環境準備

Installing kubeadm

sudo apt-get install -y apt-transport-https ca-certificates curl

curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list

sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

disable swap

swapoff -a
grep '#/swap' /etc/fstab >/dev/null || sed -i '/\/swap.*swap/s/^\/swap/#\/swap/' /etc/fstab
grep '#/swapfile.*swap' /etc/fstab >/dev/null || sed -i '/\/swapfile.*swap/s/^\/swapfile/#\/swapfile/' /etc/fstab
rm -r /swap* &>/dev/null

setting

tee /etc/modules-load.d/containers.conf<<EOF
br_netfilter
overlay
fuse
EOF

tee /etc/sysctl.d/containers.conf<<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF

install cri-o

source /etc/os-release
CRIO_VER=$(curl -s 'https://api.github.com/repos/cri-o/cri-o/releases/latest' | jq -r .name | grep -oP 'v\K\d+.\d+')
echo "deb [signed-by=/etc/apt/trusted.gpg.d/libcontainers-archive-keyring.gpg] https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
echo "deb [signed-by=/etc/apt/trusted.gpg.d/libcontainers-crio-archive-keyring.gpg] https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/${CRIO_VER}/xUbuntu_${VERSION_ID}/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:${CRIO_VER}.list

Install cri-o and crun

curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/Release.key | gpg --dearmor -o /etc/apt/trusted.gpg.d/libcontainers-archive-keyring.gpg
curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/${CRIO_VER}/xUbuntu_${VERSION_ID}/Release.key | gpg --dearmor -o /etc/apt/trusted.gpg.d/libcontainers-crio-archive-keyring.gpg
apt update
apt install -y cri-o crun

cri-o config

sudo tee /etc/crio/crio.conf <<EOF
[crio.runtime]

# Overide defaults to not use systemd cgroups.
conmon_cgroup = "pod"
cgroup_manager = "systemd" # ubuntu use systemd
default_runtime = "crun"

default_capabilities = [
  # crio default
  "CHOWN",
  "DAC_OVERRIDE",
  "FSETID",
  "FOWNER",
  "SETGID",
  "SETUID",
  "SETPCAP",
  "NET_BIND_SERVICE",
  "KILL",
  # add
  "SETFCAP",
  # ssh sudo need
  "AUDIT_WRITE",
  "SYS_CHROOT",
  # icmp ping need
  "NET_RAW"
]

[crio.runtime.runtimes.crun]
runtime_path = "/usr/bin/crun"
runtime_type = "oci"
runtime_root = ""

[crio.network]
network_dir = "/etc/cni/net.d/"
plugin_dirs = [
  "/opt/cni/bin/",
  "/usr/libexec/cni/"
]
EOF

Set crictl yaml

tee /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///var/run/crio/crio.sock
image-endpoint: unix:///var/run/crio/crio.sock
timeout: 2
EOF

Set Service

systemctl daemon-reload
systemctl restart crio
systemctl enable crio