【CKS】考试之环境准备gVisor与Containerd集成

【CKS】考试之环境准备gVisor与Containerd集成

gVisor内核要求：Linux 3.17+，如果用的是CentOS7则需要升级内核，Ubuntu不需要。

rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-2.el7.elrepo.noarch.rpm
yum --enablerepo=elrepo-kernel install kernel-ml-devel kernel-ml –y
grub2-set-default 0
reboot
uname -r

1、准备gVisor二进制文件

  set -e
  ARCH=$(uname -m)
  URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH}
  wget ${URL}/runsc ${URL}/runsc.sha512 \
    ${URL}/containerd-shim-runsc-v1 ${URL}/containerd-shim-runsc-v1.sha512
  sha512sum -c runsc.sha512 \
    -c containerd-shim-runsc-v1.sha512
  rm -f *.sha512
  chmod a+rx runsc containerd-shim-runsc-v1
  sudo mv runsc containerd-shim-runsc-v1 /usr/local/bin

2、安装到containerd
由于我的集群版本是v1.20了，改为了containerd，所以需要修改一下配置

containerd config default > /etc/containerd/config.toml
vim /etc/containerd/config.toml

添加以下内容到配置中，与runc对齐

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
          runtime_type = "io.containerd.runsc.v1"

3、重启containerd

systemctl daemon-reload
systemctl  restart containerd

4、创建Pod测试gVisor
RuntimeClass 是一个用于选择容器运行时配置的特性，容器运行时配置用
于运行 Pod 中的容器

• 创建一个RuntimeClass

cat runtimeclass.yaml  

apiVersion: node.k8s.io/v1 # RuntimeClass 定义于 node.k8s.io API 组
kind: RuntimeClass
metadata:
  name: gvisor # 用来引用 RuntimeClass 的名字
handler: runsc # 对应的 CRI 配置的名称

• 创建一个pod

[root@k8s-master gvisor]# cat gv.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: gv
spec:
  nodeName: k8s-node1
  runtimeClassName: gvisor
  containers:
  - image: nginx
    name: gv
    ports:
    - containerPort: 80