容器管理工具Containerd
nerdctl 實踐
nerdctl管理存儲
nerdctl命令創建容器的時候,可以使用-v選項將本地目錄掛載給容器實現數據持久化
示例:
[root@localhost ~]# mkdir /data
[root@localhost ~]# nerdctl run -d -v /data:/data busybox -- sleep infinity
341b6bb965f1c201a5092b004c888e5511619f42ac8e841fe13c26b045fca3ff
[root@localhost ~]# touch /data/f1
[root@localhost ~]# nerdctl exec busybox-341b6 -- ls /data
f1
nerdctl命令創建容器的時候,也可以用-v選項指定volume
[root@localhost ~]# nerdctl run -d -v /data busybox -- sleep infinity
5ffccac443bf4b85408a63e99d61678e53ae08d0d06c937910ec92c98bc575c6
[root@localhost ~]# nerdctl exec busybox-
busybox-341b6 busybox-5ffcc
[root@localhost ~]# nerdctl exec busybox-5ffcc -- touch /data/f2# 指定宿主機生成的目錄名為data
[root@localhost ~]# nerdctl run -d -v data:/data busybox -- sleep infinity
c1dbe3824e85e78d08918939b1e87e4ed9f3280de28ab0e4072d21ac506c3cc5
[root@localhost ~]# nerdctl exec busybox-c1dbe -- touch /data/f3[root@localhost ~]# ls /var/lib/nerdctl/1935db59/volumes/default/data/_data
f3
nerdctl管理命令空間
[root@localhost ~]# nerdctl namespace
Unrelated to Linux namespaces and Kubernetes namespacesUsage: nerdctl namespace [flags]Aliases: namespace, ns
Commands:create Create a new namespaceinspect Display detailed information on one or more namespaces.ls List containerd namespacesremove Remove one or more namespacesupdate Update labels for a namespaceFlags:-h, --help help for namespaceSee also 'nerdctl --help' for the global flags such as '--namespace', '--snapshotter', and '--cgroup-manager'.[root@localhost ~]# nerdctl namespace ls
NAME CONTAINERS IMAGES VOLUMES LABELS
default 8 5 3
myns 1 1 0
crictl實踐
crictl 命令
crictl 是遵循 Kubernetes CRI(Container Runtime Interface,容器運行時接口)規范的官方命令行工具,核心作用是連接用戶與節點上的容器運行時(如 containerd、CRI-O),實現對容器、鏡像的檢查與管理,是 Kubernetes 節點級運維的關鍵工具。
在 Kubernetes 集群中,crictl 的使用分為 “自動調用” 和 “手動操作” 兩種場景:
- 自動調用:kubelet 的 “隱形協作工具”
當執行kubectl run
、kubectl apply
等集群管理命令時,請求會經 API Server 下發至節點的 kubelet。此時 kubelet 會自動調用 crictl,通過 CRI 接口向容器運行時發送指令,完成 “拉取鏡像”“創建容器”“啟動容器” 等底層操作 —— 整個過程無需用戶干預,crictl 相當于 kubelet 與容器運行時之間的 “通信橋梁”。 - 手動操作:集群排障與底層查詢的 “直接入口”
日常運維中,手動執行 crictl 命令主要用于定位容器 / 鏡像相關故障或查詢底層資源狀態(尤其當kubectl
無法獲取底層詳情時)。例如:查看節點上所有鏡像(含 K8s Pod 依賴的鏡像)、排查 Pod 日志無法輸出的問題、檢查容器啟動失敗的底層原因等,是kubectl
工具的重要補充。
crictl 命令安裝
配置kubernetes源:
[root@localhost ~]# cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/repodata/repomd.xml.key
EOF
安裝CRI命令
[root@localhost ~]# yum install -y cri-tools
crictl命令配置
使用之前,先配置/etc/crictl.yml
示例:
配置crictl后端運行時使用containerd
[root@localhost ~]# vim /etc/crictl.yml
[root@localhost ~]# cat /etc/crictl.yml
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 5
debug: false
也可以通過命令進行配置:
[root@localhost ~]# crictl config runtime-endpoint unix:///run/containerd/containerd.sock
[root@localhost ~]# crictl config image-endpoint unix:///run/containerd/containerd.sock
crictl 命令實踐
[root@localhost ~]# crictl pull httpd
Image is up to date for sha256:65005131d37e90347c3259856d51f35c505d260c308f2b7d0fc020a841dd1220[root@localhost ~]# crictl images
IMAGE TAG IMAGE ID SIZE
docker.io/library/httpd latest 65005131d37e9 45.2MB
crictl 核心命令分類
crictl
作為遵循 Kubernetes CRI(容器運行時接口) 的命令行工具,命令圍繞鏡像、容器、Pod 及輔助操作展開:
- 鏡像操作:
images/image/img
:列出節點上所有鏡像,支持通過名稱、倉庫等過濾,還能顯示鏡像摘要等詳細信息;pull
:從鏡像倉庫拉取指定鏡像,可用于私有倉庫(需提前配置認證);inspecti
:返回一個或多個鏡像的狀態,幫助了解鏡像的元數據等情況;imagefsinfo
:返回鏡像文件系統的相關信息;rmi
:刪除一個或多個鏡像,也可結合--prune
清理未使用的鏡像(操作需謹慎)。
- 容器管理:
ps
:列出容器,默認顯示運行中的容器,加-a
可顯示所有容器(含已停止),還能按名稱、所屬 Pod 等過濾;create
:創建新容器;run
:在沙箱內運行新容器;inspect
:顯示一個或多個容器的狀態,包括容器的配置、運行狀態等詳細信息;info
:展示容器運行時的相關信息;attach
:連接到運行中的容器;exec
:在運行中的容器內執行命令;logs
:獲取容器的日志,支持實時跟蹤(-f
參數)、查看指定行數(--tail
參數)等;update
:更新一個或多個運行中的容器;stats
:列出容器的資源使用統計信息(如 CPU、內存等);checkpoint
:為一個或多個運行中的容器創建檢查點;start
:啟動一個或多個已創建的容器;stop
:停止一個或多個運行中的容器;rm
:刪除一個或多個容器,已停止的容器可直接刪除,運行中的容器需加-f
強制刪除(謹慎操作,可能影響 Pod)。
- Pod 相關操作:
pods
:列出節點上由 kubelet 管理的所有 Pod;runp
:運行新的 Pod;inspectp
:顯示一個或多個 Pod 的狀態,包含所屬容器、運行狀態等信息;statsp
:列出 Pod 的資源使用統計信息;port-forward
:將本地端口轉發到 Pod;stopp
:停止一個或多個運行中的 Pod;rmp
:刪除一個或多個 Pod。
- 輔助命令:
version
:顯示容器運行時的版本信息;config
:獲取和設置crictl
客戶端的配置選項;completion
:輸出 shell 自動補全代碼;help/h
:顯示命令列表或單個命令的幫助信息。
安裝OpenStack-Victoria
準備模板虛擬機
配置yum源
[root@localhost ~]# rm -rf /etc/yum.repos.d/*[root@localhost ~]# cat /etc/yum.repos.d/openstack.repo
[centos-openstack-victoria]
name=CentOS 8 - OpenStack victoria
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/cloud/x86_64/openstack-victoria/
gpgcheck=0
enabled=1[highavailability]
name=CentOS Stream 8 - HighAvailability
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/HighAvailability/x86_64/os/
gpgcheck=0
enabled=1[nfv]
name=CentOS Stream 8 - NFV
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/NFV/x86_64/os/
gpgcheck=0
enabled=1[rt]
name=CentOS Stream 8 - RT
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/RT/x86_64/os/
gpgcheck=0
enabled=1[resilientstorage]
name=CentOS Stream 8 - ResilientStorage
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/ResilientStorage/x86_64/os/
gpgcheck=0
enabled=1[extras-common]
name=CentOS Stream 8 - Extras packages
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/extras/x86_64/extras-common/
gpgcheck=0
enabled=1[extras]
name=CentOS Stream - Extras
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/extras/x86_64/os/
gpgcheck=0
enabled=1[centos-ceph-pacific]
name=CentOS - Ceph Pacific
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/storage/x86_64/ceph-pacific/
gpgcheck=0
enabled=1[centos-rabbitmq-38]
name=CentOS-8 - RabbitMQ 38
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/messaging/x86_64/rabbitmq-38/
gpgcheck=0
enabled=1[centos-nfv-openvswitch]
name=CentOS Stream 8 - NFV OpenvSwitch
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/nfv/x86_64/openvswitch-2/
gpgcheck=0
enabled=1[baseos]
name=CentOS Stream 8 - BaseOS
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/BaseOS/x86_64/os/
gpgcheck=0
enabled=1[appstream]
name=CentOS Stream 8 - AppStream
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/AppStream/x86_64/os/
gpgcheck=0
enabled=1[powertools]
name=CentOS Stream 8 - PowerTools
baseurl=https://mirrors.aliyun.com/centos-vault/8-stream/PowerTools/x86_64/os/
gpgcheck=0
enabled=1[root@localhost ~]# yum clean all
0 files removed
[root@localhost ~]#
[root@localhost ~]# yum makecache
安裝方便操作環境包及基礎軟件包
[root@localhost ~]# yum install -y bash-completion vim open-vm-tools net-tools chrony.x86_64[root@localhost ~]# source /usr/share/bash-completion/bash_completion
設置/etc/hosts
[root@localhost ~]# vim /etc/hosts
[root@localhost ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.108.10 controller
192.168.108.11 compute
關閉SELinux
[root@localhost ~]# sed -i '/^SELINUX=/cSELINUX=disabled' /etc/selinux/config
編輯網卡信息
[root@localhost ~]# cd /etc/sysconfig/network-scripts/
[root@localhost network-scripts]# vim ifcfg-ens160
[root@localhost network-scripts]# cat ifcfg-ens160
TYPE=Ethernet
BOOTPROTO=dhcp
NAME=ens160
DEVICE=ens160
ONBOOT=yes
清除密鑰信息
[root@localhost network-scripts]# cd /etc/ssh/
[root@localhost ssh]# rm -rf ssh_host_*
清除Machine ID
[root@localhost ssh]# cat /dev/null > /etc/machine-id
[root@localhost ssh]# cat /etc/machine-id
虛擬機模板準備完成
準備openstack節點
克隆出兩臺虛擬機controller和computer
配置主機名
controller:
[root@localhost ~]# hostnamectl set-hostname controller
compute:
[root@localhost ~]# hostnamectl set-hostname compute
配置IP地址
controller:
[root@localhost ~]# hostnamectl set-hostname controller
[root@localhost ~]# bash
[root@controller ~]#
[root@controller ~]#
[root@controller ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens160
[root@controller ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens160
TYPE=Ethernet
BOOTPROTO=none
NAME=ens160
DEVICE=ens160
ONBOOT=yes
IPADDR=192.168.108.10
NETMASK=255.255.255.0
GATEWAY=192.168.108.2
DNS1=192.168.108.2
[root@controller ~]# nmcli connection down ens160
[root@controller ~]# nmcli connection up ens160
compute:
[root@localhost ~]# hostnamectl set-hostname compute
[root@localhost ~]#
[root@localhost ~]# bash
[root@compute ~]#
[root@compute ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens160
[root@compute ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens160
TYPE=Ethernet
BOOTPROTO=none
NAME=ens160
DEVICE=ens160
ONBOOT=yes
IPADDR=192.168.108.11
NETMASK=255.255.255.0
GATEWAY=192.168.108.2
DNS1=192.168.108.2
[root@compute ~]# nmcli connection down ens160
[root@compute ~]# nmcli connection up ens160
配置NTP
controller:
[root@controller ~]# vim /etc/chrony.conf
# pool 2.centos.pool.ntp.org iburst
server ntp.aliyun.com iburst# Allow NTP client access from local network.
#allow 192.168.0.0/16
allow 192.168.108.0/24#啟動服務
[root@controller ~]# systemctl restart chronyd
[root@controller ~]# systemctl enable chronyd
compute:
[root@compute ~]# vim /etc/chrony.conf
# pool 2.centos.pool.ntp.org iburst
server controller iburst#啟動服務
[root@compute ~]# systemctl restart chronyd
[root@compute ~]# systemctl enable chronyd
安裝OpenStack和測試
控制節點安裝packstack
controller:
[root@controller ~]# yum install -y openstack-packstack
生成應答文件
controller:
[root@controller ~]# packstack --gen-answer-file=answers.txt
Packstack changed given value to required value /root/.ssh/id_rsa.pub
Additional information:* Parameter CONFIG_NEUTRON_L2_AGENT: You have chosen OVN Neutron backend. Note that this backend does not support the VPNaaS plugin. Geneve will be used as the encapsulation method for tenant networks
更改應答文件
controller:
[root@controller ~]# sed -i '/^CONFIG_COMPUTE_HOSTS=/cCONFIG_COMPUTE_HOSTS=192.168.108.10,192.168.108.11' answers.txt
[root@controller ~]# sed -i '/^CONFIG_PROVISION_DEMO=/cCONFIG_PROVISION_DEMO=n' answers.txt
[root@controller ~]# sed -i '/^CONFIG_HEAT_INSTALL=/cCONFIG_HEAT_INSTALL=y' answers.txt
[root@controller ~]# sed -i '/^CONFIG_NEUTRON_OVN_BRIDGE_IFACES=/cCONFIG_NEUTRON_OVN_BRIDGE_IFACES=br-ex:ens160' answers.txt
[root@controller ~]# sed -i.bak -r 's/(.+_PW)=[0-9a-z]+/\1=huawei/g' answers.txt
關閉NetworkManager
controller:
[root@controller ~]# systemctl stop NetworkManager; systemctl disable NetworkManager; systemctl mask NetworkManager
Removed /etc/systemd/system/multi-user.target.wants/NetworkManager.service.
Removed /etc/systemd/system/dbus-org.freedesktop.nm-dispatcher.service.
Removed /etc/systemd/system/network-online.target.wants/NetworkManager-wait-online.service.
Created symlink /etc/systemd/system/NetworkManager.service → /dev/null.
compute:
[root@compute ~]# systemctl stop NetworkManager; systemctl disable NetworkManager; systemctl mask NetworkManager
Removed /etc/systemd/system/multi-user.target.wants/NetworkManager.service.
Removed /etc/systemd/system/dbus-org.freedesktop.nm-dispatcher.service.
Removed /etc/systemd/system/network-online.target.wants/NetworkManager-wait-online.service.
Created symlink /etc/systemd/system/NetworkManager.service → /dev/null.
根據應答文件配置安裝openstack
controller:
[root@controller ~]# packstack --answer-file=answers.txt
Welcome to the Packstack setup utilityThe installation log file is available at: /var/tmp/packstack/20250912-145512-7_0z46p_/openstack-setup.logInstalling:
Clean Up [ DONE ]
Discovering ip protocol version [ DONE ]
root@192.168.108.11's password:
root@192.168.108.10's password:
Setting up ssh keys [ DONE ]
Preparing servers [ DONE ]
......
安裝完成
登錄測試
開啟network服務
controller:
[root@controller ~]# systemctl start network
[root@controller ~]# systemctl enable network
network.service is not a native service, redirecting to systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable network
[root@controller ~]#
compute:
[root@compute ~]# systemctl start network
[root@compute ~]# systemctl enable network
network.service is not a native service, redirecting to systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable network
[root@compute ~]#
配置OpenStack命令補全
# 只在controller里面寫入
[root@controller ~]# openstack complete >> /etc/bash_completion.d/complete
The 'openstack bgp speaker show dragents' CLI is deprecated and will be removed in the future. Use 'openstack bgp dragent list' CLI instead.
配置完成,安裝結束
compute:
[root@compute ~]# systemctl start network
[root@compute ~]# systemctl enable network
network.service is not a native service, redirecting to systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable network
[root@compute ~]#
配置OpenStack命令補全
# 只在controller里面寫入
[root@controller ~]# openstack complete >> /etc/bash_completion.d/complete
The 'openstack bgp speaker show dragents' CLI is deprecated and will be removed in the future. Use 'openstack bgp dragent list' CLI instead.
配置完成,安裝結束