crio.conf(5)(Kubernetes) Daemon crio.conf(5)(Kubernetes) Aleksa Sarai OCTOBER 2016 (NAME) crio.conf - OCI CRI-O (DESCRIPTION) CRI-O OCI crio(8) <./crio.8.md> TOML . CRI-O SIGHUP . crio.conf 'This option supports live configuration reload' . containers-registries.conf(5) SIGHUP crio . crio.conf /etc/crio/crio.conf . (FORMAT) TOML . "crio" . . TOML : [table] option = value [table.subtable1] option = value [table.subtable2] option = value CRIO (CRIO TABLE) CRI-O containers-storage.conf(5) /etc/containers/storage.conf . . CRI-O . root="/var/lib/containers/storage" " ". CRI-O . runroot="/run/containers/storage" " ". CRI-O . storage_driver="overlay" . containers-storage.conf(5) . storage_option=[] . containers-storage.conf(5) . log_dir="/var/log/crio/pods" kubelet . . version_file="/run/crio/version" CRI-O . crio wipe . version_file_persist="" CRI-O . crio wipe CRI-O . imagestore="" --root . internal_wipe=true . CRI-O . false crio wipe . internal_repair=true CRI-O . CRI-O . clean_shutdown_file="/var/lib/crio/clean.shutdown" CRI-O . crio . crio wipe . CRIO.API (CRIO.API TABLE) crio.api kubelet/gRPC . listen="/run/crio/crio.sock" AF_LOCAL CRI-O . stream_address="127.0.0.1" IP . stream_port="0" () . "0" CRI-O . stream_enable_tls=false TLS . stream_idle_timeout="" . stream_tls_cert="" x509 . CRI-O . stream_tls_key="" . CRI-O . stream_tls_ca="" CA() x509 . CRI-O . tls_min_version="VersionTLS12" TLS . "VersionTLS12" "VersionTLS13" . "VersionTLS12" . tls_cipher_suites=[] TLS 1.2. Go . TLS 1.3 Go . grpc_max_send_msg_size=83886080 gRPC . CRI-O 80 * 1024 * 1024 . grpc_max_recv_msg_size=83886080 gRPC. CRI- O 80 * 1024 * 1024 . CRIO.RUNTIME (CRIO.RUNTIME TABLE) crio.runtime OCI OCI . default_runtime="crun" OCI . . default_ulimits=[] ulimit "=:" : "nofile=1024:2048". CRI-O . no_pivot=false true pivot_root MS_MOVE . decryption_keys_path="/etc/crio/keys/" . additional_artifact_stores=[] OCI ( ). CRI-O "artifacts/" . . . CRI-O . . conmon="" conmon OCI. $PATH . RuntimeHandler.MonitorPath . conmon_cgroup="" cgroup conmon. RuntimeHandler.MonitorCgroup . conmon_env=[] conmon conmon . RuntimeHandler.MonitorEnv . default_env=[] . (override) . min_injected_gomaxprocs=0 GOMAXPROCS burstable best-effort. . burstable CPU GOMAXPROCS . best-effort ( CPU) . guaranteed workload-partitioned . 0 (). selinux=false true SELinux . SELinux . seccomp_profile="" seccomp.json seccomp . seccomp . SeccompDefault FeatureGate . privileged_seccomp_profile="" seccomp . apparmor_profile="" AppArmor CRI-O . "crio-default" . blockio_config_file="" blockio blockio cgroup. blockio_reload=false true blockio_config_file blockio . cdi_spec_dirs=[] (CDI) CDI. CDI CDI https://github.com/container-orchestrated-devices/container-device- interface . . : cdi_spec_dirs = [ "/etc/cdi", "/run/cdi", ] irqbalance_config_file="/etc/sysconfig/irqbalance" irqbalance CRI-O . CentOS/SUSE /etc/sysconfig/irqbalance . Ubuntu /etc/default/irqbalance . irqbalance_config_restore_file="/etc/sysconfig/orig_irq_banned_cpus" CPU irqbalance CRI-O . 'disable' . rdt_config_file="" RDT resctrl. cgroup_manager="systemd" cgroup . default_capabilities=[] . json . : default_capabilities = [ "CHOWN", "DAC_OVERRIDE", "FSETID", "FOWNER", "SETGID", "SETUID", "SETPCAP", "NET_BIND_SERVICE", "KILL", ] add_inheritable_capabilities=false (inheritable) (permitted) (bounding) (effective). . default_sysctls=[] sysctl . sysctl json . . /proc/sys/net/ipv4/ping_group_range : default_sysctls = [ "net.ipv4.ping_group_range = 0 2147483647", ] allowed_devices=[] "io.kubernetes.cri-o.Devices" . additional_devices=[] . "::" : "--additional-devices=/dev/sdc:/dev/xvdc:rwm". json . hooks_dir=["path", ...] *.json CRI-O . JSON oci-hooks(5) . CRI-O 1.0.0 0.1.0 0.1.0 . (oci-hooks(5) ). CRI-O OCI . io.kubernetes.cri-o.Volumes OCI . (bind- mount) . CRI-O ( /dev/shm) . default_mounts=[] . : default_mounts_file . default_mounts_file="" . /SRC:/DST . CRI-O : 1) `/etc/containers/mounts.conf` ( default_mounts_file): (override) . 2) `/usr/share/containers/mounts.conf`: . CRI-O default_mounts_file . CRI-O . pids_limit=-1 . . --pod-pids-limit Kubelet . log_filter="" . . 'request:.*' gRPC . log_level="info" . fatal panic error warn info debug trace. . log_size_max=-1 . . >= 8192 conmon . (truncate) . . --container-log-max-size Kubelet . log_to_journald=false journald . container_exits_dir="/run/crio/exits" conmon . container_attach_socket_dir="/run/crio" . bind_mount_prefix="" . CRI-O / /host . CRI-O --bind-mount- prefix=/host CRI-O /host CRI . /var/lib/foobar CRI-O /host/var/lib/foobar . CRI-O / /host /var/lib/foobar /var/lib/foobar CRI-O. read_only=false true . uid_mappings="" UID . containerUID:HostUID:Size . . . minimum_mappable_uid=-1 UID uid_mappings CRI UID 0 . (KEP-127) . gid_mappings="" GID . containerGID:HostGID:Size . . (KEP-127) . minimum_mappable_gid=-1 GID gid_mappings CRI UID 0 . (KEP-127) . ctr_stop_timeout=30 . drop_infra_ctr=true PID ( kata) infra . manage_ns_lifecycle true . infra_ctr_cpuset="" CPU infra . CRI-O CPU infra . CPU CPU . reserved- cpus kubelet . shared_cpuset="" CPU CPU . . CPU CPU . namespaces_dir="/run" . manage_ns_lifecycle true . pinns_path="" pinns . absent_mount_sources_to_reject=[] ( ). device_ownership_from_security_context=false uid/gid SecurityContext CRI ( RunAsUser/RunAsGroup) uid/gid . enable_criu_support=true CRIU criu $PATH . (: true) enable_pod_events=false CRI-O (PLEG) Kubelet. hostnetwork_disable_selinux=true SELinux . disable_hostport_mapping=false hostport CRI-O. 'false' . timezone="" CRI-O. CRI-O . 'Local' . CRIO.RUNTIME.RUNTIMES (CRIO.RUNTIME.RUNTIMES TABLE) "crio.runtime.runtimes" OCI . (runtime handler) CRI . runtime handler . . runtime_path="" OCI . runtime_root="" . runtime_type="oci" . "oci" "vm". inherit_default_runtime=false . runtime_config_path="" VM . privileged_without_host_devices=false . allowed_annotations=[] . allowed_annotations (workload) . . : "io.kubernetes.cri-o.userns-mode" . "io.kubernetes.cri-o.Devices" . "io.kubernetes.cri-o.ShmSize" /dev/shm. "io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" cgroup v2 . "io.containers.trace-syscall" OCI seccomp BPF. "seccomp-profile.kubernetes.cri-o.io" seccomp : "seccomp-profile.kubernetes.cri-o.io/" "seccomp-profile.kubernetes.cri- o.io/POD". . seccomp-profile.kubernetes.cri-o.io /POD . container_min_memory="" . . "12 MiB" . platform_runtime_paths={} . no_sync_log=false true . 'oci' . true . default_annotations={} . stream_websockets=false exec attach (port forward) . conmon-rs ( runtime_type = "pod") exec attach . . seccomp_profile="" seccomp.json seccomp . seccomp crio.runtime . seccomp . container_create_timeout=240 . . ( ) . . conmon-rs ( runtime_type = "pod") . : --runtime-request-timeout kubelet (: ) . container_create_timeout = 600 ( ) kubelet . VM . kubelet . CRIO.RUNTIME.WORKLOADS (CRIO.RUNTIME.WORKLOADS TABLE) "crio.runtime.workloads" ( ) . activation_annotation . activation_annotation="" . annotation_prefix="" . $annotation_prefix.$resource/$ctrname = $value . allowed_annotations=[] . : "io.kubernetes.cri-o.userns-mode" . "io.kubernetes.cri-o.cgroup2-mount-hierarchy- rw" cgroup "true". "io.kubernetes.cri-o.Devices" . "io.kubernetes.cri-o.ShmSize" /dev/shm. "io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" cgroup v2 . "io.containers.trace-syscall" OCI seccomp BPF. "io.kubernetes.cri-o.seccompNotifierAction" seccomp. "io.kubernetes.cri-o.umask" umask init . "io.kubernetes.cri.rdt-class" RDT . "seccomp- profile.kubernetes.cri-o.io" seccomp . "io.kubernetes.cri-o.DisableFIPS" FIPS FIPS . seccomp (Using the seccomp notifier feature): seccomp ( ) . "io.kubernetes.cri-o.seccompNotifierAction" allowed_annotations . runc 1.1.0 crun 0.19 . "io.kubernetes.cri-o.seccompNotifierAction" CRI-O seccomp . CRI- O "io.kubernetes.cri- o.seccompNotifierAction=stop" . . "restartPolicy" "Never" kubelet . defaultAction seccomp CRI-O . CRIO.RUNTIME.WORKLOAD.RESOURCES (CRIO.RUNTIME.WORKLOAD.RESOURCES TABLE) . AnnotationPrefix . cpushares="" (CPU shares) . cpuset="" cpuset . CRIO.IMAGE (CRIO.IMAGE TABLE) crio.image OCI . CRI-O containers- registries.conf(5) /etc/containers/registries.conf . default_transport="docker://" () . global_auth_file="" /var/lib/kubelet/config.json . pause_image="registry.k8s.io/pause:3.10.1" infra . . . pause_image_auth_file="" /var/lib/kubelet/config.json pause_image . . pause_command="/pause" (paused) . . pinned_images=[] (garbage collection) . (glob) . glob * . pause . signature_policy="" . ( /etc/containers/policy.json) . containers-policy.json(5) . signature_policy_dir="/etc/crio/policies" . /.json . signature_policy . . image_volumes="mkdir" . mkdir bind ignore . insecure_registries=[] TLS . . registries.conf . big_files_temporary_dir="" blob . separate_pull_cgroup="" [] cgroup . "pod" cgroup . cgroup systemd . auto_reload_registries=false true 'registries.conf.d' CRI-O . 'false' . pull_progress_timeout="0s" . pull_progress_timeout / 10 . 0 . oci_artifact_mount_support=true CRI-O OCI . true CRI-O OCI . short_name_mode="enforcing" . "enforcing" "disabled" "enforcing" . "enforcing" . "disabled" . CRIO.NETWORK (CRIO.NETWORK TABLE) crio.network CNI . cni_default_network="" CNI . "" CRI-O network_dir . network_dir="/etc/cni/net.d/" CNI. plugin_dirs=["/opt/cni/bin/",] CNI . cni_status_grace_period="0s" CNI . "0s" () . ( "1m") goroutine CNI ( rollout OVN-K) . CRIO.METRICS (CRIO.METRICS TABLE) crio.metrics Prometheus . enable_metrics=false . metrics_collectors=["image_pulls_layer_size", "containers_events_dropped_total", "containers_oom_total", "processes_defunct", "operations_total", "operations_latency_seconds", "operations_latency_seconds_total", "operations_errors_total", "image_pulls_bytes_total", "image_pulls_skipped_bytes_total", "image_pulls_failure_total", "image_pulls_success_total", "image_layer_reuse_total", "containers_oom_count_total", "containers_seccomp_notifier_count_total", "resources_stalled_at_stage"] . . metrics_host="127.0.0.1" IP . metrics_port=9090 () . metrics_socket="" . metrics_cert="" . metrics_key="" . CRIO.TRACING (CRIO.TRACING TABLE) [] crio.tracing (trace) OpenTelemetry . enable_tracing=false OpenTelemetry. tracing_endpoint="127.0.0.1:4317" gRPC . tracing_sampling_rate_per_million="" span OpenTelemetry. 1000000 . CRIO.STATS (CRIO.STATS TABLE) crio.stats . stats_collection_period=0 . 0 . : . collection_period . collection_period=0 / . 0 / . included_pod_metrics=[] . . . "cpu", "hugetlb", "memory", "network", "oom", "process", "spec", "disk", "diskIO", "pressure". "all" . "all" . CRIO.NRI (CRIO.NRI TABLE) crio.nri NRI ( ) CRI-O . enable_nri=true NRI CRI-O. nri_plugin_dir="/opt/nri/plugins" . nri_plugin_config_dir="/etc/nri/conf.d" . nri_listen="/run/nri/nri.sock" NRI . nri_disable_connections=false NRI . nri_plugin_registration_timeout="5s" NRI. nri_plugin_request_timeout="2s" NRI. CRIO.NRI.DEFAULT_VALIDATOR (CRIO.NRI.DEFAULT_VALIDATOR TABLE) crio.nri.default_validator NRI NRI . nri_enable_default_validator=false NRI. nri_validator_reject_oci_hook_adjustment=false OCI NRI. nri_validator_reject_runtime_default_seccomp_adjustment=false seccomp NRI. nri_validator_reject_unconfined_seccomp_adjustment=false (unconfined) seccomp NRI. nri_validator_reject_custom_seccomp_adjustment=false seccomp NRI. nri_validator_reject_namespace_adjustment=false NRI. nri_validator_required_plugins=[] NRI . nri_validator_tolerate_missing_plugins_annotation="" NRI . (SEE ALSO) crio.conf.d(5), containers-storage.conf(5), containers-policy.json(5), containers-registries.conf(5), crio(8) (HISTORY) Valentin Rothberg vrothberg@suse.com Aleksa Sarai asarai@suse.de Runtime Container crio.conf(5)(Kubernetes)