Sandboxed Containers Support for OpenShift OpenShift Container Platform 4.10 OpenShift sandboxed containers guide Red Hat OpenShift Documentation Team

Commands:
oc patch scc sandboxed-containers-operator-scc --type=merge --patch '{"seLinuxContext":{"type": "RunAsAny"}}'
oc scale deployments/machine-config-operator -n openshift-machine-config-operator --replicas=0
oc scale deployments/machine-config-operator -n openshift-machine-config-operator --replicas=1
oc patch scc sandboxed-containers-operator-scc --type=merge --patch '{"seLinuxContext":{"type": "MustRunAs"}}'
oc get pods -n openshift-machine-config-operator -l k8s-app=machine-config-operator -o yaml | grep scc openshift.io/scc: hostmount-anyuid
lscpu
CPU(s): 16 On-line CPU(s) list: 0-12,14,15 Off-line CPU(s) list: 13
metadata: annotations: io.katacontainers.config.hypervisor.default_vcpus: "16"
oc describe runtimeclass kata
kind: RuntimeClass apiVersion: node.k8s.io/v1 metadata: name: kata overhead: podFixed: memory: "500Mi" cpu: "500m"
apiVersion: nfd.openshift.io/v1 kind: NodeFeatureDiscovery metadata: name: nfd-kata namespace: openshift-nfd spec: operand: image: quay.io/openshift/origin-node-feature-discovery:4.10 imagePullPolicy: Always servicePort: 12000 workerConfig: configData: | sources: custom: - name: "feature.node.kubernetes.io/runtime.kata" matchOn: - cpuId: ["SSE4", "VMX"] loadedKMod: ["kvm", "kvm_intel"] - cpuId: ["SSE4", "SVM"] loadedKMod: ["kvm", "kvm_amd"]
oc create -f nfd.yaml
nodefeaturediscovery.nfd.openshift.io/nfd-kata created
apiVersion: kataconfiguration.openshift.io/v1 kind: KataConfig metadata: name: example-kataconfig spec: checkNodeEligibility: true
oc create -f kata-config.yaml
kataconfig.kataconfiguration.openshift.io/example-kataconfig created
oc get nodes --selector='feature.node.kubernetes.io/runtime.kata=true'
NAME STATUS ROLES AGE VERSION compute-3.example.com Ready worker 4h38m v1.23.3+e419edf compute-2.example.com Ready worker 4h35m v1.23.3+e419edf
apiVersion: kataconfiguration.openshift.io/v1 kind: KataConfig metadata: name: cluster-kataconfig spec: kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.2.0
apiVersion: kataconfiguration.openshift.io/v1 kind: KataConfig metadata: name: cluster-kataconfig spec: kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.2.0 kataConfigPoolSelector: matchLabels: <label_key>: '<label_value>' 1
apiVersion: v1 kind: Pod metadata: name: hello-openshift labels: app: hello-openshift spec: runtimeClassName: kata containers: - name: hello-openshift image: quay.io/openshift/origin-hello-openshift ports: - containerPort: 8888 securityContext: privileged: false allowPrivilegeEscalation: false runAsNonRoot: true runAsUser: 1001 capabilities: drop: - ALL seccompProfile: type: RuntimeDefault
apiVersion: v1 kind: Namespace metadata: name: openshift-sandboxed-containers-operator
oc create -f Namespace.yaml
apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: name: openshift-sandboxed-containers-operator namespace: openshift-sandboxed-containers-operator spec: targetNamespaces: - openshift-sandboxed-containers-operator
oc create -f OperatorGroup.yaml
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: openshift-sandboxed-containers-operator namespace: openshift-sandboxed-containers-operator spec: channel: "stable-1.2" installPlanApproval: Automatic name: sandboxed-containers-operator source: redhat-operators sourceNamespace: openshift-marketplace startingCSV: sandboxed-containers-operator.v1.2.2
oc create -f Subscription.yaml
oc get csv -n openshift-sandboxed-containers-operator
NAME DISPLAY VERSION REPLACES PHASE openshift-sandboxed-containers openshift-sandboxed-containers-operator 1.2.2 1.2.1 Succeeded
apiVersion: kataconfiguration.openshift.io/v1 kind: KataConfig metadata: name: cluster-kataconfig spec: kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.2.0
apiVersion: kataconfiguration.openshift.io/v1 kind: KataConfig metadata: name: cluster-kataconfig spec: kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.2.0 kataConfigPoolSelector: matchLabels: <label_key>: '<label_value>' 1
oc create -f <file name>.yaml
watch "oc describe kataconfig | sed -n /^Status:/,/^Events/p"
apiVersion: v1 kind: Pod metadata: name: hello-openshift labels: app: hello-openshift spec: runtimeClassName: kata containers: - name: hello-openshift image: quay.io/openshift/origin-hello-openshift ports: - containerPort: 8888 securityContext: privileged: false allowPrivilegeEscalation: false runAsNonRoot: true runAsUser: 1001 capabilities: drop: - ALL seccompProfile: type: RuntimeDefault
oc get pods -A -o json | jq -r '.items[] | select(.spec.runtimeClassName == "kata").metadata.name'
oc delete pod <pod-name>
oc delete kataconfig <KataConfig_CR_Name>
oc get kataconfig <KataConfig_CR_Name>
No KataConfig instances exist
CSV_NAME=USD(oc get csv -n openshift-sandboxed-containers-operator -o=custom-columns=:metadata.name)
oc delete subscription sandboxed-containers-operator -n openshift-sandboxed-containers-operator
oc delete csv USD{CSV_NAME} -n openshift-sandboxed-containers-operator
OG_NAME=USD(oc get operatorgroup -n openshift-sandboxed-containers-operator -o=jsonpath={..name})
oc delete operatorgroup USD{OG_NAME} -n openshift-sandboxed-containers-operator
oc delete namespace openshift-sandboxed-containers-operator
oc delete crd kataconfigs.kataconfiguration.openshift.io
oc get crd kataconfigs.kataconfiguration.openshift.io
Unknown CR KataConfig
checkNodeEligibility: false kataConfigPoolSelector: null kataMonitorImage: 'registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.3.0'
oc patch kataconfig <kataconfig_name> --type merge --patch '{"spec":{"kataMonitorImage":"registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.3.0"}}'
oc adm must-gather --image=registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel8:v4.10.0
oc adm must-gather -- /usr/bin/gather_audit_logs
NAMESPACE NAME READY STATUS RESTARTS AGE openshift-must-gather-5drcj must-gather-bklx4 2/2 Running 0 72s openshift-must-gather-5drcj must-gather-s8sdh 2/2 Running 0 72s
--image=registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel8:1.2.0
apiVersion: machineconfiguration.openshift.io/v1 kind: ContainerRuntimeConfig metadata: name: crio-debug spec: machineConfigPoolSelector: matchLabels: pools.operator.machineconfiguration.openshift.io/worker: '' 1 containerRuntimeConfig: logLevel: debug
oc create -f ctrcfg.yaml
oc get ctrcfg
NAME AGE crio-debug 3m19s
oc get mcp worker
NAME CONFIG UPDATED UPDATING DEGRADED MACHINECOUNT READYMACHINECOUNT UPDATEDMACHINECOUNT DEGRADEDMACHINECOUNT AGE worker rendered-worker-169 False True False 3 1 1 0 9h
oc debug node/<node_name>
sh-4.4# chroot /host
sh-4.4# crio config | egrep 'log_level
log_level = "debug"
oc debug node/<nodename> -- journalctl -D /host/var/log/journal -t kata -g "reading guest console"
oc debug node/<nodename> -- journalctl -D /host/var/log/journal -t kata
oc debug node/<nodename> -- journalctl -D /host/var/log/journal -t virtiofsd