Skip to content

Commit 61ce827

Browse files
emolitoremolitor
authored
✨ Backwards compatible support for containerd 2 (#1521)
* feat: Backwards compatible support for containerd 2 * fix: Remove unnecessary chmod * feat: Cleanup ARCH and add clusterd 2 support to packer templates * fix: Revert removal of permissions change and update unit files
1 parent ad99b29 commit 61ce827

File tree

7 files changed

+307
-42
lines changed

7 files changed

+307
-42
lines changed

‎templates/cluster-templates/bases/hcloud-kcp-ubuntu.yaml

Lines changed: 59 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -164,26 +164,77 @@ spec:
164164
nameserver 1.1.1.1
165165
nameserver 1.0.0.1
166166
nameserver 2606:4700:4700::1111
167+
- content: |
168+
# Copyright The containerd Authors.
169+
#
170+
# Licensed under the Apache License, Version 2.0 (the "License");
171+
# you may not use this file except in compliance with the License.
172+
# You may obtain a copy of the License at
173+
#
174+
# http://www.apache.org/licenses/LICENSE-2.0
175+
#
176+
# Unless required by applicable law or agreed to in writing, software
177+
# distributed under the License is distributed on an "AS IS" BASIS,
178+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
179+
# See the License for the specific language governing permissions and
180+
# limitations under the License.
181+
#
182+
# https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
183+
184+
[Unit]
185+
Description=containerd container runtime
186+
Documentation=https://containerd.io
187+
After=network.target local-fs.target dbus.service
188+
189+
[Service]
190+
ExecStartPre=-/sbin/modprobe overlay
191+
ExecStart=/usr/local/bin/containerd
192+
193+
Type=notify
194+
Delegate=yes
195+
KillMode=process
196+
Restart=always
197+
RestartSec=5
198+
199+
# Having non-zero Limit*s causes performance problems due to accounting overhead
200+
# in the kernel. We recommend using cgroups to do container-local accounting.
201+
LimitNPROC=infinity
202+
LimitCORE=infinity
203+
204+
# Comment TasksMax if your systemd version does not supports it.
205+
# Only systemd 226 and above support this version.
206+
TasksMax=infinity
207+
OOMScoreAdjust=-999
208+
209+
[Install]
210+
WantedBy=multi-user.target
211+
owner: root:root
212+
path: /etc/systemd/system/containerd.service
213+
permissions: "0744"
167214
preKubeadmCommands:
168215
- set -x
169216
- export CONTAINERD=1.7.24 # update: datasource=github-tags depName=containerd/containerd extractVersion=^v(?<version>.*)$ versioning=semver
217+
- export RUNC=1.2.3
170218
- export KUBERNETES_VERSION=$(echo ${KUBERNETES_VERSION} | sed 's/^v//')
171219
- export TRIMMED_KUBERNETES_VERSION=$(echo ${KUBERNETES_VERSION} | sed 's/^v//' | awk -F . '{print $1 "." $2}')
172-
- ARCH=amd64
173-
- if [ "$(uname -m)" = "aarch64" ]; then ARCH=arm64; fi
220+
- ARCH="$(dpkg --print-architecture)"
174221
- localectl set-locale LANG=en_US.UTF-8
175222
- localectl set-locale LANGUAGE=en_US.UTF-8
176223
- apt-get update -y
177224
- apt-get -y install at jq unzip wget socat mtr logrotate apt-transport-https
178225
- sed -i '/swap/d' /etc/fstab
179226
- swapoff -a
180227
- modprobe overlay && modprobe br_netfilter && sysctl --system
181-
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz
182-
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
183-
- sha256sum --check cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
184-
- tar --no-overwrite-dir -C / -xzf cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz
185-
- rm -f cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
186-
- chmod -R 644 /etc/cni && chown -R root:root /etc/cni
228+
- wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.$ARCH
229+
- wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.sha256sum
230+
- sha256sum --check --ignore-missing runc.sha256sum
231+
- install runc.$ARCH /usr/local/sbin/runc
232+
- rm -f runc.$ARCH runc.sha256sum
233+
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz
234+
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
235+
- sha256sum --check containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
236+
- tar -zxf containerd-$CONTAINERD-linux-$ARCH.tar.gz -C /usr/local
237+
- rm -f containerd-$CONTAINERD-linux-$ARCH.tar.gz containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
187238
- mkdir -p /etc/containerd
188239
- containerd config default > /etc/containerd/config.toml
189240
- sed -i "s/SystemdCgroup = false/SystemdCgroup = true/" /etc/containerd/config.toml

‎templates/cluster-templates/bases/hetznerbaremetal-kcp-ubuntu.yaml

Lines changed: 59 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -183,24 +183,77 @@ spec:
183183
nameserver 1.1.1.1
184184
nameserver 1.0.0.1
185185
nameserver 2606:4700:4700::1111
186+
- content: |
187+
# Copyright The containerd Authors.
188+
#
189+
# Licensed under the Apache License, Version 2.0 (the "License");
190+
# you may not use this file except in compliance with the License.
191+
# You may obtain a copy of the License at
192+
#
193+
# http://www.apache.org/licenses/LICENSE-2.0
194+
#
195+
# Unless required by applicable law or agreed to in writing, software
196+
# distributed under the License is distributed on an "AS IS" BASIS,
197+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
198+
# See the License for the specific language governing permissions and
199+
# limitations under the License.
200+
#
201+
# https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
202+
203+
[Unit]
204+
Description=containerd container runtime
205+
Documentation=https://containerd.io
206+
After=network.target local-fs.target dbus.service
207+
208+
[Service]
209+
ExecStartPre=-/sbin/modprobe overlay
210+
ExecStart=/usr/local/bin/containerd
211+
212+
Type=notify
213+
Delegate=yes
214+
KillMode=process
215+
Restart=always
216+
RestartSec=5
217+
218+
# Having non-zero Limit*s causes performance problems due to accounting overhead
219+
# in the kernel. We recommend using cgroups to do container-local accounting.
220+
LimitNPROC=infinity
221+
LimitCORE=infinity
222+
223+
# Comment TasksMax if your systemd version does not supports it.
224+
# Only systemd 226 and above support this version.
225+
TasksMax=infinity
226+
OOMScoreAdjust=-999
227+
228+
[Install]
229+
WantedBy=multi-user.target
230+
owner: root:root
231+
path: /etc/systemd/system/containerd.service
232+
permissions: "0744"
186233
preKubeadmCommands:
187234
- set -x
188235
- export CONTAINERD=1.7.24 # update: datasource=github-tags depName=containerd/containerd extractVersion=^v(?<version>.*)$ versioning=semver
236+
- export RUNC=1.2.3
189237
- export KUBERNETES_VERSION=$(echo ${KUBERNETES_VERSION} | sed 's/^v//')
190238
- export TRIMMED_KUBERNETES_VERSION=$(echo ${KUBERNETES_VERSION} | sed 's/^v//' | awk -F . '{print $1 "." $2}')
239+
- ARCH="$(dpkg --print-architecture)"
191240
- localectl set-locale LANG=en_US.UTF-8
192241
- localectl set-locale LANGUAGE=en_US.UTF-8
193242
- apt-get update -y
194243
- apt-get -y install at jq unzip wget socat mtr logrotate apt-transport-https
195244
- sed -i '/swap/d' /etc/fstab
196245
- swapoff -a
197246
- modprobe overlay && modprobe br_netfilter && sysctl --system
198-
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/cri-containerd-cni-$CONTAINERD-linux-amd64.tar.gz
199-
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/cri-containerd-cni-$CONTAINERD-linux-amd64.tar.gz.sha256sum
200-
- sha256sum --check cri-containerd-cni-$CONTAINERD-linux-amd64.tar.gz.sha256sum
201-
- tar --no-overwrite-dir -C / -xzf cri-containerd-cni-$CONTAINERD-linux-amd64.tar.gz
202-
- rm -f cri-containerd-cni-$CONTAINERD-linux-amd64.tar.gz cri-containerd-cni-$CONTAINERD-linux-amd64.tar.gz.sha256sum
203-
- chmod -R 644 /etc/cni && chown -R root:root /etc/cni
247+
- wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.$ARCH
248+
- wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.sha256sum
249+
- sha256sum --check --ignore-missing runc.sha256sum
250+
- install runc.$ARCH /usr/local/sbin/runc
251+
- rm -f runc.$ARCH runc.sha256sum
252+
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz
253+
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
254+
- sha256sum --check containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
255+
- tar -zxf containerd-$CONTAINERD-linux-$ARCH.tar.gz -C /usr/local
256+
- rm -f containerd-$CONTAINERD-linux-$ARCH.tar.gz containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
204257
- mkdir -p /etc/containerd
205258
- containerd config default > /etc/containerd/config.toml
206259
- sed -i "s/SystemdCgroup = false/SystemdCgroup = true/" /etc/containerd/config.toml

‎templates/cluster-templates/bases/kct-md-0-ubuntu.yaml

Lines changed: 59 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -52,27 +52,78 @@ spec:
5252
nameserver 1.1.1.1
5353
nameserver 1.0.0.1
5454
nameserver 2606:4700:4700::1111
55+
- content: |
56+
# Copyright The containerd Authors.
57+
#
58+
# Licensed under the Apache License, Version 2.0 (the "License");
59+
# you may not use this file except in compliance with the License.
60+
# You may obtain a copy of the License at
61+
#
62+
# http://www.apache.org/licenses/LICENSE-2.0
63+
#
64+
# Unless required by applicable law or agreed to in writing, software
65+
# distributed under the License is distributed on an "AS IS" BASIS,
66+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
67+
# See the License for the specific language governing permissions and
68+
# limitations under the License.
69+
#
70+
# https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
71+
72+
[Unit]
73+
Description=containerd container runtime
74+
Documentation=https://containerd.io
75+
After=network.target local-fs.target dbus.service
76+
77+
[Service]
78+
ExecStartPre=-/sbin/modprobe overlay
79+
ExecStart=/usr/local/bin/containerd
80+
81+
Type=notify
82+
Delegate=yes
83+
KillMode=process
84+
Restart=always
85+
RestartSec=5
86+
87+
# Having non-zero Limit*s causes performance problems due to accounting overhead
88+
# in the kernel. We recommend using cgroups to do container-local accounting.
89+
LimitNPROC=infinity
90+
LimitCORE=infinity
91+
92+
# Comment TasksMax if your systemd version does not supports it.
93+
# Only systemd 226 and above support this version.
94+
TasksMax=infinity
95+
OOMScoreAdjust=-999
96+
97+
[Install]
98+
WantedBy=multi-user.target
99+
owner: root:root
100+
path: /etc/systemd/system/containerd.service
101+
permissions: "0744"
55102
preKubeadmCommands:
56103
- set -x
57104
- grep VERSION= /etc/os-release; uname -a
58105
- export CONTAINERD=1.7.24 # update: datasource=github-tags depName=containerd/containerd extractVersion=^v(?<version>.*)$ versioning=semver
106+
- export RUNC=1.2.3
59107
- export KUBERNETES_VERSION=$(echo ${KUBERNETES_VERSION} | sed 's/^v//')
60108
- export TRIMMED_KUBERNETES_VERSION=$(echo ${KUBERNETES_VERSION} | sed 's/^v//' | awk -F . '{print $1 "." $2}')
61-
- ARCH=amd64
62-
- if [ "$(uname -m)" = "aarch64" ]; then ARCH=arm64; fi
109+
- ARCH="$(dpkg --print-architecture)"
63110
- localectl set-locale LANG=en_US.UTF-8
64111
- localectl set-locale LANGUAGE=en_US.UTF-8
65112
- apt-get update -y
66113
- apt-get -y install at jq unzip wget socat mtr logrotate apt-transport-https
67114
- sed -i '/swap/d' /etc/fstab
68115
- swapoff -a
69116
- modprobe overlay && modprobe br_netfilter && sysctl --system
70-
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz
71-
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
72-
- sha256sum --check cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
73-
- tar --no-overwrite-dir -C / -xzf cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz
74-
- rm -f cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz cri-containerd-cni-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
75-
- chmod -R 644 /etc/cni && chown -R root:root /etc/cni
117+
- wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.$ARCH
118+
- wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.sha256sum
119+
- sha256sum --check --ignore-missing runc.sha256sum
120+
- install runc.$ARCH /usr/local/sbin/runc
121+
- rm -f runc.$ARCH runc.sha256sum
122+
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz
123+
- wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
124+
- sha256sum --check containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
125+
- tar -zxf containerd-$CONTAINERD-linux-$ARCH.tar.gz -C /usr/local
126+
- rm -f containerd-$CONTAINERD-linux-$ARCH.tar.gz containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
76127
- mkdir -p /etc/containerd
77128
- containerd config default > /etc/containerd/config.toml
78129
- sed -i "s/SystemdCgroup = false/SystemdCgroup = true/" /etc/containerd/config.toml

‎templates/node-image/1.28.9-ubuntu-22-04-containerd/scripts/cri.sh

Lines changed: 61 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -47,25 +47,75 @@ kernel.panic=10
4747
kernel.panic_on_oops=1
4848
EOF
4949

50+
# Create containerd systemd unit
51+
cat >/etc/systemd/system/containerd.service <<'EOF'
52+
# Copyright The containerd Authors.
53+
#
54+
# Licensed under the Apache License, Version 2.0 (the "License");
55+
# you may not use this file except in compliance with the License.
56+
# You may obtain a copy of the License at
57+
#
58+
# http://www.apache.org/licenses/LICENSE-2.0
59+
#
60+
# Unless required by applicable law or agreed to in writing, software
61+
# distributed under the License is distributed on an "AS IS" BASIS,
62+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
63+
# See the License for the specific language governing permissions and
64+
# limitations under the License.
65+
#
66+
# https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
67+
68+
[Unit]
69+
Description=containerd container runtime
70+
Documentation=https://containerd.io
71+
After=network.target local-fs.target dbus.service
72+
73+
[Service]
74+
ExecStartPre=-/sbin/modprobe overlay
75+
ExecStart=/usr/local/bin/containerd
76+
77+
Type=notify
78+
Delegate=yes
79+
KillMode=process
80+
Restart=always
81+
RestartSec=5
82+
83+
# Having non-zero Limit*s causes performance problems due to accounting overhead
84+
# in the kernel. We recommend using cgroups to do container-local accounting.
85+
LimitNPROC=infinity
86+
LimitCORE=infinity
87+
88+
# Comment TasksMax if your systemd version does not supports it.
89+
# Only systemd 226 and above support this version.
90+
TasksMax=infinity
91+
OOMScoreAdjust=-999
92+
93+
[Install]
94+
WantedBy=multi-user.target
95+
EOF
96+
5097
# Apply sysctl params without reboot
5198
sysctl --system
5299

100+
ARCH="$(dpkg --print-architecture)"
53101
CONTAINERD=1.7.16 # https://github.com/containerd/containerd/releases
102+
RUNC=1.2.3 # https://github.com/opencontainers/runc/releases
103+
104+
# Install runc
105+
wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.$ARCH
106+
wget https://github.com/opencontainers/runc/releases/download/v$RUNC/runc.sha256sum
107+
sha256sum --check --ignore-missing runc.sha256sum
108+
install runc.$ARCH /usr/local/sbin/runc
54109

55110
# Install containerd
56-
wget https://github.com/containerd/containerd/releases/download/v${CONTAINERD}/cri-containerd-cni-${CONTAINERD}-linux-${PACKER_ARCH}.tar.gz
57-
wget https://github.com/containerd/containerd/releases/download/v${CONTAINERD}/cri-containerd-cni-${CONTAINERD}-linux-${PACKER_ARCH}.tar.gz.sha256sum
58-
sha256sum --check cri-containerd-cni-${CONTAINERD}-linux-${PACKER_ARCH}.tar.gz.sha256sum
59-
tar --no-overwrite-dir -C / -xzf cri-containerd-cni-${CONTAINERD}-linux-${PACKER_ARCH}.tar.gz
111+
wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz
112+
wget https://github.com/containerd/containerd/releases/download/v$CONTAINERD/containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
113+
sha256sum --check containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
114+
tar -zxf containerd-$CONTAINERD-linux-$ARCH.tar.gz -C /usr/local
60115

61116
# Cleanup
62-
rm -f cri-containerd-cni-${CONTAINERD}-linux-${PACKER_ARCH}.tar.gz cri-containerd-cni-${CONTAINERD}-linux-${PACKER_ARCH}.tar.gz.sha256sum
63-
64-
mkdir -p /etc/containerd
65-
66-
# Sets permission accordingly to CIS Benchmark
67-
chmod -R 644 /etc/cni
68-
chown -R root:root /etc/cni
117+
rm -f runc.$ARCH runc.sha256sum
118+
rm -f containerd-$CONTAINERD-linux-$ARCH.tar.gz containerd-$CONTAINERD-linux-$ARCH.tar.gz.sha256sum
69119

70120
mkdir -p /etc/containerd
71121
containerd config default >/etc/containerd/config.toml

‎templates/node-image/1.28.9-ubuntu-22-04-containerd/scripts/kubernetes.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ systemctl enable kubelet
3434

3535
kubeadm config images pull --kubernetes-version $KUBERNETES_VERSION
3636

37+
# Sets permission accordingly to CIS Benchmark
38+
chmod -R 644 /etc/cni
39+
chown -R root:root /etc/cni
40+
3741
# enable completion
3842
echo 'source <(kubectl completion bash)' >>/root/.bashrc
3943

0 commit comments

Comments
 (0)