Skip to content

Instantly share code, notes, and snippets.

@dongnguyenltqb

dongnguyenltqb/install-with-containerd.sh

Last active September 11, 2022 16:24
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dongnguyenltqb/42fb1b748d30f1a84581501b50f5a3e1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dongnguyenltqb/42fb1b748d30f1a84581501b50f5a3e1 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. dongnguyenltqb revised this gist Sep 11, 2022. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions install-with-containerd.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -322,12 +322,12 @@ systemctl start kubelet
    # sudo dpkg -i step-cli_0.21.0_amd64.deb
    # fi;
    # sudo mkdir -p /etc/kubernetes/pki
    # step certificate create root.linkerd.cluster.local /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.key \
    # sudo step certificate create root.linkerd.cluster.local /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.key \
    # --profile root-ca --no-password --insecure --not-after=87600h

    # sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --cri-socket=/run/containerd/containerd.sock
    # then taint node lable to allow coredns can allocate on master node
    # kubectl taint nodes --all node-role.kubernetes.io/control-plane-S
    # kubectl taint nodes --all node-role.kubernetes.io/control-plane-
    # install flannel cni pluggin, this allow pod can communicate with other
    # kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
    # do the same step with the worker node
  2. dongnguyenltqb revised this gist Sep 11, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion install-with-containerd.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -325,7 +325,7 @@ systemctl start kubelet
    # step certificate create root.linkerd.cluster.local /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.key \
    # --profile root-ca --no-password --insecure --not-after=87600h

    # sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --cri-socket=/run/containerd/containerd.sock --cert-dir=$(pwd)
    # sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --cri-socket=/run/containerd/containerd.sock
    # then taint node lable to allow coredns can allocate on master node
    # kubectl taint nodes --all node-role.kubernetes.io/control-plane-S
    # install flannel cni pluggin, this allow pod can communicate with other
  3. dongnguyenltqb revised this gist Sep 11, 2022. 1 changed file with 10 additions and 1 deletion.
    11 changes: 10 additions & 1 deletion install-with-containerd.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -316,7 +316,16 @@ systemctl enable kubelet
    systemctl start kubelet

    # now can init cluster with
    # sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --cri-socket=/run/containerd/containerd.sock
    # generate ca cert
    # if [[ $(command -v step) == "" ]] ; then
    # wget https://dl.step.sm/gh-release/cli/docs-cli-install/v0.21.0/step-cli_0.21.0_amd64.deb
    # sudo dpkg -i step-cli_0.21.0_amd64.deb
    # fi;
    # sudo mkdir -p /etc/kubernetes/pki
    # step certificate create root.linkerd.cluster.local /etc/kubernetes/pki/ca.crt /etc/kubernetes/pki/ca.key \
    # --profile root-ca --no-password --insecure --not-after=87600h

    # sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --cri-socket=/run/containerd/containerd.sock --cert-dir=$(pwd)
    # then taint node lable to allow coredns can allocate on master node
    # kubectl taint nodes --all node-role.kubernetes.io/control-plane-S
    # install flannel cni pluggin, this allow pod can communicate with other
  4. dongnguyenltqb revised this gist Aug 29, 2022. 1 changed file with 2 additions and 4 deletions.
    6 changes: 2 additions & 4 deletions install-with-containerd.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -309,11 +309,9 @@ curl -L --remote-name-all https://storage.googleapis.com/kubernetes-release/rele
    chmod +x {kubeadm,kubelet,kubectl}
    mv {kubeadm,kubelet,kubectl} $DOWNLOAD_DIR
    RELEASE_VERSION="v0.4.0"
    curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubelet/lib/systemd/system/kubelet.service" | tee /etc/systemd/sys
    let.service
    curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubelet/lib/systemd/system/kubelet.service" | tee /etc/systemd/system/kubelet.service
    mkdir -p /etc/systemd/system/kubelet.service.d
    curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf" | tee /etc/systemd/system/kubelet.service
    beadm.conf
    curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf" | tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    systemctl enable kubelet
    systemctl start kubelet

  5. dongnguyenltqb created this gist Aug 29, 2022.
    327 changes: 327 additions & 0 deletions install-with-containerd.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,327 @@
    #!/bin/bash
    set -ex
    if [[ $(whoami) != "root" ]]; then
    echo "Please run as root"
    exit
    fi


    # Install dep
    apt update && apt install -y socat ebtables conntrack

    # Forwarding IPv4 and letting iptables see bridged traffic
    cat <<EOF | tee /etc/modules-load.d/k8s.conf
    overlay
    br_netfilter
    EOF

    modprobe overlay
    modprobe br_netfilter

    # sysctl params required by setup, params persist across reboots
    cat <<EOF | tee /etc/sysctl.d/k8s.conf
    net.bridge.bridge-nf-call-iptables = 1
    net.bridge.bridge-nf-call-ip6tables = 1
    net.ipv4.ip_forward = 1
    EOF

    # Apply sysctl params without reboot
    sysctl --system

    # Install containerd
    wget https://github.com/containerd/containerd/releases/download/v1.6.8/containerd-1.6.8-linux-amd64.tar.gz
    tar Cxzvf /usr/local containerd-1.6.8-linux-amd64.tar.gz
    wget https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
    mkdir -p /etc/containerd
    cat <<EOF > /etc/containerd/config.toml
    disabled_plugins = []
    imports = []
    oom_score = 0
    plugin_dir = ""
    required_plugins = []
    root = "/var/lib/containerd"
    state = "/run/containerd"
    temp = ""
    version = 2
    [cgroup]
    path = ""
    [debug]
    address = ""
    format = ""
    gid = 0
    level = ""
    uid = 0
    [grpc]
    address = "/run/containerd/containerd.sock"
    gid = 0
    max_recv_message_size = 16777216
    max_send_message_size = 16777216
    tcp_address = ""
    tcp_tls_ca = ""
    tcp_tls_cert = ""
    tcp_tls_key = ""
    uid = 0
    [metrics]
    address = ""
    grpc_histogram = false
    [plugins]
    [plugins."io.containerd.gc.v1.scheduler"]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = "0s"
    startup_delay = "100ms"
    [plugins."io.containerd.grpc.v1.cri"]
    device_ownership_from_security_context = false
    disable_apparmor = false
    disable_cgroup = false
    disable_hugetlb_controller = true
    disable_proc_mount = false
    disable_tcp_service = true
    enable_selinux = false
    enable_tls_streaming = false
    enable_unprivileged_icmp = false
    enable_unprivileged_ports = false
    ignore_image_defined_volumes = false
    max_concurrent_downloads = 3
    max_container_log_line_size = 16384
    netns_mounts_under_state_dir = false
    restrict_oom_score_adj = false
    sandbox_image = "k8s.gcr.io/pause:3.6"
    selinux_category_range = 1024
    stats_collect_period = 10
    stream_idle_timeout = "4h0m0s"
    stream_server_address = "127.0.0.1"
    stream_server_port = "0"
    systemd_cgroup = false
    tolerate_missing_hugetlb_controller = true
    unset_seccomp_profile = ""
    [plugins."io.containerd.grpc.v1.cri".cni]
    bin_dir = "/opt/cni/bin"
    conf_dir = "/etc/cni/net.d"
    conf_template = ""
    ip_pref = ""
    max_conf_num = 1
    [plugins."io.containerd.grpc.v1.cri".containerd]
    default_runtime_name = "runc"
    disable_snapshot_annotations = true
    discard_unpacked_layers = false
    ignore_rdt_not_enabled_errors = false
    no_pivot = false
    snapshotter = "overlayfs"
    [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
    base_runtime_spec = ""
    cni_conf_dir = ""
    cni_max_conf_num = 0
    container_annotations = []
    pod_annotations = []
    privileged_without_host_devices = false
    runtime_engine = ""
    runtime_path = ""
    runtime_root = ""
    runtime_type = ""
    [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]
    [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
    [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
    base_runtime_spec = ""
    cni_conf_dir = ""
    cni_max_conf_num = 0
    container_annotations = []
    pod_annotations = []
    privileged_without_host_devices = false
    runtime_engine = ""
    runtime_path = ""
    runtime_root = ""
    runtime_type = "io.containerd.runc.v2"
    [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
    BinaryName = ""
    CriuImagePath = ""
    CriuPath = ""
    CriuWorkPath = ""
    IoGid = 0
    IoUid = 0
    NoNewKeyring = false
    NoPivotRoot = false
    Root = ""
    ShimCgroup = ""
    SystemdCgroup = true
    [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
    base_runtime_spec = ""
    cni_conf_dir = ""
    cni_max_conf_num = 0
    container_annotations = []
    pod_annotations = []
    privileged_without_host_devices = false
    runtime_engine = ""
    runtime_path = ""
    runtime_root = ""
    runtime_type = ""
    [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]
    [plugins."io.containerd.grpc.v1.cri".image_decryption]
    key_model = "node"
    [plugins."io.containerd.grpc.v1.cri".registry]
    config_path = ""
    [plugins."io.containerd.grpc.v1.cri".registry.auths]
    [plugins."io.containerd.grpc.v1.cri".registry.configs]
    [plugins."io.containerd.grpc.v1.cri".registry.headers]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
    tls_cert_file = ""
    tls_key_file = ""
    [plugins."io.containerd.internal.v1.opt"]
    path = "/opt/containerd"
    [plugins."io.containerd.internal.v1.restart"]
    interval = "10s"
    [plugins."io.containerd.internal.v1.tracing"]
    sampling_ratio = 1.0
    service_name = "containerd"
    [plugins."io.containerd.metadata.v1.bolt"]
    content_sharing_policy = "shared"
    [plugins."io.containerd.monitor.v1.cgroups"]
    no_prometheus = false
    [plugins."io.containerd.runtime.v1.linux"]
    no_shim = false
    runtime = "runc"
    runtime_root = ""
    shim = "containerd-shim"
    shim_debug = false
    [plugins."io.containerd.runtime.v2.task"]
    platforms = ["linux/amd64"]
    sched_core = false
    [plugins."io.containerd.service.v1.diff-service"]
    default = ["walking"]
    [plugins."io.containerd.service.v1.tasks-service"]
    rdt_config_file = ""
    [plugins."io.containerd.snapshotter.v1.aufs"]
    root_path = ""
    [plugins."io.containerd.snapshotter.v1.btrfs"]
    root_path = ""
    [plugins."io.containerd.snapshotter.v1.devmapper"]
    async_remove = false
    base_image_size = ""
    discard_blocks = false
    fs_options = ""
    fs_type = ""
    pool_name = ""
    root_path = ""
    [plugins."io.containerd.snapshotter.v1.native"]
    root_path = ""
    [plugins."io.containerd.snapshotter.v1.overlayfs"]
    root_path = ""
    upperdir_label = false
    [plugins."io.containerd.snapshotter.v1.zfs"]
    root_path = ""
    [plugins."io.containerd.tracing.processor.v1.otlp"]
    endpoint = ""
    insecure = false
    protocol = ""
    [proxy_plugins]
    [stream_processors]
    [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar"
    [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar+gzip"
    [timeouts]
    "io.containerd.timeout.bolt.open" = "0s"
    "io.containerd.timeout.shim.cleanup" = "5s"
    "io.containerd.timeout.shim.load" = "5s"
    "io.containerd.timeout.shim.shutdown" = "3s"
    "io.containerd.timeout.task.state" = "2s"
    [ttrpc]
    address = ""
    gid = 0
    uid = 0
    EOF
    mv containerd.service /etc/systemd/system/containerd.service
    systemctl daemon-reload
    systemctl enable containerd
    systemctl start containerd
    # install runc
    wget https://github.com/opencontainers/runc/releases/download/v1.1.4/runc.amd64
    install -m 755 runc.amd64 /usr/local/sbin/runc
    # install containerd cni pluggin
    wget https://github.com/containernetworking/plugins/releases/download/v1.1.1/cni-plugins-linux-amd64-v1.1.1.tgz
    mkdir -p /opt/cni/bin
    tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.1.1.tgz
    # install crictl
    wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.25.0/crictl-v1.25.0-linux-amd64.tar.gz
    tar -xvf crictl-v1.25.0-linux-amd64.tar.gz
    mv crictl /usr/bin/crictl

    # install kube-x tool
    DOWNLOAD_DIR=/usr/bin
    RELEASE="$(curl -sSL https://dl.k8s.io/release/stable.txt)"
    ARCH="amd64"
    curl -L --remote-name-all https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/${ARCH}/{kubeadm,kubelet,kubectl}
    chmod +x {kubeadm,kubelet,kubectl}
    mv {kubeadm,kubelet,kubectl} $DOWNLOAD_DIR
    RELEASE_VERSION="v0.4.0"
    curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubelet/lib/systemd/system/kubelet.service" | tee /etc/systemd/sys
    let.service
    mkdir -p /etc/systemd/system/kubelet.service.d
    curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf" | tee /etc/systemd/system/kubelet.service
    beadm.conf
    systemctl enable kubelet
    systemctl start kubelet

    # now can init cluster with
    # sudo kubeadm init --pod-network-cidr=10.244.0.0/16 --cri-socket=/run/containerd/containerd.sock
    # then taint node lable to allow coredns can allocate on master node
    # kubectl taint nodes --all node-role.kubernetes.io/control-plane-S
    # install flannel cni pluggin, this allow pod can communicate with other
    # kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
    # do the same step with the worker node
    # then use kubeadm to join