Skip to content

Commit 85964d3

Browse files
OGtrilliamsOGtrilliams
committed
howto: k8s grammar and format changes
Went through and made a few grammar and format updates to make how-to guide easier to follow, as well as adddirect links to project Github pages where applicable. Fixes: kata-containers#127 Signed-off-by: trilliams <[email protected]> howto: k8s grammar and format changes Went through and made a few grammar and format updates to make how-to guide easier to follow, as well as adddirect links to project Github pages where applicable. Fixes: kata-containers#127 Signed-off-by: trilliams <[email protected]>
1 parent 9664caf commit 85964d3

File tree

1 file changed

+210
-21
lines changed

1 file changed

+210
-21
lines changed

‎how-to/how-to-use-k8s-with-cri-containerd-and-kata.md

+210-21
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,133 @@
11
# How to use Kata Containers and CRI (containerd plugin) with Kubernetes
22

3+
<<<<<<< HEAD
34
This document describes how to set up a single-machine Kubernetes cluster.
5+
<<<<<<< HEAD
6+
<<<<<<< HEAD
47
The Kubernetes cluster will use the CRI containerd plugin and Kata Containers to launch untrusted workloads.
8+
=======
9+
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads.
10+
>>>>>>> c22d45e... made a few grammatical & format changes
511
612
## Requirements
13+
=======
14+
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads.
15+
=======
16+
This document describes how to set up a single-machine Kubernetes cluster.
17+
<<<<<<< HEAD
18+
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://github.com/kata-containers) to launch untrusted workloads.
19+
>>>>>>> f208a33... howto: k8s grammar and format changes
20+
=======
21+
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri/blob/master/README.md) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads.
22+
>>>>>>> 592bf58... edit
23+
24+
## Requirements
25+
>>>>>>> 6486053... howto: k8s grammar and format changes
726
- Kubernetes, kubelet, kubeadm
827
- cri-containerd
928
- Kata Containers
1029

30+
<<<<<<< HEAD
31+
<<<<<<< HEAD
1132
For information about the supported version of these components see
1233
Kata Containers [versions.yaml](https://github.com/kata-containers/runtime/blob/master/versions.yaml) file.
34+
=======
35+
<<<<<<< HEAD
36+
=======
37+
>>>>>>> c22d45e... made a few grammatical & format changes
38+
Note|
39+
----------------- |
40+
|For information about the supported versions of these components, see the Kata Containers [versions.yaml](https://github.com/kata-containers/runtime/blob/master/versions.yaml) file. |
41+
42+
<<<<<<< HEAD
43+
=======
44+
For information about the supported versions of these components, see the Kata Containers [versions.yaml](https://github.com/kata-containers/runtime/blob/master/versions.yaml) file.
45+
>>>>>>> f208a33... howto: k8s grammar and format changes
46+
47+
>>>>>>> 6486053... howto: k8s grammar and format changes
48+
=======
49+
50+
>>>>>>> c22d45e... made a few grammatical & format changes
1351
1452
## Install containerd(with CRI plugin enabled)
1553

1654
Follow the instructions from [CRI installation guide](http://github.com/containerd/cri/blob/master/docs/installation.md)
1755

18-
<!---
1956
```bash
2057
# Check if containerd is installed
2158
$ command -v containerd
2259
```
23-
--->
2460

25-
## Install Kata Containers
61+
## Install Kata Containers
2662

2763
Follow the instructions to [install Kata](https://github.com/kata-containers/documentation/blob/master/install/README.md).
2864

29-
<!---
3065
```bash
3166
# Check if kata-runtime is installed
3267
$ command -v kata-runtime
3368
# Check kata is well configured
3469
$ kata-runtime kata-env
3570
```
36-
--->
3771

3872
## Install Kubernetes
39-
Install Kubernetes in your host. See kubeadm [installation](https://kubernetes.io/docs/tasks/tools/install-kubeadm/)
40-
<!---
73+
Install Kubernetes in your host. See kubeadm [installation](https://kubernetes.io/docs/setup/independent/install-kubeadm/)
74+
4175
```bash
4276
# Check if kubadm is installed
4377
$ command -v kubeadm
4478
```
45-
--->
4679

4780
### Configure containerd to use Kata Containers
4881

49-
The CRI containerd plugin support configuration for two runtime types.
82+
The CRI containerd plugin supports configuration for two runtime types.
5083

84+
<<<<<<< HEAD
85+
<<<<<<< HEAD
5186
- Default runtime: A runtime that is used by default to run workloads.
5287
- Untrusted workload runtime: A runtime that will be used run untrusted workloads.
88+
=======
89+
- **Default runtime:** A runtime that is used by default to run workloads.
90+
<<<<<<< HEAD
91+
- **Untrusted workload runtime:** A runtime that will be used run untrusted workloads.
92+
=======
93+
- **Untrusted workload runtime:** A runtime that will be used to run untrusted workloads.
94+
>>>>>>> f208a33... howto: k8s grammar and format changes
95+
>>>>>>> 6486053... howto: k8s grammar and format changes
96+
97+
#### Define the Kata runtime as `untrusted_workload_runtime`
98+
99+
Configure the Kata runtime for untrusted workloads with the [config option](https://github.com/containerd/cri/blob/v1.0.0-rc.0/docs/config.md)
100+
`plugins.cri.containerd.untrusted_workload_runtime`.
101+
102+
Unless configured otherwise, the default runtime is set to `runc`.
103+
<<<<<<< HEAD
104+
=======
105+
106+
<<<<<<< HEAD
107+
- Configure containerd to use Kata as `untrusted_workload_runtime`
108+
=======
109+
- Configure containerd to use Kata as `untrusted_workload_runtime`:
110+
>>>>>>> f208a33... howto: k8s grammar and format changes
111+
112+
>>>>>>> 6486053... howto: k8s grammar and format changes
113+
=======
114+
- **Default runtime:** A runtime that is used by default to run workloads.
115+
- **Untrusted workload runtime:** A runtime that will be used run untrusted workloads.
53116

54117
#### Define the Kata runtime as `untrusted_workload_runtime`
55118

56119
Configure the Kata runtime for untrusted workload with the [config option](https://github.com/containerd/cri/blob/v1.0.0-rc.0/docs/config.md)
57120
`plugins.cri.containerd.untrusted_workload_runtime`.
58121

59122
Unless configured otherwise, the default runtime is set to `runc`.
123+
124+
- Configure containerd to use Kata as `untrusted_workload_runtime`
125+
126+
>>>>>>> c22d45e... made a few grammatical & format changes
60127
```bash
61-
# Configure containerd to use Kata as untrusted_workload_runtime
62128
$ sudo mkdir -p /etc/containerd/
129+
```
130+
```bash
63131
$ cat << EOT | sudo tee /etc/containerd/config.toml
64132
[plugins]
65133
[plugins.cri.containerd]
@@ -71,23 +139,60 @@ EOT
71139

72140
### Configure Kubelet to use containerd
73141

142+
<<<<<<< HEAD
143+
<<<<<<< HEAD
74144
In order to allow kubelet use containerd (using CRI interface) configure the service to
75145
point to containerd socket.
146+
=======
147+
<<<<<<< HEAD
148+
In order to allow kubelet use containerd (using CRI interface), configure the service to
149+
point to the `containerd` socket.
150+
=======
151+
In order to allow kubelet to use containerd (using CRI interface), configure the service to point to the `containerd` socket.
152+
>>>>>>> f208a33... howto: k8s grammar and format changes
153+
154+
155+
- Configure k8s to use containerd
156+
>>>>>>> 6486053... howto: k8s grammar and format changes
157+
=======
158+
In order to allow kubelet use containerd (using CRI interface), configure the service to
159+
point to the `containerd` socket.
160+
161+
162+
- Configure k8s to use containerd
163+
>>>>>>> c22d45e... made a few grammatical & format changes
76164
77165
```bash
78-
# Configure k8s to use containerd
79166
$ sudo mkdir -p /etc/systemd/system/kubelet.service.d/
167+
```
168+
```bash
80169
$ cat << EOF | sudo tee /etc/systemd/system/kubelet.service.d/0-containerd.conf
81170
[Service]
82171
Environment="KUBELET_EXTRA_ARGS=--container-runtime=remote --runtime-request-timeout=15m --container-runtime-endpoint=unix:///run/containerd/containerd.sock"
83172
EOF
173+
```
174+
```bash
84175
$ sudo systemctl daemon-reload
85176
```
86177

87178
### Optional: Configure proxy
88179

180+
<<<<<<< HEAD
181+
<<<<<<< HEAD
89182
If you are behind a proxy this script will configure your proxy for docker
90183
kubelet and containerd.
184+
=======
185+
<<<<<<< HEAD
186+
If you are behind a proxy, use this script to configure your proxy for docker,
187+
kubelet, and containerd.
188+
=======
189+
If you are behind a proxy, use the following script to configure your proxy for docker, kubelet, and containerd:
190+
>>>>>>> f208a33... howto: k8s grammar and format changes
191+
>>>>>>> 6486053... howto: k8s grammar and format changes
192+
=======
193+
If you are behind a proxy, use this script to configure your proxy for docker,
194+
kubelet, and containerd.
195+
>>>>>>> c22d45e... made a few grammatical & format changes
91196
92197
```bash
93198
# Set proxys
@@ -109,20 +214,61 @@ Environment="HTTPS_PROXY=${https_proxy}"
109214
Environment="NO_PROXY=${no_proxy}"
110215
EOT
111216
done
217+
```
218+
```bash
112219
$ sudo systemctl daemon-reload
113220
```
114221

115-
### Start Kubernetes with kubeadm
222+
### Start Kubernetes with `kubeadm`
223+
224+
225+
- Make sure containerd is up and running
116226

117227
```bash
118-
# Mark sure containerd is up and running
119228
$ sudo systemctl restart containerd
120229
$ sudo systemctl status containerd
230+
<<<<<<< HEAD
231+
<<<<<<< HEAD
232+
=======
233+
```
234+
<<<<<<< HEAD
121235

122-
# Prevent docker iptables rules conflict with k8s pod communication
236+
- Prevent conflicts of docker iptables rules & k8s pod communication
237+
238+
```bash
123239
$ sudo iptables -P FORWARD ACCEPT
240+
```
124241

242+
- Start cluster using `kubeadm`
243+
244+
=======
245+
246+
- Prevent conflicts of docker iptables rules & k8s pod communication
247+
>>>>>>> 6486053... howto: k8s grammar and format changes
248+
=======
249+
```
250+
251+
- Prevent conflicts of docker iptables rules & k8s pod communication
252+
>>>>>>> c22d45e... made a few grammatical & format changes
253+
254+
```bash
255+
$ sudo iptables -P FORWARD ACCEPT
256+
```
257+
258+
<<<<<<< HEAD
259+
<<<<<<< HEAD
125260
# Start cluster using kubeadm
261+
=======
262+
- Start cluster using `kubeadm`
263+
264+
>>>>>>> f208a33... howto: k8s grammar and format changes
265+
```bash
266+
>>>>>>> 6486053... howto: k8s grammar and format changes
267+
=======
268+
- Start cluster using `kubeadm`
269+
270+
```bash
271+
>>>>>>> c22d45e... made a few grammatical & format changes
126272
$ sudo kubeadm init --skip-preflight-checks \
127273
--cri-socket /run/containerd/containerd.sock --pod-network-cidr=10.244.0.0/16
128274
@@ -132,21 +278,41 @@ $ sudo -E kubectl get nodes
132278
$ sudo -E kubectl get pods
133279
```
134280

281+
<<<<<<< HEAD
282+
<<<<<<< HEAD
135283
### Install a pod network
136284
Install a pod network plugin is needed to allow pods communicate with each other.
137285

138286
Install flannel plugging, by following the instructions in the section *Installing a pod network*
139287
from [Using kubeadm to Create a Cluster ](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/)
140288
guide.
289+
=======
290+
### Install a Pod Network
291+
<<<<<<< HEAD
292+
293+
A pod network plugin is needed to allow pods to communicate with each other.
294+
295+
=======
296+
297+
A pod network plugin is needed to allow pods to communicate with each other.
298+
299+
>>>>>>> f208a33... howto: k8s grammar and format changes
300+
Install the `flannel` plugin by following the [Using kubeadm to Create a Cluster](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#instructions) guide, starting from the **Installing a pod network** section.
301+
>>>>>>> 6486053... howto: k8s grammar and format changes
302+
=======
303+
### Install a Pod Network
304+
305+
A pod network plugin is needed to allow pods to communicate with each other.
306+
307+
Install the `flannel` plugin by following the [Using kubeadm to Create a Cluster](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#instructions) guide, starting from the **Installing a pod network** section.
308+
>>>>>>> c22d45e... made a few grammatical & format changes
141309

142-
<!---
143310
```bash
144311
# Install a pod network using flannel
145312
# There is not a programmatic way to know last what flannel commit use
146313
# See https://github.com/coreos/flannel/issues/995
147314
$ sudo -E kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
148315
```
149-
--->
150316

151317

152318
```bash
@@ -166,19 +332,37 @@ $ sudo -E kubectl get pods --all-namespaces | grep dns | grep Running && echo "O
166332

167333
### Allow run pods in master node
168334

169-
By default, the cluster will not schedule pods in the master node to allow that run:
335+
By default, the cluster will not schedule pods in the master node. To enable master node scheduling, run:
170336

171337
```bash
172-
# allow master node run pods
338+
# allow master node to run pods
173339
$ sudo -E kubectl taint nodes --all node-role.kubernetes.io/master-
174340
```
175341

176342

177-
### Create a unstrusted pod using Kata Containers
343+
### Create an unstrusted pod using Kata Containers
178344

179345
By default, all pods are created with the default runtime configured in CRI containerd plugin.
346+
<<<<<<< HEAD
347+
<<<<<<< HEAD
180348
If a pod has the `io.kubernetes.cri.untrusted-workload annotation` set as
181349
`"true"`, the CRI plugin will run the pod with the Kata Containers runtime.
350+
=======
351+
If a pod has the `io.kubernetes.cri.untrusted-workload` annotation set to
352+
<<<<<<< HEAD
353+
<<<<<<< HEAD
354+
`"true"`, the CRI plugin will run the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime).
355+
=======
356+
`"true"`, the CRI plugin runs the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime).
357+
>>>>>>> f208a33... howto: k8s grammar and format changes
358+
=======
359+
`"true"`, the CRI plugin runs the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime/blob/master/README.md).
360+
>>>>>>> 592bf58... edit
361+
>>>>>>> 6486053... howto: k8s grammar and format changes
362+
=======
363+
If a pod has the `io.kubernetes.cri.untrusted-workload` annotation set to
364+
`"true"`, the CRI plugin will run the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime).
365+
>>>>>>> c22d45e... made a few grammatical & format changes
182366

183367
```bash
184368
# Create untrusted pod configuration
@@ -195,19 +379,24 @@ spec:
195379
image: nginx
196380
197381
EOT
382+
```
198383

384+
```bash
199385
# Create untrusted pod
200386
$ sudo -E kubectl apply -f nginx-untrusted.yaml
201-
387+
```
388+
```bash
202389
# Check pod is running
203390
$ sudo -E kubectl get pods
391+
```
204392

393+
```bash
205394
# Check qemu is running
206395
$ ps aux | grep qemu
207396
```
208-
### Delete created pod
209397

210398
```bash
399+
### Delete created pod
211400
# Delete pod
212401
$ sudo -E kubectl delete -f nginx-untrusted.yaml
213402
```

0 commit comments

Comments
 (0)