Bug 1218687 - [containerd/k8s] Containerd improperly configured by default for k8s
Summary: [containerd/k8s] Containerd improperly configured by default for k8s
Status: NEW
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Containers (show other bugs)
Version: Current
Hardware: All openSUSE Tumbleweed
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Priyanka Saggu
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-10 09:27 UTC by Egbert Eich
Modified: 2024-01-14 17:43 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Egbert Eich 2024-01-10 09:27:57 UTC
As installed, `containerd` uses an internal 'default' configuration. This is not appropriate to run kubernetes. At least `kubeadm init` terminates with an error printing the message:
| error execution phase addon/coredns: unable to create RBAC clusterrole: rpc error: code = Unknown desc = malformed header: missing HTTP content-type

Afterwards, some k8s system containers are running but keep crashing.

This can be fixed by changing 
[plugins."io.containerd.grpc.v1.cri"]
   SystemdCgroup = false
to:
   SystemdCgroup = true
in /etc/containerd/config.toml

This required change is non-obvious and poorly documented.
IMHO, it should be set by default to improve the openSUSE 'out-of-the-box' experience.

While at it, please also consider changing:
[plugins."io.containerd.grpc.v1.cri"]
  ...
  sandbox_image = "registry.k8s.io/pause:3.8"
to
  sandbox_image = "registry.k8s.io/pause:3.9"
To avoid the warning:
| W0110 10:18:20.477198    7395 checks.go:835] detected that the sandbox image "registry.k8s.io/pause:3.8" of the container runtime is inconsistent with that used by kubeadm. It is recommended that using "registry.opensuse.org/kubic/pause:3.9" as the CRI sandbox image.
when running `kubeadm init`.

Further note:
After installation, '/etc/containerd/config.toml' contains the comment:
# See containerd-config.toml(5) for documentation.
However, there is no man page for containerd-config.toml to be found. Please remove the comment or provide the mentioned man page.
Comment 1 Egbert Eich 2024-01-14 17:43:53 UTC
I've accidentally specified the section in /etc/containerd/config.toml containing the SystemdCgroup paramter incorrectly - it should've been:

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
    SystemdCgroup = true