149,8 +149,8 @@
 
     core:
       image:
-        repository: goharbor/harbor-core
+        repository: {{ .Modules.Registry.Core.Image }}
-        tag: {{ .Modules.Registry.Version }}
+        tag: {{ .Modules.Registry.Portal.Tag }}
       serviceAccountName: ""
       automountServiceAccountToken: false
       replicas: 1
@@ -187,8 +187,8 @@
 
     jobservice:
       image:
-        repository: goharbor/harbor-jobservice
+        repository: {{ .Modules.Registry.Jobservice.Image }}
-        tag: {{ .Modules.Registry.Version }}
+        tag: {{ .Modules.Registry.Jobservice.Tag }}
       serviceAccountName: ""
       automountServiceAccountToken: false
       replicas: 1
@@ -216,13 +216,13 @@
     registry:
       registry:
         image:
-          repository: goharbor/registry-photon
+          repository: {{ .Modules.Registry.Registry.Registry.Image }}
-          tag: {{ .Modules.Registry.Version }}
+          tag: {{ .Modules.Registry.Registry.Registry.Tag }}
         extraEnvVars: []
       controller:
         image:
-          repository: goharbor/harbor-registryctl
+          repository: {{ .Modules.Registry.Registry.Controller.Image }}
-          tag: {{ .Modules.Registry.Version }}
+          tag: {{ .Modules.Registry.Registry.Controller.Tag }}
         extraEnvVars: []
       serviceAccountName: ""
       automountServiceAccountToken: false
@@ -265,8 +265,8 @@
     trivy:
       enabled: {{ .Modules.Registry.EnabledScanner }}
       image:
-        repository: goharbor/trivy-adapter-photon
+        repository: {{ .Modules.Registry.Trivy.Image }}
-        tag: {{ .Modules.Registry.Version }}
+        tag: {{ .Modules.Registry.Trivy.Tag }}
       serviceAccountName: ""
       automountServiceAccountToken: false
       resources:
@@ -284,8 +284,8 @@
       type: internal
       internal:
         image:
-          repository: goharbor/harbor-db
+          repository: {{ .Modules.Registry.Database.Image }}
-          tag: {{ .Modules.Registry.Version }}
+          tag: {{ .Modules.Registry.Database.Tag }}
         serviceAccountName: ""
         automountServiceAccountToken: false
         livenessProbe:
@@ -343,8 +343,8 @@
       type: internal
       internal:
         image:
-          repository: goharbor/redis-photon
+          repository: {{ .Modules.Registry.Redis.Image }}
-          tag: {{ .Modules.Registry.Version }}
+          tag: {{ .Modules.Registry.Redis.Tag }}
         serviceAccountName: ""
         automountServiceAccountToken: false
         extraEnvVars: []

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl

@@ -231,6 +231,72 @@ dns_domain: {{ `"{{ cluster_name }}"` }}
 ## Default: containerd
 container_manager: {{ .Orchestrator.ContainerEngine.Type }}
 
+{{- if .Orchestrator.RegistryMirrors }}
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+      - host: {{ $registryData.Host }}
+        capabilities: ["pull", "resolve"]
+        skip_verify: {{ $registryData.SkipVerify }}
+      {{- end }}
+{{- else }}
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://quay.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://registry.redhat.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+{{- end }}
+
+## CRI-O registry mirrors setup
+{{- if .Orchestrator.RegistryMirrors }}
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+      - location: {{ $registryData.Host }}
+        insecure: {{ $registryData.SkipVerify }}
+      {{- end }}
+{{- else }}
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      - location: https://mirror.gcr.io
+        insecure: false
+      - location: https://quay.io
+        insecure: false
+      - location: https://registry.redhat.io
+        insecure: false
+{{- end }}
+
+## Docker registry mirrors setup
+{{- if .Orchestrator.RegistryMirrors }}
+docker_registry_mirrors:
+  {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+  - {{ $registryData.Host }}
+  {{- end }}
+{{- else }}
+docker_registry_mirrors:
+  - https://mirror.gcr.io
+  - https://quay.io
+  - https://registry.redhat.io
+{{- end }}
+
 # Additional container runtimes
 kata_containers_enabled: false
 

kubespray/inventory/group_vars/k8s_cluster/addons.yml

@@ -4350,7 +4350,7 @@ releases:
   
       portal:
         image:
-          repository: harbor.kvazaric.ru/kube-forge/harbor-portal
+          repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal
           tag: v2.10.1
         serviceAccountName: ""
         automountServiceAccountToken: false
@@ -4365,7 +4365,7 @@ releases:
   
       core:
         image:
-          repository: goharbor/harbor-core
+          repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-core
           tag: v2.10.1
         serviceAccountName: ""
         automountServiceAccountToken: false
@@ -4403,7 +4403,7 @@ releases:
   
       jobservice:
         image:
-          repository: goharbor/harbor-jobservice
+          repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice
           tag: v2.10.1
         serviceAccountName: ""
         automountServiceAccountToken: false
@@ -4432,12 +4432,12 @@ releases:
       registry:
         registry:
           image:
-            repository: goharbor/registry-photon
+            repository: harbor.kvazaric.ru/kube-forge/goharbor/registry-photon
             tag: v2.10.1
           extraEnvVars: []
         controller:
           image:
-            repository: goharbor/harbor-registryctl
+            repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl
             tag: v2.10.1
           extraEnvVars: []
         serviceAccountName: ""
@@ -4481,7 +4481,7 @@ releases:
       trivy:
         enabled: true
         image:
-          repository: goharbor/trivy-adapter-photon
+          repository: harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon
           tag: v2.10.1
         serviceAccountName: ""
         automountServiceAccountToken: false
@@ -4500,7 +4500,7 @@ releases:
         type: internal
         internal:
           image:
-            repository: goharbor/harbor-db
+            repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-db
             tag: v2.10.1
           serviceAccountName: ""
           automountServiceAccountToken: false
@@ -4559,7 +4559,7 @@ releases:
         type: internal
         internal:
           image:
-            repository: goharbor/redis-photon
+            repository: harbor.kvazaric.ru/kube-forge/goharbor/redis-photon
             tag: v2.10.1
           serviceAccountName: ""
           automountServiceAccountToken: false
@@ -4607,7 +4607,14 @@ releases:
       crds:
         install: true
   
+      global:
+        repository: quay.io/argoproj/argocd
+        tag: latest
+  
       server:
+        image:
+          repository: quay.io/argoproj/argocd
+          tag: latest
         certificateSecret:
           enabled: false
   
@@ -4617,12 +4624,23 @@ releases:
             enabled: true
   
       redis:
+        image:
+          repository: public.ecr.aws/docker/library/redis
+          tag: 7.2.4-alpine
+        exporter:
+          enabled: true
+          image:
+            repository: public.ecr.aws/bitnami/redis-exporter
+            tag: 1.58.0
         metrics:
           enabled: true
           serviceMonitor:
             enabled: true
   
       controller:
+        image:
+          repository: quay.io/argoproj/argocd
+          tag: latest
         replicas: 1
         metrics:
           enabled: true
@@ -4630,12 +4648,18 @@ releases:
             enabled: true
   
       applicationSet:
+        image:
+          repository: quay.io/argoproj/argocd
+          tag: latest
         metrics:
           enabled: true
           serviceMonitor:
             enabled: true
   
       dex:
+        image:
+          repository: ghcr.io/dexidp/dex
+          tag: v2.38.0
         metrics:
           enabled: true
           ## check later
@@ -4643,12 +4667,18 @@ releases:
             enabled: false
   
       repoServer:
+        image:
+          repository: quay.io/argoproj/argocd
+          tag: latest
         metrics:
           enabled: true
           serviceMonitor:
             enabled: true
   
       notifications:
+        image:
+          repository: quay.io/argoproj/argocd
+          tag: latest
         metrics:
           enabled: true
           serviceMonitor:
@@ -4659,7 +4689,7 @@ releases:
           server.insecure: true
   
         secret:
-          argocdServerAdminPassword: $2a$10$HDBhVHGtL0vBIcjuOybKzuTkc/HVVuQhZ0QHa38ljyjjZPmAESxrW
+          argocdServerAdminPassword: $2a$10$Nlkv3tEZauAtWk8BUbloqujTETrG7n1rlJmRXJAxz4xiZRRRtgfO6
   
         repositories:
           # add default helm-repository from harbor
@@ -4783,7 +4813,7 @@ releases:
           # -- Repository to use
           repository: argoproj/argo-rollouts
           # -- Overrides the image tag (default is the chart appVersion)
-          tag: ""
+          tag: latest
           # -- Image pull policy
           pullPolicy: IfNotPresent
   
@@ -5132,8 +5162,8 @@ releases:
     release_state: "present"
     values:
       image:
-        repository: keelhq/keel
+        repository: harbor.kvazaric.ru/kube-forge/keelhq/keel
-        tag: null
+        tag: latest
         pullPolicy: Always
   
       # Enable insecure registries

kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml

@@ -226,6 +226,33 @@ dns_domain: "{{ cluster_name }}"
 ## docker for docker, crio for cri-o and containerd for containerd.
 ## Default: containerd
 container_manager: containerd
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://quay.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+
+## CRI-O registry mirrors setup
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      - location: https://mirror.gcr.io
+        insecure: false
+      - location: https://quay.io
+        insecure: false
+
+## Docker registry mirrors setup
+docker_registry_mirrors:
+  - https://mirror.gcr.io
+  - https://quay.io
 
 # Additional container runtimes
 kata_containers_enabled: false