4493b6f176
The ocid project was renamed to CRI-O, months ago, it is time that we moved all of the code to the new name. We want to elminate the name ocid from use. Move fully to crio. Also cric is being renamed to crioctl for the time being. Signed-off-by: Dan Walsh <dwalsh@redhat.com>
424 lines
8.2 KiB
Markdown
424 lines
8.2 KiB
Markdown
# cri-o Tutorial
|
|
|
|
This tutorial will walk you through the installation of [cri-o](https://github.com/kubernetes-incubator/cri-o), an Open Container Initiative-based implementation of [Kubernetes Container Runtime Interface](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/container-runtime-interface-v1.md), and the creation of [Redis](https://redis.io/) server running in a [Pod](http://kubernetes.io/docs/user-guide/pods/).
|
|
|
|
## Prerequisites
|
|
|
|
A Linux machine is required to download and build the `cri-o` components and run the commands in this tutorial.
|
|
|
|
Create a machine running Ubuntu 16.10:
|
|
|
|
```
|
|
gcloud compute instances create cri-o \
|
|
--machine-type n1-standard-2 \
|
|
--image-family ubuntu-1610 \
|
|
--image-project ubuntu-os-cloud
|
|
```
|
|
|
|
SSH into the machine:
|
|
|
|
```
|
|
gcloud compute ssh cri-o
|
|
```
|
|
|
|
## Installation
|
|
|
|
This section will walk you through installing the following components:
|
|
|
|
* crio - The implementation of the Kubernetes CRI, which manages Pods.
|
|
* crioctl - The crio client for testing.
|
|
* cni - The Container Network Interface
|
|
* runc - The OCI runtime to launch the container
|
|
|
|
|
|
### runc
|
|
|
|
Download the `runc` release binary:
|
|
|
|
```
|
|
wget https://github.com/opencontainers/runc/releases/download/v1.0.0-rc2/runc-linux-amd64
|
|
```
|
|
|
|
Set the executable bit and copy the `runc` binary into your PATH:
|
|
|
|
```
|
|
chmod +x runc-linux-amd64
|
|
```
|
|
|
|
```
|
|
sudo mv runc-linux-amd64 /usr/bin/runc
|
|
```
|
|
|
|
Print the `runc` version:
|
|
|
|
```
|
|
runc -version
|
|
```
|
|
```
|
|
runc version 1.0.0-rc2
|
|
commit: c91b5bea4830a57eac7882d7455d59518cdf70ec
|
|
spec: 1.0.0-rc2-dev
|
|
```
|
|
|
|
### crio
|
|
|
|
The `crio` project does not ship binary releases so you'll need to build it from source.
|
|
|
|
#### Install the Go runtime and tool chain
|
|
|
|
Download the Go 1.7.4 binary release:
|
|
|
|
```
|
|
wget https://storage.googleapis.com/golang/go1.7.4.linux-amd64.tar.gz
|
|
```
|
|
|
|
Install Go 1.7.4:
|
|
|
|
```
|
|
sudo tar -xvf go1.7.4.linux-amd64.tar.gz -C /usr/local/
|
|
```
|
|
|
|
```
|
|
mkdir -p $HOME/go/src
|
|
```
|
|
|
|
```
|
|
export GOPATH=$HOME/go
|
|
```
|
|
|
|
```
|
|
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
|
|
```
|
|
|
|
At this point the Go 1.7.4 tool chain should be installed:
|
|
|
|
```
|
|
go version
|
|
```
|
|
|
|
```
|
|
go version go1.7.4 linux/amd64
|
|
```
|
|
|
|
#### Build crio from source
|
|
|
|
```
|
|
sudo apt-get install -y libglib2.0-dev libseccomp-dev libapparmor-dev
|
|
```
|
|
|
|
```
|
|
go get -d github.com/kubernetes-incubator/cri-o
|
|
```
|
|
|
|
```
|
|
cd $GOPATH/src/github.com/kubernetes-incubator/cri-o
|
|
```
|
|
|
|
```
|
|
make install.tools
|
|
```
|
|
|
|
```
|
|
make
|
|
```
|
|
|
|
```
|
|
sudo make install
|
|
```
|
|
|
|
Output:
|
|
|
|
```
|
|
install -D -m 755 kpod /usr/local/bin/kpod
|
|
install -D -m 755 crio /usr/local/bin/crio
|
|
install -D -m 755 crioctl /usr/local/bin/crioctl
|
|
install -D -m 755 conmon/conmon /usr/local/libexec/crio/conmon
|
|
install -D -m 755 pause/pause /usr/local/libexec/crio/pause
|
|
install -d -m 755 /usr/local/share/man/man{1,5,8}
|
|
install -m 644 docs/kpod.1 docs/kpod-launch.1 -t /usr/local/share/man/man1
|
|
install -m 644 docs/crio.conf.5 -t /usr/local/share/man/man5
|
|
install -m 644 docs/crio.8 -t /usr/local/share/man/man8
|
|
install -D -m 644 crio.conf /etc/crio/crio.conf
|
|
install -D -m 644 seccomp.json /etc/crio/seccomp.json
|
|
```
|
|
|
|
If you are installing for the first time, generate config as follows:
|
|
|
|
```
|
|
make install.config
|
|
```
|
|
|
|
Output:
|
|
|
|
```
|
|
install -D -m 644 crio.conf /etc/crio/crio.conf
|
|
install -D -m 644 seccomp.json /etc/crio/seccomp.json
|
|
```
|
|
|
|
#### Start the crio system daemon
|
|
|
|
```
|
|
sudo sh -c 'echo "[Unit]
|
|
Description=OCI-based implementation of Kubernetes Container Runtime Interface
|
|
Documentation=https://github.com/kubernetes-incubator/cri-o
|
|
|
|
[Service]
|
|
ExecStart=/usr/local/bin/crio --debug
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target" > /etc/systemd/system/crio.service'
|
|
```
|
|
|
|
```
|
|
sudo systemctl daemon-reload
|
|
```
|
|
```
|
|
sudo systemctl enable crio
|
|
```
|
|
```
|
|
sudo systemctl start crio
|
|
```
|
|
|
|
#### Ensure the crio service is running
|
|
|
|
```
|
|
sudo crioctl runtimeversion
|
|
```
|
|
```
|
|
VersionResponse: Version: 0.1.0, RuntimeName: runc, RuntimeVersion: 1.0.0-rc2, RuntimeApiVersion: v1alpha1
|
|
```
|
|
|
|
### cni
|
|
|
|
This tutorial will use the latest version of `cni` from the master branch and build it from source.
|
|
|
|
Download the `cni` source tree:
|
|
|
|
```
|
|
go get -d github.com/containernetworking/cni
|
|
```
|
|
|
|
```
|
|
cd $GOPATH/src/github.com/containernetworking/cni
|
|
```
|
|
|
|
Build the `cni` binaries:
|
|
|
|
```
|
|
./build.sh
|
|
```
|
|
|
|
Output:
|
|
|
|
```
|
|
Building API
|
|
Building reference CLI
|
|
Building plugins
|
|
flannel
|
|
tuning
|
|
bridge
|
|
ipvlan
|
|
loopback
|
|
macvlan
|
|
ptp
|
|
dhcp
|
|
host-local
|
|
noop
|
|
```
|
|
|
|
Install the `cni` binaries:
|
|
|
|
```
|
|
sudo mkdir -p /opt/cni/bin
|
|
```
|
|
|
|
```
|
|
sudo cp bin/* /opt/cni/bin/
|
|
```
|
|
|
|
#### Configure CNI
|
|
|
|
```
|
|
sudo mkdir -p /etc/cni/net.d
|
|
```
|
|
|
|
```
|
|
sudo sh -c 'cat >/etc/cni/net.d/10-mynet.conf <<-EOF
|
|
{
|
|
"cniVersion": "0.2.0",
|
|
"name": "mynet",
|
|
"type": "bridge",
|
|
"bridge": "cni0",
|
|
"isGateway": true,
|
|
"ipMasq": true,
|
|
"ipam": {
|
|
"type": "host-local",
|
|
"subnet": "10.88.0.0/16",
|
|
"routes": [
|
|
{ "dst": "0.0.0.0/0" }
|
|
]
|
|
}
|
|
}
|
|
EOF'
|
|
```
|
|
|
|
```
|
|
sudo sh -c 'cat >/etc/cni/net.d/99-loopback.conf <<-EOF
|
|
{
|
|
"cniVersion": "0.2.0",
|
|
"type": "loopback"
|
|
}
|
|
EOF'
|
|
```
|
|
|
|
At this point `cni` is installed and configured to allocation IP address to containers from the `10.88.0.0/16` subnet.
|
|
|
|
## Pod Tutorial
|
|
|
|
Now that the `cri-o` components have been installed and configured we are ready to create a Pod. This section will walk you through lauching a Redis server in a Pod. Once the Redis server is running we'll use telnet to verify it's working, then we'll stop the Redis server and clean up the Pod.
|
|
|
|
### Creating a Pod
|
|
|
|
First we need to setup a Pod sandbox using a Pod configuration, which can be found in the `cri-o` source tree:
|
|
|
|
```
|
|
cd $GOPATH/src/github.com/kubernetes-incubator/cri-o
|
|
```
|
|
|
|
Next create the Pod and capture the Pod ID for later use:
|
|
|
|
```
|
|
POD_ID=$(sudo crioctl pod run --config test/testdata/sandbox_config.json)
|
|
```
|
|
|
|
> sudo crioctl pod run --config test/testdata/sandbox_config.json
|
|
|
|
Use the `crioctl` command to get the status of the Pod:
|
|
|
|
```
|
|
sudo crioctl pod status --id $POD_ID
|
|
```
|
|
|
|
Output:
|
|
|
|
```
|
|
ID: cd6c0883663c6f4f99697aaa15af8219e351e03696bd866bc3ac055ef289702a
|
|
Name: podsandbox1
|
|
UID: redhat-test-crio
|
|
Namespace: redhat.test.crio
|
|
Attempt: 1
|
|
Status: SANDBOX_READY
|
|
Created: 2016-12-14 15:59:04.373680832 +0000 UTC
|
|
Network namespace: /var/run/netns/cni-bc37b858-fb4d-41e6-58b0-9905d0ba23f8
|
|
IP Address: 10.88.0.2
|
|
Labels:
|
|
group -> test
|
|
Annotations:
|
|
owner -> hmeng
|
|
security.alpha.kubernetes.io/seccomp/pod -> unconfined
|
|
security.alpha.kubernetes.io/sysctls -> kernel.shm_rmid_forced=1,net.ipv4.ip_local_port_range=1024 65000
|
|
security.alpha.kubernetes.io/unsafe-sysctls -> kernel.msgmax=8192
|
|
```
|
|
|
|
### Create a Redis container inside the Pod
|
|
|
|
Use the `crioctl` command to create a redis container from a container configuration and attach it to the Pod created earlier:
|
|
|
|
```
|
|
CONTAINER_ID=$(sudo crioctl ctr create --pod $POD_ID --config test/testdata/container_redis.json)
|
|
```
|
|
|
|
> sudo crioctl ctr create --pod $POD_ID --config test/testdata/container_redis.json
|
|
|
|
The `crioctl ctr create` command will take a few seconds to return because the redis container needs to be pulled.
|
|
|
|
Start the Redis container:
|
|
|
|
```
|
|
sudo crioctl ctr start --id $CONTAINER_ID
|
|
```
|
|
|
|
Get the status for the Redis container:
|
|
|
|
```
|
|
sudo crioctl ctr status --id $CONTAINER_ID
|
|
```
|
|
|
|
Output:
|
|
|
|
```
|
|
ID: d0147eb67968d81aaddbccc46cf1030211774b5280fad35bce2fdb0a507a2e7a
|
|
Name: podsandbox1-redis
|
|
Status: CONTAINER_RUNNING
|
|
Created: 2016-12-14 16:00:42.889089352 +0000 UTC
|
|
Started: 2016-12-14 16:01:56.733704267 +0000 UTC
|
|
```
|
|
|
|
### Test the Redis container
|
|
|
|
Connect to the Pod IP on port 6379:
|
|
|
|
```
|
|
telnet 10.88.0.2 6379
|
|
```
|
|
|
|
```
|
|
Trying 10.88.0.2...
|
|
Connected to 10.88.0.2.
|
|
Escape character is '^]'.
|
|
```
|
|
|
|
At the prompt type `MONITOR`:
|
|
|
|
```
|
|
Trying 10.88.0.2...
|
|
Connected to 10.88.0.2.
|
|
Escape character is '^]'.
|
|
MONITOR
|
|
+OK
|
|
```
|
|
|
|
Exit the telnet session by typing `ctrl-]` and `quit` at the prompt:
|
|
|
|
```
|
|
^]
|
|
|
|
telnet> quit
|
|
Connection closed.
|
|
```
|
|
|
|
#### Viewing the Redis logs
|
|
|
|
The Redis logs are logged to the stderr of the crio service, which can be viewed using `journalctl`:
|
|
|
|
```
|
|
sudo journalctl -u crio --no-pager
|
|
```
|
|
|
|
### Stop the redis container and delete the Pod
|
|
|
|
```
|
|
sudo crioctl ctr stop --id $CONTAINER_ID
|
|
```
|
|
|
|
```
|
|
sudo crioctl ctr remove --id $CONTAINER_ID
|
|
```
|
|
|
|
```
|
|
sudo crioctl pod stop --id $POD_ID
|
|
```
|
|
|
|
```
|
|
sudo crioctl pod remove --id $POD_ID
|
|
```
|
|
|
|
```
|
|
sudo crioctl pod list
|
|
```
|
|
|
|
```
|
|
sudo crioctl ctr list
|
|
```
|