Answers: <p>This is the answer I got from <a href="https://webpros.slack.com/archives/C02T5F4PFJ7/p1641935253158000" rel="nofollow noreferrer">Rancher Developer Brandon D in their slack</a></p>
  <blockquote>
  <p><code>ctr</code> and <code>crictl</code> both interact with containerd, via different apis. ctr uses the containerd native api, and crictl uses the CRI api. The <code>registries.yaml</code> config is used by containerd itself, and will be honored no matter what it is that does the pull or how.</p>
  </blockquote>
  
Answers: CC BY-SA 4.0
Answers: 2022-06-15T21:18:10.777Z
Answers: 2022-06-15T21:24:07.850Z
Answers: 2022-06-15T21:24:07.850Z
Answers: Evan Carroll
Body: <p><code>k3s ctr</code> launches the contianerd CLI, and <code>k3s crictl</code> is the CRI cli. I'm told you configure k3s authentication to the image registries using <a href="https://rancher.com/docs/k3s/latest/en/installation/private-registry/" rel="nofollow noreferrer"><code>/etc/rancher/k3s/registries.yaml</code></a>. Does this yaml file configure containerd, and CRI such that these commands no longer require <code>--creds</code>?</p>
  <pre class="lang-shell prettyprint-override"><code>k3s crictl pull     --creds &quot;evancarroll:$TOKEN&quot; docker.io/alpine:3
  k3s ctr images pull --creds &quot;evancarroll:$TOKEN&quot; docker.io/library/alpine:3
  </code></pre>
  <p>And can just be</p>
  <pre class="lang-shell prettyprint-override"><code>k3s crictl pull     docker.io/alpine:3
  k3s ctr images pull docker.io/library/alpine:3
  </code></pre>
  
Tags: <configuration><authentication><k3s><containerd>
Title: Does /etc/rancher/k3s/registries.yaml affect `k3s ctr` and `k3s crictl`?
UserDisplayName: Evan Carroll
ThreadText: # Does /etc/rancher/k3s/registries.yaml affect `k3s ctr` and `k3s crictl`?
  
  (Asked by: username_0 on 2022-06-15)
  
  `k3s ctr` launches the contianerd CLI, and `k3s crictl` is the CRI cli. I'm told you configure k3s authentication to the image registries using [`/etc/rancher/k3s/registries.yaml`](https://rancher.com/docs/k3s/latest/en/installation/private-registry/). Does this yaml file configure containerd, and CRI such that these commands no longer require `--creds`?
  
  ```shell
  k3s crictl pull     --creds "username_0:$TOKEN" docker.io/alpine:3
  k3s ctr images pull --creds "username_0:$TOKEN" docker.io/library/alpine:3
  
  ```
  
  And can just be
  
  ```shell
  k3s crictl pull     docker.io/alpine:3
  k3s ctr images pull docker.io/library/alpine:3
  
  ```
  
  **Tags:** configuration, authentication, k3s, containerd
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-06-15. Score: 0 | Accepted answer
  
  This is the answer I got from [Rancher Developer Brandon D in their slack](https://webpros.slack.com/archives/C02T5F4PFJ7/p1641935253158000)
  
  > `ctr` and `crictl` both interact with containerd, via different apis. ctr uses the containerd native api, and crictl uses the CRI api. The `registries.yaml` config is used by containerd itself, and will be honored no matter what it is that does the pull or how.
  
  
  ---
  
  