kubernetes
/
minikube
mirror of https://github.com/kubernetes/minikube.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Revert "Upgrade crio.conf to version v1.18.1" 

This reverts commit f19ca1597c.
pull/8653/head
Anders F Björklund 2020-07-06 10:22:40 +02:00
parent 00db37da3b
commit 5ab9c542a9
2 changed files with 61 additions and 135 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
deploy/iso/minikube-iso/package/crio-bin/crio.conf
View File

@ -35,15 +35,8 @@ storage_driver = "overlay"
# the kubelet. The log directory specified must be an absolute directory. # the kubelet. The log directory specified must be an absolute directory.
log_dir = "/var/log/crio/pods" log_dir = "/var/log/crio/pods"
# Location for CRI-O to lay down the temporary version file. # Location for CRI-O to lay down the version file
# It is used to check if crio wipe should wipe containers, which should version_file = "/var/lib/crio/version"
# always happen on a node reboot
version_file = "/var/run/crio/version"
# Location for CRI-O to lay down the persistent version file.
# It is used to check if crio wipe should wipe images, which should
# only happen when CRI-O has been upgraded
version_file_persist = "/var/lib/crio/version"
# The crio.api table contains settings for the kubelet/gRPC interface. # The crio.api table contains settings for the kubelet/gRPC interface.
[crio.api] [crio.api]
@ -51,11 +44,13 @@ version_file_persist = "/var/lib/crio/version"
# Path to AF_LOCAL socket on which CRI-O will listen. # Path to AF_LOCAL socket on which CRI-O will listen.
listen = "/var/run/crio/crio.sock" listen = "/var/run/crio/crio.sock"
# Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
host_ip = ""
# IP address on which the stream server will listen. # IP address on which the stream server will listen.
stream_address = "127.0.0.1" stream_address = "127.0.0.1"
# The port on which the stream server will listen. If the port is set to "0", then # The port on which the stream server will listen.
# CRI-O will allocate a random free port number.
stream_port = "0" stream_port = "0"
# Enable encrypted TLS transport of the stream server. # Enable encrypted TLS transport of the stream server.
@ -99,10 +94,6 @@ default_runtime = "runc"
# If true, the runtime will not use pivot_root, but instead use MS_MOVE. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
no_pivot = false no_pivot = false
# decryption_keys_path is the path where the keys required for
# image decryption are stored. This option supports live configuration reload.
decryption_keys_path = "/etc/crio/keys/"
# Path to the conmon binary, used for monitoring the OCI runtime. # Path to the conmon binary, used for monitoring the OCI runtime.
# Will be searched for using $PATH if empty. # Will be searched for using $PATH if empty.
conmon = "/usr/libexec/crio/conmon" conmon = "/usr/libexec/crio/conmon"
@ -116,26 +107,17 @@ conmon_env = [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
] ]
# Additional environment variables to set for all the
# containers. These are overridden if set in the
# container image spec or in the container runtime configuration.
default_env = [
]
# If true, SELinux will be used for pod separation on the host. # If true, SELinux will be used for pod separation on the host.
selinux = false selinux = false
# Path to the seccomp.json profile which is used as the default seccomp profile # Path to the seccomp.json profile which is used as the default seccomp profile
# for the runtime. If not specified, then the internal default seccomp profile # for the runtime. If not specified, then the internal default seccomp profile
# will be used. This option supports live configuration reload. # will be used.
seccomp_profile = "" seccomp_profile = ""
# Used to change the name of the default AppArmor profile of CRI-O. The default # Used to change the name of the default AppArmor profile of CRI-O. The default
# profile name is "crio-default". This profile only takes effect if the user # profile name is "crio-default-" followed by the version string of CRI-O.
# does not specify a profile via the Kubernetes Pod's metadata annotation. If apparmor_profile = "crio-default-1.16.1"
# the profile is set to "unconfined", then this equals to disabling AppArmor.
# This option supports live configuration reload.
apparmor_profile = "crio-default"
# Cgroup management implementation used for the runtime. # Cgroup management implementation used for the runtime.
cgroup_manager = "systemd" cgroup_manager = "systemd"
@ -148,10 +130,12 @@ default_capabilities = [
"DAC_OVERRIDE", "DAC_OVERRIDE",
"FSETID", "FSETID",
"FOWNER", "FOWNER",
"NET_RAW",
"SETGID", "SETGID",
"SETUID", "SETUID",
"SETPCAP", "SETPCAP",
"NET_BIND_SERVICE", "NET_BIND_SERVICE",
"SYS_CHROOT",
"KILL", "KILL",
] ]
@ -167,10 +151,8 @@ default_sysctls = [
additional_devices = [ additional_devices = [
] ]
# Path to OCI hooks directories for automatically executed hooks. If one of the # Path to OCI hooks directories for automatically executed hooks.
# directories does not exist, then CRI-O will automatically skip them.
hooks_dir = [ hooks_dir = [
"/usr/share/containers/oci/hooks.d",
] ]
# List of default mounts for each container. **Deprecated:** this option will # List of default mounts for each container. **Deprecated:** this option will
@ -218,13 +200,9 @@ bind_mount_prefix = ""
read_only = false read_only = false
# Changes the verbosity of the logs based on the level it is set to. Options # Changes the verbosity of the logs based on the level it is set to. Options
# are fatal, panic, error, warn, info, debug and trace. This option supports # are fatal, panic, error, warn, info, and debug. This option supports live
# live configuration reload. # configuration reload.
log_level = "info" log_level = "error"
# Filter the log messages by the provided regular expression.
# This option supports live configuration reload.
log_filter = ""
# The UID mappings for the user namespace of each container. A range is # The UID mappings for the user namespace of each container. A range is
# specified in the form containerUID:HostUID:Size. Multiple ranges must be # specified in the form containerUID:HostUID:Size. Multiple ranges must be
@ -237,23 +215,12 @@ uid_mappings = ""
gid_mappings = "" gid_mappings = ""
# The minimal amount of time in seconds to wait before issuing a timeout # The minimal amount of time in seconds to wait before issuing a timeout
# regarding the proper termination of the container. The lowest possible # regarding the proper termination of the container.
# value is 30s, whereas lower values are not considered by CRI-O. ctr_stop_timeout = 0
ctr_stop_timeout = 30
# **DEPRECATED** this option is being replaced by manage_ns_lifecycle, which is described below. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
# manage_network_ns_lifecycle = false # and manage its lifecycle.
manage_network_ns_lifecycle = false
# manage_ns_lifecycle determines whether we pin and remove namespaces
# and manage their lifecycle
manage_ns_lifecycle = false
# The directory where the state of the managed namespaces gets tracked.
# Only used when manage_ns_lifecycle is true.
namespaces_dir = "/var/run"
# pinns_path is the path to find the pinns binary, which is needed to manage namespace lifecycle
pinns_path = "/usr/bin/pinns"
# The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
# The runtime to use is picked based on the runtime_handler provided by the CRI. # The runtime to use is picked based on the runtime_handler provided by the CRI.
@ -314,7 +281,7 @@ global_auth_file = ""
# The image used to instantiate infra containers. # The image used to instantiate infra containers.
# This option supports live configuration reload. # This option supports live configuration reload.
pause_image = "k8s.gcr.io/pause:3.2" pause_image = "k8s.gcr.io/pause:3.1"
# The path to a file containing credentials specific for pulling the pause_image from # The path to a file containing credentials specific for pulling the pause_image from
# above. The file is similar to that of /var/lib/kubelet/config.json # above. The file is similar to that of /var/lib/kubelet/config.json
@ -357,10 +324,6 @@ registries = [
# CNI plugins. # CNI plugins.
[crio.network] [crio.network]
# The default CNI network name to be selected. If not set or "", then
# CRI-O will pick-up the first one found in network_dir.
# cni_default_network = ""
# Path to the directory where CNI configuration files are located. # Path to the directory where CNI configuration files are located.
network_dir = "/etc/cni/net.d/" network_dir = "/etc/cni/net.d/"

81
deploy/iso/minikube-iso/package/crio-bin/crio.conf.default
View File

@ -35,15 +35,8 @@
# the kubelet. The log directory specified must be an absolute directory. # the kubelet. The log directory specified must be an absolute directory.
log_dir = "/var/log/crio/pods" log_dir = "/var/log/crio/pods"
# Location for CRI-O to lay down the temporary version file. # Location for CRI-O to lay down the version file
# It is used to check if crio wipe should wipe containers, which should version_file = "/var/lib/crio/version"
# always happen on a node reboot
version_file = "/var/run/crio/version"
# Location for CRI-O to lay down the persistent version file.
# It is used to check if crio wipe should wipe images, which should
# only happen when CRI-O has been upgraded
version_file_persist = "/var/lib/crio/version"
# The crio.api table contains settings for the kubelet/gRPC interface. # The crio.api table contains settings for the kubelet/gRPC interface.
[crio.api] [crio.api]
@ -51,11 +44,13 @@ version_file_persist = "/var/lib/crio/version"
# Path to AF_LOCAL socket on which CRI-O will listen. # Path to AF_LOCAL socket on which CRI-O will listen.
listen = "/var/run/crio/crio.sock" listen = "/var/run/crio/crio.sock"
# Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
host_ip = ""
# IP address on which the stream server will listen. # IP address on which the stream server will listen.
stream_address = "127.0.0.1" stream_address = "127.0.0.1"
# The port on which the stream server will listen. If the port is set to "0", then # The port on which the stream server will listen.
# CRI-O will allocate a random free port number.
stream_port = "0" stream_port = "0"
# Enable encrypted TLS transport of the stream server. # Enable encrypted TLS transport of the stream server.
@ -99,10 +94,6 @@ default_runtime = "runc"
# If true, the runtime will not use pivot_root, but instead use MS_MOVE. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
no_pivot = false no_pivot = false
# decryption_keys_path is the path where the keys required for
# image decryption are stored. This option supports live configuration reload.
decryption_keys_path = "/etc/crio/keys/"
# Path to the conmon binary, used for monitoring the OCI runtime. # Path to the conmon binary, used for monitoring the OCI runtime.
# Will be searched for using $PATH if empty. # Will be searched for using $PATH if empty.
conmon = "" conmon = ""
@ -116,29 +107,20 @@ conmon_env = [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
] ]
# Additional environment variables to set for all the
# containers. These are overridden if set in the
# container image spec or in the container runtime configuration.
default_env = [
]
# If true, SELinux will be used for pod separation on the host. # If true, SELinux will be used for pod separation on the host.
selinux = false selinux = false
# Path to the seccomp.json profile which is used as the default seccomp profile # Path to the seccomp.json profile which is used as the default seccomp profile
# for the runtime. If not specified, then the internal default seccomp profile # for the runtime. If not specified, then the internal default seccomp profile
# will be used. This option supports live configuration reload. # will be used.
seccomp_profile = "" seccomp_profile = ""
# Used to change the name of the default AppArmor profile of CRI-O. The default # Used to change the name of the default AppArmor profile of CRI-O. The default
# profile name is "crio-default". This profile only takes effect if the user # profile name is "crio-default-" followed by the version string of CRI-O.
# does not specify a profile via the Kubernetes Pod's metadata annotation. If apparmor_profile = "crio-default-1.16.1"
# the profile is set to "unconfined", then this equals to disabling AppArmor.
# This option supports live configuration reload.
apparmor_profile = "crio-default"
# Cgroup management implementation used for the runtime. # Cgroup management implementation used for the runtime.
cgroup_manager = "systemd" cgroup_manager = "cgroupfs"
# List of default capabilities for containers. If it is empty or commented out, # List of default capabilities for containers. If it is empty or commented out,
# only the capabilities defined in the containers json file by the user/kube # only the capabilities defined in the containers json file by the user/kube
@ -148,10 +130,12 @@ default_capabilities = [
"DAC_OVERRIDE", "DAC_OVERRIDE",
"FSETID", "FSETID",
"FOWNER", "FOWNER",
"NET_RAW",
"SETGID", "SETGID",
"SETUID", "SETUID",
"SETPCAP", "SETPCAP",
"NET_BIND_SERVICE", "NET_BIND_SERVICE",
"SYS_CHROOT",
"KILL", "KILL",
] ]
@ -167,10 +151,8 @@ default_sysctls = [
additional_devices = [ additional_devices = [
] ]
# Path to OCI hooks directories for automatically executed hooks. If one of the # Path to OCI hooks directories for automatically executed hooks.
# directories does not exist, then CRI-O will automatically skip them.
hooks_dir = [ hooks_dir = [
"/usr/share/containers/oci/hooks.d",
] ]
# List of default mounts for each container. **Deprecated:** this option will # List of default mounts for each container. **Deprecated:** this option will
@ -218,13 +200,9 @@ bind_mount_prefix = ""
read_only = false read_only = false
# Changes the verbosity of the logs based on the level it is set to. Options # Changes the verbosity of the logs based on the level it is set to. Options
# are fatal, panic, error, warn, info, debug and trace. This option supports # are fatal, panic, error, warn, info, and debug. This option supports live
# live configuration reload. # configuration reload.
log_level = "info" log_level = "error"
# Filter the log messages by the provided regular expression.
# This option supports live configuration reload.
log_filter = ""
# The UID mappings for the user namespace of each container. A range is # The UID mappings for the user namespace of each container. A range is
# specified in the form containerUID:HostUID:Size. Multiple ranges must be # specified in the form containerUID:HostUID:Size. Multiple ranges must be
@ -237,23 +215,12 @@ uid_mappings = ""
gid_mappings = "" gid_mappings = ""
# The minimal amount of time in seconds to wait before issuing a timeout # The minimal amount of time in seconds to wait before issuing a timeout
# regarding the proper termination of the container. The lowest possible # regarding the proper termination of the container.
# value is 30s, whereas lower values are not considered by CRI-O. ctr_stop_timeout = 0
ctr_stop_timeout = 30
# **DEPRECATED** this option is being replaced by manage_ns_lifecycle, which is described below. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
# manage_network_ns_lifecycle = false # and manage its lifecycle.
manage_network_ns_lifecycle = false
# manage_ns_lifecycle determines whether we pin and remove namespaces
# and manage their lifecycle
manage_ns_lifecycle = false
# The directory where the state of the managed namespaces gets tracked.
# Only used when manage_ns_lifecycle is true.
namespaces_dir = "/var/run"
# pinns_path is the path to find the pinns binary, which is needed to manage namespace lifecycle
pinns_path = ""
# The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
# The runtime to use is picked based on the runtime_handler provided by the CRI. # The runtime to use is picked based on the runtime_handler provided by the CRI.
@ -314,7 +281,7 @@ global_auth_file = ""
# The image used to instantiate infra containers. # The image used to instantiate infra containers.
# This option supports live configuration reload. # This option supports live configuration reload.
pause_image = "k8s.gcr.io/pause:3.2" pause_image = "k8s.gcr.io/pause:3.1"
# The path to a file containing credentials specific for pulling the pause_image from # The path to a file containing credentials specific for pulling the pause_image from
# above. The file is similar to that of /var/lib/kubelet/config.json # above. The file is similar to that of /var/lib/kubelet/config.json
@ -356,10 +323,6 @@ image_volumes = "mkdir"
# CNI plugins. # CNI plugins.
[crio.network] [crio.network]
# The default CNI network name to be selected. If not set or "", then
# CRI-O will pick-up the first one found in network_dir.
# cni_default_network = ""
# Path to the directory where CNI configuration files are located. # Path to the directory where CNI configuration files are located.
network_dir = "/etc/cni/net.d/" network_dir = "/etc/cni/net.d/"