Fix containerd config_path mirrors and remove nerdctl insecure_registry (#10196)

* Fix containerd_registries in config_path for mirrors and remove nerdctl global insecure_registry setting

* Make containerd hosts.toml mode 0640

* Add containerd_registries_mirrors and keep containerd_registries to pass packet_debian11-calico-upgrade

tests/common/_docker_hub_registry_mirror.yml

@@ -10,6 +10,16 @@ containerd_registries:
     - "https://mirror.gcr.io"
     - "https://registry-1.docker.io"
 
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://registry-1.docker.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+
 containerd_max_container_log_line_size: -1
 
 crio_registries:

tests/files/packet_ubuntu22-calico-aio.yml

@@ -11,8 +11,17 @@ auto_renew_certificates: true
 kube_proxy_mode: iptables
 enable_nodelocaldns: False
 
-containerd_insecure_registries:
-  "172.19.16.11:5000": "http://172.19.16.11:5000"
-
 containerd_registries:
-  "docker.io": "https://mirror.gcr.io"
+  "docker.io": "https://mirror.gcr.io"
+
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+  - prefix: 172.19.16.11:5000
+    mirrors:
+      - host: http://172.19.16.11:5000
+        capabilities: ["pull", "resolve", "push"]
+        skip_verify: true