Skip to content
This repository has been archived by the owner on May 12, 2021. It is now read-only.

Commit

Permalink
howto: k8s grammar and format changes
Browse files Browse the repository at this point in the history 
Went through and made a few grammar and format updates to make how-to guide
easier to follow, as well as adddirect links to project Github pages where applicable.

Fixes: #127

Signed-off-by: trilliams <tribecca@tribecc.us>

howto: k8s grammar and format changes

Went through and made a few grammar and format updates to make how-to guide
easier to follow, as well as adddirect links to project Github pages where applicable.

Fixes: #127

Signed-off-by: trilliams <tribecca@tribecc.us>
  • Loading branch information
@OGtrilliams
OGtrilliams committed Jul 30, 2018
1 parent c22d45e commit 8c20dc7
Showing 1 changed file with 253 additions and 12 deletions.
265 changes: 253 additions & 12 deletions how-to/how-to-use-k8s-with-cri-containerd-and-kata.md
View file
Original file line number Diff line number Diff line change
@@ -1,56 +1,140 @@
# How to use Kata Containers and CRI (containerd plugin) with Kubernetes

This document describes how to set up a single-machine Kubernetes cluster.
<<<<<<< HEAD
<<<<<<< HEAD
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads.
=======
<<<<<<< HEAD
<<<<<<< HEAD
The Kubernetes cluster will use the CRI containerd plugin and Kata Containers to launch untrusted workloads.
=======
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads.
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
## Requirements
=======
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads.
=======
This document describes how to set up a single-machine Kubernetes cluster.
<<<<<<< HEAD
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://github.com/kata-containers) to launch untrusted workloads.
>>>>>>> f208a33... howto: k8s grammar and format changes
=======
=======
The Kubernetes cluster will use the CRI containerd plugin and Kata Containers to launch untrusted workloads.

>>>>>>> 3a167fc... latest
The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri/blob/master/README.md) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads.

## Requirements
- Kubernetes, kubelet, kubeadm
- cri-containerd
- Kata Containers

<<<<<<< HEAD
<<<<<<< HEAD
=======
<<<<<<< HEAD
<<<<<<< HEAD
For information about the supported version of these components see
Kata Containers [versions.yaml](https://github.com/kata-containers/runtime/blob/master/versions.yaml) file.
=======
<<<<<<< HEAD
=======
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======
For information about the supported version of these components see
Kata Containers [versions.yaml](https://github.com/kata-containers/runtime/blob/master/versions.yaml) file.

>>>>>>> 3a167fc... latest
Note|
----------------- |
|For information about the supported versions of these components, see the Kata Containers [versions.yaml](https://github.com/kata-containers/runtime/blob/master/versions.yaml) file. |

<<<<<<< HEAD
<<<<<<< HEAD

=======
<<<<<<< HEAD
=======
For information about the supported versions of these components, see the Kata Containers [versions.yaml](https://github.com/kata-containers/runtime/blob/master/versions.yaml) file.
>>>>>>> f208a33... howto: k8s grammar and format changes
>>>>>>> 6486053... howto: k8s grammar and format changes
=======

>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======
>>>>>>> 3a167fc... latest
## Install containerd(with CRI plugin enabled)

Follow the instructions from [CRI installation guide](http://github.com/containerd/cri/blob/master/docs/installation.md)

<!---
```bash
# Check if containerd is installed
$ command -v containerd
```
--->

## Install Kata Containers
## Install Kata Containers

Follow the instructions to [install Kata](https://github.com/kata-containers/documentation/blob/master/install/README.md).

<!---
```bash
# Check if kata-runtime is installed
$ command -v kata-runtime
# Check kata is well configured
$ kata-runtime kata-env
```
--->

## Install Kubernetes
Install Kubernetes in your host. See kubeadm [installation](https://kubernetes.io/docs/tasks/tools/install-kubeadm/)
<!---
Install Kubernetes in your host. See [kubeadm installation](https://kubernetes.io/docs/setup/independent/install-kubeadm/)

```bash
# Check if kubadm is installed
$ command -v kubeadm
```
--->

### Configure containerd to use Kata Containers

The CRI containerd plugin supports configuration for two runtime types.

<<<<<<< HEAD
<<<<<<< HEAD
=======
<<<<<<< HEAD
<<<<<<< HEAD
- Default runtime: A runtime that is used by default to run workloads.
- Untrusted workload runtime: A runtime that will be used run untrusted workloads.
=======
=======
>>>>>>> 3a167fc... latest
- **Default runtime:** A runtime that is used by default to run workloads.
- **Untrusted workload runtime:** A runtime that will be used to run untrusted workloads.

#### Define the Kata runtime as `untrusted_workload_runtime`

<<<<<<< HEAD
Configure the Kata runtime for untrusted workloads with the [config option](https://github.com/containerd/cri/blob/v1.0.0-rc.0/docs/config.md)
`plugins.cri.containerd.untrusted_workload_runtime`.

Unless configured otherwise, the default runtime is set to `runc`.
<<<<<<< HEAD
=======

<<<<<<< HEAD
- Configure containerd to use Kata as `untrusted_workload_runtime`
=======
- Configure containerd to use Kata as `untrusted_workload_runtime`:
>>>>>>> f208a33... howto: k8s grammar and format changes
>>>>>>> 6486053... howto: k8s grammar and format changes
=======
>>>>>>> 85964d3... howto: k8s grammar and format changes
- **Default runtime:** A runtime that is used by default to run workloads.
- **Untrusted workload runtime:** A runtime that will be used run untrusted workloads.

Expand All @@ -63,7 +147,18 @@ Unless configured otherwise, the default runtime is set to `runc`.

- Configure containerd to use Kata as `untrusted_workload_runtime`

<<<<<<< HEAD
=======
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======
Configure the Kata runtime for untrusted workloads with the [config option](https://github.com/containerd/cri/blob/v1.0.0-rc.0/docs/config.md) `plugins.cri.containerd.untrusted_workload_runtime`.

Unless configured otherwise, the default runtime is set to `runc`.

>>>>>>> 3a167fc... latest
```bash
# Configure containerd to use Kata as untrusted_workload_runtime
$ sudo mkdir -p /etc/containerd/
```
```bash
Expand All @@ -78,11 +173,43 @@ EOT

### Configure Kubelet to use containerd

<<<<<<< HEAD
<<<<<<< HEAD
In order to allow kubelet use containerd (using CRI interface), configure the service to
point to the `containerd` socket.


- Configure k8s to use containerd
=======
<<<<<<< HEAD
<<<<<<< HEAD
In order to allow kubelet use containerd (using CRI interface) configure the service to
point to containerd socket.
=======
<<<<<<< HEAD
In order to allow kubelet use containerd (using CRI interface), configure the service to
point to the `containerd` socket.
=======
In order to allow kubelet to use containerd (using CRI interface), configure the service to point to the `containerd` socket.
>>>>>>> f208a33... howto: k8s grammar and format changes

- Configure k8s to use containerd
>>>>>>> 6486053... howto: k8s grammar and format changes
=======
In order to allow kubelet use containerd (using CRI interface), configure the service to
point to the `containerd` socket.
=======
>>>>>>> 3a167fc... latest
In order to allow kubelet to use containerd (using CRI interface), configure the service to point to the `containerd` socket.

- Configure k8s to use containerd
<<<<<<< HEAD
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======
>>>>>>> 3a167fc... latest
```bash
$ sudo mkdir -p /etc/systemd/system/kubelet.service.d/
Expand All @@ -99,8 +226,32 @@ $ sudo systemctl daemon-reload

### Optional: Configure proxy

<<<<<<< HEAD
<<<<<<< HEAD
If you are behind a proxy, use this script to configure your proxy for docker,
kubelet, and containerd.
=======
<<<<<<< HEAD
<<<<<<< HEAD
If you are behind a proxy this script will configure your proxy for docker
kubelet and containerd.
=======
<<<<<<< HEAD
If you are behind a proxy, use this script to configure your proxy for docker,
kubelet, and containerd.
=======
If you are behind a proxy, use the following script to configure your proxy for docker, kubelet, and containerd:
>>>>>>> f208a33... howto: k8s grammar and format changes
>>>>>>> 6486053... howto: k8s grammar and format changes
=======
If you are behind a proxy, use this script to configure your proxy for docker,
kubelet, and containerd.
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======

If you are behind a proxy, use the following script to configure your proxy for docker, kubelet, and containerd:
>>>>>>> 3a167fc... latest
```bash
# Set proxys
Expand Down Expand Up @@ -135,17 +286,51 @@ $ sudo systemctl daemon-reload
```bash
$ sudo systemctl restart containerd
$ sudo systemctl status containerd
<<<<<<< HEAD
<<<<<<< HEAD
```

- Prevent conflicts of docker iptables rules & k8s pod communication

=======
<<<<<<< HEAD
<<<<<<< HEAD
=======
```
<<<<<<< HEAD
- Prevent conflicts of docker iptables rules & k8s pod communication
>>>>>>> 85964d3... howto: k8s grammar and format changes
```bash
$ sudo iptables -P FORWARD ACCEPT
```

- Start cluster using `kubeadm`

<<<<<<< HEAD
```bash
=======
=======

=======
```

>>>>>>> 3a167fc... latest
- Prevent conflicts of docker iptables rules & k8s pod communication

```bash
$ sudo iptables -P FORWARD ACCEPT
```

- Start cluster using `kubeadm`

```bash
<<<<<<< HEAD
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======
>>>>>>> 3a167fc... latest
$ sudo kubeadm init --skip-preflight-checks \
--cri-socket /run/containerd/containerd.sock --pod-network-cidr=10.244.0.0/16

Expand All @@ -155,21 +340,49 @@ $ sudo -E kubectl get nodes
$ sudo -E kubectl get pods
```

<<<<<<< HEAD
<<<<<<< HEAD
### Install a Pod Network

A pod network plugin is needed to allow pods to communicate with each other.

Install the `flannel` plugin by following the [Using kubeadm to Create a Cluster](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#instructions) guide, starting from the **Installing a pod network** section.
=======
<<<<<<< HEAD
<<<<<<< HEAD
### Install a pod network
Install a pod network plugin is needed to allow pods communicate with each other.

Install flannel plugging, by following the instructions in the section *Installing a pod network*
from [Using kubeadm to Create a Cluster ](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/)
guide.
=======
=======
>>>>>>> 3a167fc... latest
### Install a Pod Network

A pod network plugin is needed to allow pods to communicate with each other.

Install the `flannel` plugin by following the [Using kubeadm to Create a Cluster](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#instructions) guide, starting from the **Installing a pod network** section.
<<<<<<< HEAD
>>>>>>> 6486053... howto: k8s grammar and format changes
=======
### Install a Pod Network

A pod network plugin is needed to allow pods to communicate with each other.

Install the `flannel` plugin by following the [Using kubeadm to Create a Cluster](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#instructions) guide, starting from the **Installing a pod network** section.
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======
>>>>>>> 3a167fc... latest
<!---
```bash
# Install a pod network using flannel
# There is not a programmatic way to know last what flannel commit use
# See https://github.com/coreos/flannel/issues/995
$ sudo -E kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
```
--->


```bash
# wait for pod network
Expand All @@ -196,11 +409,39 @@ $ sudo -E kubectl taint nodes --all node-role.kubernetes.io/master-
```


### Create a unstrusted pod using Kata Containers
### Create an unstrusted pod using Kata Containers

<<<<<<< HEAD
By default, all pods are created with the default runtime configured in CRI containerd plugin.
<<<<<<< HEAD
If a pod has the `io.kubernetes.cri.untrusted-workload` annotation set to
`"true"`, the CRI plugin will run the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime).
=======
<<<<<<< HEAD
<<<<<<< HEAD
If a pod has the `io.kubernetes.cri.untrusted-workload annotation` set as
`"true"`, the CRI plugin will run the pod with the Kata Containers runtime.
=======
If a pod has the `io.kubernetes.cri.untrusted-workload` annotation set to
<<<<<<< HEAD
<<<<<<< HEAD
`"true"`, the CRI plugin will run the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime).
=======
`"true"`, the CRI plugin runs the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime).
>>>>>>> f208a33... howto: k8s grammar and format changes
=======
`"true"`, the CRI plugin runs the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime/blob/master/README.md).
>>>>>>> 592bf58... edit
>>>>>>> 6486053... howto: k8s grammar and format changes
=======
If a pod has the `io.kubernetes.cri.untrusted-workload` annotation set to
`"true"`, the CRI plugin will run the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime).
>>>>>>> c22d45e... made a few grammatical & format changes
>>>>>>> 85964d3... howto: k8s grammar and format changes
=======
By default, all pods are created with the default runtime configured in CRI containerd plugin. If a pod has the `io.kubernetes.cri.untrusted-workload` annotation set to `"true"`, the CRI plugin runs the pod with the [Kata Containers runtime](https://github.com/kata-containers/runtime/blob/master/README.md).

>>>>>>> 3a167fc... latest
```bash
# Create untrusted pod configuration
Expand Down

0 comments on commit 8c20dc7

Please sign in to comment.