安装容器运行时CRI

安装前准备

转发IPv4允许iptables检查桥接流量

cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

# sysctl params required by setup, params persist across reboots
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF

# Apply sysctl params without reboot
sudo sysctl --system

检查是否成功装载br_netfilter, overlay

1 2	`lsmod \| grep br_netfilter lsmod \| grep overlay`

检查net.bridge.bridge-nf-call-iptables, net.bridge.bridge-nf-call-ip6tables, net.ipv4.ip_forward是否设置为1

1	`sysctl net.bridge.bridge-nf-call-iptables net.bridge.bridge-nf-call-ip6tables net.ipv4.ip_forward`

Cgroup 驱动

有两种cgroup驱动

cgroupfs
systemd

推荐使用systemd作为统一的驱动，因为现在大多数系统使用systemd来调度进程，cgroupfs是kubelet默认使用的cgroup驱动，如果同时使用两种驱动话可能最引起冲突。如果使用cgroupv2的话也需要使用systemd。

Note: 1.22版本之后如果没有特意在KubeletConfiguration 下设置 cgroupDriver 字段，kubeadm会默认使用systemd

Container runtime

安装CRI使用了一个Github的文档：Getting started with containerd

方法一：官方二进制包

先决条件

安装runc和CNI plugins

安装方法

下载runc然后安装到到/usr/local/sbin/runc

二进制包地址

1 2	`wget https://github.com/opencontainers/runc/releases/download/v1.2.0-rc.1/runc.amd64 install -m 755 runc.amd64 /usr/local/sbin/runc`

经测试这个方式是正确的，上一个是错误的。

安装CNI plugins

下载CNI plugins之后解压在/opt/cni/bin

wget https://github.com/containernetworking/plugins/releases/download/v1.4.1/cni-plugins-linux-amd64-v1.4.1.tgz

mkdir -p /opt/cni/bin
tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.4.1.tgz

安装containerd

Download the containerd-<VERSION>-<OS>-<ARCH>.tar.gz archive from https://github.com/containerd/containerd/releases , verify its sha256sum, and extract it under /usr/local:

wget https://github.com/containerd/containerd/releases/download/v1.7.15/containerd-1.7.15-linux-amd64.tar.gz

tar Cxzvf /usr/local containerd-1.7.15-linux-amd64.tar.gz
bin/
bin/containerd-shim-runc-v2
bin/containerd-shim
bin/ctr
bin/containerd-shim-runc-v1
bin/containerd
bin/containerd-stress

systemd

使用systemd管理containerd，下载service文件到/usr/local/lib/systemd/system/containerd.service，文件下载地址，containerd.service。

wget https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
mv containerd.service /usr/local/lib/systemd/system/containerd.service
# mkdir -p /usr/local/lib/systemd/system/
# 没有这个目录就创建一下吧

systemctl daemon-reload
systemctl enable --now containerd

生成config文件

mkdir /etc/containerd
# 创建目录
touch /etc/containerd/config.toml
# 创建config文件
containerd config default > /etc/containerd/config.toml
# 输出默认配置到文件

修改config内容

vim /etc/containerd/config.toml

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
  ...
  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
    SystemdCgroup = true

载入配置