Change:
--> <!-- overview --> <del> {{< feature-state for_k8s_version="v1.6" state="stable" >}} <!-- To run containers in Pods, Kubernetes uses a container runtime. Here are the installation instructions for various runtimes. --> Kubernetes 使用容器运行时来实现在 pod 中运行容器。 这是各种运行时的安装说明。 </del> <ins> <!-- You need to install a {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} into each node in the cluster so that Pods can run there. This page outlines what is involved and describes related tasks for setting up nodes. --> 你需要在集群内每个节点上安装一个 {{< glossary_tooltip text="容器运行时" term_id="container-runtime" >}} 以使 Pod 可以运行在上面。本文概述了所涉及的内容并描述了与节点设置相关的任务。 </ins> <!-- body --> <del> <!-- A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. Please refer to [CVE-2019-5736](https://access.redhat.com/security/cve/cve-2019-5736) for more information about the issue. --> {{< caution >}} 我们发现 runc 在运行容器，处理系统文件描述符时存在一个漏洞。 恶意容器可以利用此漏洞覆盖 runc 二进制文件的内容，并以此在主机系统的容器上运行任意的命令。 请参考此链接以获取有关此问题的更多信息 [cve-2019-5736: runc vulnerability](https://access.redhat.com/security/cve/cve-2019-5736) {{< /caution >}} </del> <ins> <!-- This page lists details for using several common container runtimes with Kubernetes, on Linux: --> 本文列出了在 Linux 上结合 Kubernetes 使用的几种通用容器运行时的详细信息： </ins> <del> <!-- ### Applicability --> ### 适用性 </del> <ins> - [containerd](#containerd) - [CRI-O](#cri-o) - [Docker](#docker) </ins> <del> <!-- This document is written for users installing CRI onto Linux. For other operating systems, look for documentation specific to your platform --> </del> <ins> <!-- </ins> {{< note >}} <del> 本文档是为在 Linux 上安装 CRI 的用户编写的。 对于其他操作系统，请查找特定于你平台的文档。 </del> <ins> For other operating systems, look for documentation specific to your platform. </ins> {{< /note >}} <ins> --> 提示：对于其他操作系统，请查阅特定于你所使用平台的相关文档。 </ins> <!-- <del> You should execute all the commands in this guide as `root`. For example, prefix commands with `sudo `, or become `root` and run the commands as that user. </del> <ins> ## Cgroup drivers </ins> --> <del> 你应该以 `root` 身份执行本指南中的所有命令。 例如，使用 `sudo` 前缀命令，或者成为 `root` 并以该用户身份运行命令。 </del> <ins> ## Cgroup 驱动程序 </ins> <!-- <del> ### Cgroup drivers --> ### Cgroup 驱动程序 </del> <ins> Control groups are used to constrain resources that are allocated to processes. </ins> <del> <!-- When systemd is chosen as the init system for a Linux distribution, the init process generates and consumes a root control group (`cgroup`) and acts as a cgroup manager. Systemd has a tight integration with cgroups and will allocate cgroups per process. It's possible to configure your container runtime and the kubelet to use `cgroupfs`. Using `cgroupfs` alongside systemd means that there will then be two different cgroup managers. </del> <ins> When [systemd](https://www.freedesktop.org/wiki/Software/systemd/) is chosen as the init system for a Linux distribution, the init process generates and consumes a root control group (`cgroup`) and acts as a cgroup manager. Systemd has a tight integration with cgroups and allocates a cgroup per systemd unit. It's possible to configure your container runtime and the kubelet to use `cgroupfs`. Using `cgroupfs` alongside systemd means that there will be two different cgroup managers. </ins> --> <del> 当某个 Linux 系统发行版使用 systemd 作为其初始化系统时，初始化进程会生成并使用一个 root 控制组 （`cgroup`），并充当 cgroup 管理器。 systemd 与 cgroup 集成紧密，并将为每个进程分配 cgroup。 </del> <ins> 控制组用来约束分配给进程的资源。 当某个 Linux 系统发行版使用 [systemd](https://www.freedesktop.org/wiki/Software/systemd/) 作为其初始化系统时，初始化进程会生成并使用一个 root 控制组 (`cgroup`), 并充当 cgroup 管理器。 Systemd 与 cgroup 集成紧密，并将为每个 systemd 单元分配一个 cgroup。 </ins> 你也可以配置容器运行时和 kubelet 使用 `cgroupfs`。 连同 systemd 一起使用 `cgroupfs` 意味着将有两个不同的 cgroup 管理器。 <!-- <del> Control groups are used to constrain resources that are allocated to processes. A single cgroup manager will simplify the view of what resources are being allocated and will by default have a more consistent view of the available and in-use resources. When we have two managers we end up with two views of those resources. We have seen cases in the field where nodes that are configured to use `cgroupfs` for the kubelet and Docker, and `systemd` for the rest of the processes running on the node becomes unstable under resource pressure. </del> <ins> A single cgroup manager simplifies the view of what resources are being allocated and will by default have a more consistent view of the available and in-use resources. When there are two cgroup managers on a system, you end up with two views of those resources. In the field, people have reported cases where nodes that are configured to use `cgroupfs` for the kubelet and Docker, but `systemd` for the rest of the processes, become unstable under resource pressure. </ins> --> <del> 控制组用来约束分配给进程的资源。 </del> 单个 cgroup 管理器将简化分配资源的视图，并且默认情况下将对可用资源和使用中的资源具有更一致的视图。 <del> 当有两个管理器时，最终将对这些资源产生两种视图。 在此领域我们已经看到案例，某些节点配置让 kubelet 和 docker 使用 `cgroupfs`，而节点上运行的其余进程则使用 systemd；这类节点在资源压力下会变得不稳定。 </del> <ins> 当有两个管理器共存于一个系统中时，最终将对这些资源产生两种视图。 在此领域人们已经报告过一些案例，某些节点配置让 kubelet 和 docker 使用 `cgroupfs`，而节点上运行的其余进程则使用 systemd; 这类节点在资源压力下会变得不稳定。 </ins> <!-- Changing the settings such that your container runtime and kubelet use `systemd` as the cgroup driver <del> stabilized the system. Please note the `native.cgroupdriver=systemd` option in the Docker setup below. </del> <ins> stabilized the system. To configure this for Docker, set `native.cgroupdriver=systemd`. </ins> --> 更改设置，令容器运行时和 kubelet 使用 `systemd` 作为 cgroup 驱动，以此使系统更为稳定。 <del> 请注意在 docker  下设置 `native.cgroupdriver=systemd` 选项。 </del> <ins> 对于 Docker, 设置 `native.cgroupdriver=systemd` 选项。 </ins> <del> {{< caution >}} </del> <!-- <del> Changing the cgroup driver of a Node that has joined a cluster is highly unrecommended. </del> <ins> {{< caution >}} Changing the cgroup driver of a Node that has joined a cluster is strongly *not* recommended. </ins> If the kubelet has created Pods using the semantics of one cgroup driver, changing the container <del> runtime to another cgroup driver can cause errors when trying to re-create the PodSandbox for such existing Pods. Restarting the kubelet may not solve such errors. The recommendation is to drain the Node from its workloads, remove it from the cluster and re-join it. --> 强烈建议不要更改已加入集群的节点的 cgroup 驱动。 如果 kubelet 已经使用某 cgroup 驱动的语义创建了 pod，尝试更改运行时以使用别的 cgroup 驱动，为现有 Pods 重新创建 PodSandbox 时会产生错误。 重启 kubelet 也可能无法解决此类问题。 推荐将工作负载逐出节点，之后将节点从集群中删除并重新加入。 </del> <ins> runtime to another cgroup driver can cause errors when trying to re-create the Pod sandbox for such existing Pods. Restarting the kubelet may not solve such errors. If you have automation that makes it feasible, replace the node with another using the updated configuration, or reinstall it using automation. </ins> {{< /caution >}} <ins> --> 注意：非常 *不* 建议更改已加入集群的节点的 cgroup 驱动。 如果 kubelet 已经使用某 cgroup 驱动的语义创建了 pod，更改运行时以使用别的 cgroup 驱动，当为现有 Pods 重新创建 PodSandbox 时会产生错误。重启 kubelet 也可能无法解决此类问题。 如果你有切实可行的自动化方案，使用其他已更新配置的节点来替换该节点，或者使用自动化方案来重新安装。 <!-- ## Container runtimes --> ## 容器运行时 {{% thirdparty-content %}} ### containerd </ins> <!-- <del> ## Docker </del> <ins> This section contains the necessary steps to use `containerd` as CRI runtime. </ins> <del> On each of your machines, install Docker. Version 19.03.11 is recommended, but 1.13.1, 17.03, 17.06, 17.09, 18.06 and 18.09 are known to work as well. Keep track of the latest verified Docker version in the Kubernetes release notes. </del> <ins> Use the following commands to install Containerd on your system: </ins> <del> Use the following commands to install Docker on your system: </del> <ins> Install and configure prerequisites: ```shell cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf overlay br_netfilter EOF sudo modprobe overlay sudo modprobe br_netfilter # Setup required sysctl params, these persist across reboots. cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf net.bridge.bridge-nf-call-iptables  = 1 net.ipv4.ip_forward                 = 1 net.bridge.bridge-nf-call-ip6tables = 1 EOF # Apply sysctl params without reboot sudo sysctl --system ``` </ins> --> <del> ## Docker </del> <ins> 本节包含使用 `containerd` 作为 CRI 运行时的必要步骤。 </ins> <del> 在你的每台机器上安装 Docker。 推荐安装 19.03.11 版本，但是 1.13.1、17.03、17.06、17.09、18.06 和 18.09 版本也是可以的。 请跟踪 Kubernetes 发行说明中经过验证的 Docker 最新版本变化。 </del> <ins> 使用以下命令在系统上安装容器： </ins> <del> 使用以下命令在你的系统上安装 Docker： </del> <ins> 安装和配置的先决条件： </ins> <del> {{< tabs name="tab-cri-docker-installation" >}} {{% tab name="Ubuntu 16.04+" %}} </del> <ins> ```shell cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf overlay br_netfilter EOF </ins> <del> <!-- # Install Docker CE ## Set up the repository: ### Install packages to allow apt to use a repository over HTTPS apt-get update && apt-get install  apt-transport-https ca-certificates curl software-properties-common </del> <ins> sudo modprobe overlay sudo modprobe br_netfilter # 设置必需的 sysctl 参数，这些参数在重新启动后仍然存在。 cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf net.bridge.bridge-nf-call-iptables  = 1 net.ipv4.ip_forward                 = 1 net.bridge.bridge-nf-call-ip6tables = 1 EOF # Apply sysctl params without reboot sudo sysctl --system ``` </ins> <del> ### Add Docker’s official GPG key curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - </del> <ins> <!-- Install containerd: </ins> --> <ins> 安装 containerd: {{< tabs name="tab-cri-containerd-installation" >}} {{% tab name="Ubuntu 16.04" %}} <!-- </ins> ```shell <del> # 安装 Docker CE ## 设置仓库 ### 安装软件包以允许 apt 通过 HTTPS 使用存储库 apt-get update && apt-get install  apt-transport-https ca-certificates curl software-properties-common </del> <ins> # (Install containerd) ## Set up the repository ### Install packages to allow apt to use a repository over HTTPS sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common </ins> ``` ```shell <del> ### 新增 Docker 的 官方 GPG 秘钥 curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - </del> <ins> ## Add Docker's official GPG key curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` ```shell ## Add Docker apt repository. sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" </ins> ``` <del> <!-- ### Add Docker apt repository. add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" ## Install Docker CE. apt-get update && apt-get install  containerd.io=1.2.10-3  docker-ce=5:19.03.4~3-0~ubuntu-$(lsb_release -cs)  docker-ce-cli=5:19.03.4~3-0~ubuntu-$(lsb_release -cs) </del> <ins> ```shell ## Install containerd sudo apt-get update && sudo apt-get install -y containerd.io ``` </ins> <del> # Setup daemon. cat > /etc/docker/daemon.json <<EOF { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2" } EOF </del> <ins> ```shell # Configure containerd sudo mkdir -p /etc/containerd sudo containerd config default > /etc/containerd/config.toml ``` </ins> <del> mkdir -p /etc/systemd/system/docker.service.d </del> <ins> ```shell # Restart containerd sudo systemctl restart containerd ``` </ins> --> ```shell <del> ### 添加 Docker apt 仓库 add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" </del> <ins> # (安装 containerd) ## (设置仓库) ### (安装软件包以允许 apt 通过 HTTPS 使用存储库) sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common </ins> ``` ```shell <del> ## 安装 Docker CE apt-get update && apt-get install -y containerd.io=1.2.13-2  docker-ce=5:19.03.11~3-0~ubuntu-$(lsb_release -cs)  docker-ce-cli=5:19.03.11~3-0~ubuntu-$(lsb_release -cs) </del> <ins> ## 安装 Docker 的官方 GPG 密钥 curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - </ins> ``` ```shell <del> # 设置 daemon cat > /etc/docker/daemon.json <<EOF { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2" } EOF </del> <ins> ## 新增 Docker apt 仓库。 sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" ``` ```shell ## 安装 containerd sudo apt-get update && sudo apt-get install -y containerd.io </ins> ``` ```shell <del> mkdir -p /etc/systemd/system/docker.service.d </del> <ins> # 配置 containerd sudo mkdir -p /etc/containerd sudo containerd config default > /etc/containerd/config.toml </ins> ``` <del> <!-- # Restart docker. systemctl daemon-reload systemctl restart docker --> </del> ```shell <del> # 重启 docker. systemctl daemon-reload systemctl restart docker </del> <ins> # 重启 containerd sudo systemctl restart containerd </ins> ``` <del> {{% /tab %}} </del> <ins> {{< /tab >}} </ins> {{% tab name="CentOS/RHEL 7.4+" %}} <!-- <del> # Install Docker CE </del> <ins> ```shell # (Install containerd) </ins> ## Set up the repository <del> ### Install required packages. yum install yum-utils device-mapper-persistent-data lvm2 </del> <ins> ### Install required packages sudo yum install -y yum-utils device-mapper-persistent-data lvm2 ``` </ins> <del> ### Add Docker repository. yum-config-manager  </del> <ins> ```shell ## Add docker repository sudo yum-config-manager  </ins> --add-repo  https://download.docker.com/linux/centos/docker-ce.repo <ins> ``` </ins> <del> ## Install Docker CE. yum update -y && yum install -y  containerd.io-1.2.13  docker-ce-19.03.11  docker-ce-cli-19.03.11 ## Create /etc/docker directory. mkdir /etc/docker </del> <ins> ```shell ## Install containerd sudo yum update -y && sudo yum install -y containerd.io ``` </ins> <del> # Setup daemon. cat > /etc/docker/daemon.json <<EOF { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2", "storage-opts": [ "overlay2.override_kernel_check=true" ] } EOF </del> <ins> ```shell ## Configure containerd sudo mkdir -p /etc/containerd sudo containerd config default > /etc/containerd/config.toml ``` </ins> <del> mkdir -p /etc/systemd/system/docker.service.d </del> <ins> ```shell # Restart containerd sudo systemctl restart containerd ``` </ins> --> ```shell <del> # 安装 Docker CE </del> <ins> # 安装 containerd </ins> ## 设置仓库 ### 安装所需包 <del> yum install yum-utils device-mapper-persistent-data lvm2 </del> <ins> sudo yum install -y yum-utils device-mapper-persistent-data lvm2 </ins> ``` ```shell <del> ### 新增 Docker 仓库。 yum-config-manager  --add-repo  https://download.docker.com/linux/centos/docker-ce.repo </del> <ins> ### 新增 Docker 仓库 sudo yum-config-manager  --add-repo  https://download.docker.com/linux/centos/docker-ce.repo </ins> ``` ```shell <del> ## 安装 Docker CE. yum update -y && yum install -y  containerd.io-1.2.13  docker-ce-19.03.11  docker-ce-cli-19.03.11 </del> <ins> ## 安装 containerd sudo yum update -y && sudo yum install -y containerd.io </ins> ``` ```shell <del> ## 创建 /etc/docker 目录。 mkdir /etc/docker </del> <ins> # 配置 containerd sudo mkdir -p /etc/containerd sudo containerd config default > /etc/containerd/config.toml </ins> ``` ```shell <del> # 设置 daemon。 cat > /etc/docker/daemon.json <<EOF { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2", "storage-opts": [ "overlay2.override_kernel_check=true" ] } EOF </del> <ins> # 重启 containerd sudo systemctl restart containerd ``` {{% /tab %}} {{% tab name="Windows (PowerShell)" %}} <!-- ```powershell # (Install containerd) # download containerd cmd /c curl -OL https://github.com/containerd/containerd/releases/download/v1.4.0-beta.2/containerd-1.4.0-beta.2-windows-amd64.tar.gz cmd /c tar xvf .containerd-1.4.0-beta.2-windows-amd64.tar.gz </ins> ``` <del> ```shell mkdir -p /etc/systemd/system/docker.service.d </del> <ins> ```powershell # extract and configure Copy-Item -Path ".bin" -Destination "$Env:ProgramFilescontainerd" -Recurse -Force cd $Env:ProgramFilescontainerd .containerd.exe config default | Out-File config.toml -Encoding ascii # review the configuration. depending on setup you may want to adjust: # - the sandbox_image (kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml </ins> ``` <del> <!-- # Restart Docker systemctl daemon-reload systemctl restart docker --> ```shell # 重启 Docker systemctl daemon-reload systemctl restart docker </del> <ins> ```powershell # start containerd .containerd.exe --register-service Start-Service containerd ``` --> ```powershell # （安装 containerd ） # 下载 contianerd cmd /c curl -OL https://github.com/containerd/containerd/releases/download/v1.4.0-beta.2/containerd-1.4.0-beta.2-windows-amd64.tar.gz cmd /c tar xvf .containerd-1.4.0-beta.2-windows-amd64.tar.gz </ins> ``` <del> {{% /tab %}} {{% /tabs %}} <!-- If you want the docker service to start on boot, run the following command: </del> <ins> ```powershell # 解压并配置 Copy-Item -Path ".bin" -Destination "$Env:ProgramFilescontainerd" -Recurse -Force cd $Env:ProgramFilescontainerd .containerd.exe config default | Out-File config.toml -Encoding ascii </ins> <del> ```shell sudo systemctl enable docker </del> <ins> # 检查配置文件，基于你可能想要调整的设置： # - sandbox_image (kubernetes pause 镜像) # - CNI 的 bin_dir 和 conf_dir 路径 Get-Content config.toml </ins> ``` <del> --> 如果你想开机即启动 docker 服务，执行以下命令： </del> <ins> ```powershell # 启动 containerd .containerd.exe --register-service Start-Service containerd ``` {{% /tab %}} {{< /tabs >}} </ins> <del> ```shell sudo systemctl enable docker </del> <ins> #### systemd {#containerd-systemd} <!-- To use the `systemd` cgroup driver in `/etc/containerd/config.toml` with `runc`, set ``` [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] ... [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] SystemdCgroup = true </ins> ``` <del> <!-- Refer to the [official Docker installation guides](https://docs.docker.com/engine/installation/) for more information. </del> <ins> When using kubeadm, manually configure the [cgroup driver for kubelet](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#configure-cgroup-driver-used-by-kubelet-on-control-plane-node). </ins> --> <ins> 结合 `runc` 使用 `systemd` cgroup 驱动，在 `/etc/containerd/config.toml` 中设置 </ins> <del> 请参阅[官方 Docker 安装指南](https://docs.docker.com/engine/installation/) 来获取更多的信息。 </del> <ins> ``` [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] ... [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] SystemdCgroup = true ``` </ins> <del> <!-- ## CRI-O </del> <ins> 当使用 kubeadm 时，请手动配置 [kubelet 的 cgroup 驱动](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#configure-cgroup-driver-used-by-kubelet-on-control-plane-node). </ins> <del> This section contains the necessary steps to install `CRI-O` as CRI runtime. </del> <ins> ### CRI-O <!-- This section contains the necessary steps to install CRI-O as a container runtime. </ins> Use the following commands to install CRI-O on your system: <del> ### Prerequisites </del> <ins> {{< note >}} The CRI-O major and minor versions must match the Kubernetes major and minor versions. For more information, see the [CRI-O compatibility matrix](https://github.com/cri-o/cri-o). {{< /note >}} Install and configure prerequisites: </ins> ```shell <del> modprobe overlay modprobe br_netfilter </del> <ins> sudo modprobe overlay sudo modprobe br_netfilter </ins> <del> # Setup required sysctl params, these persist across reboots. cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF </del> <ins> # Set up required sysctl params, these persist across reboots. cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf </ins> net.bridge.bridge-nf-call-iptables  = 1 net.ipv4.ip_forward                 = 1 net.bridge.bridge-nf-call-ip6tables = 1 EOF <del> sysctl --system </del> <ins> sudo sysctl --system </ins> ``` --> <del> ## CRI-O 本节包含安装 `CRI-O` 作为 CRI 运行时的必要步骤。 </del> <ins> 本节包含安装 CRI-O 作为容器运行时的必要步骤。 </ins> 使用以下命令在系统中安装 CRI-O： <del> ### 准备环境 </del> <ins> 提示：CRI-O 的主要以及次要版本必须与 Kubernetes 的主要和次要版本相匹配。 更多信息请查阅 [CRI-O 兼容性列表](https://github.com/cri-o/cri-o). 安装以及配置的先决条件： </ins> ```shell <del> modprobe overlay modprobe br_netfilter </del> <ins> sudo modprobe overlay sudo modprobe br_netfilter </ins> <del> # 设置必需的sysctl参数，这些参数在重新启动后仍然存在。 cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF </del> <ins> # 设置必需的 sysctl 参数，这些参数在重新启动后仍然存在。 cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf </ins> net.bridge.bridge-nf-call-iptables  = 1 net.ipv4.ip_forward                 = 1 net.bridge.bridge-nf-call-ip6tables = 1 EOF <del> sysctl --system </del> <ins> sudo sysctl --system </ins> ``` {{< tabs name="tab-cri-cri-o-installation" >}} {{% tab name="Debian" %}} <del> <!-- ```shell # Debian Unstable/Sid echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Unstable/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Unstable/Release.key -O- | sudo apt-key add - ``` --> ```shell # Debian Unstable/Sid echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Unstable/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Unstable/Release.key -O- | sudo apt-key add - ``` <!-- ```shell # Debian Testing echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Testing/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Testing/Release.key -O- | sudo apt-key add - ``` --> ```shell # Debian Testing echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Testing/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Testing/Release.key -O- | sudo apt-key add - ``` <!-- ```shell # Debian 10 echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_10/Release.key -O- | sudo apt-key add - ``` --> </del> <ins> <!-- To install CRI-O on the following operating systems, set the environment variable `OS` to the appropriate value from the following table: </ins> <del> ```shell # Debian 10 echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_10/Release.key -O- | sudo apt-key add - ``` </del> <ins> | Operating system | `$OS`             | |------------------|-------------------| | Debian Unstable  | `Debian_Unstable` | | Debian Testing   | `Debian_Testing`  | </ins> <del> <!-- ```shell # Raspbian 10 echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Raspbian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Raspbian_10/Release.key -O- | sudo apt-key add - ``` --> ```shell # Raspbian 10 echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Raspbian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Raspbian_10/Release.key -O- | sudo apt-key add - ``` <!-- and then install CRI-O: ```shell sudo apt-get install cri-o-1.17 ``` --> 随后安装 CRI-O: ```shell sudo apt-get update sudo apt-get install cri-o-1.17 ``` {{% /tab %}} {{% tab name="Ubuntu 18.04, 19.04 and 19.10" %}} </del> <ins> <br /> Then, set `$VERSION` to the CRI-O version that matches your Kubernetes version. For instance, if you want to install CRI-O 1.18, set `VERSION=1.18`. You can pin your installation to a specific release. To install version 1.18.3, set `VERSION=1.18:1.18.3`. <br /> </ins> <del> <!-- ```shell # Configure package repository . /etc/os-release sudo sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/x${NAME}_${VERSION_ID}/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list" wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/x${NAME}_${VERSION_ID}/Release.key -O- | sudo apt-key add - sudo apt-get update ``` --> </del> <ins> Then run --> 在下列操作系统上安装 CRI-O, 使用下表中合适的值设置环境变量 `OS`: </ins> <del> ```shell # 配置仓库 . /etc/os-release sudo sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/x${NAME}_${VERSION_ID}/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list" wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/x${NAME}_${VERSION_ID}/Release.key -O- | sudo apt-key add - sudo apt-get update ``` </del> <ins> | 操作系统         | `$OS`             | |-----------------|-------------------| | Debian Unstable | `Debian_Unstable` | | Debian Testing  | `Debian_Testing`  | </ins> <del> <!-- ```shell # Install CRI-O sudo apt-get install cri-o-1.17 ``` --> </del> <ins> <br /> 然后，将 `$VERSION` 设置为与你的 Kubernetes 相匹配的 CRI-O 版本。 例如，如果你要安装 CRI-O 1.18, 请设置 `VERSION=1.18`. 你也可以安装一个特定的发行版本。 例如要安装 1.18.3 版本，设置 `VERSION=1.18:1.18.3`. <br /> 然后执行 </ins> ```shell <del> # 安装 CRI-O </del> <ins> cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/ / EOF cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.list deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$VERSION/$OS/ / EOF curl -L https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable:cri-o:$VERSION/$OS/Release.key | sudo apt-key add --keyring /etc/apt/trusted.gpg.d/libcontainers.gpg - curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/Release.key | sudo apt-key add --keyring /etc/apt/trusted.gpg.d/libcontainers.gpg - </ins> sudo apt-get update <del> sudo apt-get install cri-o-1.17 </del> <ins> sudo apt-get install cri-o cri-o-runc </ins> ``` {{% /tab %}} <del> {{% tab name="Ubuntu 16.04" %}} </del> <ins> {{% tab name="Ubuntu" %}} </ins> <del> <!-- # Install prerequisites apt-get update apt-get install software-properties-common </del> <ins> <!-- To install on the following operating systems, set the environment variable `OS` to the appropriate field in the following table: </ins> <del> add-apt-repository ppa:projectatomic/ppa apt-get update </del> <ins> | Operating system | `$OS`           | |------------------|-----------------| | Ubuntu 20.04     | `xUbuntu_20.04` | | Ubuntu 19.10     | `xUbuntu_19.10` | | Ubuntu 19.04     | `xUbuntu_19.04` | | Ubuntu 18.04     | `xUbuntu_18.04` | </ins> <del> # Install CRI-O apt-get install cri-o-1.15 --> </del> <ins> <br /> Then, set `$VERSION` to the CRI-O version that matches your Kubernetes version. For instance, if you want to install CRI-O 1.18, set `VERSION=1.18`. You can pin your installation to a specific release. To install version 1.18.3, set `VERSION=1.18:1.18.3`. <br /> Then run --> 在下列操作系统上安装 CRI-O, 使用下表中合适的值设置环境变量 `OS`: | 操作系统      | `$OS`           | |--------------|-----------------| | Ubuntu 20.04 | `xUbuntu_20.04` | | Ubuntu 19.10 | `xUbuntu_19.10` | | Ubuntu 19.04 | `xUbuntu_19.04` | | Ubuntu 18.04 | `xUbuntu_18.04` | <br /> 然后，将 `$VERSION` 设置为与你的 Kubernetes 相匹配的 CRI-O 版本。 例如，如果你要安装 CRI-O 1.18, 请设置 `VERSION=1.18`. 你也可以安装一个特定的发行版本。 例如要安装 1.18.3 版本，设置 `VERSION=1.18:1.18.3`. <br /> 然后执行 </ins> ```shell <del> # 安装必备软件 apt-get update apt-get install software-properties-common </del> <ins> cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/ / EOF cat <<EOF | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.list deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$VERSION/$OS/ / EOF </ins> <del> add-apt-repository ppa:projectatomic/ppa apt-get update </del> <ins> curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/Release.key | sudo apt-key add --keyring /etc/apt/trusted.gpg.d/libcontainers.gpg curl -L https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable:cri-o:$VERSION/$OS/Release.key | sudo apt-key add --keyring /etc/apt/trusted.gpg.d/libcontainers-cri-o.gpg - </ins> <del> # 安装 CRI-O apt-get install cri-o-1.15 </del> <ins> sudo apt-get update sudo apt-get install cri-o cri-o-runc </ins> ``` {{% /tab %}} {{% tab name="CentOS" %}} <del> <!-- To install on the following operating systems, set the environment variable $OS to the appropriate field in the following table: </del> <ins> <!-- To install on the following operating systems, set the environment variable `OS` to the appropriate field in the following table: </ins> <del> | Operating system | $OS               | | ---------------- | ----------------- | </del> <ins> | Operating system | `$OS`             | |------------------|-------------------| </ins> | Centos 8         | `CentOS_8`        | | Centos 8 Stream  | `CentOS_8_Stream` | | Centos 7         | `CentOS_7`        |

Discussion:
With # merged, we are unable to track the changes to the in the English version. So this page needs a resync manually. /language zh
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I'm gonna fixing this one if no other people working on this. /assign
Thank you very much,