Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docs to change Container runtime #30141

Merged
merged 17 commits into from
Feb 11, 2022
Original file line number Diff line number Diff line change
@@ -0,0 +1,141 @@
---
title: "Changing the container runtime from Docker Engine to containerd"
weight: 8
content_type: task
---
This task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd highly recommend following the structure in kubernetes/kubernetes#104878 (comment) as it stays in line with our task template and provides contextual information before diving into the tasks. So a brief overview, prerequisites, etc.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes the outline will remain the same as you have mentioned and as it is mentioned in the above review here #30141 (comment)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add an introduction to this task.

Also - are there any prerequisites for this task? For example, I assume you need to install containerd.

If there are please include a "Prerequisites" section before the task steps, i.e.

Suggested change
This task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier.
## Prerequisites
- Install containerd. For more information see, [containerd's installation documentation](https://containerd.io/docs/getting-started/)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 (and please use ## {{% heading "prerequisites" %}} for the heading)

## Prerequisites
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved
1. Install containerd. For more information see, [containerd's installation documentation](https://containerd.io/docs/getting-started/)


2. Drain Node
```
# replace <node-to-drain> with the name of your node you are draining
kubectl drain <node-to-drain> --ignore-daemonsets
```
3. Stop the Docker daemon
```
systemctl stop kubelet
systemctl stop docker
```

2. Start containerd
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved

## Migrate a Linux node {#migration-linux}
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved
Use the following commands to install Containerd on your system:

1. Install and configure prerequisites:

```shell
cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF
```
```shell
sudo modprobe overlay
sudo modprobe br_netfilter
```
2. Setup required sysctl params, these persist across reboots.
```shell
cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF
```
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved
3. Apply sysctl params without reboot
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved
```shell
sudo sysctl --system
```

Install containerd:
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved

1. Install the `containerd.io` package from the official Docker repositories.
You can find instructions for installing `containerd` at
[Starting Containerd](https://containerd.io/docs/getting-started/#starting-containerd).

2. Configure containerd:
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved

```shell
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml
```

3. Restart containerd:
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved

```shell
sudo systemctl restart containerd
```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would explicitly link to the next step the reader should follow, where they start the kubelet etc.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 - something like "After you install containerd, you must [configure the kubelet to use containerd as the container runtime](#use-containerd-as-runtime)."

## Migrate a Windows node {#migrate-windows-powershell}
Debanitrkl marked this conversation as resolved.
Show resolved Hide resolved

Start a Powershell session, set `$Version` to the desired version (ex: `$Version=1.4.3`),
and then run the following commands:

1. Download containerd:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd recommend linking to containerd's install instructions instead of duplicating them here.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This please ^^. I consider this a blocking change and will not merge until it's done! ❤️‍🔥

Copy link
Contributor

@shannonxtreme shannonxtreme Jan 24, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The containerd docs don't currently have instructions, but both these sections in this PR are duplicates of our container runtimes instructions on kubernetes.io. Maybe instead of the duplicate content, we can link to that page? The instructions are the same and are tabbed for readability.

This would mean our instructions on this page would go like:

For each node:

  1. Cordon and drain the node
  2. Install containerd (link)
  3. Configure the kubelet
  4. Uncordon the node
  5. Verify Pods are running
  6. Describe the node to verify the runtime

WDYT @celestehorgan / @sftim?


```powershell
curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz
tar.exe xvf .\containerd-windows-amd64.tar.gz
```

2. Extract and configure:

```powershell
Copy-Item -Path ".\bin\" -Destination "$Env:ProgramFiles\containerd" -Recurse -Force
cd $Env:ProgramFiles\containerd\
.\containerd.exe config default | Out-File config.toml -Encoding ascii

# Review the configuration. Depending on setup you may want to adjust:
# - the sandbox_image (Kubernetes pause image)
# - cni bin_dir and conf_dir locations
Get-Content config.toml

# (Optional - but highly recommended) Exclude containerd from Windows Defender Scans
Add-MpPreference -ExclusionProcess "$Env:ProgramFiles\containerd\containerd.exe"
```

3. Start containerd:

```powershell
.\containerd.exe --register-service
Start-Service containerd
```
- ## Configure the kubelet to use containerd as its container runtime {#use-containerd-as-runtime}

Edit the file `/var/lib/kubelet/kubeadm-flags.env` and add the containerd runtime to the flags. `--container-runtime=remote` and `--container-runtimeendpoint=unix:///run/containerd/containerd.sock"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this apply equally to Linux and Windows systems? If not, let's clarify.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's different for both the environments

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's --container-runtime-endpoint with a - before endpoint.


For users using kubeadm should consider the following:

Kubeadm stores the CRI socket for each host as an annotation in the Node object for that host.
To change it you must do the following:

- Execute `kubectl edit no <NODE-NAME>` on a machine that has the kubeadm `/etc/kubernetes/admin.conf` file.

This will start a text editor where you can edit the Node object.

To choose a text editor you can set the `KUBE_EDITOR` environment variable.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you can also set EDITOR - have I got that right?

- Change the value of `kubeadm.alpha.kubernetes.io/cri-socket` from `/var/run/dockershim.sock`to the CRI socket path of your chose (for example `unix:///run/containerd/containerd.sock`).

Note that new CRI socket paths must be prefixed with `unix://` ideally.
- Save the changes in the text editor, which will update the Node object.




- restart kubelet
`systemctl start kubelet`

- verify pods are running
Run `kubectl get nodes -o wide` and containerd appears as the runtime for the node we just changed.

- finally if everything goes well remove docker
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How would a reader know if things have gone well?

```
apt purge docker-ce docker-ce-cli
OR
yum remove docker-ce docker-ce-cli
```