k8s使用containerd作为CRI

参考链接

https://www.nocentino.com/posts/2021-12-27-installing-and-configuring-containerd-as-a-kubernetes-container-runtime/

一、前置操作

1、加载k8s和containerd所需的overlay和br_netfilter两个模块

sudo modprobe overlay
sudo modprobe br_netfilter

cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF

2、配置启动参数并应用

cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
net.bridge.bridge-nf-call-iptables  = 1
net.ipv4.ip_forward                 = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF

sudo sysctl --system

3、安装containerd

省略

二、配置containerd并启动

1、生成containerd默认配置文件

sudo mkdir -p /etc/containerd
sudo containerd config default | sudo tee /etc/containerd/config.toml

2、修改cgroup为system

在文件/etc/containerd/config.toml中找到[plugins.“io.containerd.grpc.v1.cri”.containerd.runtimes.runc.options]，在下面配置SystemdCgroup=true，若无此项，则添加

# 注意是修改SystemdCgroup，不是systemd_cgroup
SystemdCgroup = true

3、配置containerd镜像源为阿里云

将文件/etc/containerd/config.toml中[plugins.“io.containerd.grpc.v1.cri”.registry.mirrors.“docker.io”]下的endpoint换成阿里云镜像源

#endpoint=["https://registry-1.docker.io"]
endpoint = ["https://te2osmuz.mirror.aliyuncs.com"]

4、修改sandbox_image的前缀为阿里云前缀

替换文件中的sandbox_image

# containerd此配置会覆盖kubelet对此项的配置
sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.2"

5、load配置并重启containerd

systemctl daemon-reload
systemctl restart containerd
# 查看containerd启动状态
systemctl status containerd
# 查看日志
journalctl -xeu containerd

三、设置kubelet cni为containerd且cgroup为systemd

1、修改kubelet配置文件 /etc/sysconfig/kubelet

KUBELET_EXTRA_ARGS="XXX原有数据xxxx --container-runtime=remote --container-runtime-endpoint=unix:///run/containerd/containerd.sock --cgroup-driver=systemd"

2、启动kubelet

systemctl restart kubelet
# 查看日志，报错为failed to load kubelet config file /var/lib/kubelet/config.yaml是正常的，待执行kubeadm后会生成此配置文件
journalctl -xeu kubelet

四、创建master节点

# --image-repository 设置k8s部署所需的镜像前缀，默认为k8s.gcr.io
# --cri-socket 设置cri，默认为docker
kubeadm init --apiserver-advertise-address=10.128.142.116 --pod-network-cidr=12.12.0.0/16 --image-repository=registry.aliyuncs.com/google_containers --cri-socket=/run/containerd/containerd.sock

根据提示完成相应操作后查看node，显示其cri是containerd

[root@master-node images]# kubectl get nodes -owide
NAME           STATUS   ROLES                  AGE    VERSION   INTERNAL-IP      EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION           CONTAINER-RUNTIME
master-node    Ready    control-plane,master   173m   v1.23.4   10.128.142.116   <none>        CentOS Linux 7 (Core)   3.10.0-1160.el7.x86_64   containerd://1.4.13

五、join节点

需要指定cri

kubeadm join 10.128.142.116:6443 --cri-socket /run/containerd/containerd.sock --token v5vq1a.5r1cpyxosls5gnmd \
        --discovery-token-ca-cert-hash sha256:3d36f31826442fb11bea48fa8d80fb51202bed98e1e2b59076b271ef52266e79