跳到主要内容

containerd

https://github.com/containerd/containerd/blob/main/docs/getting-started.md

https://github.com/containerd/containerd/releases/download/v1.7.15/cri-containerd-cni-1.7.15-linux-amd64.tar.gz

生成默认配置
mkdir /etc/containerd
containerd config default > /etc/containerd/config.toml


# 设置aliyun地址，不设置会连接不上, 如果无法下载镜像检查一下配置是否替换 cat /etc/containerd/config.toml |grep sandbox_image
sed -i "s#registry.k8s.io/pause#registry.aliyuncs.com/google_containers/pause#g" /etc/containerd/config.toml
sed -i "s#k8s.gcr.io/pause#registry.aliyuncs.com/google_containers/pause#g" /etc/containerd/config.toml

# 设置驱动为systemd
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml

# 设置dicker地址为aliyun镜像地址  可选
sed -i '/\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\.mirrors\]/a\      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]\n        endpoint = ["https://8aj710su.mirror.aliyuncs.com" ,"https://registry-1.docker.io"]' /etc/containerd/config.toml

检查安装结果
crictl info
crictl images

systemctl daemon-reload
systemctl restart containerd

拉取镜像
ctr -n k8s.io image pull 192.168.100.150:8082/proaim/proaim-trinity-service:RELEASE-1.2.0-fc67c4d5 --plain-http --user admin:YOUR_HARBOR_PASSWORD


ctr -n k8s.io image ls

使用代理拉取镜像
HTTPS_PROXY=http://192.168.10.105:7890 ctr image pull docker.io/calico/typha:v3.27.3




centos 源安装
yum install yum-uti1s
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install -y containerd
/usr/lib/systemd/system/containerd.service

cat > /etc/systemd/system/containerd.service <<EOF
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target

[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd
Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target
EOF



systemd  代理


Environment="HTTPS_PROXY=http://192.168.10.105:7890"
Environment="HTTPS_PROXY=http://arick:qq123456@192.168.0.51:7890"
ExecStart=/usr/bin/containerd


HTTPS_PROXY=http://192.168.10.105:7890 ctr image pull registry.k8s.io/metrics-server/metrics-server:v0.7.
1

harbor 登陆信息 和 镜像仓库

    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = ""

      [plugins."io.containerd.grpc.v1.cri".registry.auths]

      [plugins."io.containerd.grpc.v1.cri".registry.configs]
        [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.100.150:8082".tls]
          insecure_skip_verify = true  # 是否跳过安全认证
        [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.100.150:8082".auth]
          username = "admin"
          password = "YOUR_HARBOR_PASSWORD"
      [plugins."io.containerd.grpc.v1.cri".registry.headers]

      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["https://registry-1.docker.io"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.100.150:8082"]
          endpoint = ["http://192.168.100.150:8082"]

如何配置 Containerd 在 harbor 私有仓库拉取镜像?
描述: 在k8s的1.20版本发布之后，对外宣称在1.23.x不再使用dokershim作为默认的底层容器运行时，而是通过​​Container Runtime Interface(CRI)​​​使用containerd来作为容器运行时, 因此原来在docker中配置的个人仓库环境不再起作用，导致k8s配置pods时拉取镜像失败, 本节将进行演示如何在 ​​containerd​​ 配置从私有仓库拉取镜像。

Step 1.kubernetes 使用 containerd 拉取harbor仓库中镜像配置说明, 项目地址介绍: https://github.com/containerd/cri/blob/master/docs/registry.md



Step 2.containerd 的配置文件 (相当于docker 的 daemon.json)



$ vim /etc/containerd/config.toml
[plugins."io.containerd.grpc.v1.cri".registry]
   [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
        endpoint = ["https://xlx9erfu.mirror.aliyuncs.com"]                         # 使用阿里镜像源到此为配置文件默认生成，之后为需要添加的内容
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."harbor.weiyigeek.top"] # 内部私有仓库配置
        endpoint = ["https://harbor.weiyigeek.top"]                             
   [plugins."io.containerd.grpc.v1.cri".registry.configs]
     [plugins."io.containerd.grpc.v1.cri".registry.configs."harbor.weiyigeek.to"] 
       [plugins."io.containerd.grpc.v1.cri".registry.configs."harbor.weiyigeek.top".auth]   # harbor 认证的账号密码 配置
         username = "admin"                                                      
         password = "Harbor12345"
         auth = ""
         identitytoken = ""
       [plugins."io.containerd.grpc.v1.cri".registry.configs."harbor.weiyigeek.top".tls]    # harbor 证书认证配置
         insecure_skip_verify = false                     # 是否跳过证书认证
         ca_file   = "/etc/containerd/harbor/ca.crt"      # CA 证书
         cert_file = "/etc/containerd/harbor/harbor.crt"  # harbor 证书
         key_file  = "/etc/containerd/harbor/harbor.key"  # harbor 私钥


version = 2

[plugins]

  [plugins."io.containerd.grpc.v1.cri"]
    sandbox_image = "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6"
    [plugins."io.containerd.grpc.v1.cri".containerd]
      snapshotter = "overlayfs"
      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
            SystemdCgroup = true
    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = ""

      [plugins."io.containerd.grpc.v1.cri".registry.auths]

      [plugins."io.containerd.grpc.v1.cri".registry.configs]

      [plugins."io.containerd.grpc.v1.cri".registry.headers]

      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["http://hub-mirror.c.163.com","https://docker.mirrors.ustc.edu.cn","https://xlx9erfu.mirror.aliyuncs.com"]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.k8s.io"]
        endpoint = ["https://registry.aliyuncs.com/google_containers"]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."easzlab.io.local:5000"]
          endpoint = ["http://easzlab.io.local:5000"]

配置containerd镜像加速器

指定加速器目录信息：

vim /etc/containerd/config.toml

config_path = "/etc/containerd/certs.d"
配置加速信息：

mkdir /etc/containerd/certs.d/docker.io/ -p
vim /etc/containerd/certs.d/docker.io/hosts.toml

[host."https://vh3bm52y.mirror.aliyuncs.com",host."https://registry.docker-cn.com"]
  capabilities = ["pull"]
重启containerd

登录后复制 
systemctl restart containerd