CRI-O All the Runtime Kubernetes need Antonio Murdaca < - - PowerPoint PPT Presentation

▶
cri o
SMART_READER_LITE
LIVE PREVIEW

CRI-O All the Runtime Kubernetes need Antonio Murdaca < - - PowerPoint PPT Presentation

Feb 11, 2023 428 likes •794 views

CRI-O All the Runtime Kubernetes need Antonio Murdaca < runcom@redhat.com > Senior Software Engineer, Red Hat Inc. @runc0m Issues... Docker ...breaks rkt Pod concept Maintenance Pluggability CRI

slide-1
SLIDE 1

Antonio Murdaca < runcom@redhat.com > Senior Software Engineer, Red Hat Inc. @runc0m

CRI-O

All the Runtime Kubernetes need

slide-2
SLIDE 2

Issues...

  • Docker
  • ...breaks
  • rkt
  • Pod concept
  • Maintenance
  • Pluggability
slide-3
SLIDE 3

CRI Container Runtime Interface

  • Plug and play
  • Protocol buffers
  • gRPC
  • 1.5+
  • Client - Server
slide-4
SLIDE 4

Runtime Service

  • Pods lifecycle
  • Containers lifecycle
  • Interactions
slide-5
SLIDE 5

Image Service

  • Images lifecycle
  • FS information
slide-6
SLIDE 6

CRI in action

slide-7
SLIDE 7
  • Open governance
  • Open source
  • Lean
  • Stable
  • Secure
  • BORING!

CRI-O

slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
  • Tied to the CRI
  • Shaped around Kubernetes
  • Only supported user is

Kubernetes

  • No features that can mine

stability and performance

  • Versioning is tied to

Kubernetes

  • Support is tied to Kubernetes

Scope

slide-11
SLIDE 11

Architecture

slide-12
SLIDE 12

OCI runtimes

slide-13
SLIDE 13

containers/storage

  • verlayfs (default)
  • Manage layers on COW
  • Former “storage drivers”
slide-14
SLIDE 14

containers/image

  • Where everything started
  • Battle tested
  • Seamlessly pull any of your

images

  • New features
slide-15
SLIDE 15

OCI runtime tools

  • Generates OCI configurations
  • OCI runtimes can understand

the very same configuration

  • There’s a library!!!
  • Run containers
slide-16
SLIDE 16

CNI - Container Network Interface

  • Pluggable network stack
  • Flannel
  • Weave
  • …
  • penshift-sdn
slide-17
SLIDE 17

conmon

  • Monitoring
  • Logging
  • Handling tty
  • Serving attach clients
  • Detecting and reporting OOM
  • CRI-O restarts
slide-18
SLIDE 18

Pod architecture (runc)

Infra Container

Pod

(ipc, net, pid namespaces) Container A (runc) Container B (runc) conmon conmon conmon

slide-19
SLIDE 19

Pod architecture (Clear Containers & Kata Containers)

Pod

conmon

Virtual Machine

Container B Container A conmon cc-shim cc-shim Agent

slide-20
SLIDE 20

...live demo?

slide-21
SLIDE 21
  • k8s tests
  • OpenShift tests
  • critest
  • Integration tests
  • Performance tests
  • On every PR
  • Tests?
  • Tests??
  • Tests???
  • Tests????
  • Tests?????

Status

slide-22
SLIDE 22

Status

  • CRI at any time is fully implemented
  • Released 1.7 (1.0), 1.8, 1.9, 1.10, 1.11-dev
  • Maintainers/contributors from Red Hat, Intel, IBM,

SUSE, Lyft and many others (80+)

  • Kubeadm works for setting up k8s with CRI-O
  • Minikube works
  • Support for mixed workloads
  • Deployed to our OpenShift Online test cluster
  • Available in Fedora, Ubuntu, RHEL ...
slide-23
SLIDE 23

Kubernetes setup

$ minikube start \

  • -network-plugin=cni \
  • -container-runtime=cri-o \
  • -bootstrapper=kubeadm
slide-24
SLIDE 24

Local Kubernetes setup

$ CONTAINER_RUNTIME=remote \ CONTAINER_RUNTIME_ENDPOINT=' \ /var/run/crio/crio.sock \

  • -runtime-request-timeout=5m' \

hack/local-up-cluster.sh

slide-25
SLIDE 25

OpenShift setup

[...] kubeletArguments: [...] container-runtime-endpoint:

  • "/var/run/crio/crio.sock"

container-runtime:

  • "remote"

runtime-request-timeout:

  • "15m"

[...]

slide-26
SLIDE 26

Debug

  • https://github.com/kubernetes-incubat
  • r/cri-tools
  • crictl
  • Upstream community tool
  • Debugging through the CRI on a node
  • Work is ongoing to move the project

into Kubernetes core

slide-27
SLIDE 27
slide-28
SLIDE 28

skopeo

  • Play with container images
  • No daemon running
  • Perfect for pipelines (Jenkins?)
  • Transports
slide-29
SLIDE 29

buildah

  • Build images
  • No daemon running
  • shell-like syntax
  • Build from Dockerfile(s)
slide-30
SLIDE 30

podman

  • Running containers
  • Integrated with CRI-O (soon)
  • No daemon running
  • Known CLI
slide-31
SLIDE 31

Summary

  • CRI
  • CRI-O
  • Ecosystem
  • New tools from legos
slide-32
SLIDE 32

Roadmap

  • Switch to CRI-O as the default in Kube? (trollface)
  • Keep pace with upstream Kubernetes

○ Tracking and supporting k8s versions

  • Graduating out of incubator
  • GA in OpenShift 3.9 (not the default yet)
  • Default container runtime for OpenShift 3.10 (hopefully)
  • Deployed to OpenShift Online
slide-33
SLIDE 33

Get involved!

Blog: https://medium.com/cri-o Github: https://github.com/kubernetes-incubater/cri-o IRC: freenode: #cri-o Slack: sig-node Site: https://cri-o.io, https://www.projectatomic.io

slide-34
SLIDE 34

Obrigado!