mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-01-11 10:00:03 -03:30
b9fc4ec43e
Refactor NRI (Node Resource Interface) activation in CRI-O and containerd. Introduce a shared variable, nri_enabled, to streamline the process. Currently, enabling NRI requires a separate update of defaults for each container runtime independently, without any verification of NRI support for the specific version of containerd or CRI-O in use. With this commit, the previous approach is replaced. Now, a single variable, nri_enabled, handles this functionality. Also, this commit separates the responsibility of verifying NRI supported versions of containerd and CRI-O from cluster administrators, and leaves it to Ansible. Signed-off-by: Feruzjon Muyassarov <feruzjon.muyassarov@intel.com> (cherry picked from commit 1fd31ccc282741c6dc2cfe825e35353e81830215)
143 lines
4.2 KiB
Markdown
143 lines
4.2 KiB
Markdown
# containerd
|
|
|
|
[containerd] An industry-standard container runtime with an emphasis on simplicity, robustness and portability
|
|
Kubespray supports basic functionality for using containerd as the default container runtime in a cluster.
|
|
|
|
_To use the containerd container runtime set the following variables:_
|
|
|
|
## k8s_cluster.yml
|
|
|
|
When kube_node contains etcd, you define your etcd cluster to be as well schedulable for Kubernetes workloads. Thus containerd and dockerd can not run at same time, must be set to bellow for running etcd cluster with only containerd.
|
|
|
|
```yaml
|
|
container_manager: containerd
|
|
```
|
|
|
|
## etcd.yml
|
|
|
|
```yaml
|
|
etcd_deployment_type: host
|
|
```
|
|
|
|
## Containerd config
|
|
|
|
Example: define registry mirror for docker hub
|
|
|
|
```yaml
|
|
containerd_registries_mirrors:
|
|
- prefix: docker.io
|
|
mirrors:
|
|
- host: https://mirror.gcr.io
|
|
capabilities: ["pull", "resolve"]
|
|
skip_verify: false
|
|
- host: https://registry-1.docker.io
|
|
capabilities: ["pull", "resolve"]
|
|
skip_verify: false
|
|
```
|
|
|
|
`containerd_registries_mirrors` is ignored for pulling images when `image_command_tool=nerdctl`
|
|
(the default for `container_manager=containerd`). Use `crictl` instead, it supports
|
|
`containerd_registries_mirrors` but lacks proper multi-arch support (see
|
|
[#8375](https://github.com/kubernetes-sigs/kubespray/issues/8375)):
|
|
|
|
```yaml
|
|
image_command_tool: crictl
|
|
```
|
|
|
|
### Containerd Runtimes
|
|
|
|
Containerd supports multiple runtime configurations that can be used with
|
|
[RuntimeClass] Kubernetes feature. See [runtime classes in containerd] for the
|
|
details of containerd configuration.
|
|
|
|
In kubespray, the default runtime name is "runc", and it can be configured with the `containerd_runc_runtime` dictionary:
|
|
|
|
```yaml
|
|
containerd_runc_runtime:
|
|
name: runc
|
|
type: "io.containerd.runc.v2"
|
|
engine: ""
|
|
root: ""
|
|
options:
|
|
systemdCgroup: "false"
|
|
binaryName: /usr/local/bin/my-runc
|
|
base_runtime_spec: cri-base.json
|
|
```
|
|
|
|
Further runtimes can be configured with `containerd_additional_runtimes`, which
|
|
is a list of such dictionaries.
|
|
|
|
Default runtime can be changed by setting `containerd_default_runtime`.
|
|
|
|
#### Base runtime specs and limiting number of open files
|
|
|
|
`base_runtime_spec` key in a runtime dictionary is used to explicitly
|
|
specify a runtime spec json file. `runc` runtime has it set to `cri-base.json`,
|
|
which is generated with `ctr oci spec > /etc/containerd/cri-base.json` and
|
|
updated to include a custom setting for maximum number of file descriptors per
|
|
container.
|
|
|
|
You can change maximum number of file descriptors per container for the default
|
|
`runc` runtime by setting the `containerd_base_runtime_spec_rlimit_nofile`
|
|
variable.
|
|
|
|
You can tune many more [settings][runtime-spec] by supplying your own file name and content with `containerd_base_runtime_specs`:
|
|
|
|
```yaml
|
|
containerd_base_runtime_specs:
|
|
cri-spec-custom.json: |
|
|
{
|
|
"ociVersion": "1.0.2-dev",
|
|
"process": {
|
|
"user": {
|
|
"uid": 0,
|
|
...
|
|
```
|
|
|
|
The files in this dict will be placed in containerd config directory,
|
|
`/etc/containerd` by default. The files can then be referenced by filename in a
|
|
runtime:
|
|
|
|
```yaml
|
|
containerd_runc_runtime:
|
|
name: runc
|
|
base_runtime_spec: cri-spec-custom.json
|
|
...
|
|
```
|
|
|
|
Config insecure-registry access to self hosted registries.
|
|
|
|
```yaml
|
|
containerd_registries_mirrors:
|
|
- prefix: test.registry.io
|
|
mirrors:
|
|
- host: http://test.registry.io
|
|
capabilities: ["pull", "resolve"]
|
|
skip_verify: true
|
|
- prefix: 172.19.16.11:5000
|
|
mirrors:
|
|
- host: http://172.19.16.11:5000
|
|
capabilities: ["pull", "resolve"]
|
|
skip_verify: true
|
|
- prefix: repo:5000
|
|
mirrors:
|
|
- host: http://repo:5000
|
|
capabilities: ["pull", "resolve"]
|
|
skip_verify: true
|
|
```
|
|
|
|
[containerd]: https://containerd.io/
|
|
[RuntimeClass]: https://kubernetes.io/docs/concepts/containers/runtime-class/
|
|
[runtime classes in containerd]: https://github.com/containerd/containerd/blob/main/docs/cri/config.md#runtime-classes
|
|
[runtime-spec]: https://github.com/opencontainers/runtime-spec
|
|
|
|
### Optional : NRI
|
|
|
|
[Node Resource Interface](https://github.com/containerd/nri) (NRI) is disabled by default for the containerd. If you
|
|
are using contained version v1.7.0 or above, then you can enable it with the
|
|
following configuration:
|
|
|
|
```yaml
|
|
nri_enabled: true
|
|
```
|