Use CRI-O’s pause_image_auth_file option

pkg/controller/template/render.go

@@ -17,7 +17,6 @@ import (
 	ignv2_2types "github.com/coreos/ignition/config/v2_2/types"
 	"github.com/ghodss/yaml"
 	"github.com/golang/glog"
-	"github.com/openshift/machine-config-operator/lib/resourcemerge"
 	mcfgv1 "github.com/openshift/machine-config-operator/pkg/apis/machineconfiguration.openshift.io/v1"
 	"github.com/openshift/machine-config-operator/pkg/controller/common"
 	"github.com/openshift/machine-config-operator/pkg/version"
@@ -75,11 +74,7 @@ func generateTemplateMachineConfigs(config *RenderConfig, templateDir string) ([
 		if err != nil {
 			return nil, fmt.Errorf("failed to create MachineConfig for role %s: %v", role, err)
 		}
-		if len(roleConfigs) > 0 {
-			injectDockerConfigKubeletAuthSymlink(roleConfigs[len(roleConfigs)-1])
-		}
 		cfgs = append(cfgs, roleConfigs...)
-
 	}
 
 	// tag all the machineconfigs with version of the controller.
@@ -93,24 +88,6 @@ func generateTemplateMachineConfigs(config *RenderConfig, templateDir string) ([
 	return cfgs, nil
 }
 
-// injectDockerConfigKubeletAuthSymlink is a hack to symlink /var/lib/kubelet/auth.json -> ~/.docker/config.json
-// See https://bugzilla.redhat.com/show_bug.cgi?id=1686556
-// https://github.com/containers/skopeo/pull/612
-func injectDockerConfigKubeletAuthSymlink(cfg *mcfgv1.MachineConfig) {
-	authLink := ignv2_2types.Link{
-		Node: ignv2_2types.Node{
-			Filesystem: "root",
-			Path:       "/root/.docker/config.json",
-			Overwrite:  resourcemerge.BoolPtr(false),
-		},
-		LinkEmbedded1: ignv2_2types.LinkEmbedded1{
-			Hard:   false,
-			Target: "/var/lib/kubelet/config.json",
-		},
-	}
-	cfg.Spec.Config.Storage.Links = append(cfg.Spec.Config.Storage.Links, authLink)
-}
-
 // GenerateMachineConfigsForRole creates MachineConfigs for the role provided
 func GenerateMachineConfigsForRole(config *RenderConfig, role string, path string) ([]*mcfgv1.MachineConfig, error) {
 	infos, err := ioutil.ReadDir(path)

templates/master/01-master-container-runtime/_base/files/crio.yaml

@@ -205,6 +205,10 @@ contents:
     # pause_image is the image which we use to instantiate infra containers.
     pause_image = "{{.Images.infraImage}}"
 
+    # If not empty, the path to a docker/config.json-like file containing credentials
+    # necessary for pulling the image specified by pause_image above.
+    pause_image_auth_file = "/var/lib/kubelet/config.json"
+
     # pause_command is the command to run in a pause_image to have a container just
     # sit there.  If the image contains the necessary information, this value need
     # not be specified.

templates/worker/01-worker-container-runtime/_base/files/crio.yaml

@@ -205,6 +205,10 @@ contents:
     # pause_image is the image which we use to instantiate infra containers.
     pause_image = "{{.Images.infraImage}}"
 
+    # If not empty, the path to a docker/config.json-like file containing credentials
+    # necessary for pulling the image specified by pause_image above.
+    pause_image_auth_file = "/var/lib/kubelet/config.json"
+
     # pause_command is the command to run in a pause_image to have a container just
     # sit there.  If the image contains the necessary information, this value need
     # not be specified.