add containerd registry mirror certificate configuration

[KubeKyrie]

What type of PR is this?
/kind feature

What this PR does / why we need it:
Support configre containerd with private registry certificates. See https://github.com/containerd/containerd/blob/main/docs/hosts.md
And I update containerd hosts.toml to support it.

Which issue(s) this PR fixes:

Fixes #11853

Special notes for your reviewer:
I have tested all cases including client type is a path or an array of paths or an array of pairs of paths.

Does this PR introduce a user-facing change?:

Support containerd registry mirror certificate configuration

[k8s-ci-robot]

Hi @KubeKyrie. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yankay]

/ok-to-test

[VannTen]

Same here

[KubeKyrie]

ca as a list is ok, such as ca: [one, two], but client is different. Client could be like client = "/etc/certs/client.pem", client = ["/etc/certs/client-1.pem", "/etc/certs/client-2.pem"] or client = [["/etc/certs/client.cert", "/etc/certs/client.key"],["/etc/certs/client.pem", ""]]

I don't know how to deal with it, could u please give me some help? Thanks.

[VannTen]

Is there one form which can express everything possible with containerd config ?
In that case, just use that one and don't consider the others . We don't have to be able to template the full possible form of containerd configuration, as long as we can do everything which should be possible.

[KubeKyrie]

@VannTen PTAL, thanks very much.

[ant31]

I think, we should use the most expressive version (#3) :

1. client = "client.pem"
2. client = ["client.pem"]
3. client = [["client.pem", ""]]

As others can't do:
3. client = [["client.pem", "client.key"]]

[KubeKyrie]

done.

@ant31 @VannTen PTAL, thanks!

[ant31]

thank you, looks good.

[ant31]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ant31, KubeKyrie

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ant31]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment