From f4d762bb95d3d33d45acbe72c0b75bc213bc083b Mon Sep 17 00:00:00 2001 From: Di Xu Date: Fri, 5 Jan 2018 13:23:48 +0800 Subject: [PATCH] fix docker opts incompatible running on aarch64 Redhat/Centos On Aarch64, the default cgroup driver for docker is systemd instead of cgroupfs. Should conform kubelet to use systemd as cgroup driver as well to keep it consistent with docker. Without this change, below exception will be raised. /usr/bin/docker-current: Error response from daemon: shim error: docker-runc not installed on system. Change-Id: Id496ec9eaac6580e4da2f3ef1a386c9abc2a5129 --- inventory/sample/group_vars/k8s-cluster.yml | 8 +++++++- roles/kubernetes/node/templates/kubelet.standard.env.j2 | 3 +++ roles/kubespray-defaults/defaults/main.yaml | 8 +++++++- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/inventory/sample/group_vars/k8s-cluster.yml b/inventory/sample/group_vars/k8s-cluster.yml index 52a9a2079..02221c434 100644 --- a/inventory/sample/group_vars/k8s-cluster.yml +++ b/inventory/sample/group_vars/k8s-cluster.yml @@ -145,7 +145,13 @@ docker_daemon_graph: "/var/lib/docker" ## An obvious use case is allowing insecure-registry access ## to self hosted registries like so: -docker_options: "--insecure-registry={{ kube_service_addresses }} --graph={{ docker_daemon_graph }} {{ docker_log_opts }}" +docker_options: > + --insecure-registry={{ kube_service_addresses }} --graph={{ docker_daemon_graph }} {{ docker_log_opts }} + {% if ansible_architecture == "aarch64" and ansible_os_family == "RedHat" %} + --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current + --default-runtime=docker-runc --exec-opt native.cgroupdriver=systemd + --userland-proxy-path=/usr/libexec/docker/docker-proxy-current --signature-verification=false + {% endif %} docker_bin_dir: "/usr/bin" ## If non-empty will override default system MounFlags value. diff --git a/roles/kubernetes/node/templates/kubelet.standard.env.j2 b/roles/kubernetes/node/templates/kubelet.standard.env.j2 index 83d657f7e..de32d996d 100644 --- a/roles/kubernetes/node/templates/kubelet.standard.env.j2 +++ b/roles/kubernetes/node/templates/kubelet.standard.env.j2 @@ -40,6 +40,9 @@ KUBELET_HOSTNAME="--hostname-override={{ kube_override_hostname }}" {% if kubelet_authorization_mode_webhook %} --authorization-mode=Webhook \ {% endif %} +{% if ansible_architecture == "aarch64" and ansible_os_family == "RedHat" %} +--cgroup-driver=systemd \ +{% endif %} --enforce-node-allocatable={{ kubelet_enforce_node_allocatable }} {% endif %}{% endset %} {# DNS settings for kubelet #} diff --git a/roles/kubespray-defaults/defaults/main.yaml b/roles/kubespray-defaults/defaults/main.yaml index adeb84dc6..d14b50105 100644 --- a/roles/kubespray-defaults/defaults/main.yaml +++ b/roles/kubespray-defaults/defaults/main.yaml @@ -144,7 +144,13 @@ docker_log_opts: "--log-opt max-size=50m --log-opt max-file=5" ## This string should be exactly as you wish it to appear. ## An obvious use case is allowing insecure-registry access ## to self hosted registries like so: -docker_options: "--insecure-registry={{ kube_service_addresses }} --graph={{ docker_daemon_graph }} {{ docker_log_opts }}" +docker_options: > + --insecure-registry={{ kube_service_addresses }} --graph={{ docker_daemon_graph }} {{ docker_log_opts }} + {% if ansible_architecture == "aarch64" and ansible_os_family == "RedHat" %} + --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current + --default-runtime=docker-runc --exec-opt native.cgroupdriver=systemd + --userland-proxy-path=/usr/libexec/docker/docker-proxy-current --signature-verification=false + {% endif %} ## If non-empty will override default system MounFlags value. ## This option takes a mount propagation flag: shared, slave