mirror of
https://github.com/k3s-io/k3s.git
synced 2024-06-07 19:41:36 +00:00
6e8284e3d4
Now rootless mode can be used with cgroup v2 resource limitations. A pod is executed in a cgroup like "/user.slice/user-1001.slice/user@1001.service/k3s-rootless.service/kubepods/podd0eb6921-c81a-4214-b36c-d3b9bb212fac/63b5a253a1fd4627da16bfce9bec58d72144cf30fe833e0ca9a6d60ebf837475". This is accomplished by running `kubelet` in a cgroup namespace, and enabling `cgroupfs` driver for the cgroup hierarchy delegated by systemd. To enable cgroup v2 resource limitation, `k3s server --rootless` needs to be launched as `systemctl --user` service. Please see the comment lines in `k3s-rootless.service` for the usage. Running `k3s server --rootless` via a terminal is not supported. When it really needs to be launched via a terminal, `systemd-run --user -p Delegate --tty` needs to be prepended to create a systemd scope. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
94 lines
2.7 KiB
Go
94 lines
2.7 KiB
Go
package templates
|
|
|
|
import (
|
|
"bytes"
|
|
"text/template"
|
|
|
|
"github.com/rancher/k3s/pkg/daemons/config"
|
|
)
|
|
|
|
type ContainerdConfig struct {
|
|
NodeConfig *config.Node
|
|
DisableCgroup bool
|
|
IsRunningInUserNS bool
|
|
PrivateRegistryConfig *Registry
|
|
}
|
|
|
|
const ContainerdConfigTemplate = `
|
|
[plugins.opt]
|
|
path = "{{ .NodeConfig.Containerd.Opt }}"
|
|
|
|
[plugins.cri]
|
|
stream_server_address = "127.0.0.1"
|
|
stream_server_port = "10010"
|
|
enable_selinux = {{ .NodeConfig.SELinux }}
|
|
|
|
{{- if .DisableCgroup}}
|
|
disable_cgroup = true
|
|
{{end}}
|
|
{{- if .IsRunningInUserNS }}
|
|
disable_apparmor = true
|
|
restrict_oom_score_adj = true
|
|
{{end}}
|
|
|
|
{{- if .NodeConfig.AgentConfig.PauseImage }}
|
|
sandbox_image = "{{ .NodeConfig.AgentConfig.PauseImage }}"
|
|
{{end}}
|
|
|
|
{{- if .NodeConfig.AgentConfig.Snapshotter }}
|
|
[plugins.cri.containerd]
|
|
disable_snapshot_annotations = true
|
|
snapshotter = "{{ .NodeConfig.AgentConfig.Snapshotter }}"
|
|
{{end}}
|
|
|
|
{{- if not .NodeConfig.NoFlannel }}
|
|
[plugins.cri.cni]
|
|
bin_dir = "{{ .NodeConfig.AgentConfig.CNIBinDir }}"
|
|
conf_dir = "{{ .NodeConfig.AgentConfig.CNIConfDir }}"
|
|
{{end}}
|
|
|
|
[plugins.cri.containerd.runtimes.runc]
|
|
runtime_type = "io.containerd.runc.v2"
|
|
|
|
{{ if .PrivateRegistryConfig }}
|
|
{{ if .PrivateRegistryConfig.Mirrors }}
|
|
[plugins.cri.registry.mirrors]{{end}}
|
|
{{range $k, $v := .PrivateRegistryConfig.Mirrors }}
|
|
[plugins.cri.registry.mirrors."{{$k}}"]
|
|
endpoint = [{{range $i, $j := $v.Endpoints}}{{if $i}}, {{end}}{{printf "%q" .}}{{end}}]
|
|
{{if $v.Rewrites}}
|
|
[plugins.cri.registry.mirrors."{{$k}}".rewrite]
|
|
{{range $pattern, $replace := $v.Rewrites}}
|
|
"{{$pattern}}" = "{{$replace}}"
|
|
{{end}}
|
|
{{end}}
|
|
{{end}}
|
|
|
|
{{range $k, $v := .PrivateRegistryConfig.Configs }}
|
|
{{ if $v.Auth }}
|
|
[plugins.cri.registry.configs."{{$k}}".auth]
|
|
{{ if $v.Auth.Username }}username = {{ printf "%q" $v.Auth.Username }}{{end}}
|
|
{{ if $v.Auth.Password }}password = {{ printf "%q" $v.Auth.Password }}{{end}}
|
|
{{ if $v.Auth.Auth }}auth = {{ printf "%q" $v.Auth.Auth }}{{end}}
|
|
{{ if $v.Auth.IdentityToken }}identitytoken = {{ printf "%q" $v.Auth.IdentityToken }}{{end}}
|
|
{{end}}
|
|
{{ if $v.TLS }}
|
|
[plugins.cri.registry.configs."{{$k}}".tls]
|
|
{{ if $v.TLS.CAFile }}ca_file = "{{ $v.TLS.CAFile }}"{{end}}
|
|
{{ if $v.TLS.CertFile }}cert_file = "{{ $v.TLS.CertFile }}"{{end}}
|
|
{{ if $v.TLS.KeyFile }}key_file = "{{ $v.TLS.KeyFile }}"{{end}}
|
|
{{ if $v.TLS.InsecureSkipVerify }}insecure_skip_verify = true{{end}}
|
|
{{end}}
|
|
{{end}}
|
|
{{end}}
|
|
`
|
|
|
|
func ParseTemplateFromConfig(templateBuffer string, config interface{}) (string, error) {
|
|
out := new(bytes.Buffer)
|
|
t := template.Must(template.New("compiled_template").Parse(templateBuffer))
|
|
if err := t.Execute(out, config); err != nil {
|
|
return "", err
|
|
}
|
|
return out.String(), nil
|
|
}
|