From 6b223194a927b202977b9081489781466840b1dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 30 Mar 2021 22:19:02 +0200 Subject: [PATCH 1/7] docs: Remove SLE installation guide MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The content of the SLE installation guide is related to the 1.x packages, as SUSE doesn't provide katacontainers 2.x packages. Fixes: #1586 Signed-off-by: Fabiano Fidêncio (cherry picked from commit 2888ceb0242e63bebae5943ff9b5fb9ac559d375) --- docs/install/README.md | 1 - docs/install/sle-installation-guide.md | 13 ------------- 2 files changed, 14 deletions(-) delete mode 100644 docs/install/sle-installation-guide.md diff --git a/docs/install/README.md b/docs/install/README.md index 7831a36a87..27ec23d800 100644 --- a/docs/install/README.md +++ b/docs/install/README.md @@ -52,7 +52,6 @@ Kata packages are provided by official distribution repositories for: | [CentOS](centos-installation-guide.md) | 8 | | [Fedora](fedora-installation-guide.md) | 32, Rawhide | | [openSUSE](opensuse-installation-guide.md) | [Leap 15.1](opensuse-leap-15.1-installation-guide.md)
Leap 15.2, Tumbleweed | -| [SUSE Linux Enterprise (SLE)](sle-installation-guide.md) | SLE 15 SP1, 15 SP2 | > **Note::** > diff --git a/docs/install/sle-installation-guide.md b/docs/install/sle-installation-guide.md deleted file mode 100644 index ba7cff288c..0000000000 --- a/docs/install/sle-installation-guide.md +++ /dev/null @@ -1,13 +0,0 @@ -# Install Kata Containers on SLE - -1. Install the Kata Containers components with the following commands: - - ```bash - $ source /etc/os-release - $ DISTRO_VERSION=$(sed "s/-/_/g" <<< "$VERSION") - $ sudo -E zypper addrepo --refresh "https://download.opensuse.org/repositories/devel:/kubic/SLE_${DISTRO_VERSION}_Backports/devel:kubic.repo" - $ sudo -E zypper -n --gpg-auto-import-keys install katacontainers - ``` - -2. Decide which container manager to use and select the corresponding link that follows: - - [Kubernetes](../Developer-Guide.md#run-kata-containers-with-kubernetes) From 0466ee04da3ec2c6115c57f2a12abb53ceb10e1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 30 Mar 2021 21:39:00 +0200 Subject: [PATCH 2/7] docs: Update Fedora install docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The package to be installed on Fedora is `kata-containers` instead of `kata-runtime`. The difference being `kata-runtime` is the 1.x package, while `kata-containers` is the 2.x one. Fixes: #1582 Signed-off-by: Fabiano Fidêncio (cherry picked from commit 3f90561bf1145b8beaee0ce5cb9926582eef697d) --- docs/install/fedora-installation-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/install/fedora-installation-guide.md b/docs/install/fedora-installation-guide.md index cce1f25065..4f9d7e5751 100644 --- a/docs/install/fedora-installation-guide.md +++ b/docs/install/fedora-installation-guide.md @@ -3,7 +3,7 @@ 1. Install the Kata Containers components with the following commands: ```bash - $ sudo -E dnf -y install kata-runtime + $ sudo -E dnf -y install kata-containers ``` 2. Decide which container manager to use and select the corresponding link that follows: From abfff68de645ee569687b837fa3d8b6108698cb7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 30 Mar 2021 21:49:19 +0200 Subject: [PATCH 3/7] docs: Update CentOS install docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There are two changes here. There first one being relying on the `centos-release-advanced-virtualization` package instead providing the content of the repo ourselves; and the second one being installing `kata-containers` (2.x) instead of the `kata-runtime` one (1.x). Fixes: #1583 Signed-off-by: Fabiano Fidêncio (cherry picked from commit 1ce29fc95973fbb474cb3d94a659f248e91f7746) --- docs/install/centos-installation-guide.md | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/docs/install/centos-installation-guide.md b/docs/install/centos-installation-guide.md index f55f20d962..df7340d268 100644 --- a/docs/install/centos-installation-guide.md +++ b/docs/install/centos-installation-guide.md @@ -3,15 +3,9 @@ 1. Install the Kata Containers components with the following commands: ```bash + $ sudo -E dnf install -y centos-release-advanced-virtualization + $ sudo -E dnf module disable -y virt:rhel $ source /etc/os-release - $ cat < Date: Wed, 3 Feb 2021 18:05:00 +0800 Subject: [PATCH 4/7] docs: update how-to-use-k8s-with-cri-containerd-and-kata.md Update how-to-use-k8s-with-cri-containerd-and-kata.md to fit the latest Kubernetes way. And also changed CNI plugin from flannel to bridge, that will be easy to run. Fixes: #1325 Signed-off-by: bin (cherry picked from commit 2c47277ca1332ecdb76ed65eff165c68e5480bdd) --- ...to-use-k8s-with-cri-containerd-and-kata.md | 94 ++++++++++--------- 1 file changed, 48 insertions(+), 46 deletions(-) diff --git a/docs/how-to/how-to-use-k8s-with-cri-containerd-and-kata.md b/docs/how-to/how-to-use-k8s-with-cri-containerd-and-kata.md index c8b095711e..94eb91bb80 100644 --- a/docs/how-to/how-to-use-k8s-with-cri-containerd-and-kata.md +++ b/docs/how-to/how-to-use-k8s-with-cri-containerd-and-kata.md @@ -7,9 +7,10 @@ * [Configure Kubelet to use containerd](#configure-kubelet-to-use-containerd) * [Configure HTTP proxy - OPTIONAL](#configure-http-proxy---optional) * [Start Kubernetes](#start-kubernetes) -* [Install a Pod Network](#install-a-pod-network) +* [Configure Pod Network](#configure-pod-network) * [Allow pods to run in the master node](#allow-pods-to-run-in-the-master-node) -* [Create an untrusted pod using Kata Containers](#create-an-untrusted-pod-using-kata-containers) +* [Create runtime class for Kata Containers](#create-runtime-class-for-kata-containers) +* [Run pod in Kata Containers](#run-pod-in-kata-containers) * [Delete created pod](#delete-created-pod) This document describes how to set up a single-machine Kubernetes (k8s) cluster. @@ -18,9 +19,6 @@ The Kubernetes cluster will use the [CRI containerd plugin](https://github.com/containerd/cri) and [Kata Containers](https://katacontainers.io) to launch untrusted workloads. -For Kata Containers 1.5.0-rc2 and above, we will use `containerd-shim-kata-v2` (short as `shimv2` in this documentation) -to launch Kata Containers. For the previous version of Kata Containers, the Pods are launched with `kata-runtime`. - ## Requirements - Kubernetes, Kubelet, `kubeadm` @@ -125,43 +123,33 @@ $ sudo systemctl daemon-reload $ sudo -E kubectl get pods ``` -## Install a Pod Network +## Configure Pod Network A pod network plugin is needed to allow pods to communicate with each other. +You can find more about CNI plugins from the [Creating a cluster with `kubeadm`](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#instructions) guide. -- Install the `flannel` plugin by following the - [Using `kubeadm` to Create a Cluster](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#instructions) - guide, starting from the **Installing a pod network** section. - -- Create a pod network using flannel - - > **Note:** There is no known way to determine programmatically the best version (commit) to use. - > See https://github.com/coreos/flannel/issues/995. +By default the CNI plugin binaries is installed under `/opt/cni/bin` (in package `kubernetes-cni`), you only need to create a configuration file for CNI plugin. ```bash - $ sudo -E kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml - ``` + $ sudo -E mkdir -p /etc/cni/net.d -- Wait for the pod network to become available - - ```bash - # number of seconds to wait for pod network to become available - $ timeout_dns=420 - - $ while [ "$timeout_dns" -gt 0 ]; do - if sudo -E kubectl get pods --all-namespaces | grep dns | grep Running; then - break - fi - - sleep 1s - ((timeout_dns--)) - done - ``` - -- Check the pod network is running - - ```bash - $ sudo -E kubectl get pods --all-namespaces | grep dns | grep Running && echo "OK" || ( echo "FAIL" && false ) + $ sudo -E cat > /etc/cni/net.d/10-mynet.conf < runtime.yaml < Date: Wed, 31 Mar 2021 15:26:03 +0200 Subject: [PATCH 5/7] docs: Update snap install guide MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As this repo is specific to the kata-containers 2.x, let's stop mentioning / referring to the 1.x here, including how to setup and use the snap package for 1.x. Fixes: #1601 Signed-off-by: Fabiano Fidêncio (cherry picked from commit 4a38ff41f08760f2c2ef1c93730732f2dd42be18) --- docs/install/snap-installation-guide.md | 59 ++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 7 deletions(-) diff --git a/docs/install/snap-installation-guide.md b/docs/install/snap-installation-guide.md index a4660511fc..3a96b12a3f 100644 --- a/docs/install/snap-installation-guide.md +++ b/docs/install/snap-installation-guide.md @@ -1,13 +1,58 @@ -# Install Kata Containers from `snapcraft.io` +# Kata Containers snap package + +* [Install Kata Containers](#install-kata-containers) +* [Configure Kata Containers](#configure-kata-containers) +* [Integration with shim v2 Container Engines](#integration-with-shim-v2-container-engines) +* [Remove Kata Containers snap package](#remove-kata-containers-snap-package) + + +## Install Kata Containers Kata Containers can be installed in any Linux distribution that supports [snapd](https://docs.snapcraft.io/installing-snapd). -Run the following command to install Kata Containers: +Run the following command to install **Kata Containers**: - ```bash - $ sudo snap install kata-containers --classic - ``` +```sh +$ sudo snap install kata-containers --candidate --classic +``` -For further information on integrating and configuring the `snap` Kata Containers install, -refer to the [Kata Containers packaging `snap` documentation](https://github.com/kata-containers/packaging/blob/master/snap/README.md#configure-kata-containers). +## Configure Kata Containers + +By default Kata Containers snap image is mounted at `/snap/kata-containers` as a +read-only file system, therefore default configuration file can not be edited. +Fortunately Kata Containers supports loading a configuration file from another +path than the default. + +```sh +$ sudo mkdir -p /etc/kata-containers +$ sudo cp /snap/kata-containers/current/usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers/ +$ $EDITOR /etc/kata-containers/configuration.toml +``` + +## Integration with shim v2 Container Engines + +The Container engine daemon (`cri-o`, `containerd`, etc) needs to be able to find the +`containerd-shim-kata-v2` binary to allow Kata Containers to be created. +Run the following command to create a symbolic link to the shim v2 binary. + +```sh +$ sudo ln -sf /snap/kata-containers/current/usr/bin/containerd-shim-kata-v2 /usr/local/bin/containerd-shim-kata-v2 +``` + +Once the symbolic link has been created and the engine daemon configured, `io.containerd.kata.v2` +can be used as runtime. + +Read the following documents to know how to run Kata Containers 2.x with `containerd`. + +* [How to use Kata Containers and Containerd](https://github.com/kata-containers/kata-containers/blob/main/docs/how-to/containerd-kata.md) +* [Install Kata Containers with containerd](https://github.com/kata-containers/kata-containers/blob/main/docs/install/container-manager/containerd/containerd-install.md) + + +## Remove Kata Containers snap package + +Run the following command to remove the Kata Containers snap: + +```sh +$ sudo snap remove kata-containers +``` From f5adc4c114a85dec9ca8846ffdd82852fc723665 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 30 Mar 2021 22:32:26 +0200 Subject: [PATCH 6/7] docs: Remove ubuntu installation guide MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The installation guide points to 1.x packages from OBS. For 2.x we decided to stop building packages on OBS in favour of advertising kata-deploy. Apart from this, Ubuntu itself doesn't provide packages for kata-containers. Fixes: #1588 Signed-off-by: Fabiano Fidêncio (cherry picked from commit ede1ab86702de5182b5d3906f7f77e1ee700e1e2) --- docs/install/ubuntu-installation-guide.md | 15 --------------- docs/use-cases/zun_kata.md | 5 +---- 2 files changed, 1 insertion(+), 19 deletions(-) delete mode 100644 docs/install/ubuntu-installation-guide.md diff --git a/docs/install/ubuntu-installation-guide.md b/docs/install/ubuntu-installation-guide.md deleted file mode 100644 index 29bb03883b..0000000000 --- a/docs/install/ubuntu-installation-guide.md +++ /dev/null @@ -1,15 +0,0 @@ -# Install Kata Containers on Ubuntu - -1. Install the Kata Containers components with the following commands: - - ```bash - $ ARCH=$(arch) - $ BRANCH="${BRANCH:-master}" - $ sudo sh -c "echo 'deb http://download.opensuse.org/repositories/home:/katacontainers:/releases:/${ARCH}:/${BRANCH}/xUbuntu_$(lsb_release -rs)/ /' > /etc/apt/sources.list.d/kata-containers.list" - $ curl -sL http://download.opensuse.org/repositories/home:/katacontainers:/releases:/${ARCH}:/${BRANCH}/xUbuntu_$(lsb_release -rs)/Release.key | sudo apt-key add - - $ sudo -E apt-get update - $ sudo -E apt-get -y install kata-runtime kata-proxy kata-shim - ``` - -2. Decide which container manager to use and select the corresponding link that follows: - - [Kubernetes](../Developer-Guide.md#run-kata-containers-with-kubernetes) diff --git a/docs/use-cases/zun_kata.md b/docs/use-cases/zun_kata.md index fca0dcab94..20fa9c4f54 100644 --- a/docs/use-cases/zun_kata.md +++ b/docs/use-cases/zun_kata.md @@ -10,9 +10,6 @@ Currently, the instructions are based on the following links: - https://docs.openstack.org/zun/latest/admin/clear-containers.html -- ../install/ubuntu-installation-guide.md - - ## Install Git to use with DevStack ```sh @@ -54,7 +51,7 @@ $ zun delete test ## Install Kata Containers -Follow [these instructions](../install/ubuntu-installation-guide.md) +Follow [these instructions](../install/README.md) to install the Kata Containers components. ## Update Docker with new Kata Containers runtime From 6586f3b7257d66843beeddc0e912aeab66d6bc39 Mon Sep 17 00:00:00 2001 From: bin Date: Tue, 6 Apr 2021 17:42:49 +0800 Subject: [PATCH 7/7] docs: update configuration for passing annotations in conatinerd Using "io.containerd.kata.v2" instead of deprecated "io.containerd.runc.v1". Fixes: #1629 Signed-off-by: bin (cherry picked from commit b0e4618e84396eeb4159102efb62a7c64d1151ee) --- docs/how-to/how-to-set-sandbox-config-kata.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/how-to/how-to-set-sandbox-config-kata.md b/docs/how-to/how-to-set-sandbox-config-kata.md index 4d8d1d8457..43e8d4df1f 100644 --- a/docs/how-to/how-to-set-sandbox-config-kata.md +++ b/docs/how-to/how-to-set-sandbox-config-kata.md @@ -80,6 +80,8 @@ There are several kinds of Kata configurations and they are listed below. In case of CRI-O, all annotations specified in the pod spec are passed down to Kata. +# containerd Configuration + For containerd, annotations specified in the pod spec are passed down to Kata starting with version `1.3.0` of containerd. Additionally, extra configuration is needed for containerd, by providing a `pod_annotations` field in the containerd config @@ -92,11 +94,9 @@ for passing annotations to Kata from containerd: $ cat /etc/containerd/config .... -[plugins.cri.containerd.runtimes.kata] - runtime_type = "io.containerd.runc.v1" + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata] + runtime_type = "io.containerd.kata.v2" pod_annotations = ["io.katacontainers.*"] - [plugins.cri.containerd.runtimes.kata.options] - BinaryName = "/usr/bin/kata-runtime" .... ```