API tools faq
paste
Guest User

Untitled

a guest
Jan 15th, 2020
366
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 480.21 KB | None | 0 0
raw download clone embed print report
  1. I0115 17:24:43.670426 302697 start.go:74] Version: machine-config-daemon-4.3.0-201910280117-126-g927a3079-dirty (927a3079840b596c77456cd181635ed3edb84254)
  2. I0115 17:24:43.672127 302697 start.go:84] Calling chroot("/rootfs")
  3. I0115 17:24:43.672243 302697 rpm-ostree.go:366] Running captured: rpm-ostree status --json
  4. I0115 17:24:44.195828 302697 daemon.go:210] Booted osImageURL: registry.svc.ci.openshift.org/origin/4.4-2020-01-14-215321@sha256:e16075809c80f31f3a7b2dc46e84a13bfe7b5c255280bd7cd05708a7333f34fd ()
  5. I0115 17:24:44.198558 302697 metrics.go:106] Registering Prometheus metrics
  6. I0115 17:24:44.198693 302697 metrics.go:111] Starting metrics listener on 127.0.0.1:8797
  7. I0115 17:24:44.201391 302697 update.go:1042] Starting to manage node: master-0
  8. I0115 17:24:44.205662 302697 rpm-ostree.go:366] Running captured: rpm-ostree status
  9. I0115 17:24:44.212625 302697 daemon.go:591] Detected a new login session: New session 1 of user core.
  10. I0115 17:24:44.212664 302697 daemon.go:592] Login access is discouraged! Applying annotation: machineconfiguration.openshift.io/ssh
  11. I0115 17:24:44.595133 302697 daemon.go:779] State: idle
  12. AutomaticUpdates: disabled
  13. Deployments:
  14. * pivot://registry.svc.ci.openshift.org/origin/4.4-2020-01-14-215321@sha256:e16075809c80f31f3a7b2dc46e84a13bfe7b5c255280bd7cd05708a7333f34fd
  15. CustomOrigin: Managed by machine-config-operator
  16. Timestamp: 2020-01-14T21:50:32Z
  17.  
  18. ostree://fedora:fedora/x86_64/coreos/stable
  19. Version: 31.20200113.3.1 (2020-01-14T00:20:15Z)
  20. Commit: f480038412cba26ab010d2cd5a09ddec736204a6e9faa8370edaa943cf33c932
  21. GPGSignature: Valid signature by 7D22D5867F2A4236474BF7B850CB390B3C3359C4
  22. I0115 17:24:44.595164 302697 rpm-ostree.go:366] Running captured: journalctl --list-boots
  23. I0115 17:24:44.600628 302697 daemon.go:786] journalctl --list-boots:
  24. -1 9e42051e695c4b498bbd71a8ad0ed391 Wed 2020-01-15 15:45:16 UTC—Wed 2020-01-15 15:50:57 UTC
  25. 0 fdf96aa48a6a4621bb88df0dfea4ec58 Wed 2020-01-15 15:51:06 UTC—Wed 2020-01-15 17:24:44 UTC
  26. I0115 17:24:44.600657 302697 daemon.go:529] Starting MachineConfigDaemon
  27. I0115 17:24:44.600756 302697 daemon.go:536] Enabling Kubelet Healthz Monitor
  28. W0115 17:24:44.600779 302697 daemon.go:557] Got an error from auxiliary tools: error: cannot apply annotation for SSH access due to: unable to update node "nil": node "master-0" not found
  29. I0115 17:25:07.477181 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  30. I0115 17:25:07.477208 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  31. I0115 17:25:07.482183 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  32. I0115 17:25:07.482212 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  33. I0115 17:25:07.492855 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  34. E0115 17:25:07.493880 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  35. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  36. # daemon, but in a TOML format that can be more easily modified and versioned.
  37. #
  38. # Please refer to crio.conf(5) for details of all configuration options.
  39.  
  40. # CRI-O supports partial configuration reload during runtime, which can be
  41. # done by sending SIGHUP to the running process. Currently supported options
  42. # are explicitly mentioned with: 'This option supports live configuration
  43. # reload'.
  44.  
  45. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  46. # located at /etc/containers/storage.conf. Modify this storage configuration if
  47. # you want to change the system's defaults. If you want to modify storage just
  48. # for CRI-O, you can change the storage configuration options here.
  49. [crio]
  50.  
  51. # Path to the "root directory". CRI-O stores all of its data, including
  52. # containers images, in this directory.
  53. #root = "/var/lib/containers/storage"
  54.  
  55. # Path to the "run directory". CRI-O stores all of its state in this directory.
  56. #runroot = "/run/user/1000"
  57.  
  58. # Storage driver used to manage the storage of images and containers. Please
  59. # refer to containers-storage.conf(5) to see all available storage drivers.
  60. #storage_driver = "overlay"
  61.  
  62. # List to pass options to the storage driver. Please refer to
  63. # containers-storage.conf(5) to see all available storage options.
  64. #storage_option = [
  65. #]
  66.  
  67. # The default log directory where all logs will go unless directly specified by
  68. # the kubelet. The log directory specified must be an absolute directory.
  69. # log_dir = "/var/log/crio/pods"
  70.  
  71. # Location for CRI-O to lay down the version file
  72. # version_file = "/var/lib/crio/version"
  73.  
  74. # The crio.api table contains settings for the kubelet/gRPC interface.
  75. [crio.api]
  76.  
  77. # Path to AF_LOCAL socket on which CRI-O will listen.
  78. # listen = "/var/run/crio/crio.sock"
  79.  
  80. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  81. # host_ip = ""
  82.  
  83. # IP address on which the stream server will listen.
  84. stream_address = ""
  85.  
  86. # The port on which the stream server will listen.
  87. stream_port = "10010"
  88.  
  89. # Enable encrypted TLS transport of the stream server.
  90. # stream_enable_tls = false
  91.  
  92. # Path to the x509 certificate file used to serve the encrypted stream. This
  93. # file can change, and CRI-O will automatically pick up the changes within 5
  94. # minutes.
  95. # stream_tls_cert = ""
  96.  
  97. # Path to the key file used to serve the encrypted stream. This file can
  98. # change and CRI-O will automatically pick up the changes within 5 minutes.
  99. # stream_tls_key = ""
  100.  
  101. # Path to the x509 CA(s) file used to verify and authenticate client
  102. # communication with the encrypted stream. This file can change and CRI-O will
  103. # automatically pick up the changes within 5 minutes.
  104. # stream_tls_ca = ""
  105.  
  106. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  107. # grpc_max_send_msg_size = 16777216
  108.  
  109. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  110. # grpc_max_recv_msg_size = 16777216
  111.  
  112. # The crio.runtime table contains settings pertaining to the OCI runtime used
  113. # and options for how to set up and manage the OCI runtime.
  114. [crio.runtime]
  115.  
  116. # A list of ulimits to be set in containers by default, specified as
  117. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  118. # "nofile=1024:2048"
  119. # If nothing is set here, settings will be inherited from the CRI-O daemon
  120. #default_ulimits = [
  121. #]
  122.  
  123. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  124. # The name is matched against the runtimes map below.
  125. # default_runtime = "runc"
  126.  
  127. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  128. # no_pivot = false
  129.  
  130. # Path to the conmon binary, used for monitoring the OCI runtime.
  131. # Will be searched for using $PATH if empty.
  132. conmon = "/usr/libexec/crio/conmon"
  133.  
  134. # Cgroup setting for conmon
  135. conmon_cgroup = "pod"
  136.  
  137. # Environment variable list for the conmon process, used for passing necessary
  138. # environment variables to conmon or the runtime.
  139. # conmon_env = [
  140. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  141. # ]
  142.  
  143. # If true, SELinux will be used for pod separation on the host.
  144. # selinux = true
  145.  
  146. # Path to the seccomp.json profile which is used as the default seccomp profile
  147. # for the runtime. If not specified, then the internal default seccomp profile
  148. # will be used.
  149. # seccomp_profile = "/etc/crio/seccomp.json"
  150.  
  151. # Used to change the name of the default AppArmor profile of CRI-O. The default
  152. # profile name is "crio-default-" followed by the version string of CRI-O.
  153. apparmor_profile = "crio-default"
  154.  
  155. # Cgroup management implementation used for the runtime.
  156. cgroup_manager = "systemd"
  157.  
  158. # List of default capabilities for containers. If it is empty or commented out,
  159. # only the capabilities defined in the containers json file by the user/kube
  160. # will be added.
  161. # default_capabilities = [
  162. # "CHOWN",
  163. # "DAC_OVERRIDE",
  164. # "FSETID",
  165. # "FOWNER",
  166. # "NET_RAW",
  167. # "SETGID",
  168. # "SETUID",
  169. # "SETPCAP",
  170. # "NET_BIND_SERVICE",
  171. # "SYS_CHROOT",
  172. # "KILL",
  173. # ]
  174.  
  175. # List of default sysctls. If it is empty or commented out, only the sysctls
  176. # defined in the container json file by the user/kube will be added.
  177. # default_sysctls = [
  178. # ]
  179.  
  180. # List of additional devices. specified as
  181. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  182. #If it is empty or commented out, only the devices
  183. # defined in the container json file by the user/kube will be added.
  184. # additional_devices = [
  185. # ]
  186.  
  187. # Path to OCI hooks directories for automatically executed hooks.
  188. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  189. # so we add /etc/containers/oci/hooks.d as well
  190. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  191. hooks_dir = [
  192. "/etc/containers/oci/hooks.d",
  193. ]
  194.  
  195. # List of default mounts for each container. **Deprecated:** this option will
  196. # be removed in future versions in favor of default_mounts_file.
  197. # default_mounts = [
  198. # "/usr/share/rhel/secrets:/run/secrets",
  199. # ]
  200.  
  201. # Path to the file specifying the defaults mounts for each container. The
  202. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  203. # its default mounts from the following two files:
  204. #
  205. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  206. # override file, where users can either add in their own default mounts, or
  207. # override the default mounts shipped with the package.
  208. #
  209. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  210. # mounts. If you want CRI-O to read from a different, specific mounts file,
  211. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  212. # only add mounts it finds in this file.
  213. #
  214. #default_mounts_file = ""
  215.  
  216. # Maximum number of processes allowed in a container.
  217. # pids_limit = 1024
  218.  
  219. # Maximum sized allowed for the container log file. Negative numbers indicate
  220. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  221. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  222. # limit is never exceeded.
  223. # log_size_max = -1
  224.  
  225. # Whether container output should be logged to journald in addition to the kuberentes log file
  226. # log_to_journald = false
  227.  
  228. # Path to directory in which container exit files are written to by conmon.
  229. # container_exits_dir = "/var/run/crio/exits"
  230.  
  231. # Path to directory for container attach sockets.
  232. # container_attach_socket_dir = "/var/run/crio"
  233.  
  234. # The prefix to use for the source of the bind mounts.
  235. # bind_mount_prefix = ""
  236.  
  237. # If set to true, all containers will run in read-only mode.
  238. # read_only = false
  239.  
  240. # Changes the verbosity of the logs based on the level it is set to. Options
  241. # are fatal, panic, error, warn, info, and debug. This option supports live
  242. # configuration reload.
  243. # log_level = "error"
  244.  
  245. # The UID mappings for the user namespace of each container. A range is
  246. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  247. # separated by comma.
  248. # uid_mappings = ""
  249.  
  250. # The GID mappings for the user namespace of each container. A range is
  251. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  252. # separated by comma.
  253. # gid_mappings = ""
  254.  
  255. # The minimal amount of time in seconds to wait before issuing a timeout
  256. # regarding the proper termination of the container.
  257. # ctr_stop_timeout = 0
  258.  
  259. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  260. # and manage its lifecycle.
  261. # manage_network_ns_lifecycle = false
  262.  
  263. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  264. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  265. # If no runtime_handler is provided, the runtime will be picked based on the level
  266. # of trust of the workload. Each entry in the table should follow the format:
  267. #
  268. #[crio.runtime.runtimes.runtime-handler]
  269. # runtime_path = "/path/to/the/executable"
  270. # runtime_type = "oci"
  271. # runtime_root = "/path/to/the/root"
  272. #
  273. # Where:
  274. # - runtime-handler: name used to identify the runtime
  275. # - runtime_path (optional, string): absolute path to the runtime executable in
  276. # the host filesystem. If omitted, the runtime-handler identifier should match
  277. # the runtime executable name, and the runtime executable should be placed
  278. # in $PATH.
  279. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  280. # omitted, an "oci" runtime is assumed.
  281. # - runtime_root (optional, string): root directory for storage of containers
  282. # state.
  283.  
  284.  
  285. # [crio.runtime.runtimes.runc]
  286. # runtime_path = ""
  287. # runtime_type = "oci"
  288. # runtime_root = "/run/runc"
  289.  
  290.  
  291. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  292. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  293. # surface and mitigating the consequences of containers breakout.
  294.  
  295. # Kata Containers with the default configured VMM
  296. #[crio.runtime.runtimes.kata-runtime]
  297.  
  298. # Kata Containers with the QEMU VMM
  299. #[crio.runtime.runtimes.kata-qemu]
  300.  
  301. # Kata Containers with the Firecracker VMM
  302. #[crio.runtime.runtimes.kata-fc]
  303.  
  304. # The crio.image table contains settings pertaining to the management of OCI images.
  305. #
  306. # CRI-O reads its configured registries defaults from the system wide
  307. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  308. # you want to modify just CRI-O, you can change the registries configuration in
  309. # this file. Otherwise, leave insecure_registries and registries commented out to
  310. # use the system's defaults from /etc/containers/registries.conf.
  311. [crio.image]
  312.  
  313. # Default transport for pulling images from a remote container storage.
  314. # default_transport = "docker://"
  315.  
  316. # The path to a file containing credentials necessary for pulling images from
  317. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  318. global_auth_file = "/var/lib/kubelet/config.json"
  319.  
  320. # The image used to instantiate infra containers.
  321. # This option supports live configuration reload.
  322. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  323.  
  324. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  325.  
  326. # The path to a file containing credentials specific for pulling the pause_image from
  327. # above. The file is similar to that of /var/lib/kubelet/config.json
  328. # This option supports live configuration reload.
  329. pause_image_auth_file = "/var/lib/kubelet/config.json"
  330.  
  331. # The command to run to have a container stay in the paused state.
  332. # This option supports live configuration reload.
  333. pause_command = "/usr/bin/pod"
  334.  
  335. # Path to the file which decides what sort of policy we use when deciding
  336. # whether or not to trust an image that we've pulled. It is not recommended that
  337. # this option be used, as the default behavior of using the system-wide default
  338. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  339. # refer to containers-policy.json(5) for more details.
  340. # signature_policy = ""
  341.  
  342. # List of registries to skip TLS verification for pulling images. Please
  343. # consider configuring the registries via /etc/containers/registries.conf before
  344. # changing them here.
  345. #insecure_registries = "[]"
  346.  
  347. # Controls how image volumes are handled. The valid values are mkdir, bind and
  348. # ignore; the latter will ignore volumes entirely.
  349. # image_volumes = "mkdir"
  350.  
  351. # List of registries to be used when pulling an unqualified image (e.g.,
  352. # "alpine:latest"). By default, registries is set to "docker.io" for
  353. # compatibility reasons. Depending on your workload and usecase you may add more
  354. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  355. # "registry.opensuse.org", etc.).
  356. #registries = [
  357. # ]
  358.  
  359.  
  360. # The crio.network table containers settings pertaining to the management of
  361. # CNI plugins.
  362. [crio.network]
  363.  
  364. # Path to the directory where CNI configuration files are located.
  365. # Note this default is changed from the RPM.
  366. network_dir = "/etc/kubernetes/cni/net.d/"
  367.  
  368. # Paths to directories where CNI plugin binaries are located.
  369. # Note this default is changed from the RPM.
  370. plugin_dirs = [
  371. "/var/lib/cni/bin",
  372. ]
  373.  
  374. # A necessary configuration for Prometheus based metrics retrieval
  375. [crio.metrics]
  376.  
  377. # Globally enable or disable metrics support.
  378. enable_metrics = true
  379.  
  380. # The port on which the metrics server will listen.
  381. metrics_port = 9537
  382.  
  383.  
  384. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  385.  
  386. # The path to a file containing credentials specific for pulling the pause_image from
  387. # above. The file is similar to that of /var/lib/kubelet/config.json
  388. # This option supports live configuration reload.
  389. pause_image_auth_file = "/var/lib/kubelet/config.json"
  390.  
  391. # The command to run to have a container stay in the paused state.
  392. # This option supports live configuration reload.
  393. pause_command = "/usr/bin/pod"
  394.  
  395. # Path to the file which decides what sort of policy we use when deciding
  396. # whether or not to trust an image that we've pulled. It is not recommended that
  397. # this option be used, as the default behavior of using the system-wide default
  398. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  399. # refer to containers-policy.json(5) for more details.
  400. # signature_policy = ""
  401.  
  402. # List of registries to skip TLS verification for pulling images. Please
  403. # consider configuring the registries via /etc/containers/registries.conf before
  404. # changing them here.
  405. #insecure_registries = "[]"
  406.  
  407. # Controls how image volumes are handled. The valid values are mkdir, bind and
  408. # ignore; the latter will ignore volumes entirely.
  409. # image_volumes = "mkdir"
  410.  
  411. # List of registries to be used when pulling an unqualified image (e.g.,
  412. # "alpine:latest"). By default, registries is set to "docker.io" for
  413. # compatibility reasons. Depending on your workload and usecase you may add more
  414. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  415. # "registry.opensuse.org", etc.).
  416. #registries = [
  417. # ]
  418.  
  419.  
  420. # The crio.network table containers settings pertaining to the management of
  421. # CNI plugins.
  422. [crio.network]
  423.  
  424. # Path to the directory where CNI configuration files are located.
  425. # Note this default is changed from the RPM.
  426. network_dir = "/etc/kubernetes/cni/net.d/"
  427.  
  428. # Paths to directories where CNI plugin binaries are located.
  429. # Note this default is changed from the RPM.
  430. plugin_dirs = [
  431. "/var/lib/cni/bin",
  432. ]
  433.  
  434. # A necessary configuration for Prometheus based metrics retrieval
  435. [crio.metrics]
  436.  
  437. # Globally enable or disable metrics support.
  438. enable_metrics = true
  439.  
  440. # The port on which the metrics server will listen.
  441. metrics_port = 9537
  442.  
  443.  
  444. E0115 17:25:07.493933 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  445. I0115 17:25:09.512590 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  446. I0115 17:25:09.512614 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  447. I0115 17:25:09.517472 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  448. I0115 17:25:09.517495 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  449. I0115 17:25:09.526581 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  450. E0115 17:25:09.527270 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  451. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  452. # daemon, but in a TOML format that can be more easily modified and versioned.
  453. #
  454. # Please refer to crio.conf(5) for details of all configuration options.
  455.  
  456. # CRI-O supports partial configuration reload during runtime, which can be
  457. # done by sending SIGHUP to the running process. Currently supported options
  458. # are explicitly mentioned with: 'This option supports live configuration
  459. # reload'.
  460.  
  461. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  462. # located at /etc/containers/storage.conf. Modify this storage configuration if
  463. # you want to change the system's defaults. If you want to modify storage just
  464. # for CRI-O, you can change the storage configuration options here.
  465. [crio]
  466.  
  467. # Path to the "root directory". CRI-O stores all of its data, including
  468. # containers images, in this directory.
  469. #root = "/var/lib/containers/storage"
  470.  
  471. # Path to the "run directory". CRI-O stores all of its state in this directory.
  472. #runroot = "/run/user/1000"
  473.  
  474. # Storage driver used to manage the storage of images and containers. Please
  475. # refer to containers-storage.conf(5) to see all available storage drivers.
  476. #storage_driver = "overlay"
  477.  
  478. # List to pass options to the storage driver. Please refer to
  479. # containers-storage.conf(5) to see all available storage options.
  480. #storage_option = [
  481. #]
  482.  
  483. # The default log directory where all logs will go unless directly specified by
  484. # the kubelet. The log directory specified must be an absolute directory.
  485. # log_dir = "/var/log/crio/pods"
  486.  
  487. # Location for CRI-O to lay down the version file
  488. # version_file = "/var/lib/crio/version"
  489.  
  490. # The crio.api table contains settings for the kubelet/gRPC interface.
  491. [crio.api]
  492.  
  493. # Path to AF_LOCAL socket on which CRI-O will listen.
  494. # listen = "/var/run/crio/crio.sock"
  495.  
  496. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  497. # host_ip = ""
  498.  
  499. # IP address on which the stream server will listen.
  500. stream_address = ""
  501.  
  502. # The port on which the stream server will listen.
  503. stream_port = "10010"
  504.  
  505. # Enable encrypted TLS transport of the stream server.
  506. # stream_enable_tls = false
  507.  
  508. # Path to the x509 certificate file used to serve the encrypted stream. This
  509. # file can change, and CRI-O will automatically pick up the changes within 5
  510. # minutes.
  511. # stream_tls_cert = ""
  512.  
  513. # Path to the key file used to serve the encrypted stream. This file can
  514. # change and CRI-O will automatically pick up the changes within 5 minutes.
  515. # stream_tls_key = ""
  516.  
  517. # Path to the x509 CA(s) file used to verify and authenticate client
  518. # communication with the encrypted stream. This file can change and CRI-O will
  519. # automatically pick up the changes within 5 minutes.
  520. # stream_tls_ca = ""
  521.  
  522. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  523. # grpc_max_send_msg_size = 16777216
  524.  
  525. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  526. # grpc_max_recv_msg_size = 16777216
  527.  
  528. # The crio.runtime table contains settings pertaining to the OCI runtime used
  529. # and options for how to set up and manage the OCI runtime.
  530. [crio.runtime]
  531.  
  532. # A list of ulimits to be set in containers by default, specified as
  533. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  534. # "nofile=1024:2048"
  535. # If nothing is set here, settings will be inherited from the CRI-O daemon
  536. #default_ulimits = [
  537. #]
  538.  
  539. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  540. # The name is matched against the runtimes map below.
  541. # default_runtime = "runc"
  542.  
  543. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  544. # no_pivot = false
  545.  
  546. # Path to the conmon binary, used for monitoring the OCI runtime.
  547. # Will be searched for using $PATH if empty.
  548. conmon = "/usr/libexec/crio/conmon"
  549.  
  550. # Cgroup setting for conmon
  551. conmon_cgroup = "pod"
  552.  
  553. # Environment variable list for the conmon process, used for passing necessary
  554. # environment variables to conmon or the runtime.
  555. # conmon_env = [
  556. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  557. # ]
  558.  
  559. # If true, SELinux will be used for pod separation on the host.
  560. # selinux = true
  561.  
  562. # Path to the seccomp.json profile which is used as the default seccomp profile
  563. # for the runtime. If not specified, then the internal default seccomp profile
  564. # will be used.
  565. # seccomp_profile = "/etc/crio/seccomp.json"
  566.  
  567. # Used to change the name of the default AppArmor profile of CRI-O. The default
  568. # profile name is "crio-default-" followed by the version string of CRI-O.
  569. apparmor_profile = "crio-default"
  570.  
  571. # Cgroup management implementation used for the runtime.
  572. cgroup_manager = "systemd"
  573.  
  574. # List of default capabilities for containers. If it is empty or commented out,
  575. # only the capabilities defined in the containers json file by the user/kube
  576. # will be added.
  577. # default_capabilities = [
  578. # "CHOWN",
  579. # "DAC_OVERRIDE",
  580. # "FSETID",
  581. # "FOWNER",
  582. # "NET_RAW",
  583. # "SETGID",
  584. # "SETUID",
  585. # "SETPCAP",
  586. # "NET_BIND_SERVICE",
  587. # "SYS_CHROOT",
  588. # "KILL",
  589. # ]
  590.  
  591. # List of default sysctls. If it is empty or commented out, only the sysctls
  592. # defined in the container json file by the user/kube will be added.
  593. # default_sysctls = [
  594. # ]
  595.  
  596. # List of additional devices. specified as
  597. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  598. #If it is empty or commented out, only the devices
  599. # defined in the container json file by the user/kube will be added.
  600. # additional_devices = [
  601. # ]
  602.  
  603. # Path to OCI hooks directories for automatically executed hooks.
  604. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  605. # so we add /etc/containers/oci/hooks.d as well
  606. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  607. hooks_dir = [
  608. "/etc/containers/oci/hooks.d",
  609. ]
  610.  
  611. # List of default mounts for each container. **Deprecated:** this option will
  612. # be removed in future versions in favor of default_mounts_file.
  613. # default_mounts = [
  614. # "/usr/share/rhel/secrets:/run/secrets",
  615. # ]
  616.  
  617. # Path to the file specifying the defaults mounts for each container. The
  618. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  619. # its default mounts from the following two files:
  620. #
  621. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  622. # override file, where users can either add in their own default mounts, or
  623. # override the default mounts shipped with the package.
  624. #
  625. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  626. # mounts. If you want CRI-O to read from a different, specific mounts file,
  627. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  628. # only add mounts it finds in this file.
  629. #
  630. #default_mounts_file = ""
  631.  
  632. # Maximum number of processes allowed in a container.
  633. # pids_limit = 1024
  634.  
  635. # Maximum sized allowed for the container log file. Negative numbers indicate
  636. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  637. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  638. # limit is never exceeded.
  639. # log_size_max = -1
  640.  
  641. # Whether container output should be logged to journald in addition to the kuberentes log file
  642. # log_to_journald = false
  643.  
  644. # Path to directory in which container exit files are written to by conmon.
  645. # container_exits_dir = "/var/run/crio/exits"
  646.  
  647. # Path to directory for container attach sockets.
  648. # container_attach_socket_dir = "/var/run/crio"
  649.  
  650. # The prefix to use for the source of the bind mounts.
  651. # bind_mount_prefix = ""
  652.  
  653. # If set to true, all containers will run in read-only mode.
  654. # read_only = false
  655.  
  656. # Changes the verbosity of the logs based on the level it is set to. Options
  657. # are fatal, panic, error, warn, info, and debug. This option supports live
  658. # configuration reload.
  659. # log_level = "error"
  660.  
  661. # The UID mappings for the user namespace of each container. A range is
  662. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  663. # separated by comma.
  664. # uid_mappings = ""
  665.  
  666. # The GID mappings for the user namespace of each container. A range is
  667. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  668. # separated by comma.
  669. # gid_mappings = ""
  670.  
  671. # The minimal amount of time in seconds to wait before issuing a timeout
  672. # regarding the proper termination of the container.
  673. # ctr_stop_timeout = 0
  674.  
  675. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  676. # and manage its lifecycle.
  677. # manage_network_ns_lifecycle = false
  678.  
  679. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  680. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  681. # If no runtime_handler is provided, the runtime will be picked based on the level
  682. # of trust of the workload. Each entry in the table should follow the format:
  683. #
  684. #[crio.runtime.runtimes.runtime-handler]
  685. # runtime_path = "/path/to/the/executable"
  686. # runtime_type = "oci"
  687. # runtime_root = "/path/to/the/root"
  688. #
  689. # Where:
  690. # - runtime-handler: name used to identify the runtime
  691. # - runtime_path (optional, string): absolute path to the runtime executable in
  692. # the host filesystem. If omitted, the runtime-handler identifier should match
  693. # the runtime executable name, and the runtime executable should be placed
  694. # in $PATH.
  695. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  696. # omitted, an "oci" runtime is assumed.
  697. # - runtime_root (optional, string): root directory for storage of containers
  698. # state.
  699.  
  700.  
  701. # [crio.runtime.runtimes.runc]
  702. # runtime_path = ""
  703. # runtime_type = "oci"
  704. # runtime_root = "/run/runc"
  705.  
  706.  
  707. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  708. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  709. # surface and mitigating the consequences of containers breakout.
  710.  
  711. # Kata Containers with the default configured VMM
  712. #[crio.runtime.runtimes.kata-runtime]
  713.  
  714. # Kata Containers with the QEMU VMM
  715. #[crio.runtime.runtimes.kata-qemu]
  716.  
  717. # Kata Containers with the Firecracker VMM
  718. #[crio.runtime.runtimes.kata-fc]
  719.  
  720. # The crio.image table contains settings pertaining to the management of OCI images.
  721. #
  722. # CRI-O reads its configured registries defaults from the system wide
  723. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  724. # you want to modify just CRI-O, you can change the registries configuration in
  725. # this file. Otherwise, leave insecure_registries and registries commented out to
  726. # use the system's defaults from /etc/containers/registries.conf.
  727. [crio.image]
  728.  
  729. # Default transport for pulling images from a remote container storage.
  730. # default_transport = "docker://"
  731.  
  732. # The path to a file containing credentials necessary for pulling images from
  733. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  734. global_auth_file = "/var/lib/kubelet/config.json"
  735.  
  736. # The image used to instantiate infra containers.
  737. # This option supports live configuration reload.
  738. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  739.  
  740. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  741.  
  742. # The path to a file containing credentials specific for pulling the pause_image from
  743. # above. The file is similar to that of /var/lib/kubelet/config.json
  744. # This option supports live configuration reload.
  745. pause_image_auth_file = "/var/lib/kubelet/config.json"
  746.  
  747. # The command to run to have a container stay in the paused state.
  748. # This option supports live configuration reload.
  749. pause_command = "/usr/bin/pod"
  750.  
  751. # Path to the file which decides what sort of policy we use when deciding
  752. # whether or not to trust an image that we've pulled. It is not recommended that
  753. # this option be used, as the default behavior of using the system-wide default
  754. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  755. # refer to containers-policy.json(5) for more details.
  756. # signature_policy = ""
  757.  
  758. # List of registries to skip TLS verification for pulling images. Please
  759. # consider configuring the registries via /etc/containers/registries.conf before
  760. # changing them here.
  761. #insecure_registries = "[]"
  762.  
  763. # Controls how image volumes are handled. The valid values are mkdir, bind and
  764. # ignore; the latter will ignore volumes entirely.
  765. # image_volumes = "mkdir"
  766.  
  767. # List of registries to be used when pulling an unqualified image (e.g.,
  768. # "alpine:latest"). By default, registries is set to "docker.io" for
  769. # compatibility reasons. Depending on your workload and usecase you may add more
  770. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  771. # "registry.opensuse.org", etc.).
  772. #registries = [
  773. # ]
  774.  
  775.  
  776. # The crio.network table containers settings pertaining to the management of
  777. # CNI plugins.
  778. [crio.network]
  779.  
  780. # Path to the directory where CNI configuration files are located.
  781. # Note this default is changed from the RPM.
  782. network_dir = "/etc/kubernetes/cni/net.d/"
  783.  
  784. # Paths to directories where CNI plugin binaries are located.
  785. # Note this default is changed from the RPM.
  786. plugin_dirs = [
  787. "/var/lib/cni/bin",
  788. ]
  789.  
  790. # A necessary configuration for Prometheus based metrics retrieval
  791. [crio.metrics]
  792.  
  793. # Globally enable or disable metrics support.
  794. enable_metrics = true
  795.  
  796. # The port on which the metrics server will listen.
  797. metrics_port = 9537
  798.  
  799.  
  800. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  801.  
  802. # The path to a file containing credentials specific for pulling the pause_image from
  803. # above. The file is similar to that of /var/lib/kubelet/config.json
  804. # This option supports live configuration reload.
  805. pause_image_auth_file = "/var/lib/kubelet/config.json"
  806.  
  807. # The command to run to have a container stay in the paused state.
  808. # This option supports live configuration reload.
  809. pause_command = "/usr/bin/pod"
  810.  
  811. # Path to the file which decides what sort of policy we use when deciding
  812. # whether or not to trust an image that we've pulled. It is not recommended that
  813. # this option be used, as the default behavior of using the system-wide default
  814. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  815. # refer to containers-policy.json(5) for more details.
  816. # signature_policy = ""
  817.  
  818. # List of registries to skip TLS verification for pulling images. Please
  819. # consider configuring the registries via /etc/containers/registries.conf before
  820. # changing them here.
  821. #insecure_registries = "[]"
  822.  
  823. # Controls how image volumes are handled. The valid values are mkdir, bind and
  824. # ignore; the latter will ignore volumes entirely.
  825. # image_volumes = "mkdir"
  826.  
  827. # List of registries to be used when pulling an unqualified image (e.g.,
  828. # "alpine:latest"). By default, registries is set to "docker.io" for
  829. # compatibility reasons. Depending on your workload and usecase you may add more
  830. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  831. # "registry.opensuse.org", etc.).
  832. #registries = [
  833. # ]
  834.  
  835.  
  836. # The crio.network table containers settings pertaining to the management of
  837. # CNI plugins.
  838. [crio.network]
  839.  
  840. # Path to the directory where CNI configuration files are located.
  841. # Note this default is changed from the RPM.
  842. network_dir = "/etc/kubernetes/cni/net.d/"
  843.  
  844. # Paths to directories where CNI plugin binaries are located.
  845. # Note this default is changed from the RPM.
  846. plugin_dirs = [
  847. "/var/lib/cni/bin",
  848. ]
  849.  
  850. # A necessary configuration for Prometheus based metrics retrieval
  851. [crio.metrics]
  852.  
  853. # Globally enable or disable metrics support.
  854. enable_metrics = true
  855.  
  856. # The port on which the metrics server will listen.
  857. metrics_port = 9537
  858.  
  859.  
  860. E0115 17:25:09.527302 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  861. I0115 17:25:17.538856 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  862. I0115 17:25:17.538879 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  863. I0115 17:25:17.543601 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  864. I0115 17:25:17.543630 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  865. I0115 17:25:17.553449 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  866. E0115 17:25:17.554174 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  867. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  868. # daemon, but in a TOML format that can be more easily modified and versioned.
  869. #
  870. # Please refer to crio.conf(5) for details of all configuration options.
  871.  
  872. # CRI-O supports partial configuration reload during runtime, which can be
  873. # done by sending SIGHUP to the running process. Currently supported options
  874. # are explicitly mentioned with: 'This option supports live configuration
  875. # reload'.
  876.  
  877. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  878. # located at /etc/containers/storage.conf. Modify this storage configuration if
  879. # you want to change the system's defaults. If you want to modify storage just
  880. # for CRI-O, you can change the storage configuration options here.
  881. [crio]
  882.  
  883. # Path to the "root directory". CRI-O stores all of its data, including
  884. # containers images, in this directory.
  885. #root = "/var/lib/containers/storage"
  886.  
  887. # Path to the "run directory". CRI-O stores all of its state in this directory.
  888. #runroot = "/run/user/1000"
  889.  
  890. # Storage driver used to manage the storage of images and containers. Please
  891. # refer to containers-storage.conf(5) to see all available storage drivers.
  892. #storage_driver = "overlay"
  893.  
  894. # List to pass options to the storage driver. Please refer to
  895. # containers-storage.conf(5) to see all available storage options.
  896. #storage_option = [
  897. #]
  898.  
  899. # The default log directory where all logs will go unless directly specified by
  900. # the kubelet. The log directory specified must be an absolute directory.
  901. # log_dir = "/var/log/crio/pods"
  902.  
  903. # Location for CRI-O to lay down the version file
  904. # version_file = "/var/lib/crio/version"
  905.  
  906. # The crio.api table contains settings for the kubelet/gRPC interface.
  907. [crio.api]
  908.  
  909. # Path to AF_LOCAL socket on which CRI-O will listen.
  910. # listen = "/var/run/crio/crio.sock"
  911.  
  912. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  913. # host_ip = ""
  914.  
  915. # IP address on which the stream server will listen.
  916. stream_address = ""
  917.  
  918. # The port on which the stream server will listen.
  919. stream_port = "10010"
  920.  
  921. # Enable encrypted TLS transport of the stream server.
  922. # stream_enable_tls = false
  923.  
  924. # Path to the x509 certificate file used to serve the encrypted stream. This
  925. # file can change, and CRI-O will automatically pick up the changes within 5
  926. # minutes.
  927. # stream_tls_cert = ""
  928.  
  929. # Path to the key file used to serve the encrypted stream. This file can
  930. # change and CRI-O will automatically pick up the changes within 5 minutes.
  931. # stream_tls_key = ""
  932.  
  933. # Path to the x509 CA(s) file used to verify and authenticate client
  934. # communication with the encrypted stream. This file can change and CRI-O will
  935. # automatically pick up the changes within 5 minutes.
  936. # stream_tls_ca = ""
  937.  
  938. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  939. # grpc_max_send_msg_size = 16777216
  940.  
  941. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  942. # grpc_max_recv_msg_size = 16777216
  943.  
  944. # The crio.runtime table contains settings pertaining to the OCI runtime used
  945. # and options for how to set up and manage the OCI runtime.
  946. [crio.runtime]
  947.  
  948. # A list of ulimits to be set in containers by default, specified as
  949. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  950. # "nofile=1024:2048"
  951. # If nothing is set here, settings will be inherited from the CRI-O daemon
  952. #default_ulimits = [
  953. #]
  954.  
  955. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  956. # The name is matched against the runtimes map below.
  957. # default_runtime = "runc"
  958.  
  959. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  960. # no_pivot = false
  961.  
  962. # Path to the conmon binary, used for monitoring the OCI runtime.
  963. # Will be searched for using $PATH if empty.
  964. conmon = "/usr/libexec/crio/conmon"
  965.  
  966. # Cgroup setting for conmon
  967. conmon_cgroup = "pod"
  968.  
  969. # Environment variable list for the conmon process, used for passing necessary
  970. # environment variables to conmon or the runtime.
  971. # conmon_env = [
  972. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  973. # ]
  974.  
  975. # If true, SELinux will be used for pod separation on the host.
  976. # selinux = true
  977.  
  978. # Path to the seccomp.json profile which is used as the default seccomp profile
  979. # for the runtime. If not specified, then the internal default seccomp profile
  980. # will be used.
  981. # seccomp_profile = "/etc/crio/seccomp.json"
  982.  
  983. # Used to change the name of the default AppArmor profile of CRI-O. The default
  984. # profile name is "crio-default-" followed by the version string of CRI-O.
  985. apparmor_profile = "crio-default"
  986.  
  987. # Cgroup management implementation used for the runtime.
  988. cgroup_manager = "systemd"
  989.  
  990. # List of default capabilities for containers. If it is empty or commented out,
  991. # only the capabilities defined in the containers json file by the user/kube
  992. # will be added.
  993. # default_capabilities = [
  994. # "CHOWN",
  995. # "DAC_OVERRIDE",
  996. # "FSETID",
  997. # "FOWNER",
  998. # "NET_RAW",
  999. # "SETGID",
  1000. # "SETUID",
  1001. # "SETPCAP",
  1002. # "NET_BIND_SERVICE",
  1003. # "SYS_CHROOT",
  1004. # "KILL",
  1005. # ]
  1006.  
  1007. # List of default sysctls. If it is empty or commented out, only the sysctls
  1008. # defined in the container json file by the user/kube will be added.
  1009. # default_sysctls = [
  1010. # ]
  1011.  
  1012. # List of additional devices. specified as
  1013. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  1014. #If it is empty or commented out, only the devices
  1015. # defined in the container json file by the user/kube will be added.
  1016. # additional_devices = [
  1017. # ]
  1018.  
  1019. # Path to OCI hooks directories for automatically executed hooks.
  1020. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  1021. # so we add /etc/containers/oci/hooks.d as well
  1022. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  1023. hooks_dir = [
  1024. "/etc/containers/oci/hooks.d",
  1025. ]
  1026.  
  1027. # List of default mounts for each container. **Deprecated:** this option will
  1028. # be removed in future versions in favor of default_mounts_file.
  1029. # default_mounts = [
  1030. # "/usr/share/rhel/secrets:/run/secrets",
  1031. # ]
  1032.  
  1033. # Path to the file specifying the defaults mounts for each container. The
  1034. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  1035. # its default mounts from the following two files:
  1036. #
  1037. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  1038. # override file, where users can either add in their own default mounts, or
  1039. # override the default mounts shipped with the package.
  1040. #
  1041. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  1042. # mounts. If you want CRI-O to read from a different, specific mounts file,
  1043. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  1044. # only add mounts it finds in this file.
  1045. #
  1046. #default_mounts_file = ""
  1047.  
  1048. # Maximum number of processes allowed in a container.
  1049. # pids_limit = 1024
  1050.  
  1051. # Maximum sized allowed for the container log file. Negative numbers indicate
  1052. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  1053. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  1054. # limit is never exceeded.
  1055. # log_size_max = -1
  1056.  
  1057. # Whether container output should be logged to journald in addition to the kuberentes log file
  1058. # log_to_journald = false
  1059.  
  1060. # Path to directory in which container exit files are written to by conmon.
  1061. # container_exits_dir = "/var/run/crio/exits"
  1062.  
  1063. # Path to directory for container attach sockets.
  1064. # container_attach_socket_dir = "/var/run/crio"
  1065.  
  1066. # The prefix to use for the source of the bind mounts.
  1067. # bind_mount_prefix = ""
  1068.  
  1069. # If set to true, all containers will run in read-only mode.
  1070. # read_only = false
  1071.  
  1072. # Changes the verbosity of the logs based on the level it is set to. Options
  1073. # are fatal, panic, error, warn, info, and debug. This option supports live
  1074. # configuration reload.
  1075. # log_level = "error"
  1076.  
  1077. # The UID mappings for the user namespace of each container. A range is
  1078. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  1079. # separated by comma.
  1080. # uid_mappings = ""
  1081.  
  1082. # The GID mappings for the user namespace of each container. A range is
  1083. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  1084. # separated by comma.
  1085. # gid_mappings = ""
  1086.  
  1087. # The minimal amount of time in seconds to wait before issuing a timeout
  1088. # regarding the proper termination of the container.
  1089. # ctr_stop_timeout = 0
  1090.  
  1091. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  1092. # and manage its lifecycle.
  1093. # manage_network_ns_lifecycle = false
  1094.  
  1095. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  1096. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  1097. # If no runtime_handler is provided, the runtime will be picked based on the level
  1098. # of trust of the workload. Each entry in the table should follow the format:
  1099. #
  1100. #[crio.runtime.runtimes.runtime-handler]
  1101. # runtime_path = "/path/to/the/executable"
  1102. # runtime_type = "oci"
  1103. # runtime_root = "/path/to/the/root"
  1104. #
  1105. # Where:
  1106. # - runtime-handler: name used to identify the runtime
  1107. # - runtime_path (optional, string): absolute path to the runtime executable in
  1108. # the host filesystem. If omitted, the runtime-handler identifier should match
  1109. # the runtime executable name, and the runtime executable should be placed
  1110. # in $PATH.
  1111. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  1112. # omitted, an "oci" runtime is assumed.
  1113. # - runtime_root (optional, string): root directory for storage of containers
  1114. # state.
  1115.  
  1116.  
  1117. # [crio.runtime.runtimes.runc]
  1118. # runtime_path = ""
  1119. # runtime_type = "oci"
  1120. # runtime_root = "/run/runc"
  1121.  
  1122.  
  1123. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  1124. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  1125. # surface and mitigating the consequences of containers breakout.
  1126.  
  1127. # Kata Containers with the default configured VMM
  1128. #[crio.runtime.runtimes.kata-runtime]
  1129.  
  1130. # Kata Containers with the QEMU VMM
  1131. #[crio.runtime.runtimes.kata-qemu]
  1132.  
  1133. # Kata Containers with the Firecracker VMM
  1134. #[crio.runtime.runtimes.kata-fc]
  1135.  
  1136. # The crio.image table contains settings pertaining to the management of OCI images.
  1137. #
  1138. # CRI-O reads its configured registries defaults from the system wide
  1139. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  1140. # you want to modify just CRI-O, you can change the registries configuration in
  1141. # this file. Otherwise, leave insecure_registries and registries commented out to
  1142. # use the system's defaults from /etc/containers/registries.conf.
  1143. [crio.image]
  1144.  
  1145. # Default transport for pulling images from a remote container storage.
  1146. # default_transport = "docker://"
  1147.  
  1148. # The path to a file containing credentials necessary for pulling images from
  1149. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  1150. global_auth_file = "/var/lib/kubelet/config.json"
  1151.  
  1152. # The image used to instantiate infra containers.
  1153. # This option supports live configuration reload.
  1154. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  1155.  
  1156. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  1157.  
  1158. # The path to a file containing credentials specific for pulling the pause_image from
  1159. # above. The file is similar to that of /var/lib/kubelet/config.json
  1160. # This option supports live configuration reload.
  1161. pause_image_auth_file = "/var/lib/kubelet/config.json"
  1162.  
  1163. # The command to run to have a container stay in the paused state.
  1164. # This option supports live configuration reload.
  1165. pause_command = "/usr/bin/pod"
  1166.  
  1167. # Path to the file which decides what sort of policy we use when deciding
  1168. # whether or not to trust an image that we've pulled. It is not recommended that
  1169. # this option be used, as the default behavior of using the system-wide default
  1170. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  1171. # refer to containers-policy.json(5) for more details.
  1172. # signature_policy = ""
  1173.  
  1174. # List of registries to skip TLS verification for pulling images. Please
  1175. # consider configuring the registries via /etc/containers/registries.conf before
  1176. # changing them here.
  1177. #insecure_registries = "[]"
  1178.  
  1179. # Controls how image volumes are handled. The valid values are mkdir, bind and
  1180. # ignore; the latter will ignore volumes entirely.
  1181. # image_volumes = "mkdir"
  1182.  
  1183. # List of registries to be used when pulling an unqualified image (e.g.,
  1184. # "alpine:latest"). By default, registries is set to "docker.io" for
  1185. # compatibility reasons. Depending on your workload and usecase you may add more
  1186. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  1187. # "registry.opensuse.org", etc.).
  1188. #registries = [
  1189. # ]
  1190.  
  1191.  
  1192. # The crio.network table containers settings pertaining to the management of
  1193. # CNI plugins.
  1194. [crio.network]
  1195.  
  1196. # Path to the directory where CNI configuration files are located.
  1197. # Note this default is changed from the RPM.
  1198. network_dir = "/etc/kubernetes/cni/net.d/"
  1199.  
  1200. # Paths to directories where CNI plugin binaries are located.
  1201. # Note this default is changed from the RPM.
  1202. plugin_dirs = [
  1203. "/var/lib/cni/bin",
  1204. ]
  1205.  
  1206. # A necessary configuration for Prometheus based metrics retrieval
  1207. [crio.metrics]
  1208.  
  1209. # Globally enable or disable metrics support.
  1210. enable_metrics = true
  1211.  
  1212. # The port on which the metrics server will listen.
  1213. metrics_port = 9537
  1214.  
  1215.  
  1216. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  1217.  
  1218. # The path to a file containing credentials specific for pulling the pause_image from
  1219. # above. The file is similar to that of /var/lib/kubelet/config.json
  1220. # This option supports live configuration reload.
  1221. pause_image_auth_file = "/var/lib/kubelet/config.json"
  1222.  
  1223. # The command to run to have a container stay in the paused state.
  1224. # This option supports live configuration reload.
  1225. pause_command = "/usr/bin/pod"
  1226.  
  1227. # Path to the file which decides what sort of policy we use when deciding
  1228. # whether or not to trust an image that we've pulled. It is not recommended that
  1229. # this option be used, as the default behavior of using the system-wide default
  1230. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  1231. # refer to containers-policy.json(5) for more details.
  1232. # signature_policy = ""
  1233.  
  1234. # List of registries to skip TLS verification for pulling images. Please
  1235. # consider configuring the registries via /etc/containers/registries.conf before
  1236. # changing them here.
  1237. #insecure_registries = "[]"
  1238.  
  1239. # Controls how image volumes are handled. The valid values are mkdir, bind and
  1240. # ignore; the latter will ignore volumes entirely.
  1241. # image_volumes = "mkdir"
  1242.  
  1243. # List of registries to be used when pulling an unqualified image (e.g.,
  1244. # "alpine:latest"). By default, registries is set to "docker.io" for
  1245. # compatibility reasons. Depending on your workload and usecase you may add more
  1246. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  1247. # "registry.opensuse.org", etc.).
  1248. #registries = [
  1249. # ]
  1250.  
  1251.  
  1252. # The crio.network table containers settings pertaining to the management of
  1253. # CNI plugins.
  1254. [crio.network]
  1255.  
  1256. # Path to the directory where CNI configuration files are located.
  1257. # Note this default is changed from the RPM.
  1258. network_dir = "/etc/kubernetes/cni/net.d/"
  1259.  
  1260. # Paths to directories where CNI plugin binaries are located.
  1261. # Note this default is changed from the RPM.
  1262. plugin_dirs = [
  1263. "/var/lib/cni/bin",
  1264. ]
  1265.  
  1266. # A necessary configuration for Prometheus based metrics retrieval
  1267. [crio.metrics]
  1268.  
  1269. # Globally enable or disable metrics support.
  1270. enable_metrics = true
  1271.  
  1272. # The port on which the metrics server will listen.
  1273. metrics_port = 9537
  1274.  
  1275.  
  1276. E0115 17:25:17.554200 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  1277. I0115 17:25:33.565105 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  1278. I0115 17:25:33.565131 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  1279. I0115 17:25:33.569985 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  1280. I0115 17:25:33.570004 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  1281. I0115 17:25:33.580277 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  1282. E0115 17:25:33.580967 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  1283. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  1284. # daemon, but in a TOML format that can be more easily modified and versioned.
  1285. #
  1286. # Please refer to crio.conf(5) for details of all configuration options.
  1287.  
  1288. # CRI-O supports partial configuration reload during runtime, which can be
  1289. # done by sending SIGHUP to the running process. Currently supported options
  1290. # are explicitly mentioned with: 'This option supports live configuration
  1291. # reload'.
  1292.  
  1293. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  1294. # located at /etc/containers/storage.conf. Modify this storage configuration if
  1295. # you want to change the system's defaults. If you want to modify storage just
  1296. # for CRI-O, you can change the storage configuration options here.
  1297. [crio]
  1298.  
  1299. # Path to the "root directory". CRI-O stores all of its data, including
  1300. # containers images, in this directory.
  1301. #root = "/var/lib/containers/storage"
  1302.  
  1303. # Path to the "run directory". CRI-O stores all of its state in this directory.
  1304. #runroot = "/run/user/1000"
  1305.  
  1306. # Storage driver used to manage the storage of images and containers. Please
  1307. # refer to containers-storage.conf(5) to see all available storage drivers.
  1308. #storage_driver = "overlay"
  1309.  
  1310. # List to pass options to the storage driver. Please refer to
  1311. # containers-storage.conf(5) to see all available storage options.
  1312. #storage_option = [
  1313. #]
  1314.  
  1315. # The default log directory where all logs will go unless directly specified by
  1316. # the kubelet. The log directory specified must be an absolute directory.
  1317. # log_dir = "/var/log/crio/pods"
  1318.  
  1319. # Location for CRI-O to lay down the version file
  1320. # version_file = "/var/lib/crio/version"
  1321.  
  1322. # The crio.api table contains settings for the kubelet/gRPC interface.
  1323. [crio.api]
  1324.  
  1325. # Path to AF_LOCAL socket on which CRI-O will listen.
  1326. # listen = "/var/run/crio/crio.sock"
  1327.  
  1328. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  1329. # host_ip = ""
  1330.  
  1331. # IP address on which the stream server will listen.
  1332. stream_address = ""
  1333.  
  1334. # The port on which the stream server will listen.
  1335. stream_port = "10010"
  1336.  
  1337. # Enable encrypted TLS transport of the stream server.
  1338. # stream_enable_tls = false
  1339.  
  1340. # Path to the x509 certificate file used to serve the encrypted stream. This
  1341. # file can change, and CRI-O will automatically pick up the changes within 5
  1342. # minutes.
  1343. # stream_tls_cert = ""
  1344.  
  1345. # Path to the key file used to serve the encrypted stream. This file can
  1346. # change and CRI-O will automatically pick up the changes within 5 minutes.
  1347. # stream_tls_key = ""
  1348.  
  1349. # Path to the x509 CA(s) file used to verify and authenticate client
  1350. # communication with the encrypted stream. This file can change and CRI-O will
  1351. # automatically pick up the changes within 5 minutes.
  1352. # stream_tls_ca = ""
  1353.  
  1354. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  1355. # grpc_max_send_msg_size = 16777216
  1356.  
  1357. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  1358. # grpc_max_recv_msg_size = 16777216
  1359.  
  1360. # The crio.runtime table contains settings pertaining to the OCI runtime used
  1361. # and options for how to set up and manage the OCI runtime.
  1362. [crio.runtime]
  1363.  
  1364. # A list of ulimits to be set in containers by default, specified as
  1365. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  1366. # "nofile=1024:2048"
  1367. # If nothing is set here, settings will be inherited from the CRI-O daemon
  1368. #default_ulimits = [
  1369. #]
  1370.  
  1371. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  1372. # The name is matched against the runtimes map below.
  1373. # default_runtime = "runc"
  1374.  
  1375. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  1376. # no_pivot = false
  1377.  
  1378. # Path to the conmon binary, used for monitoring the OCI runtime.
  1379. # Will be searched for using $PATH if empty.
  1380. conmon = "/usr/libexec/crio/conmon"
  1381.  
  1382. # Cgroup setting for conmon
  1383. conmon_cgroup = "pod"
  1384.  
  1385. # Environment variable list for the conmon process, used for passing necessary
  1386. # environment variables to conmon or the runtime.
  1387. # conmon_env = [
  1388. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  1389. # ]
  1390.  
  1391. # If true, SELinux will be used for pod separation on the host.
  1392. # selinux = true
  1393.  
  1394. # Path to the seccomp.json profile which is used as the default seccomp profile
  1395. # for the runtime. If not specified, then the internal default seccomp profile
  1396. # will be used.
  1397. # seccomp_profile = "/etc/crio/seccomp.json"
  1398.  
  1399. # Used to change the name of the default AppArmor profile of CRI-O. The default
  1400. # profile name is "crio-default-" followed by the version string of CRI-O.
  1401. apparmor_profile = "crio-default"
  1402.  
  1403. # Cgroup management implementation used for the runtime.
  1404. cgroup_manager = "systemd"
  1405.  
  1406. # List of default capabilities for containers. If it is empty or commented out,
  1407. # only the capabilities defined in the containers json file by the user/kube
  1408. # will be added.
  1409. # default_capabilities = [
  1410. # "CHOWN",
  1411. # "DAC_OVERRIDE",
  1412. # "FSETID",
  1413. # "FOWNER",
  1414. # "NET_RAW",
  1415. # "SETGID",
  1416. # "SETUID",
  1417. # "SETPCAP",
  1418. # "NET_BIND_SERVICE",
  1419. # "SYS_CHROOT",
  1420. # "KILL",
  1421. # ]
  1422.  
  1423. # List of default sysctls. If it is empty or commented out, only the sysctls
  1424. # defined in the container json file by the user/kube will be added.
  1425. # default_sysctls = [
  1426. # ]
  1427.  
  1428. # List of additional devices. specified as
  1429. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  1430. #If it is empty or commented out, only the devices
  1431. # defined in the container json file by the user/kube will be added.
  1432. # additional_devices = [
  1433. # ]
  1434.  
  1435. # Path to OCI hooks directories for automatically executed hooks.
  1436. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  1437. # so we add /etc/containers/oci/hooks.d as well
  1438. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  1439. hooks_dir = [
  1440. "/etc/containers/oci/hooks.d",
  1441. ]
  1442.  
  1443. # List of default mounts for each container. **Deprecated:** this option will
  1444. # be removed in future versions in favor of default_mounts_file.
  1445. # default_mounts = [
  1446. # "/usr/share/rhel/secrets:/run/secrets",
  1447. # ]
  1448.  
  1449. # Path to the file specifying the defaults mounts for each container. The
  1450. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  1451. # its default mounts from the following two files:
  1452. #
  1453. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  1454. # override file, where users can either add in their own default mounts, or
  1455. # override the default mounts shipped with the package.
  1456. #
  1457. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  1458. # mounts. If you want CRI-O to read from a different, specific mounts file,
  1459. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  1460. # only add mounts it finds in this file.
  1461. #
  1462. #default_mounts_file = ""
  1463.  
  1464. # Maximum number of processes allowed in a container.
  1465. # pids_limit = 1024
  1466.  
  1467. # Maximum sized allowed for the container log file. Negative numbers indicate
  1468. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  1469. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  1470. # limit is never exceeded.
  1471. # log_size_max = -1
  1472.  
  1473. # Whether container output should be logged to journald in addition to the kuberentes log file
  1474. # log_to_journald = false
  1475.  
  1476. # Path to directory in which container exit files are written to by conmon.
  1477. # container_exits_dir = "/var/run/crio/exits"
  1478.  
  1479. # Path to directory for container attach sockets.
  1480. # container_attach_socket_dir = "/var/run/crio"
  1481.  
  1482. # The prefix to use for the source of the bind mounts.
  1483. # bind_mount_prefix = ""
  1484.  
  1485. # If set to true, all containers will run in read-only mode.
  1486. # read_only = false
  1487.  
  1488. # Changes the verbosity of the logs based on the level it is set to. Options
  1489. # are fatal, panic, error, warn, info, and debug. This option supports live
  1490. # configuration reload.
  1491. # log_level = "error"
  1492.  
  1493. # The UID mappings for the user namespace of each container. A range is
  1494. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  1495. # separated by comma.
  1496. # uid_mappings = ""
  1497.  
  1498. # The GID mappings for the user namespace of each container. A range is
  1499. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  1500. # separated by comma.
  1501. # gid_mappings = ""
  1502.  
  1503. # The minimal amount of time in seconds to wait before issuing a timeout
  1504. # regarding the proper termination of the container.
  1505. # ctr_stop_timeout = 0
  1506.  
  1507. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  1508. # and manage its lifecycle.
  1509. # manage_network_ns_lifecycle = false
  1510.  
  1511. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  1512. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  1513. # If no runtime_handler is provided, the runtime will be picked based on the level
  1514. # of trust of the workload. Each entry in the table should follow the format:
  1515. #
  1516. #[crio.runtime.runtimes.runtime-handler]
  1517. # runtime_path = "/path/to/the/executable"
  1518. # runtime_type = "oci"
  1519. # runtime_root = "/path/to/the/root"
  1520. #
  1521. # Where:
  1522. # - runtime-handler: name used to identify the runtime
  1523. # - runtime_path (optional, string): absolute path to the runtime executable in
  1524. # the host filesystem. If omitted, the runtime-handler identifier should match
  1525. # the runtime executable name, and the runtime executable should be placed
  1526. # in $PATH.
  1527. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  1528. # omitted, an "oci" runtime is assumed.
  1529. # - runtime_root (optional, string): root directory for storage of containers
  1530. # state.
  1531.  
  1532.  
  1533. # [crio.runtime.runtimes.runc]
  1534. # runtime_path = ""
  1535. # runtime_type = "oci"
  1536. # runtime_root = "/run/runc"
  1537.  
  1538.  
  1539. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  1540. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  1541. # surface and mitigating the consequences of containers breakout.
  1542.  
  1543. # Kata Containers with the default configured VMM
  1544. #[crio.runtime.runtimes.kata-runtime]
  1545.  
  1546. # Kata Containers with the QEMU VMM
  1547. #[crio.runtime.runtimes.kata-qemu]
  1548.  
  1549. # Kata Containers with the Firecracker VMM
  1550. #[crio.runtime.runtimes.kata-fc]
  1551.  
  1552. # The crio.image table contains settings pertaining to the management of OCI images.
  1553. #
  1554. # CRI-O reads its configured registries defaults from the system wide
  1555. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  1556. # you want to modify just CRI-O, you can change the registries configuration in
  1557. # this file. Otherwise, leave insecure_registries and registries commented out to
  1558. # use the system's defaults from /etc/containers/registries.conf.
  1559. [crio.image]
  1560.  
  1561. # Default transport for pulling images from a remote container storage.
  1562. # default_transport = "docker://"
  1563.  
  1564. # The path to a file containing credentials necessary for pulling images from
  1565. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  1566. global_auth_file = "/var/lib/kubelet/config.json"
  1567.  
  1568. # The image used to instantiate infra containers.
  1569. # This option supports live configuration reload.
  1570. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  1571.  
  1572. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  1573.  
  1574. # The path to a file containing credentials specific for pulling the pause_image from
  1575. # above. The file is similar to that of /var/lib/kubelet/config.json
  1576. # This option supports live configuration reload.
  1577. pause_image_auth_file = "/var/lib/kubelet/config.json"
  1578.  
  1579. # The command to run to have a container stay in the paused state.
  1580. # This option supports live configuration reload.
  1581. pause_command = "/usr/bin/pod"
  1582.  
  1583. # Path to the file which decides what sort of policy we use when deciding
  1584. # whether or not to trust an image that we've pulled. It is not recommended that
  1585. # this option be used, as the default behavior of using the system-wide default
  1586. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  1587. # refer to containers-policy.json(5) for more details.
  1588. # signature_policy = ""
  1589.  
  1590. # List of registries to skip TLS verification for pulling images. Please
  1591. # consider configuring the registries via /etc/containers/registries.conf before
  1592. # changing them here.
  1593. #insecure_registries = "[]"
  1594.  
  1595. # Controls how image volumes are handled. The valid values are mkdir, bind and
  1596. # ignore; the latter will ignore volumes entirely.
  1597. # image_volumes = "mkdir"
  1598.  
  1599. # List of registries to be used when pulling an unqualified image (e.g.,
  1600. # "alpine:latest"). By default, registries is set to "docker.io" for
  1601. # compatibility reasons. Depending on your workload and usecase you may add more
  1602. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  1603. # "registry.opensuse.org", etc.).
  1604. #registries = [
  1605. # ]
  1606.  
  1607.  
  1608. # The crio.network table containers settings pertaining to the management of
  1609. # CNI plugins.
  1610. [crio.network]
  1611.  
  1612. # Path to the directory where CNI configuration files are located.
  1613. # Note this default is changed from the RPM.
  1614. network_dir = "/etc/kubernetes/cni/net.d/"
  1615.  
  1616. # Paths to directories where CNI plugin binaries are located.
  1617. # Note this default is changed from the RPM.
  1618. plugin_dirs = [
  1619. "/var/lib/cni/bin",
  1620. ]
  1621.  
  1622. # A necessary configuration for Prometheus based metrics retrieval
  1623. [crio.metrics]
  1624.  
  1625. # Globally enable or disable metrics support.
  1626. enable_metrics = true
  1627.  
  1628. # The port on which the metrics server will listen.
  1629. metrics_port = 9537
  1630.  
  1631.  
  1632. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  1633.  
  1634. # The path to a file containing credentials specific for pulling the pause_image from
  1635. # above. The file is similar to that of /var/lib/kubelet/config.json
  1636. # This option supports live configuration reload.
  1637. pause_image_auth_file = "/var/lib/kubelet/config.json"
  1638.  
  1639. # The command to run to have a container stay in the paused state.
  1640. # This option supports live configuration reload.
  1641. pause_command = "/usr/bin/pod"
  1642.  
  1643. # Path to the file which decides what sort of policy we use when deciding
  1644. # whether or not to trust an image that we've pulled. It is not recommended that
  1645. # this option be used, as the default behavior of using the system-wide default
  1646. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  1647. # refer to containers-policy.json(5) for more details.
  1648. # signature_policy = ""
  1649.  
  1650. # List of registries to skip TLS verification for pulling images. Please
  1651. # consider configuring the registries via /etc/containers/registries.conf before
  1652. # changing them here.
  1653. #insecure_registries = "[]"
  1654.  
  1655. # Controls how image volumes are handled. The valid values are mkdir, bind and
  1656. # ignore; the latter will ignore volumes entirely.
  1657. # image_volumes = "mkdir"
  1658.  
  1659. # List of registries to be used when pulling an unqualified image (e.g.,
  1660. # "alpine:latest"). By default, registries is set to "docker.io" for
  1661. # compatibility reasons. Depending on your workload and usecase you may add more
  1662. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  1663. # "registry.opensuse.org", etc.).
  1664. #registries = [
  1665. # ]
  1666.  
  1667.  
  1668. # The crio.network table containers settings pertaining to the management of
  1669. # CNI plugins.
  1670. [crio.network]
  1671.  
  1672. # Path to the directory where CNI configuration files are located.
  1673. # Note this default is changed from the RPM.
  1674. network_dir = "/etc/kubernetes/cni/net.d/"
  1675.  
  1676. # Paths to directories where CNI plugin binaries are located.
  1677. # Note this default is changed from the RPM.
  1678. plugin_dirs = [
  1679. "/var/lib/cni/bin",
  1680. ]
  1681.  
  1682. # A necessary configuration for Prometheus based metrics retrieval
  1683. [crio.metrics]
  1684.  
  1685. # Globally enable or disable metrics support.
  1686. enable_metrics = true
  1687.  
  1688. # The port on which the metrics server will listen.
  1689. metrics_port = 9537
  1690.  
  1691.  
  1692. E0115 17:25:33.580994 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  1693. I0115 17:26:05.592388 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  1694. I0115 17:26:05.592420 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  1695. I0115 17:26:05.597271 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  1696. I0115 17:26:05.597294 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  1697. I0115 17:26:05.606854 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  1698. E0115 17:26:05.607648 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  1699. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  1700. # daemon, but in a TOML format that can be more easily modified and versioned.
  1701. #
  1702. # Please refer to crio.conf(5) for details of all configuration options.
  1703.  
  1704. # CRI-O supports partial configuration reload during runtime, which can be
  1705. # done by sending SIGHUP to the running process. Currently supported options
  1706. # are explicitly mentioned with: 'This option supports live configuration
  1707. # reload'.
  1708.  
  1709. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  1710. # located at /etc/containers/storage.conf. Modify this storage configuration if
  1711. # you want to change the system's defaults. If you want to modify storage just
  1712. # for CRI-O, you can change the storage configuration options here.
  1713. [crio]
  1714.  
  1715. # Path to the "root directory". CRI-O stores all of its data, including
  1716. # containers images, in this directory.
  1717. #root = "/var/lib/containers/storage"
  1718.  
  1719. # Path to the "run directory". CRI-O stores all of its state in this directory.
  1720. #runroot = "/run/user/1000"
  1721.  
  1722. # Storage driver used to manage the storage of images and containers. Please
  1723. # refer to containers-storage.conf(5) to see all available storage drivers.
  1724. #storage_driver = "overlay"
  1725.  
  1726. # List to pass options to the storage driver. Please refer to
  1727. # containers-storage.conf(5) to see all available storage options.
  1728. #storage_option = [
  1729. #]
  1730.  
  1731. # The default log directory where all logs will go unless directly specified by
  1732. # the kubelet. The log directory specified must be an absolute directory.
  1733. # log_dir = "/var/log/crio/pods"
  1734.  
  1735. # Location for CRI-O to lay down the version file
  1736. # version_file = "/var/lib/crio/version"
  1737.  
  1738. # The crio.api table contains settings for the kubelet/gRPC interface.
  1739. [crio.api]
  1740.  
  1741. # Path to AF_LOCAL socket on which CRI-O will listen.
  1742. # listen = "/var/run/crio/crio.sock"
  1743.  
  1744. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  1745. # host_ip = ""
  1746.  
  1747. # IP address on which the stream server will listen.
  1748. stream_address = ""
  1749.  
  1750. # The port on which the stream server will listen.
  1751. stream_port = "10010"
  1752.  
  1753. # Enable encrypted TLS transport of the stream server.
  1754. # stream_enable_tls = false
  1755.  
  1756. # Path to the x509 certificate file used to serve the encrypted stream. This
  1757. # file can change, and CRI-O will automatically pick up the changes within 5
  1758. # minutes.
  1759. # stream_tls_cert = ""
  1760.  
  1761. # Path to the key file used to serve the encrypted stream. This file can
  1762. # change and CRI-O will automatically pick up the changes within 5 minutes.
  1763. # stream_tls_key = ""
  1764.  
  1765. # Path to the x509 CA(s) file used to verify and authenticate client
  1766. # communication with the encrypted stream. This file can change and CRI-O will
  1767. # automatically pick up the changes within 5 minutes.
  1768. # stream_tls_ca = ""
  1769.  
  1770. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  1771. # grpc_max_send_msg_size = 16777216
  1772.  
  1773. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  1774. # grpc_max_recv_msg_size = 16777216
  1775.  
  1776. # The crio.runtime table contains settings pertaining to the OCI runtime used
  1777. # and options for how to set up and manage the OCI runtime.
  1778. [crio.runtime]
  1779.  
  1780. # A list of ulimits to be set in containers by default, specified as
  1781. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  1782. # "nofile=1024:2048"
  1783. # If nothing is set here, settings will be inherited from the CRI-O daemon
  1784. #default_ulimits = [
  1785. #]
  1786.  
  1787. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  1788. # The name is matched against the runtimes map below.
  1789. # default_runtime = "runc"
  1790.  
  1791. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  1792. # no_pivot = false
  1793.  
  1794. # Path to the conmon binary, used for monitoring the OCI runtime.
  1795. # Will be searched for using $PATH if empty.
  1796. conmon = "/usr/libexec/crio/conmon"
  1797.  
  1798. # Cgroup setting for conmon
  1799. conmon_cgroup = "pod"
  1800.  
  1801. # Environment variable list for the conmon process, used for passing necessary
  1802. # environment variables to conmon or the runtime.
  1803. # conmon_env = [
  1804. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  1805. # ]
  1806.  
  1807. # If true, SELinux will be used for pod separation on the host.
  1808. # selinux = true
  1809.  
  1810. # Path to the seccomp.json profile which is used as the default seccomp profile
  1811. # for the runtime. If not specified, then the internal default seccomp profile
  1812. # will be used.
  1813. # seccomp_profile = "/etc/crio/seccomp.json"
  1814.  
  1815. # Used to change the name of the default AppArmor profile of CRI-O. The default
  1816. # profile name is "crio-default-" followed by the version string of CRI-O.
  1817. apparmor_profile = "crio-default"
  1818.  
  1819. # Cgroup management implementation used for the runtime.
  1820. cgroup_manager = "systemd"
  1821.  
  1822. # List of default capabilities for containers. If it is empty or commented out,
  1823. # only the capabilities defined in the containers json file by the user/kube
  1824. # will be added.
  1825. # default_capabilities = [
  1826. # "CHOWN",
  1827. # "DAC_OVERRIDE",
  1828. # "FSETID",
  1829. # "FOWNER",
  1830. # "NET_RAW",
  1831. # "SETGID",
  1832. # "SETUID",
  1833. # "SETPCAP",
  1834. # "NET_BIND_SERVICE",
  1835. # "SYS_CHROOT",
  1836. # "KILL",
  1837. # ]
  1838.  
  1839. # List of default sysctls. If it is empty or commented out, only the sysctls
  1840. # defined in the container json file by the user/kube will be added.
  1841. # default_sysctls = [
  1842. # ]
  1843.  
  1844. # List of additional devices. specified as
  1845. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  1846. #If it is empty or commented out, only the devices
  1847. # defined in the container json file by the user/kube will be added.
  1848. # additional_devices = [
  1849. # ]
  1850.  
  1851. # Path to OCI hooks directories for automatically executed hooks.
  1852. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  1853. # so we add /etc/containers/oci/hooks.d as well
  1854. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  1855. hooks_dir = [
  1856. "/etc/containers/oci/hooks.d",
  1857. ]
  1858.  
  1859. # List of default mounts for each container. **Deprecated:** this option will
  1860. # be removed in future versions in favor of default_mounts_file.
  1861. # default_mounts = [
  1862. # "/usr/share/rhel/secrets:/run/secrets",
  1863. # ]
  1864.  
  1865. # Path to the file specifying the defaults mounts for each container. The
  1866. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  1867. # its default mounts from the following two files:
  1868. #
  1869. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  1870. # override file, where users can either add in their own default mounts, or
  1871. # override the default mounts shipped with the package.
  1872. #
  1873. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  1874. # mounts. If you want CRI-O to read from a different, specific mounts file,
  1875. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  1876. # only add mounts it finds in this file.
  1877. #
  1878. #default_mounts_file = ""
  1879.  
  1880. # Maximum number of processes allowed in a container.
  1881. # pids_limit = 1024
  1882.  
  1883. # Maximum sized allowed for the container log file. Negative numbers indicate
  1884. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  1885. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  1886. # limit is never exceeded.
  1887. # log_size_max = -1
  1888.  
  1889. # Whether container output should be logged to journald in addition to the kuberentes log file
  1890. # log_to_journald = false
  1891.  
  1892. # Path to directory in which container exit files are written to by conmon.
  1893. # container_exits_dir = "/var/run/crio/exits"
  1894.  
  1895. # Path to directory for container attach sockets.
  1896. # container_attach_socket_dir = "/var/run/crio"
  1897.  
  1898. # The prefix to use for the source of the bind mounts.
  1899. # bind_mount_prefix = ""
  1900.  
  1901. # If set to true, all containers will run in read-only mode.
  1902. # read_only = false
  1903.  
  1904. # Changes the verbosity of the logs based on the level it is set to. Options
  1905. # are fatal, panic, error, warn, info, and debug. This option supports live
  1906. # configuration reload.
  1907. # log_level = "error"
  1908.  
  1909. # The UID mappings for the user namespace of each container. A range is
  1910. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  1911. # separated by comma.
  1912. # uid_mappings = ""
  1913.  
  1914. # The GID mappings for the user namespace of each container. A range is
  1915. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  1916. # separated by comma.
  1917. # gid_mappings = ""
  1918.  
  1919. # The minimal amount of time in seconds to wait before issuing a timeout
  1920. # regarding the proper termination of the container.
  1921. # ctr_stop_timeout = 0
  1922.  
  1923. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  1924. # and manage its lifecycle.
  1925. # manage_network_ns_lifecycle = false
  1926.  
  1927. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  1928. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  1929. # If no runtime_handler is provided, the runtime will be picked based on the level
  1930. # of trust of the workload. Each entry in the table should follow the format:
  1931. #
  1932. #[crio.runtime.runtimes.runtime-handler]
  1933. # runtime_path = "/path/to/the/executable"
  1934. # runtime_type = "oci"
  1935. # runtime_root = "/path/to/the/root"
  1936. #
  1937. # Where:
  1938. # - runtime-handler: name used to identify the runtime
  1939. # - runtime_path (optional, string): absolute path to the runtime executable in
  1940. # the host filesystem. If omitted, the runtime-handler identifier should match
  1941. # the runtime executable name, and the runtime executable should be placed
  1942. # in $PATH.
  1943. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  1944. # omitted, an "oci" runtime is assumed.
  1945. # - runtime_root (optional, string): root directory for storage of containers
  1946. # state.
  1947.  
  1948.  
  1949. # [crio.runtime.runtimes.runc]
  1950. # runtime_path = ""
  1951. # runtime_type = "oci"
  1952. # runtime_root = "/run/runc"
  1953.  
  1954.  
  1955. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  1956. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  1957. # surface and mitigating the consequences of containers breakout.
  1958.  
  1959. # Kata Containers with the default configured VMM
  1960. #[crio.runtime.runtimes.kata-runtime]
  1961.  
  1962. # Kata Containers with the QEMU VMM
  1963. #[crio.runtime.runtimes.kata-qemu]
  1964.  
  1965. # Kata Containers with the Firecracker VMM
  1966. #[crio.runtime.runtimes.kata-fc]
  1967.  
  1968. # The crio.image table contains settings pertaining to the management of OCI images.
  1969. #
  1970. # CRI-O reads its configured registries defaults from the system wide
  1971. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  1972. # you want to modify just CRI-O, you can change the registries configuration in
  1973. # this file. Otherwise, leave insecure_registries and registries commented out to
  1974. # use the system's defaults from /etc/containers/registries.conf.
  1975. [crio.image]
  1976.  
  1977. # Default transport for pulling images from a remote container storage.
  1978. # default_transport = "docker://"
  1979.  
  1980. # The path to a file containing credentials necessary for pulling images from
  1981. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  1982. global_auth_file = "/var/lib/kubelet/config.json"
  1983.  
  1984. # The image used to instantiate infra containers.
  1985. # This option supports live configuration reload.
  1986. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  1987.  
  1988. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  1989.  
  1990. # The path to a file containing credentials specific for pulling the pause_image from
  1991. # above. The file is similar to that of /var/lib/kubelet/config.json
  1992. # This option supports live configuration reload.
  1993. pause_image_auth_file = "/var/lib/kubelet/config.json"
  1994.  
  1995. # The command to run to have a container stay in the paused state.
  1996. # This option supports live configuration reload.
  1997. pause_command = "/usr/bin/pod"
  1998.  
  1999. # Path to the file which decides what sort of policy we use when deciding
  2000. # whether or not to trust an image that we've pulled. It is not recommended that
  2001. # this option be used, as the default behavior of using the system-wide default
  2002. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  2003. # refer to containers-policy.json(5) for more details.
  2004. # signature_policy = ""
  2005.  
  2006. # List of registries to skip TLS verification for pulling images. Please
  2007. # consider configuring the registries via /etc/containers/registries.conf before
  2008. # changing them here.
  2009. #insecure_registries = "[]"
  2010.  
  2011. # Controls how image volumes are handled. The valid values are mkdir, bind and
  2012. # ignore; the latter will ignore volumes entirely.
  2013. # image_volumes = "mkdir"
  2014.  
  2015. # List of registries to be used when pulling an unqualified image (e.g.,
  2016. # "alpine:latest"). By default, registries is set to "docker.io" for
  2017. # compatibility reasons. Depending on your workload and usecase you may add more
  2018. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  2019. # "registry.opensuse.org", etc.).
  2020. #registries = [
  2021. # ]
  2022.  
  2023.  
  2024. # The crio.network table containers settings pertaining to the management of
  2025. # CNI plugins.
  2026. [crio.network]
  2027.  
  2028. # Path to the directory where CNI configuration files are located.
  2029. # Note this default is changed from the RPM.
  2030. network_dir = "/etc/kubernetes/cni/net.d/"
  2031.  
  2032. # Paths to directories where CNI plugin binaries are located.
  2033. # Note this default is changed from the RPM.
  2034. plugin_dirs = [
  2035. "/var/lib/cni/bin",
  2036. ]
  2037.  
  2038. # A necessary configuration for Prometheus based metrics retrieval
  2039. [crio.metrics]
  2040.  
  2041. # Globally enable or disable metrics support.
  2042. enable_metrics = true
  2043.  
  2044. # The port on which the metrics server will listen.
  2045. metrics_port = 9537
  2046.  
  2047.  
  2048. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  2049.  
  2050. # The path to a file containing credentials specific for pulling the pause_image from
  2051. # above. The file is similar to that of /var/lib/kubelet/config.json
  2052. # This option supports live configuration reload.
  2053. pause_image_auth_file = "/var/lib/kubelet/config.json"
  2054.  
  2055. # The command to run to have a container stay in the paused state.
  2056. # This option supports live configuration reload.
  2057. pause_command = "/usr/bin/pod"
  2058.  
  2059. # Path to the file which decides what sort of policy we use when deciding
  2060. # whether or not to trust an image that we've pulled. It is not recommended that
  2061. # this option be used, as the default behavior of using the system-wide default
  2062. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  2063. # refer to containers-policy.json(5) for more details.
  2064. # signature_policy = ""
  2065.  
  2066. # List of registries to skip TLS verification for pulling images. Please
  2067. # consider configuring the registries via /etc/containers/registries.conf before
  2068. # changing them here.
  2069. #insecure_registries = "[]"
  2070.  
  2071. # Controls how image volumes are handled. The valid values are mkdir, bind and
  2072. # ignore; the latter will ignore volumes entirely.
  2073. # image_volumes = "mkdir"
  2074.  
  2075. # List of registries to be used when pulling an unqualified image (e.g.,
  2076. # "alpine:latest"). By default, registries is set to "docker.io" for
  2077. # compatibility reasons. Depending on your workload and usecase you may add more
  2078. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  2079. # "registry.opensuse.org", etc.).
  2080. #registries = [
  2081. # ]
  2082.  
  2083.  
  2084. # The crio.network table containers settings pertaining to the management of
  2085. # CNI plugins.
  2086. [crio.network]
  2087.  
  2088. # Path to the directory where CNI configuration files are located.
  2089. # Note this default is changed from the RPM.
  2090. network_dir = "/etc/kubernetes/cni/net.d/"
  2091.  
  2092. # Paths to directories where CNI plugin binaries are located.
  2093. # Note this default is changed from the RPM.
  2094. plugin_dirs = [
  2095. "/var/lib/cni/bin",
  2096. ]
  2097.  
  2098. # A necessary configuration for Prometheus based metrics retrieval
  2099. [crio.metrics]
  2100.  
  2101. # Globally enable or disable metrics support.
  2102. enable_metrics = true
  2103.  
  2104. # The port on which the metrics server will listen.
  2105. metrics_port = 9537
  2106.  
  2107.  
  2108. E0115 17:26:05.607694 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2109. I0115 17:27:05.619669 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2110. I0115 17:27:05.619772 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  2111. I0115 17:27:05.625101 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  2112. I0115 17:27:05.625124 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  2113. I0115 17:27:05.634145 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2114. E0115 17:27:05.634849 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  2115. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  2116. # daemon, but in a TOML format that can be more easily modified and versioned.
  2117. #
  2118. # Please refer to crio.conf(5) for details of all configuration options.
  2119.  
  2120. # CRI-O supports partial configuration reload during runtime, which can be
  2121. # done by sending SIGHUP to the running process. Currently supported options
  2122. # are explicitly mentioned with: 'This option supports live configuration
  2123. # reload'.
  2124.  
  2125. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  2126. # located at /etc/containers/storage.conf. Modify this storage configuration if
  2127. # you want to change the system's defaults. If you want to modify storage just
  2128. # for CRI-O, you can change the storage configuration options here.
  2129. [crio]
  2130.  
  2131. # Path to the "root directory". CRI-O stores all of its data, including
  2132. # containers images, in this directory.
  2133. #root = "/var/lib/containers/storage"
  2134.  
  2135. # Path to the "run directory". CRI-O stores all of its state in this directory.
  2136. #runroot = "/run/user/1000"
  2137.  
  2138. # Storage driver used to manage the storage of images and containers. Please
  2139. # refer to containers-storage.conf(5) to see all available storage drivers.
  2140. #storage_driver = "overlay"
  2141.  
  2142. # List to pass options to the storage driver. Please refer to
  2143. # containers-storage.conf(5) to see all available storage options.
  2144. #storage_option = [
  2145. #]
  2146.  
  2147. # The default log directory where all logs will go unless directly specified by
  2148. # the kubelet. The log directory specified must be an absolute directory.
  2149. # log_dir = "/var/log/crio/pods"
  2150.  
  2151. # Location for CRI-O to lay down the version file
  2152. # version_file = "/var/lib/crio/version"
  2153.  
  2154. # The crio.api table contains settings for the kubelet/gRPC interface.
  2155. [crio.api]
  2156.  
  2157. # Path to AF_LOCAL socket on which CRI-O will listen.
  2158. # listen = "/var/run/crio/crio.sock"
  2159.  
  2160. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  2161. # host_ip = ""
  2162.  
  2163. # IP address on which the stream server will listen.
  2164. stream_address = ""
  2165.  
  2166. # The port on which the stream server will listen.
  2167. stream_port = "10010"
  2168.  
  2169. # Enable encrypted TLS transport of the stream server.
  2170. # stream_enable_tls = false
  2171.  
  2172. # Path to the x509 certificate file used to serve the encrypted stream. This
  2173. # file can change, and CRI-O will automatically pick up the changes within 5
  2174. # minutes.
  2175. # stream_tls_cert = ""
  2176.  
  2177. # Path to the key file used to serve the encrypted stream. This file can
  2178. # change and CRI-O will automatically pick up the changes within 5 minutes.
  2179. # stream_tls_key = ""
  2180.  
  2181. # Path to the x509 CA(s) file used to verify and authenticate client
  2182. # communication with the encrypted stream. This file can change and CRI-O will
  2183. # automatically pick up the changes within 5 minutes.
  2184. # stream_tls_ca = ""
  2185.  
  2186. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  2187. # grpc_max_send_msg_size = 16777216
  2188.  
  2189. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  2190. # grpc_max_recv_msg_size = 16777216
  2191.  
  2192. # The crio.runtime table contains settings pertaining to the OCI runtime used
  2193. # and options for how to set up and manage the OCI runtime.
  2194. [crio.runtime]
  2195.  
  2196. # A list of ulimits to be set in containers by default, specified as
  2197. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  2198. # "nofile=1024:2048"
  2199. # If nothing is set here, settings will be inherited from the CRI-O daemon
  2200. #default_ulimits = [
  2201. #]
  2202.  
  2203. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  2204. # The name is matched against the runtimes map below.
  2205. # default_runtime = "runc"
  2206.  
  2207. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  2208. # no_pivot = false
  2209.  
  2210. # Path to the conmon binary, used for monitoring the OCI runtime.
  2211. # Will be searched for using $PATH if empty.
  2212. conmon = "/usr/libexec/crio/conmon"
  2213.  
  2214. # Cgroup setting for conmon
  2215. conmon_cgroup = "pod"
  2216.  
  2217. # Environment variable list for the conmon process, used for passing necessary
  2218. # environment variables to conmon or the runtime.
  2219. # conmon_env = [
  2220. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  2221. # ]
  2222.  
  2223. # If true, SELinux will be used for pod separation on the host.
  2224. # selinux = true
  2225.  
  2226. # Path to the seccomp.json profile which is used as the default seccomp profile
  2227. # for the runtime. If not specified, then the internal default seccomp profile
  2228. # will be used.
  2229. # seccomp_profile = "/etc/crio/seccomp.json"
  2230.  
  2231. # Used to change the name of the default AppArmor profile of CRI-O. The default
  2232. # profile name is "crio-default-" followed by the version string of CRI-O.
  2233. apparmor_profile = "crio-default"
  2234.  
  2235. # Cgroup management implementation used for the runtime.
  2236. cgroup_manager = "systemd"
  2237.  
  2238. # List of default capabilities for containers. If it is empty or commented out,
  2239. # only the capabilities defined in the containers json file by the user/kube
  2240. # will be added.
  2241. # default_capabilities = [
  2242. # "CHOWN",
  2243. # "DAC_OVERRIDE",
  2244. # "FSETID",
  2245. # "FOWNER",
  2246. # "NET_RAW",
  2247. # "SETGID",
  2248. # "SETUID",
  2249. # "SETPCAP",
  2250. # "NET_BIND_SERVICE",
  2251. # "SYS_CHROOT",
  2252. # "KILL",
  2253. # ]
  2254.  
  2255. # List of default sysctls. If it is empty or commented out, only the sysctls
  2256. # defined in the container json file by the user/kube will be added.
  2257. # default_sysctls = [
  2258. # ]
  2259.  
  2260. # List of additional devices. specified as
  2261. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  2262. #If it is empty or commented out, only the devices
  2263. # defined in the container json file by the user/kube will be added.
  2264. # additional_devices = [
  2265. # ]
  2266.  
  2267. # Path to OCI hooks directories for automatically executed hooks.
  2268. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  2269. # so we add /etc/containers/oci/hooks.d as well
  2270. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  2271. hooks_dir = [
  2272. "/etc/containers/oci/hooks.d",
  2273. ]
  2274.  
  2275. # List of default mounts for each container. **Deprecated:** this option will
  2276. # be removed in future versions in favor of default_mounts_file.
  2277. # default_mounts = [
  2278. # "/usr/share/rhel/secrets:/run/secrets",
  2279. # ]
  2280.  
  2281. # Path to the file specifying the defaults mounts for each container. The
  2282. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  2283. # its default mounts from the following two files:
  2284. #
  2285. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  2286. # override file, where users can either add in their own default mounts, or
  2287. # override the default mounts shipped with the package.
  2288. #
  2289. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  2290. # mounts. If you want CRI-O to read from a different, specific mounts file,
  2291. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  2292. # only add mounts it finds in this file.
  2293. #
  2294. #default_mounts_file = ""
  2295.  
  2296. # Maximum number of processes allowed in a container.
  2297. # pids_limit = 1024
  2298.  
  2299. # Maximum sized allowed for the container log file. Negative numbers indicate
  2300. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  2301. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  2302. # limit is never exceeded.
  2303. # log_size_max = -1
  2304.  
  2305. # Whether container output should be logged to journald in addition to the kuberentes log file
  2306. # log_to_journald = false
  2307.  
  2308. # Path to directory in which container exit files are written to by conmon.
  2309. # container_exits_dir = "/var/run/crio/exits"
  2310.  
  2311. # Path to directory for container attach sockets.
  2312. # container_attach_socket_dir = "/var/run/crio"
  2313.  
  2314. # The prefix to use for the source of the bind mounts.
  2315. # bind_mount_prefix = ""
  2316.  
  2317. # If set to true, all containers will run in read-only mode.
  2318. # read_only = false
  2319.  
  2320. # Changes the verbosity of the logs based on the level it is set to. Options
  2321. # are fatal, panic, error, warn, info, and debug. This option supports live
  2322. # configuration reload.
  2323. # log_level = "error"
  2324.  
  2325. # The UID mappings for the user namespace of each container. A range is
  2326. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  2327. # separated by comma.
  2328. # uid_mappings = ""
  2329.  
  2330. # The GID mappings for the user namespace of each container. A range is
  2331. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  2332. # separated by comma.
  2333. # gid_mappings = ""
  2334.  
  2335. # The minimal amount of time in seconds to wait before issuing a timeout
  2336. # regarding the proper termination of the container.
  2337. # ctr_stop_timeout = 0
  2338.  
  2339. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  2340. # and manage its lifecycle.
  2341. # manage_network_ns_lifecycle = false
  2342.  
  2343. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  2344. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  2345. # If no runtime_handler is provided, the runtime will be picked based on the level
  2346. # of trust of the workload. Each entry in the table should follow the format:
  2347. #
  2348. #[crio.runtime.runtimes.runtime-handler]
  2349. # runtime_path = "/path/to/the/executable"
  2350. # runtime_type = "oci"
  2351. # runtime_root = "/path/to/the/root"
  2352. #
  2353. # Where:
  2354. # - runtime-handler: name used to identify the runtime
  2355. # - runtime_path (optional, string): absolute path to the runtime executable in
  2356. # the host filesystem. If omitted, the runtime-handler identifier should match
  2357. # the runtime executable name, and the runtime executable should be placed
  2358. # in $PATH.
  2359. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  2360. # omitted, an "oci" runtime is assumed.
  2361. # - runtime_root (optional, string): root directory for storage of containers
  2362. # state.
  2363.  
  2364.  
  2365. # [crio.runtime.runtimes.runc]
  2366. # runtime_path = ""
  2367. # runtime_type = "oci"
  2368. # runtime_root = "/run/runc"
  2369.  
  2370.  
  2371. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  2372. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  2373. # surface and mitigating the consequences of containers breakout.
  2374.  
  2375. # Kata Containers with the default configured VMM
  2376. #[crio.runtime.runtimes.kata-runtime]
  2377.  
  2378. # Kata Containers with the QEMU VMM
  2379. #[crio.runtime.runtimes.kata-qemu]
  2380.  
  2381. # Kata Containers with the Firecracker VMM
  2382. #[crio.runtime.runtimes.kata-fc]
  2383.  
  2384. # The crio.image table contains settings pertaining to the management of OCI images.
  2385. #
  2386. # CRI-O reads its configured registries defaults from the system wide
  2387. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  2388. # you want to modify just CRI-O, you can change the registries configuration in
  2389. # this file. Otherwise, leave insecure_registries and registries commented out to
  2390. # use the system's defaults from /etc/containers/registries.conf.
  2391. [crio.image]
  2392.  
  2393. # Default transport for pulling images from a remote container storage.
  2394. # default_transport = "docker://"
  2395.  
  2396. # The path to a file containing credentials necessary for pulling images from
  2397. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  2398. global_auth_file = "/var/lib/kubelet/config.json"
  2399.  
  2400. # The image used to instantiate infra containers.
  2401. # This option supports live configuration reload.
  2402. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  2403.  
  2404. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  2405.  
  2406. # The path to a file containing credentials specific for pulling the pause_image from
  2407. # above. The file is similar to that of /var/lib/kubelet/config.json
  2408. # This option supports live configuration reload.
  2409. pause_image_auth_file = "/var/lib/kubelet/config.json"
  2410.  
  2411. # The command to run to have a container stay in the paused state.
  2412. # This option supports live configuration reload.
  2413. pause_command = "/usr/bin/pod"
  2414.  
  2415. # Path to the file which decides what sort of policy we use when deciding
  2416. # whether or not to trust an image that we've pulled. It is not recommended that
  2417. # this option be used, as the default behavior of using the system-wide default
  2418. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  2419. # refer to containers-policy.json(5) for more details.
  2420. # signature_policy = ""
  2421.  
  2422. # List of registries to skip TLS verification for pulling images. Please
  2423. # consider configuring the registries via /etc/containers/registries.conf before
  2424. # changing them here.
  2425. #insecure_registries = "[]"
  2426.  
  2427. # Controls how image volumes are handled. The valid values are mkdir, bind and
  2428. # ignore; the latter will ignore volumes entirely.
  2429. # image_volumes = "mkdir"
  2430.  
  2431. # List of registries to be used when pulling an unqualified image (e.g.,
  2432. # "alpine:latest"). By default, registries is set to "docker.io" for
  2433. # compatibility reasons. Depending on your workload and usecase you may add more
  2434. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  2435. # "registry.opensuse.org", etc.).
  2436. #registries = [
  2437. # ]
  2438.  
  2439.  
  2440. # The crio.network table containers settings pertaining to the management of
  2441. # CNI plugins.
  2442. [crio.network]
  2443.  
  2444. # Path to the directory where CNI configuration files are located.
  2445. # Note this default is changed from the RPM.
  2446. network_dir = "/etc/kubernetes/cni/net.d/"
  2447.  
  2448. # Paths to directories where CNI plugin binaries are located.
  2449. # Note this default is changed from the RPM.
  2450. plugin_dirs = [
  2451. "/var/lib/cni/bin",
  2452. ]
  2453.  
  2454. # A necessary configuration for Prometheus based metrics retrieval
  2455. [crio.metrics]
  2456.  
  2457. # Globally enable or disable metrics support.
  2458. enable_metrics = true
  2459.  
  2460. # The port on which the metrics server will listen.
  2461. metrics_port = 9537
  2462.  
  2463.  
  2464. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  2465.  
  2466. # The path to a file containing credentials specific for pulling the pause_image from
  2467. # above. The file is similar to that of /var/lib/kubelet/config.json
  2468. # This option supports live configuration reload.
  2469. pause_image_auth_file = "/var/lib/kubelet/config.json"
  2470.  
  2471. # The command to run to have a container stay in the paused state.
  2472. # This option supports live configuration reload.
  2473. pause_command = "/usr/bin/pod"
  2474.  
  2475. # Path to the file which decides what sort of policy we use when deciding
  2476. # whether or not to trust an image that we've pulled. It is not recommended that
  2477. # this option be used, as the default behavior of using the system-wide default
  2478. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  2479. # refer to containers-policy.json(5) for more details.
  2480. # signature_policy = ""
  2481.  
  2482. # List of registries to skip TLS verification for pulling images. Please
  2483. # consider configuring the registries via /etc/containers/registries.conf before
  2484. # changing them here.
  2485. #insecure_registries = "[]"
  2486.  
  2487. # Controls how image volumes are handled. The valid values are mkdir, bind and
  2488. # ignore; the latter will ignore volumes entirely.
  2489. # image_volumes = "mkdir"
  2490.  
  2491. # List of registries to be used when pulling an unqualified image (e.g.,
  2492. # "alpine:latest"). By default, registries is set to "docker.io" for
  2493. # compatibility reasons. Depending on your workload and usecase you may add more
  2494. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  2495. # "registry.opensuse.org", etc.).
  2496. #registries = [
  2497. # ]
  2498.  
  2499.  
  2500. # The crio.network table containers settings pertaining to the management of
  2501. # CNI plugins.
  2502. [crio.network]
  2503.  
  2504. # Path to the directory where CNI configuration files are located.
  2505. # Note this default is changed from the RPM.
  2506. network_dir = "/etc/kubernetes/cni/net.d/"
  2507.  
  2508. # Paths to directories where CNI plugin binaries are located.
  2509. # Note this default is changed from the RPM.
  2510. plugin_dirs = [
  2511. "/var/lib/cni/bin",
  2512. ]
  2513.  
  2514. # A necessary configuration for Prometheus based metrics retrieval
  2515. [crio.metrics]
  2516.  
  2517. # Globally enable or disable metrics support.
  2518. enable_metrics = true
  2519.  
  2520. # The port on which the metrics server will listen.
  2521. metrics_port = 9537
  2522.  
  2523.  
  2524. E0115 17:27:05.634877 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2525. I0115 17:28:05.646135 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2526. I0115 17:28:05.646162 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  2527. I0115 17:28:05.650982 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  2528. I0115 17:28:05.651006 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  2529. I0115 17:28:05.661019 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2530. E0115 17:28:05.661929 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  2531. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  2532. # daemon, but in a TOML format that can be more easily modified and versioned.
  2533. #
  2534. # Please refer to crio.conf(5) for details of all configuration options.
  2535.  
  2536. # CRI-O supports partial configuration reload during runtime, which can be
  2537. # done by sending SIGHUP to the running process. Currently supported options
  2538. # are explicitly mentioned with: 'This option supports live configuration
  2539. # reload'.
  2540.  
  2541. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  2542. # located at /etc/containers/storage.conf. Modify this storage configuration if
  2543. # you want to change the system's defaults. If you want to modify storage just
  2544. # for CRI-O, you can change the storage configuration options here.
  2545. [crio]
  2546.  
  2547. # Path to the "root directory". CRI-O stores all of its data, including
  2548. # containers images, in this directory.
  2549. #root = "/var/lib/containers/storage"
  2550.  
  2551. # Path to the "run directory". CRI-O stores all of its state in this directory.
  2552. #runroot = "/run/user/1000"
  2553.  
  2554. # Storage driver used to manage the storage of images and containers. Please
  2555. # refer to containers-storage.conf(5) to see all available storage drivers.
  2556. #storage_driver = "overlay"
  2557.  
  2558. # List to pass options to the storage driver. Please refer to
  2559. # containers-storage.conf(5) to see all available storage options.
  2560. #storage_option = [
  2561. #]
  2562.  
  2563. # The default log directory where all logs will go unless directly specified by
  2564. # the kubelet. The log directory specified must be an absolute directory.
  2565. # log_dir = "/var/log/crio/pods"
  2566.  
  2567. # Location for CRI-O to lay down the version file
  2568. # version_file = "/var/lib/crio/version"
  2569.  
  2570. # The crio.api table contains settings for the kubelet/gRPC interface.
  2571. [crio.api]
  2572.  
  2573. # Path to AF_LOCAL socket on which CRI-O will listen.
  2574. # listen = "/var/run/crio/crio.sock"
  2575.  
  2576. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  2577. # host_ip = ""
  2578.  
  2579. # IP address on which the stream server will listen.
  2580. stream_address = ""
  2581.  
  2582. # The port on which the stream server will listen.
  2583. stream_port = "10010"
  2584.  
  2585. # Enable encrypted TLS transport of the stream server.
  2586. # stream_enable_tls = false
  2587.  
  2588. # Path to the x509 certificate file used to serve the encrypted stream. This
  2589. # file can change, and CRI-O will automatically pick up the changes within 5
  2590. # minutes.
  2591. # stream_tls_cert = ""
  2592.  
  2593. # Path to the key file used to serve the encrypted stream. This file can
  2594. # change and CRI-O will automatically pick up the changes within 5 minutes.
  2595. # stream_tls_key = ""
  2596.  
  2597. # Path to the x509 CA(s) file used to verify and authenticate client
  2598. # communication with the encrypted stream. This file can change and CRI-O will
  2599. # automatically pick up the changes within 5 minutes.
  2600. # stream_tls_ca = ""
  2601.  
  2602. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  2603. # grpc_max_send_msg_size = 16777216
  2604.  
  2605. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  2606. # grpc_max_recv_msg_size = 16777216
  2607.  
  2608. # The crio.runtime table contains settings pertaining to the OCI runtime used
  2609. # and options for how to set up and manage the OCI runtime.
  2610. [crio.runtime]
  2611.  
  2612. # A list of ulimits to be set in containers by default, specified as
  2613. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  2614. # "nofile=1024:2048"
  2615. # If nothing is set here, settings will be inherited from the CRI-O daemon
  2616. #default_ulimits = [
  2617. #]
  2618.  
  2619. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  2620. # The name is matched against the runtimes map below.
  2621. # default_runtime = "runc"
  2622.  
  2623. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  2624. # no_pivot = false
  2625.  
  2626. # Path to the conmon binary, used for monitoring the OCI runtime.
  2627. # Will be searched for using $PATH if empty.
  2628. conmon = "/usr/libexec/crio/conmon"
  2629.  
  2630. # Cgroup setting for conmon
  2631. conmon_cgroup = "pod"
  2632.  
  2633. # Environment variable list for the conmon process, used for passing necessary
  2634. # environment variables to conmon or the runtime.
  2635. # conmon_env = [
  2636. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  2637. # ]
  2638.  
  2639. # If true, SELinux will be used for pod separation on the host.
  2640. # selinux = true
  2641.  
  2642. # Path to the seccomp.json profile which is used as the default seccomp profile
  2643. # for the runtime. If not specified, then the internal default seccomp profile
  2644. # will be used.
  2645. # seccomp_profile = "/etc/crio/seccomp.json"
  2646.  
  2647. # Used to change the name of the default AppArmor profile of CRI-O. The default
  2648. # profile name is "crio-default-" followed by the version string of CRI-O.
  2649. apparmor_profile = "crio-default"
  2650.  
  2651. # Cgroup management implementation used for the runtime.
  2652. cgroup_manager = "systemd"
  2653.  
  2654. # List of default capabilities for containers. If it is empty or commented out,
  2655. # only the capabilities defined in the containers json file by the user/kube
  2656. # will be added.
  2657. # default_capabilities = [
  2658. # "CHOWN",
  2659. # "DAC_OVERRIDE",
  2660. # "FSETID",
  2661. # "FOWNER",
  2662. # "NET_RAW",
  2663. # "SETGID",
  2664. # "SETUID",
  2665. # "SETPCAP",
  2666. # "NET_BIND_SERVICE",
  2667. # "SYS_CHROOT",
  2668. # "KILL",
  2669. # ]
  2670.  
  2671. # List of default sysctls. If it is empty or commented out, only the sysctls
  2672. # defined in the container json file by the user/kube will be added.
  2673. # default_sysctls = [
  2674. # ]
  2675.  
  2676. # List of additional devices. specified as
  2677. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  2678. #If it is empty or commented out, only the devices
  2679. # defined in the container json file by the user/kube will be added.
  2680. # additional_devices = [
  2681. # ]
  2682.  
  2683. # Path to OCI hooks directories for automatically executed hooks.
  2684. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  2685. # so we add /etc/containers/oci/hooks.d as well
  2686. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  2687. hooks_dir = [
  2688. "/etc/containers/oci/hooks.d",
  2689. ]
  2690.  
  2691. # List of default mounts for each container. **Deprecated:** this option will
  2692. # be removed in future versions in favor of default_mounts_file.
  2693. # default_mounts = [
  2694. # "/usr/share/rhel/secrets:/run/secrets",
  2695. # ]
  2696.  
  2697. # Path to the file specifying the defaults mounts for each container. The
  2698. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  2699. # its default mounts from the following two files:
  2700. #
  2701. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  2702. # override file, where users can either add in their own default mounts, or
  2703. # override the default mounts shipped with the package.
  2704. #
  2705. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  2706. # mounts. If you want CRI-O to read from a different, specific mounts file,
  2707. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  2708. # only add mounts it finds in this file.
  2709. #
  2710. #default_mounts_file = ""
  2711.  
  2712. # Maximum number of processes allowed in a container.
  2713. # pids_limit = 1024
  2714.  
  2715. # Maximum sized allowed for the container log file. Negative numbers indicate
  2716. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  2717. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  2718. # limit is never exceeded.
  2719. # log_size_max = -1
  2720.  
  2721. # Whether container output should be logged to journald in addition to the kuberentes log file
  2722. # log_to_journald = false
  2723.  
  2724. # Path to directory in which container exit files are written to by conmon.
  2725. # container_exits_dir = "/var/run/crio/exits"
  2726.  
  2727. # Path to directory for container attach sockets.
  2728. # container_attach_socket_dir = "/var/run/crio"
  2729.  
  2730. # The prefix to use for the source of the bind mounts.
  2731. # bind_mount_prefix = ""
  2732.  
  2733. # If set to true, all containers will run in read-only mode.
  2734. # read_only = false
  2735.  
  2736. # Changes the verbosity of the logs based on the level it is set to. Options
  2737. # are fatal, panic, error, warn, info, and debug. This option supports live
  2738. # configuration reload.
  2739. # log_level = "error"
  2740.  
  2741. # The UID mappings for the user namespace of each container. A range is
  2742. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  2743. # separated by comma.
  2744. # uid_mappings = ""
  2745.  
  2746. # The GID mappings for the user namespace of each container. A range is
  2747. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  2748. # separated by comma.
  2749. # gid_mappings = ""
  2750.  
  2751. # The minimal amount of time in seconds to wait before issuing a timeout
  2752. # regarding the proper termination of the container.
  2753. # ctr_stop_timeout = 0
  2754.  
  2755. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  2756. # and manage its lifecycle.
  2757. # manage_network_ns_lifecycle = false
  2758.  
  2759. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  2760. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  2761. # If no runtime_handler is provided, the runtime will be picked based on the level
  2762. # of trust of the workload. Each entry in the table should follow the format:
  2763. #
  2764. #[crio.runtime.runtimes.runtime-handler]
  2765. # runtime_path = "/path/to/the/executable"
  2766. # runtime_type = "oci"
  2767. # runtime_root = "/path/to/the/root"
  2768. #
  2769. # Where:
  2770. # - runtime-handler: name used to identify the runtime
  2771. # - runtime_path (optional, string): absolute path to the runtime executable in
  2772. # the host filesystem. If omitted, the runtime-handler identifier should match
  2773. # the runtime executable name, and the runtime executable should be placed
  2774. # in $PATH.
  2775. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  2776. # omitted, an "oci" runtime is assumed.
  2777. # - runtime_root (optional, string): root directory for storage of containers
  2778. # state.
  2779.  
  2780.  
  2781. # [crio.runtime.runtimes.runc]
  2782. # runtime_path = ""
  2783. # runtime_type = "oci"
  2784. # runtime_root = "/run/runc"
  2785.  
  2786.  
  2787. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  2788. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  2789. # surface and mitigating the consequences of containers breakout.
  2790.  
  2791. # Kata Containers with the default configured VMM
  2792. #[crio.runtime.runtimes.kata-runtime]
  2793.  
  2794. # Kata Containers with the QEMU VMM
  2795. #[crio.runtime.runtimes.kata-qemu]
  2796.  
  2797. # Kata Containers with the Firecracker VMM
  2798. #[crio.runtime.runtimes.kata-fc]
  2799.  
  2800. # The crio.image table contains settings pertaining to the management of OCI images.
  2801. #
  2802. # CRI-O reads its configured registries defaults from the system wide
  2803. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  2804. # you want to modify just CRI-O, you can change the registries configuration in
  2805. # this file. Otherwise, leave insecure_registries and registries commented out to
  2806. # use the system's defaults from /etc/containers/registries.conf.
  2807. [crio.image]
  2808.  
  2809. # Default transport for pulling images from a remote container storage.
  2810. # default_transport = "docker://"
  2811.  
  2812. # The path to a file containing credentials necessary for pulling images from
  2813. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  2814. global_auth_file = "/var/lib/kubelet/config.json"
  2815.  
  2816. # The image used to instantiate infra containers.
  2817. # This option supports live configuration reload.
  2818. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  2819.  
  2820. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  2821.  
  2822. # The path to a file containing credentials specific for pulling the pause_image from
  2823. # above. The file is similar to that of /var/lib/kubelet/config.json
  2824. # This option supports live configuration reload.
  2825. pause_image_auth_file = "/var/lib/kubelet/config.json"
  2826.  
  2827. # The command to run to have a container stay in the paused state.
  2828. # This option supports live configuration reload.
  2829. pause_command = "/usr/bin/pod"
  2830.  
  2831. # Path to the file which decides what sort of policy we use when deciding
  2832. # whether or not to trust an image that we've pulled. It is not recommended that
  2833. # this option be used, as the default behavior of using the system-wide default
  2834. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  2835. # refer to containers-policy.json(5) for more details.
  2836. # signature_policy = ""
  2837.  
  2838. # List of registries to skip TLS verification for pulling images. Please
  2839. # consider configuring the registries via /etc/containers/registries.conf before
  2840. # changing them here.
  2841. #insecure_registries = "[]"
  2842.  
  2843. # Controls how image volumes are handled. The valid values are mkdir, bind and
  2844. # ignore; the latter will ignore volumes entirely.
  2845. # image_volumes = "mkdir"
  2846.  
  2847. # List of registries to be used when pulling an unqualified image (e.g.,
  2848. # "alpine:latest"). By default, registries is set to "docker.io" for
  2849. # compatibility reasons. Depending on your workload and usecase you may add more
  2850. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  2851. # "registry.opensuse.org", etc.).
  2852. #registries = [
  2853. # ]
  2854.  
  2855.  
  2856. # The crio.network table containers settings pertaining to the management of
  2857. # CNI plugins.
  2858. [crio.network]
  2859.  
  2860. # Path to the directory where CNI configuration files are located.
  2861. # Note this default is changed from the RPM.
  2862. network_dir = "/etc/kubernetes/cni/net.d/"
  2863.  
  2864. # Paths to directories where CNI plugin binaries are located.
  2865. # Note this default is changed from the RPM.
  2866. plugin_dirs = [
  2867. "/var/lib/cni/bin",
  2868. ]
  2869.  
  2870. # A necessary configuration for Prometheus based metrics retrieval
  2871. [crio.metrics]
  2872.  
  2873. # Globally enable or disable metrics support.
  2874. enable_metrics = true
  2875.  
  2876. # The port on which the metrics server will listen.
  2877. metrics_port = 9537
  2878.  
  2879.  
  2880. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  2881.  
  2882. # The path to a file containing credentials specific for pulling the pause_image from
  2883. # above. The file is similar to that of /var/lib/kubelet/config.json
  2884. # This option supports live configuration reload.
  2885. pause_image_auth_file = "/var/lib/kubelet/config.json"
  2886.  
  2887. # The command to run to have a container stay in the paused state.
  2888. # This option supports live configuration reload.
  2889. pause_command = "/usr/bin/pod"
  2890.  
  2891. # Path to the file which decides what sort of policy we use when deciding
  2892. # whether or not to trust an image that we've pulled. It is not recommended that
  2893. # this option be used, as the default behavior of using the system-wide default
  2894. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  2895. # refer to containers-policy.json(5) for more details.
  2896. # signature_policy = ""
  2897.  
  2898. # List of registries to skip TLS verification for pulling images. Please
  2899. # consider configuring the registries via /etc/containers/registries.conf before
  2900. # changing them here.
  2901. #insecure_registries = "[]"
  2902.  
  2903. # Controls how image volumes are handled. The valid values are mkdir, bind and
  2904. # ignore; the latter will ignore volumes entirely.
  2905. # image_volumes = "mkdir"
  2906.  
  2907. # List of registries to be used when pulling an unqualified image (e.g.,
  2908. # "alpine:latest"). By default, registries is set to "docker.io" for
  2909. # compatibility reasons. Depending on your workload and usecase you may add more
  2910. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  2911. # "registry.opensuse.org", etc.).
  2912. #registries = [
  2913. # ]
  2914.  
  2915.  
  2916. # The crio.network table containers settings pertaining to the management of
  2917. # CNI plugins.
  2918. [crio.network]
  2919.  
  2920. # Path to the directory where CNI configuration files are located.
  2921. # Note this default is changed from the RPM.
  2922. network_dir = "/etc/kubernetes/cni/net.d/"
  2923.  
  2924. # Paths to directories where CNI plugin binaries are located.
  2925. # Note this default is changed from the RPM.
  2926. plugin_dirs = [
  2927. "/var/lib/cni/bin",
  2928. ]
  2929.  
  2930. # A necessary configuration for Prometheus based metrics retrieval
  2931. [crio.metrics]
  2932.  
  2933. # Globally enable or disable metrics support.
  2934. enable_metrics = true
  2935.  
  2936. # The port on which the metrics server will listen.
  2937. metrics_port = 9537
  2938.  
  2939.  
  2940. E0115 17:28:05.661961 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2941. I0115 17:29:05.674704 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2942. I0115 17:29:05.674727 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  2943. I0115 17:29:05.679783 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  2944. I0115 17:29:05.679804 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  2945. I0115 17:29:05.690148 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  2946. E0115 17:29:05.690825 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  2947. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  2948. # daemon, but in a TOML format that can be more easily modified and versioned.
  2949. #
  2950. # Please refer to crio.conf(5) for details of all configuration options.
  2951.  
  2952. # CRI-O supports partial configuration reload during runtime, which can be
  2953. # done by sending SIGHUP to the running process. Currently supported options
  2954. # are explicitly mentioned with: 'This option supports live configuration
  2955. # reload'.
  2956.  
  2957. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  2958. # located at /etc/containers/storage.conf. Modify this storage configuration if
  2959. # you want to change the system's defaults. If you want to modify storage just
  2960. # for CRI-O, you can change the storage configuration options here.
  2961. [crio]
  2962.  
  2963. # Path to the "root directory". CRI-O stores all of its data, including
  2964. # containers images, in this directory.
  2965. #root = "/var/lib/containers/storage"
  2966.  
  2967. # Path to the "run directory". CRI-O stores all of its state in this directory.
  2968. #runroot = "/run/user/1000"
  2969.  
  2970. # Storage driver used to manage the storage of images and containers. Please
  2971. # refer to containers-storage.conf(5) to see all available storage drivers.
  2972. #storage_driver = "overlay"
  2973.  
  2974. # List to pass options to the storage driver. Please refer to
  2975. # containers-storage.conf(5) to see all available storage options.
  2976. #storage_option = [
  2977. #]
  2978.  
  2979. # The default log directory where all logs will go unless directly specified by
  2980. # the kubelet. The log directory specified must be an absolute directory.
  2981. # log_dir = "/var/log/crio/pods"
  2982.  
  2983. # Location for CRI-O to lay down the version file
  2984. # version_file = "/var/lib/crio/version"
  2985.  
  2986. # The crio.api table contains settings for the kubelet/gRPC interface.
  2987. [crio.api]
  2988.  
  2989. # Path to AF_LOCAL socket on which CRI-O will listen.
  2990. # listen = "/var/run/crio/crio.sock"
  2991.  
  2992. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  2993. # host_ip = ""
  2994.  
  2995. # IP address on which the stream server will listen.
  2996. stream_address = ""
  2997.  
  2998. # The port on which the stream server will listen.
  2999. stream_port = "10010"
  3000.  
  3001. # Enable encrypted TLS transport of the stream server.
  3002. # stream_enable_tls = false
  3003.  
  3004. # Path to the x509 certificate file used to serve the encrypted stream. This
  3005. # file can change, and CRI-O will automatically pick up the changes within 5
  3006. # minutes.
  3007. # stream_tls_cert = ""
  3008.  
  3009. # Path to the key file used to serve the encrypted stream. This file can
  3010. # change and CRI-O will automatically pick up the changes within 5 minutes.
  3011. # stream_tls_key = ""
  3012.  
  3013. # Path to the x509 CA(s) file used to verify and authenticate client
  3014. # communication with the encrypted stream. This file can change and CRI-O will
  3015. # automatically pick up the changes within 5 minutes.
  3016. # stream_tls_ca = ""
  3017.  
  3018. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  3019. # grpc_max_send_msg_size = 16777216
  3020.  
  3021. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  3022. # grpc_max_recv_msg_size = 16777216
  3023.  
  3024. # The crio.runtime table contains settings pertaining to the OCI runtime used
  3025. # and options for how to set up and manage the OCI runtime.
  3026. [crio.runtime]
  3027.  
  3028. # A list of ulimits to be set in containers by default, specified as
  3029. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  3030. # "nofile=1024:2048"
  3031. # If nothing is set here, settings will be inherited from the CRI-O daemon
  3032. #default_ulimits = [
  3033. #]
  3034.  
  3035. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  3036. # The name is matched against the runtimes map below.
  3037. # default_runtime = "runc"
  3038.  
  3039. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  3040. # no_pivot = false
  3041.  
  3042. # Path to the conmon binary, used for monitoring the OCI runtime.
  3043. # Will be searched for using $PATH if empty.
  3044. conmon = "/usr/libexec/crio/conmon"
  3045.  
  3046. # Cgroup setting for conmon
  3047. conmon_cgroup = "pod"
  3048.  
  3049. # Environment variable list for the conmon process, used for passing necessary
  3050. # environment variables to conmon or the runtime.
  3051. # conmon_env = [
  3052. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  3053. # ]
  3054.  
  3055. # If true, SELinux will be used for pod separation on the host.
  3056. # selinux = true
  3057.  
  3058. # Path to the seccomp.json profile which is used as the default seccomp profile
  3059. # for the runtime. If not specified, then the internal default seccomp profile
  3060. # will be used.
  3061. # seccomp_profile = "/etc/crio/seccomp.json"
  3062.  
  3063. # Used to change the name of the default AppArmor profile of CRI-O. The default
  3064. # profile name is "crio-default-" followed by the version string of CRI-O.
  3065. apparmor_profile = "crio-default"
  3066.  
  3067. # Cgroup management implementation used for the runtime.
  3068. cgroup_manager = "systemd"
  3069.  
  3070. # List of default capabilities for containers. If it is empty or commented out,
  3071. # only the capabilities defined in the containers json file by the user/kube
  3072. # will be added.
  3073. # default_capabilities = [
  3074. # "CHOWN",
  3075. # "DAC_OVERRIDE",
  3076. # "FSETID",
  3077. # "FOWNER",
  3078. # "NET_RAW",
  3079. # "SETGID",
  3080. # "SETUID",
  3081. # "SETPCAP",
  3082. # "NET_BIND_SERVICE",
  3083. # "SYS_CHROOT",
  3084. # "KILL",
  3085. # ]
  3086.  
  3087. # List of default sysctls. If it is empty or commented out, only the sysctls
  3088. # defined in the container json file by the user/kube will be added.
  3089. # default_sysctls = [
  3090. # ]
  3091.  
  3092. # List of additional devices. specified as
  3093. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  3094. #If it is empty or commented out, only the devices
  3095. # defined in the container json file by the user/kube will be added.
  3096. # additional_devices = [
  3097. # ]
  3098.  
  3099. # Path to OCI hooks directories for automatically executed hooks.
  3100. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  3101. # so we add /etc/containers/oci/hooks.d as well
  3102. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  3103. hooks_dir = [
  3104. "/etc/containers/oci/hooks.d",
  3105. ]
  3106.  
  3107. # List of default mounts for each container. **Deprecated:** this option will
  3108. # be removed in future versions in favor of default_mounts_file.
  3109. # default_mounts = [
  3110. # "/usr/share/rhel/secrets:/run/secrets",
  3111. # ]
  3112.  
  3113. # Path to the file specifying the defaults mounts for each container. The
  3114. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  3115. # its default mounts from the following two files:
  3116. #
  3117. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  3118. # override file, where users can either add in their own default mounts, or
  3119. # override the default mounts shipped with the package.
  3120. #
  3121. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  3122. # mounts. If you want CRI-O to read from a different, specific mounts file,
  3123. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  3124. # only add mounts it finds in this file.
  3125. #
  3126. #default_mounts_file = ""
  3127.  
  3128. # Maximum number of processes allowed in a container.
  3129. # pids_limit = 1024
  3130.  
  3131. # Maximum sized allowed for the container log file. Negative numbers indicate
  3132. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  3133. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  3134. # limit is never exceeded.
  3135. # log_size_max = -1
  3136.  
  3137. # Whether container output should be logged to journald in addition to the kuberentes log file
  3138. # log_to_journald = false
  3139.  
  3140. # Path to directory in which container exit files are written to by conmon.
  3141. # container_exits_dir = "/var/run/crio/exits"
  3142.  
  3143. # Path to directory for container attach sockets.
  3144. # container_attach_socket_dir = "/var/run/crio"
  3145.  
  3146. # The prefix to use for the source of the bind mounts.
  3147. # bind_mount_prefix = ""
  3148.  
  3149. # If set to true, all containers will run in read-only mode.
  3150. # read_only = false
  3151.  
  3152. # Changes the verbosity of the logs based on the level it is set to. Options
  3153. # are fatal, panic, error, warn, info, and debug. This option supports live
  3154. # configuration reload.
  3155. # log_level = "error"
  3156.  
  3157. # The UID mappings for the user namespace of each container. A range is
  3158. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  3159. # separated by comma.
  3160. # uid_mappings = ""
  3161.  
  3162. # The GID mappings for the user namespace of each container. A range is
  3163. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  3164. # separated by comma.
  3165. # gid_mappings = ""
  3166.  
  3167. # The minimal amount of time in seconds to wait before issuing a timeout
  3168. # regarding the proper termination of the container.
  3169. # ctr_stop_timeout = 0
  3170.  
  3171. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  3172. # and manage its lifecycle.
  3173. # manage_network_ns_lifecycle = false
  3174.  
  3175. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  3176. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  3177. # If no runtime_handler is provided, the runtime will be picked based on the level
  3178. # of trust of the workload. Each entry in the table should follow the format:
  3179. #
  3180. #[crio.runtime.runtimes.runtime-handler]
  3181. # runtime_path = "/path/to/the/executable"
  3182. # runtime_type = "oci"
  3183. # runtime_root = "/path/to/the/root"
  3184. #
  3185. # Where:
  3186. # - runtime-handler: name used to identify the runtime
  3187. # - runtime_path (optional, string): absolute path to the runtime executable in
  3188. # the host filesystem. If omitted, the runtime-handler identifier should match
  3189. # the runtime executable name, and the runtime executable should be placed
  3190. # in $PATH.
  3191. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  3192. # omitted, an "oci" runtime is assumed.
  3193. # - runtime_root (optional, string): root directory for storage of containers
  3194. # state.
  3195.  
  3196.  
  3197. # [crio.runtime.runtimes.runc]
  3198. # runtime_path = ""
  3199. # runtime_type = "oci"
  3200. # runtime_root = "/run/runc"
  3201.  
  3202.  
  3203. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  3204. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  3205. # surface and mitigating the consequences of containers breakout.
  3206.  
  3207. # Kata Containers with the default configured VMM
  3208. #[crio.runtime.runtimes.kata-runtime]
  3209.  
  3210. # Kata Containers with the QEMU VMM
  3211. #[crio.runtime.runtimes.kata-qemu]
  3212.  
  3213. # Kata Containers with the Firecracker VMM
  3214. #[crio.runtime.runtimes.kata-fc]
  3215.  
  3216. # The crio.image table contains settings pertaining to the management of OCI images.
  3217. #
  3218. # CRI-O reads its configured registries defaults from the system wide
  3219. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  3220. # you want to modify just CRI-O, you can change the registries configuration in
  3221. # this file. Otherwise, leave insecure_registries and registries commented out to
  3222. # use the system's defaults from /etc/containers/registries.conf.
  3223. [crio.image]
  3224.  
  3225. # Default transport for pulling images from a remote container storage.
  3226. # default_transport = "docker://"
  3227.  
  3228. # The path to a file containing credentials necessary for pulling images from
  3229. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  3230. global_auth_file = "/var/lib/kubelet/config.json"
  3231.  
  3232. # The image used to instantiate infra containers.
  3233. # This option supports live configuration reload.
  3234. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  3235.  
  3236. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  3237.  
  3238. # The path to a file containing credentials specific for pulling the pause_image from
  3239. # above. The file is similar to that of /var/lib/kubelet/config.json
  3240. # This option supports live configuration reload.
  3241. pause_image_auth_file = "/var/lib/kubelet/config.json"
  3242.  
  3243. # The command to run to have a container stay in the paused state.
  3244. # This option supports live configuration reload.
  3245. pause_command = "/usr/bin/pod"
  3246.  
  3247. # Path to the file which decides what sort of policy we use when deciding
  3248. # whether or not to trust an image that we've pulled. It is not recommended that
  3249. # this option be used, as the default behavior of using the system-wide default
  3250. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  3251. # refer to containers-policy.json(5) for more details.
  3252. # signature_policy = ""
  3253.  
  3254. # List of registries to skip TLS verification for pulling images. Please
  3255. # consider configuring the registries via /etc/containers/registries.conf before
  3256. # changing them here.
  3257. #insecure_registries = "[]"
  3258.  
  3259. # Controls how image volumes are handled. The valid values are mkdir, bind and
  3260. # ignore; the latter will ignore volumes entirely.
  3261. # image_volumes = "mkdir"
  3262.  
  3263. # List of registries to be used when pulling an unqualified image (e.g.,
  3264. # "alpine:latest"). By default, registries is set to "docker.io" for
  3265. # compatibility reasons. Depending on your workload and usecase you may add more
  3266. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  3267. # "registry.opensuse.org", etc.).
  3268. #registries = [
  3269. # ]
  3270.  
  3271.  
  3272. # The crio.network table containers settings pertaining to the management of
  3273. # CNI plugins.
  3274. [crio.network]
  3275.  
  3276. # Path to the directory where CNI configuration files are located.
  3277. # Note this default is changed from the RPM.
  3278. network_dir = "/etc/kubernetes/cni/net.d/"
  3279.  
  3280. # Paths to directories where CNI plugin binaries are located.
  3281. # Note this default is changed from the RPM.
  3282. plugin_dirs = [
  3283. "/var/lib/cni/bin",
  3284. ]
  3285.  
  3286. # A necessary configuration for Prometheus based metrics retrieval
  3287. [crio.metrics]
  3288.  
  3289. # Globally enable or disable metrics support.
  3290. enable_metrics = true
  3291.  
  3292. # The port on which the metrics server will listen.
  3293. metrics_port = 9537
  3294.  
  3295.  
  3296. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  3297.  
  3298. # The path to a file containing credentials specific for pulling the pause_image from
  3299. # above. The file is similar to that of /var/lib/kubelet/config.json
  3300. # This option supports live configuration reload.
  3301. pause_image_auth_file = "/var/lib/kubelet/config.json"
  3302.  
  3303. # The command to run to have a container stay in the paused state.
  3304. # This option supports live configuration reload.
  3305. pause_command = "/usr/bin/pod"
  3306.  
  3307. # Path to the file which decides what sort of policy we use when deciding
  3308. # whether or not to trust an image that we've pulled. It is not recommended that
  3309. # this option be used, as the default behavior of using the system-wide default
  3310. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  3311. # refer to containers-policy.json(5) for more details.
  3312. # signature_policy = ""
  3313.  
  3314. # List of registries to skip TLS verification for pulling images. Please
  3315. # consider configuring the registries via /etc/containers/registries.conf before
  3316. # changing them here.
  3317. #insecure_registries = "[]"
  3318.  
  3319. # Controls how image volumes are handled. The valid values are mkdir, bind and
  3320. # ignore; the latter will ignore volumes entirely.
  3321. # image_volumes = "mkdir"
  3322.  
  3323. # List of registries to be used when pulling an unqualified image (e.g.,
  3324. # "alpine:latest"). By default, registries is set to "docker.io" for
  3325. # compatibility reasons. Depending on your workload and usecase you may add more
  3326. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  3327. # "registry.opensuse.org", etc.).
  3328. #registries = [
  3329. # ]
  3330.  
  3331.  
  3332. # The crio.network table containers settings pertaining to the management of
  3333. # CNI plugins.
  3334. [crio.network]
  3335.  
  3336. # Path to the directory where CNI configuration files are located.
  3337. # Note this default is changed from the RPM.
  3338. network_dir = "/etc/kubernetes/cni/net.d/"
  3339.  
  3340. # Paths to directories where CNI plugin binaries are located.
  3341. # Note this default is changed from the RPM.
  3342. plugin_dirs = [
  3343. "/var/lib/cni/bin",
  3344. ]
  3345.  
  3346. # A necessary configuration for Prometheus based metrics retrieval
  3347. [crio.metrics]
  3348.  
  3349. # Globally enable or disable metrics support.
  3350. enable_metrics = true
  3351.  
  3352. # The port on which the metrics server will listen.
  3353. metrics_port = 9537
  3354.  
  3355.  
  3356. E0115 17:29:05.690854 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  3357. I0115 17:30:05.702659 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  3358. I0115 17:30:05.702681 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  3359. I0115 17:30:05.707501 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  3360. I0115 17:30:05.707541 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  3361. I0115 17:30:05.716453 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  3362. E0115 17:30:05.717179 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  3363. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  3364. # daemon, but in a TOML format that can be more easily modified and versioned.
  3365. #
  3366. # Please refer to crio.conf(5) for details of all configuration options.
  3367.  
  3368. # CRI-O supports partial configuration reload during runtime, which can be
  3369. # done by sending SIGHUP to the running process. Currently supported options
  3370. # are explicitly mentioned with: 'This option supports live configuration
  3371. # reload'.
  3372.  
  3373. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  3374. # located at /etc/containers/storage.conf. Modify this storage configuration if
  3375. # you want to change the system's defaults. If you want to modify storage just
  3376. # for CRI-O, you can change the storage configuration options here.
  3377. [crio]
  3378.  
  3379. # Path to the "root directory". CRI-O stores all of its data, including
  3380. # containers images, in this directory.
  3381. #root = "/var/lib/containers/storage"
  3382.  
  3383. # Path to the "run directory". CRI-O stores all of its state in this directory.
  3384. #runroot = "/run/user/1000"
  3385.  
  3386. # Storage driver used to manage the storage of images and containers. Please
  3387. # refer to containers-storage.conf(5) to see all available storage drivers.
  3388. #storage_driver = "overlay"
  3389.  
  3390. # List to pass options to the storage driver. Please refer to
  3391. # containers-storage.conf(5) to see all available storage options.
  3392. #storage_option = [
  3393. #]
  3394.  
  3395. # The default log directory where all logs will go unless directly specified by
  3396. # the kubelet. The log directory specified must be an absolute directory.
  3397. # log_dir = "/var/log/crio/pods"
  3398.  
  3399. # Location for CRI-O to lay down the version file
  3400. # version_file = "/var/lib/crio/version"
  3401.  
  3402. # The crio.api table contains settings for the kubelet/gRPC interface.
  3403. [crio.api]
  3404.  
  3405. # Path to AF_LOCAL socket on which CRI-O will listen.
  3406. # listen = "/var/run/crio/crio.sock"
  3407.  
  3408. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  3409. # host_ip = ""
  3410.  
  3411. # IP address on which the stream server will listen.
  3412. stream_address = ""
  3413.  
  3414. # The port on which the stream server will listen.
  3415. stream_port = "10010"
  3416.  
  3417. # Enable encrypted TLS transport of the stream server.
  3418. # stream_enable_tls = false
  3419.  
  3420. # Path to the x509 certificate file used to serve the encrypted stream. This
  3421. # file can change, and CRI-O will automatically pick up the changes within 5
  3422. # minutes.
  3423. # stream_tls_cert = ""
  3424.  
  3425. # Path to the key file used to serve the encrypted stream. This file can
  3426. # change and CRI-O will automatically pick up the changes within 5 minutes.
  3427. # stream_tls_key = ""
  3428.  
  3429. # Path to the x509 CA(s) file used to verify and authenticate client
  3430. # communication with the encrypted stream. This file can change and CRI-O will
  3431. # automatically pick up the changes within 5 minutes.
  3432. # stream_tls_ca = ""
  3433.  
  3434. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  3435. # grpc_max_send_msg_size = 16777216
  3436.  
  3437. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  3438. # grpc_max_recv_msg_size = 16777216
  3439.  
  3440. # The crio.runtime table contains settings pertaining to the OCI runtime used
  3441. # and options for how to set up and manage the OCI runtime.
  3442. [crio.runtime]
  3443.  
  3444. # A list of ulimits to be set in containers by default, specified as
  3445. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  3446. # "nofile=1024:2048"
  3447. # If nothing is set here, settings will be inherited from the CRI-O daemon
  3448. #default_ulimits = [
  3449. #]
  3450.  
  3451. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  3452. # The name is matched against the runtimes map below.
  3453. # default_runtime = "runc"
  3454.  
  3455. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  3456. # no_pivot = false
  3457.  
  3458. # Path to the conmon binary, used for monitoring the OCI runtime.
  3459. # Will be searched for using $PATH if empty.
  3460. conmon = "/usr/libexec/crio/conmon"
  3461.  
  3462. # Cgroup setting for conmon
  3463. conmon_cgroup = "pod"
  3464.  
  3465. # Environment variable list for the conmon process, used for passing necessary
  3466. # environment variables to conmon or the runtime.
  3467. # conmon_env = [
  3468. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  3469. # ]
  3470.  
  3471. # If true, SELinux will be used for pod separation on the host.
  3472. # selinux = true
  3473.  
  3474. # Path to the seccomp.json profile which is used as the default seccomp profile
  3475. # for the runtime. If not specified, then the internal default seccomp profile
  3476. # will be used.
  3477. # seccomp_profile = "/etc/crio/seccomp.json"
  3478.  
  3479. # Used to change the name of the default AppArmor profile of CRI-O. The default
  3480. # profile name is "crio-default-" followed by the version string of CRI-O.
  3481. apparmor_profile = "crio-default"
  3482.  
  3483. # Cgroup management implementation used for the runtime.
  3484. cgroup_manager = "systemd"
  3485.  
  3486. # List of default capabilities for containers. If it is empty or commented out,
  3487. # only the capabilities defined in the containers json file by the user/kube
  3488. # will be added.
  3489. # default_capabilities = [
  3490. # "CHOWN",
  3491. # "DAC_OVERRIDE",
  3492. # "FSETID",
  3493. # "FOWNER",
  3494. # "NET_RAW",
  3495. # "SETGID",
  3496. # "SETUID",
  3497. # "SETPCAP",
  3498. # "NET_BIND_SERVICE",
  3499. # "SYS_CHROOT",
  3500. # "KILL",
  3501. # ]
  3502.  
  3503. # List of default sysctls. If it is empty or commented out, only the sysctls
  3504. # defined in the container json file by the user/kube will be added.
  3505. # default_sysctls = [
  3506. # ]
  3507.  
  3508. # List of additional devices. specified as
  3509. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  3510. #If it is empty or commented out, only the devices
  3511. # defined in the container json file by the user/kube will be added.
  3512. # additional_devices = [
  3513. # ]
  3514.  
  3515. # Path to OCI hooks directories for automatically executed hooks.
  3516. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  3517. # so we add /etc/containers/oci/hooks.d as well
  3518. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  3519. hooks_dir = [
  3520. "/etc/containers/oci/hooks.d",
  3521. ]
  3522.  
  3523. # List of default mounts for each container. **Deprecated:** this option will
  3524. # be removed in future versions in favor of default_mounts_file.
  3525. # default_mounts = [
  3526. # "/usr/share/rhel/secrets:/run/secrets",
  3527. # ]
  3528.  
  3529. # Path to the file specifying the defaults mounts for each container. The
  3530. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  3531. # its default mounts from the following two files:
  3532. #
  3533. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  3534. # override file, where users can either add in their own default mounts, or
  3535. # override the default mounts shipped with the package.
  3536. #
  3537. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  3538. # mounts. If you want CRI-O to read from a different, specific mounts file,
  3539. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  3540. # only add mounts it finds in this file.
  3541. #
  3542. #default_mounts_file = ""
  3543.  
  3544. # Maximum number of processes allowed in a container.
  3545. # pids_limit = 1024
  3546.  
  3547. # Maximum sized allowed for the container log file. Negative numbers indicate
  3548. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  3549. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  3550. # limit is never exceeded.
  3551. # log_size_max = -1
  3552.  
  3553. # Whether container output should be logged to journald in addition to the kuberentes log file
  3554. # log_to_journald = false
  3555.  
  3556. # Path to directory in which container exit files are written to by conmon.
  3557. # container_exits_dir = "/var/run/crio/exits"
  3558.  
  3559. # Path to directory for container attach sockets.
  3560. # container_attach_socket_dir = "/var/run/crio"
  3561.  
  3562. # The prefix to use for the source of the bind mounts.
  3563. # bind_mount_prefix = ""
  3564.  
  3565. # If set to true, all containers will run in read-only mode.
  3566. # read_only = false
  3567.  
  3568. # Changes the verbosity of the logs based on the level it is set to. Options
  3569. # are fatal, panic, error, warn, info, and debug. This option supports live
  3570. # configuration reload.
  3571. # log_level = "error"
  3572.  
  3573. # The UID mappings for the user namespace of each container. A range is
  3574. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  3575. # separated by comma.
  3576. # uid_mappings = ""
  3577.  
  3578. # The GID mappings for the user namespace of each container. A range is
  3579. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  3580. # separated by comma.
  3581. # gid_mappings = ""
  3582.  
  3583. # The minimal amount of time in seconds to wait before issuing a timeout
  3584. # regarding the proper termination of the container.
  3585. # ctr_stop_timeout = 0
  3586.  
  3587. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  3588. # and manage its lifecycle.
  3589. # manage_network_ns_lifecycle = false
  3590.  
  3591. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  3592. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  3593. # If no runtime_handler is provided, the runtime will be picked based on the level
  3594. # of trust of the workload. Each entry in the table should follow the format:
  3595. #
  3596. #[crio.runtime.runtimes.runtime-handler]
  3597. # runtime_path = "/path/to/the/executable"
  3598. # runtime_type = "oci"
  3599. # runtime_root = "/path/to/the/root"
  3600. #
  3601. # Where:
  3602. # - runtime-handler: name used to identify the runtime
  3603. # - runtime_path (optional, string): absolute path to the runtime executable in
  3604. # the host filesystem. If omitted, the runtime-handler identifier should match
  3605. # the runtime executable name, and the runtime executable should be placed
  3606. # in $PATH.
  3607. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  3608. # omitted, an "oci" runtime is assumed.
  3609. # - runtime_root (optional, string): root directory for storage of containers
  3610. # state.
  3611.  
  3612.  
  3613. # [crio.runtime.runtimes.runc]
  3614. # runtime_path = ""
  3615. # runtime_type = "oci"
  3616. # runtime_root = "/run/runc"
  3617.  
  3618.  
  3619. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  3620. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  3621. # surface and mitigating the consequences of containers breakout.
  3622.  
  3623. # Kata Containers with the default configured VMM
  3624. #[crio.runtime.runtimes.kata-runtime]
  3625.  
  3626. # Kata Containers with the QEMU VMM
  3627. #[crio.runtime.runtimes.kata-qemu]
  3628.  
  3629. # Kata Containers with the Firecracker VMM
  3630. #[crio.runtime.runtimes.kata-fc]
  3631.  
  3632. # The crio.image table contains settings pertaining to the management of OCI images.
  3633. #
  3634. # CRI-O reads its configured registries defaults from the system wide
  3635. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  3636. # you want to modify just CRI-O, you can change the registries configuration in
  3637. # this file. Otherwise, leave insecure_registries and registries commented out to
  3638. # use the system's defaults from /etc/containers/registries.conf.
  3639. [crio.image]
  3640.  
  3641. # Default transport for pulling images from a remote container storage.
  3642. # default_transport = "docker://"
  3643.  
  3644. # The path to a file containing credentials necessary for pulling images from
  3645. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  3646. global_auth_file = "/var/lib/kubelet/config.json"
  3647.  
  3648. # The image used to instantiate infra containers.
  3649. # This option supports live configuration reload.
  3650. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  3651.  
  3652. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  3653.  
  3654. # The path to a file containing credentials specific for pulling the pause_image from
  3655. # above. The file is similar to that of /var/lib/kubelet/config.json
  3656. # This option supports live configuration reload.
  3657. pause_image_auth_file = "/var/lib/kubelet/config.json"
  3658.  
  3659. # The command to run to have a container stay in the paused state.
  3660. # This option supports live configuration reload.
  3661. pause_command = "/usr/bin/pod"
  3662.  
  3663. # Path to the file which decides what sort of policy we use when deciding
  3664. # whether or not to trust an image that we've pulled. It is not recommended that
  3665. # this option be used, as the default behavior of using the system-wide default
  3666. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  3667. # refer to containers-policy.json(5) for more details.
  3668. # signature_policy = ""
  3669.  
  3670. # List of registries to skip TLS verification for pulling images. Please
  3671. # consider configuring the registries via /etc/containers/registries.conf before
  3672. # changing them here.
  3673. #insecure_registries = "[]"
  3674.  
  3675. # Controls how image volumes are handled. The valid values are mkdir, bind and
  3676. # ignore; the latter will ignore volumes entirely.
  3677. # image_volumes = "mkdir"
  3678.  
  3679. # List of registries to be used when pulling an unqualified image (e.g.,
  3680. # "alpine:latest"). By default, registries is set to "docker.io" for
  3681. # compatibility reasons. Depending on your workload and usecase you may add more
  3682. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  3683. # "registry.opensuse.org", etc.).
  3684. #registries = [
  3685. # ]
  3686.  
  3687.  
  3688. # The crio.network table containers settings pertaining to the management of
  3689. # CNI plugins.
  3690. [crio.network]
  3691.  
  3692. # Path to the directory where CNI configuration files are located.
  3693. # Note this default is changed from the RPM.
  3694. network_dir = "/etc/kubernetes/cni/net.d/"
  3695.  
  3696. # Paths to directories where CNI plugin binaries are located.
  3697. # Note this default is changed from the RPM.
  3698. plugin_dirs = [
  3699. "/var/lib/cni/bin",
  3700. ]
  3701.  
  3702. # A necessary configuration for Prometheus based metrics retrieval
  3703. [crio.metrics]
  3704.  
  3705. # Globally enable or disable metrics support.
  3706. enable_metrics = true
  3707.  
  3708. # The port on which the metrics server will listen.
  3709. metrics_port = 9537
  3710.  
  3711.  
  3712. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  3713.  
  3714. # The path to a file containing credentials specific for pulling the pause_image from
  3715. # above. The file is similar to that of /var/lib/kubelet/config.json
  3716. # This option supports live configuration reload.
  3717. pause_image_auth_file = "/var/lib/kubelet/config.json"
  3718.  
  3719. # The command to run to have a container stay in the paused state.
  3720. # This option supports live configuration reload.
  3721. pause_command = "/usr/bin/pod"
  3722.  
  3723. # Path to the file which decides what sort of policy we use when deciding
  3724. # whether or not to trust an image that we've pulled. It is not recommended that
  3725. # this option be used, as the default behavior of using the system-wide default
  3726. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  3727. # refer to containers-policy.json(5) for more details.
  3728. # signature_policy = ""
  3729.  
  3730. # List of registries to skip TLS verification for pulling images. Please
  3731. # consider configuring the registries via /etc/containers/registries.conf before
  3732. # changing them here.
  3733. #insecure_registries = "[]"
  3734.  
  3735. # Controls how image volumes are handled. The valid values are mkdir, bind and
  3736. # ignore; the latter will ignore volumes entirely.
  3737. # image_volumes = "mkdir"
  3738.  
  3739. # List of registries to be used when pulling an unqualified image (e.g.,
  3740. # "alpine:latest"). By default, registries is set to "docker.io" for
  3741. # compatibility reasons. Depending on your workload and usecase you may add more
  3742. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  3743. # "registry.opensuse.org", etc.).
  3744. #registries = [
  3745. # ]
  3746.  
  3747.  
  3748. # The crio.network table containers settings pertaining to the management of
  3749. # CNI plugins.
  3750. [crio.network]
  3751.  
  3752. # Path to the directory where CNI configuration files are located.
  3753. # Note this default is changed from the RPM.
  3754. network_dir = "/etc/kubernetes/cni/net.d/"
  3755.  
  3756. # Paths to directories where CNI plugin binaries are located.
  3757. # Note this default is changed from the RPM.
  3758. plugin_dirs = [
  3759. "/var/lib/cni/bin",
  3760. ]
  3761.  
  3762. # A necessary configuration for Prometheus based metrics retrieval
  3763. [crio.metrics]
  3764.  
  3765. # Globally enable or disable metrics support.
  3766. enable_metrics = true
  3767.  
  3768. # The port on which the metrics server will listen.
  3769. metrics_port = 9537
  3770.  
  3771.  
  3772. E0115 17:30:05.717207 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  3773. I0115 17:31:05.730431 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  3774. I0115 17:31:05.730455 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  3775. I0115 17:31:05.735232 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  3776. I0115 17:31:05.735261 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  3777. I0115 17:31:05.744551 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  3778. E0115 17:31:05.745279 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  3779. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  3780. # daemon, but in a TOML format that can be more easily modified and versioned.
  3781. #
  3782. # Please refer to crio.conf(5) for details of all configuration options.
  3783.  
  3784. # CRI-O supports partial configuration reload during runtime, which can be
  3785. # done by sending SIGHUP to the running process. Currently supported options
  3786. # are explicitly mentioned with: 'This option supports live configuration
  3787. # reload'.
  3788.  
  3789. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  3790. # located at /etc/containers/storage.conf. Modify this storage configuration if
  3791. # you want to change the system's defaults. If you want to modify storage just
  3792. # for CRI-O, you can change the storage configuration options here.
  3793. [crio]
  3794.  
  3795. # Path to the "root directory". CRI-O stores all of its data, including
  3796. # containers images, in this directory.
  3797. #root = "/var/lib/containers/storage"
  3798.  
  3799. # Path to the "run directory". CRI-O stores all of its state in this directory.
  3800. #runroot = "/run/user/1000"
  3801.  
  3802. # Storage driver used to manage the storage of images and containers. Please
  3803. # refer to containers-storage.conf(5) to see all available storage drivers.
  3804. #storage_driver = "overlay"
  3805.  
  3806. # List to pass options to the storage driver. Please refer to
  3807. # containers-storage.conf(5) to see all available storage options.
  3808. #storage_option = [
  3809. #]
  3810.  
  3811. # The default log directory where all logs will go unless directly specified by
  3812. # the kubelet. The log directory specified must be an absolute directory.
  3813. # log_dir = "/var/log/crio/pods"
  3814.  
  3815. # Location for CRI-O to lay down the version file
  3816. # version_file = "/var/lib/crio/version"
  3817.  
  3818. # The crio.api table contains settings for the kubelet/gRPC interface.
  3819. [crio.api]
  3820.  
  3821. # Path to AF_LOCAL socket on which CRI-O will listen.
  3822. # listen = "/var/run/crio/crio.sock"
  3823.  
  3824. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  3825. # host_ip = ""
  3826.  
  3827. # IP address on which the stream server will listen.
  3828. stream_address = ""
  3829.  
  3830. # The port on which the stream server will listen.
  3831. stream_port = "10010"
  3832.  
  3833. # Enable encrypted TLS transport of the stream server.
  3834. # stream_enable_tls = false
  3835.  
  3836. # Path to the x509 certificate file used to serve the encrypted stream. This
  3837. # file can change, and CRI-O will automatically pick up the changes within 5
  3838. # minutes.
  3839. # stream_tls_cert = ""
  3840.  
  3841. # Path to the key file used to serve the encrypted stream. This file can
  3842. # change and CRI-O will automatically pick up the changes within 5 minutes.
  3843. # stream_tls_key = ""
  3844.  
  3845. # Path to the x509 CA(s) file used to verify and authenticate client
  3846. # communication with the encrypted stream. This file can change and CRI-O will
  3847. # automatically pick up the changes within 5 minutes.
  3848. # stream_tls_ca = ""
  3849.  
  3850. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  3851. # grpc_max_send_msg_size = 16777216
  3852.  
  3853. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  3854. # grpc_max_recv_msg_size = 16777216
  3855.  
  3856. # The crio.runtime table contains settings pertaining to the OCI runtime used
  3857. # and options for how to set up and manage the OCI runtime.
  3858. [crio.runtime]
  3859.  
  3860. # A list of ulimits to be set in containers by default, specified as
  3861. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  3862. # "nofile=1024:2048"
  3863. # If nothing is set here, settings will be inherited from the CRI-O daemon
  3864. #default_ulimits = [
  3865. #]
  3866.  
  3867. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  3868. # The name is matched against the runtimes map below.
  3869. # default_runtime = "runc"
  3870.  
  3871. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  3872. # no_pivot = false
  3873.  
  3874. # Path to the conmon binary, used for monitoring the OCI runtime.
  3875. # Will be searched for using $PATH if empty.
  3876. conmon = "/usr/libexec/crio/conmon"
  3877.  
  3878. # Cgroup setting for conmon
  3879. conmon_cgroup = "pod"
  3880.  
  3881. # Environment variable list for the conmon process, used for passing necessary
  3882. # environment variables to conmon or the runtime.
  3883. # conmon_env = [
  3884. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  3885. # ]
  3886.  
  3887. # If true, SELinux will be used for pod separation on the host.
  3888. # selinux = true
  3889.  
  3890. # Path to the seccomp.json profile which is used as the default seccomp profile
  3891. # for the runtime. If not specified, then the internal default seccomp profile
  3892. # will be used.
  3893. # seccomp_profile = "/etc/crio/seccomp.json"
  3894.  
  3895. # Used to change the name of the default AppArmor profile of CRI-O. The default
  3896. # profile name is "crio-default-" followed by the version string of CRI-O.
  3897. apparmor_profile = "crio-default"
  3898.  
  3899. # Cgroup management implementation used for the runtime.
  3900. cgroup_manager = "systemd"
  3901.  
  3902. # List of default capabilities for containers. If it is empty or commented out,
  3903. # only the capabilities defined in the containers json file by the user/kube
  3904. # will be added.
  3905. # default_capabilities = [
  3906. # "CHOWN",
  3907. # "DAC_OVERRIDE",
  3908. # "FSETID",
  3909. # "FOWNER",
  3910. # "NET_RAW",
  3911. # "SETGID",
  3912. # "SETUID",
  3913. # "SETPCAP",
  3914. # "NET_BIND_SERVICE",
  3915. # "SYS_CHROOT",
  3916. # "KILL",
  3917. # ]
  3918.  
  3919. # List of default sysctls. If it is empty or commented out, only the sysctls
  3920. # defined in the container json file by the user/kube will be added.
  3921. # default_sysctls = [
  3922. # ]
  3923.  
  3924. # List of additional devices. specified as
  3925. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  3926. #If it is empty or commented out, only the devices
  3927. # defined in the container json file by the user/kube will be added.
  3928. # additional_devices = [
  3929. # ]
  3930.  
  3931. # Path to OCI hooks directories for automatically executed hooks.
  3932. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  3933. # so we add /etc/containers/oci/hooks.d as well
  3934. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  3935. hooks_dir = [
  3936. "/etc/containers/oci/hooks.d",
  3937. ]
  3938.  
  3939. # List of default mounts for each container. **Deprecated:** this option will
  3940. # be removed in future versions in favor of default_mounts_file.
  3941. # default_mounts = [
  3942. # "/usr/share/rhel/secrets:/run/secrets",
  3943. # ]
  3944.  
  3945. # Path to the file specifying the defaults mounts for each container. The
  3946. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  3947. # its default mounts from the following two files:
  3948. #
  3949. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  3950. # override file, where users can either add in their own default mounts, or
  3951. # override the default mounts shipped with the package.
  3952. #
  3953. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  3954. # mounts. If you want CRI-O to read from a different, specific mounts file,
  3955. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  3956. # only add mounts it finds in this file.
  3957. #
  3958. #default_mounts_file = ""
  3959.  
  3960. # Maximum number of processes allowed in a container.
  3961. # pids_limit = 1024
  3962.  
  3963. # Maximum sized allowed for the container log file. Negative numbers indicate
  3964. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  3965. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  3966. # limit is never exceeded.
  3967. # log_size_max = -1
  3968.  
  3969. # Whether container output should be logged to journald in addition to the kuberentes log file
  3970. # log_to_journald = false
  3971.  
  3972. # Path to directory in which container exit files are written to by conmon.
  3973. # container_exits_dir = "/var/run/crio/exits"
  3974.  
  3975. # Path to directory for container attach sockets.
  3976. # container_attach_socket_dir = "/var/run/crio"
  3977.  
  3978. # The prefix to use for the source of the bind mounts.
  3979. # bind_mount_prefix = ""
  3980.  
  3981. # If set to true, all containers will run in read-only mode.
  3982. # read_only = false
  3983.  
  3984. # Changes the verbosity of the logs based on the level it is set to. Options
  3985. # are fatal, panic, error, warn, info, and debug. This option supports live
  3986. # configuration reload.
  3987. # log_level = "error"
  3988.  
  3989. # The UID mappings for the user namespace of each container. A range is
  3990. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  3991. # separated by comma.
  3992. # uid_mappings = ""
  3993.  
  3994. # The GID mappings for the user namespace of each container. A range is
  3995. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  3996. # separated by comma.
  3997. # gid_mappings = ""
  3998.  
  3999. # The minimal amount of time in seconds to wait before issuing a timeout
  4000. # regarding the proper termination of the container.
  4001. # ctr_stop_timeout = 0
  4002.  
  4003. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  4004. # and manage its lifecycle.
  4005. # manage_network_ns_lifecycle = false
  4006.  
  4007. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  4008. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  4009. # If no runtime_handler is provided, the runtime will be picked based on the level
  4010. # of trust of the workload. Each entry in the table should follow the format:
  4011. #
  4012. #[crio.runtime.runtimes.runtime-handler]
  4013. # runtime_path = "/path/to/the/executable"
  4014. # runtime_type = "oci"
  4015. # runtime_root = "/path/to/the/root"
  4016. #
  4017. # Where:
  4018. # - runtime-handler: name used to identify the runtime
  4019. # - runtime_path (optional, string): absolute path to the runtime executable in
  4020. # the host filesystem. If omitted, the runtime-handler identifier should match
  4021. # the runtime executable name, and the runtime executable should be placed
  4022. # in $PATH.
  4023. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  4024. # omitted, an "oci" runtime is assumed.
  4025. # - runtime_root (optional, string): root directory for storage of containers
  4026. # state.
  4027.  
  4028.  
  4029. # [crio.runtime.runtimes.runc]
  4030. # runtime_path = ""
  4031. # runtime_type = "oci"
  4032. # runtime_root = "/run/runc"
  4033.  
  4034.  
  4035. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  4036. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  4037. # surface and mitigating the consequences of containers breakout.
  4038.  
  4039. # Kata Containers with the default configured VMM
  4040. #[crio.runtime.runtimes.kata-runtime]
  4041.  
  4042. # Kata Containers with the QEMU VMM
  4043. #[crio.runtime.runtimes.kata-qemu]
  4044.  
  4045. # Kata Containers with the Firecracker VMM
  4046. #[crio.runtime.runtimes.kata-fc]
  4047.  
  4048. # The crio.image table contains settings pertaining to the management of OCI images.
  4049. #
  4050. # CRI-O reads its configured registries defaults from the system wide
  4051. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  4052. # you want to modify just CRI-O, you can change the registries configuration in
  4053. # this file. Otherwise, leave insecure_registries and registries commented out to
  4054. # use the system's defaults from /etc/containers/registries.conf.
  4055. [crio.image]
  4056.  
  4057. # Default transport for pulling images from a remote container storage.
  4058. # default_transport = "docker://"
  4059.  
  4060. # The path to a file containing credentials necessary for pulling images from
  4061. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  4062. global_auth_file = "/var/lib/kubelet/config.json"
  4063.  
  4064. # The image used to instantiate infra containers.
  4065. # This option supports live configuration reload.
  4066. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  4067.  
  4068. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  4069.  
  4070. # The path to a file containing credentials specific for pulling the pause_image from
  4071. # above. The file is similar to that of /var/lib/kubelet/config.json
  4072. # This option supports live configuration reload.
  4073. pause_image_auth_file = "/var/lib/kubelet/config.json"
  4074.  
  4075. # The command to run to have a container stay in the paused state.
  4076. # This option supports live configuration reload.
  4077. pause_command = "/usr/bin/pod"
  4078.  
  4079. # Path to the file which decides what sort of policy we use when deciding
  4080. # whether or not to trust an image that we've pulled. It is not recommended that
  4081. # this option be used, as the default behavior of using the system-wide default
  4082. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  4083. # refer to containers-policy.json(5) for more details.
  4084. # signature_policy = ""
  4085.  
  4086. # List of registries to skip TLS verification for pulling images. Please
  4087. # consider configuring the registries via /etc/containers/registries.conf before
  4088. # changing them here.
  4089. #insecure_registries = "[]"
  4090.  
  4091. # Controls how image volumes are handled. The valid values are mkdir, bind and
  4092. # ignore; the latter will ignore volumes entirely.
  4093. # image_volumes = "mkdir"
  4094.  
  4095. # List of registries to be used when pulling an unqualified image (e.g.,
  4096. # "alpine:latest"). By default, registries is set to "docker.io" for
  4097. # compatibility reasons. Depending on your workload and usecase you may add more
  4098. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  4099. # "registry.opensuse.org", etc.).
  4100. #registries = [
  4101. # ]
  4102.  
  4103.  
  4104. # The crio.network table containers settings pertaining to the management of
  4105. # CNI plugins.
  4106. [crio.network]
  4107.  
  4108. # Path to the directory where CNI configuration files are located.
  4109. # Note this default is changed from the RPM.
  4110. network_dir = "/etc/kubernetes/cni/net.d/"
  4111.  
  4112. # Paths to directories where CNI plugin binaries are located.
  4113. # Note this default is changed from the RPM.
  4114. plugin_dirs = [
  4115. "/var/lib/cni/bin",
  4116. ]
  4117.  
  4118. # A necessary configuration for Prometheus based metrics retrieval
  4119. [crio.metrics]
  4120.  
  4121. # Globally enable or disable metrics support.
  4122. enable_metrics = true
  4123.  
  4124. # The port on which the metrics server will listen.
  4125. metrics_port = 9537
  4126.  
  4127.  
  4128. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  4129.  
  4130. # The path to a file containing credentials specific for pulling the pause_image from
  4131. # above. The file is similar to that of /var/lib/kubelet/config.json
  4132. # This option supports live configuration reload.
  4133. pause_image_auth_file = "/var/lib/kubelet/config.json"
  4134.  
  4135. # The command to run to have a container stay in the paused state.
  4136. # This option supports live configuration reload.
  4137. pause_command = "/usr/bin/pod"
  4138.  
  4139. # Path to the file which decides what sort of policy we use when deciding
  4140. # whether or not to trust an image that we've pulled. It is not recommended that
  4141. # this option be used, as the default behavior of using the system-wide default
  4142. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  4143. # refer to containers-policy.json(5) for more details.
  4144. # signature_policy = ""
  4145.  
  4146. # List of registries to skip TLS verification for pulling images. Please
  4147. # consider configuring the registries via /etc/containers/registries.conf before
  4148. # changing them here.
  4149. #insecure_registries = "[]"
  4150.  
  4151. # Controls how image volumes are handled. The valid values are mkdir, bind and
  4152. # ignore; the latter will ignore volumes entirely.
  4153. # image_volumes = "mkdir"
  4154.  
  4155. # List of registries to be used when pulling an unqualified image (e.g.,
  4156. # "alpine:latest"). By default, registries is set to "docker.io" for
  4157. # compatibility reasons. Depending on your workload and usecase you may add more
  4158. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  4159. # "registry.opensuse.org", etc.).
  4160. #registries = [
  4161. # ]
  4162.  
  4163.  
  4164. # The crio.network table containers settings pertaining to the management of
  4165. # CNI plugins.
  4166. [crio.network]
  4167.  
  4168. # Path to the directory where CNI configuration files are located.
  4169. # Note this default is changed from the RPM.
  4170. network_dir = "/etc/kubernetes/cni/net.d/"
  4171.  
  4172. # Paths to directories where CNI plugin binaries are located.
  4173. # Note this default is changed from the RPM.
  4174. plugin_dirs = [
  4175. "/var/lib/cni/bin",
  4176. ]
  4177.  
  4178. # A necessary configuration for Prometheus based metrics retrieval
  4179. [crio.metrics]
  4180.  
  4181. # Globally enable or disable metrics support.
  4182. enable_metrics = true
  4183.  
  4184. # The port on which the metrics server will listen.
  4185. metrics_port = 9537
  4186.  
  4187.  
  4188. E0115 17:31:05.745307 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  4189. I0115 17:32:05.757302 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  4190. I0115 17:32:05.757324 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  4191. I0115 17:32:05.762332 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  4192. I0115 17:32:05.762353 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  4193. I0115 17:32:05.771707 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  4194. E0115 17:32:05.772626 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  4195. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  4196. # daemon, but in a TOML format that can be more easily modified and versioned.
  4197. #
  4198. # Please refer to crio.conf(5) for details of all configuration options.
  4199.  
  4200. # CRI-O supports partial configuration reload during runtime, which can be
  4201. # done by sending SIGHUP to the running process. Currently supported options
  4202. # are explicitly mentioned with: 'This option supports live configuration
  4203. # reload'.
  4204.  
  4205. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  4206. # located at /etc/containers/storage.conf. Modify this storage configuration if
  4207. # you want to change the system's defaults. If you want to modify storage just
  4208. # for CRI-O, you can change the storage configuration options here.
  4209. [crio]
  4210.  
  4211. # Path to the "root directory". CRI-O stores all of its data, including
  4212. # containers images, in this directory.
  4213. #root = "/var/lib/containers/storage"
  4214.  
  4215. # Path to the "run directory". CRI-O stores all of its state in this directory.
  4216. #runroot = "/run/user/1000"
  4217.  
  4218. # Storage driver used to manage the storage of images and containers. Please
  4219. # refer to containers-storage.conf(5) to see all available storage drivers.
  4220. #storage_driver = "overlay"
  4221.  
  4222. # List to pass options to the storage driver. Please refer to
  4223. # containers-storage.conf(5) to see all available storage options.
  4224. #storage_option = [
  4225. #]
  4226.  
  4227. # The default log directory where all logs will go unless directly specified by
  4228. # the kubelet. The log directory specified must be an absolute directory.
  4229. # log_dir = "/var/log/crio/pods"
  4230.  
  4231. # Location for CRI-O to lay down the version file
  4232. # version_file = "/var/lib/crio/version"
  4233.  
  4234. # The crio.api table contains settings for the kubelet/gRPC interface.
  4235. [crio.api]
  4236.  
  4237. # Path to AF_LOCAL socket on which CRI-O will listen.
  4238. # listen = "/var/run/crio/crio.sock"
  4239.  
  4240. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  4241. # host_ip = ""
  4242.  
  4243. # IP address on which the stream server will listen.
  4244. stream_address = ""
  4245.  
  4246. # The port on which the stream server will listen.
  4247. stream_port = "10010"
  4248.  
  4249. # Enable encrypted TLS transport of the stream server.
  4250. # stream_enable_tls = false
  4251.  
  4252. # Path to the x509 certificate file used to serve the encrypted stream. This
  4253. # file can change, and CRI-O will automatically pick up the changes within 5
  4254. # minutes.
  4255. # stream_tls_cert = ""
  4256.  
  4257. # Path to the key file used to serve the encrypted stream. This file can
  4258. # change and CRI-O will automatically pick up the changes within 5 minutes.
  4259. # stream_tls_key = ""
  4260.  
  4261. # Path to the x509 CA(s) file used to verify and authenticate client
  4262. # communication with the encrypted stream. This file can change and CRI-O will
  4263. # automatically pick up the changes within 5 minutes.
  4264. # stream_tls_ca = ""
  4265.  
  4266. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  4267. # grpc_max_send_msg_size = 16777216
  4268.  
  4269. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  4270. # grpc_max_recv_msg_size = 16777216
  4271.  
  4272. # The crio.runtime table contains settings pertaining to the OCI runtime used
  4273. # and options for how to set up and manage the OCI runtime.
  4274. [crio.runtime]
  4275.  
  4276. # A list of ulimits to be set in containers by default, specified as
  4277. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  4278. # "nofile=1024:2048"
  4279. # If nothing is set here, settings will be inherited from the CRI-O daemon
  4280. #default_ulimits = [
  4281. #]
  4282.  
  4283. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  4284. # The name is matched against the runtimes map below.
  4285. # default_runtime = "runc"
  4286.  
  4287. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  4288. # no_pivot = false
  4289.  
  4290. # Path to the conmon binary, used for monitoring the OCI runtime.
  4291. # Will be searched for using $PATH if empty.
  4292. conmon = "/usr/libexec/crio/conmon"
  4293.  
  4294. # Cgroup setting for conmon
  4295. conmon_cgroup = "pod"
  4296.  
  4297. # Environment variable list for the conmon process, used for passing necessary
  4298. # environment variables to conmon or the runtime.
  4299. # conmon_env = [
  4300. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  4301. # ]
  4302.  
  4303. # If true, SELinux will be used for pod separation on the host.
  4304. # selinux = true
  4305.  
  4306. # Path to the seccomp.json profile which is used as the default seccomp profile
  4307. # for the runtime. If not specified, then the internal default seccomp profile
  4308. # will be used.
  4309. # seccomp_profile = "/etc/crio/seccomp.json"
  4310.  
  4311. # Used to change the name of the default AppArmor profile of CRI-O. The default
  4312. # profile name is "crio-default-" followed by the version string of CRI-O.
  4313. apparmor_profile = "crio-default"
  4314.  
  4315. # Cgroup management implementation used for the runtime.
  4316. cgroup_manager = "systemd"
  4317.  
  4318. # List of default capabilities for containers. If it is empty or commented out,
  4319. # only the capabilities defined in the containers json file by the user/kube
  4320. # will be added.
  4321. # default_capabilities = [
  4322. # "CHOWN",
  4323. # "DAC_OVERRIDE",
  4324. # "FSETID",
  4325. # "FOWNER",
  4326. # "NET_RAW",
  4327. # "SETGID",
  4328. # "SETUID",
  4329. # "SETPCAP",
  4330. # "NET_BIND_SERVICE",
  4331. # "SYS_CHROOT",
  4332. # "KILL",
  4333. # ]
  4334.  
  4335. # List of default sysctls. If it is empty or commented out, only the sysctls
  4336. # defined in the container json file by the user/kube will be added.
  4337. # default_sysctls = [
  4338. # ]
  4339.  
  4340. # List of additional devices. specified as
  4341. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  4342. #If it is empty or commented out, only the devices
  4343. # defined in the container json file by the user/kube will be added.
  4344. # additional_devices = [
  4345. # ]
  4346.  
  4347. # Path to OCI hooks directories for automatically executed hooks.
  4348. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  4349. # so we add /etc/containers/oci/hooks.d as well
  4350. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  4351. hooks_dir = [
  4352. "/etc/containers/oci/hooks.d",
  4353. ]
  4354.  
  4355. # List of default mounts for each container. **Deprecated:** this option will
  4356. # be removed in future versions in favor of default_mounts_file.
  4357. # default_mounts = [
  4358. # "/usr/share/rhel/secrets:/run/secrets",
  4359. # ]
  4360.  
  4361. # Path to the file specifying the defaults mounts for each container. The
  4362. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  4363. # its default mounts from the following two files:
  4364. #
  4365. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  4366. # override file, where users can either add in their own default mounts, or
  4367. # override the default mounts shipped with the package.
  4368. #
  4369. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  4370. # mounts. If you want CRI-O to read from a different, specific mounts file,
  4371. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  4372. # only add mounts it finds in this file.
  4373. #
  4374. #default_mounts_file = ""
  4375.  
  4376. # Maximum number of processes allowed in a container.
  4377. # pids_limit = 1024
  4378.  
  4379. # Maximum sized allowed for the container log file. Negative numbers indicate
  4380. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  4381. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  4382. # limit is never exceeded.
  4383. # log_size_max = -1
  4384.  
  4385. # Whether container output should be logged to journald in addition to the kuberentes log file
  4386. # log_to_journald = false
  4387.  
  4388. # Path to directory in which container exit files are written to by conmon.
  4389. # container_exits_dir = "/var/run/crio/exits"
  4390.  
  4391. # Path to directory for container attach sockets.
  4392. # container_attach_socket_dir = "/var/run/crio"
  4393.  
  4394. # The prefix to use for the source of the bind mounts.
  4395. # bind_mount_prefix = ""
  4396.  
  4397. # If set to true, all containers will run in read-only mode.
  4398. # read_only = false
  4399.  
  4400. # Changes the verbosity of the logs based on the level it is set to. Options
  4401. # are fatal, panic, error, warn, info, and debug. This option supports live
  4402. # configuration reload.
  4403. # log_level = "error"
  4404.  
  4405. # The UID mappings for the user namespace of each container. A range is
  4406. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  4407. # separated by comma.
  4408. # uid_mappings = ""
  4409.  
  4410. # The GID mappings for the user namespace of each container. A range is
  4411. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  4412. # separated by comma.
  4413. # gid_mappings = ""
  4414.  
  4415. # The minimal amount of time in seconds to wait before issuing a timeout
  4416. # regarding the proper termination of the container.
  4417. # ctr_stop_timeout = 0
  4418.  
  4419. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  4420. # and manage its lifecycle.
  4421. # manage_network_ns_lifecycle = false
  4422.  
  4423. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  4424. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  4425. # If no runtime_handler is provided, the runtime will be picked based on the level
  4426. # of trust of the workload. Each entry in the table should follow the format:
  4427. #
  4428. #[crio.runtime.runtimes.runtime-handler]
  4429. # runtime_path = "/path/to/the/executable"
  4430. # runtime_type = "oci"
  4431. # runtime_root = "/path/to/the/root"
  4432. #
  4433. # Where:
  4434. # - runtime-handler: name used to identify the runtime
  4435. # - runtime_path (optional, string): absolute path to the runtime executable in
  4436. # the host filesystem. If omitted, the runtime-handler identifier should match
  4437. # the runtime executable name, and the runtime executable should be placed
  4438. # in $PATH.
  4439. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  4440. # omitted, an "oci" runtime is assumed.
  4441. # - runtime_root (optional, string): root directory for storage of containers
  4442. # state.
  4443.  
  4444.  
  4445. # [crio.runtime.runtimes.runc]
  4446. # runtime_path = ""
  4447. # runtime_type = "oci"
  4448. # runtime_root = "/run/runc"
  4449.  
  4450.  
  4451. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  4452. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  4453. # surface and mitigating the consequences of containers breakout.
  4454.  
  4455. # Kata Containers with the default configured VMM
  4456. #[crio.runtime.runtimes.kata-runtime]
  4457.  
  4458. # Kata Containers with the QEMU VMM
  4459. #[crio.runtime.runtimes.kata-qemu]
  4460.  
  4461. # Kata Containers with the Firecracker VMM
  4462. #[crio.runtime.runtimes.kata-fc]
  4463.  
  4464. # The crio.image table contains settings pertaining to the management of OCI images.
  4465. #
  4466. # CRI-O reads its configured registries defaults from the system wide
  4467. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  4468. # you want to modify just CRI-O, you can change the registries configuration in
  4469. # this file. Otherwise, leave insecure_registries and registries commented out to
  4470. # use the system's defaults from /etc/containers/registries.conf.
  4471. [crio.image]
  4472.  
  4473. # Default transport for pulling images from a remote container storage.
  4474. # default_transport = "docker://"
  4475.  
  4476. # The path to a file containing credentials necessary for pulling images from
  4477. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  4478. global_auth_file = "/var/lib/kubelet/config.json"
  4479.  
  4480. # The image used to instantiate infra containers.
  4481. # This option supports live configuration reload.
  4482. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  4483.  
  4484. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  4485.  
  4486. # The path to a file containing credentials specific for pulling the pause_image from
  4487. # above. The file is similar to that of /var/lib/kubelet/config.json
  4488. # This option supports live configuration reload.
  4489. pause_image_auth_file = "/var/lib/kubelet/config.json"
  4490.  
  4491. # The command to run to have a container stay in the paused state.
  4492. # This option supports live configuration reload.
  4493. pause_command = "/usr/bin/pod"
  4494.  
  4495. # Path to the file which decides what sort of policy we use when deciding
  4496. # whether or not to trust an image that we've pulled. It is not recommended that
  4497. # this option be used, as the default behavior of using the system-wide default
  4498. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  4499. # refer to containers-policy.json(5) for more details.
  4500. # signature_policy = ""
  4501.  
  4502. # List of registries to skip TLS verification for pulling images. Please
  4503. # consider configuring the registries via /etc/containers/registries.conf before
  4504. # changing them here.
  4505. #insecure_registries = "[]"
  4506.  
  4507. # Controls how image volumes are handled. The valid values are mkdir, bind and
  4508. # ignore; the latter will ignore volumes entirely.
  4509. # image_volumes = "mkdir"
  4510.  
  4511. # List of registries to be used when pulling an unqualified image (e.g.,
  4512. # "alpine:latest"). By default, registries is set to "docker.io" for
  4513. # compatibility reasons. Depending on your workload and usecase you may add more
  4514. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  4515. # "registry.opensuse.org", etc.).
  4516. #registries = [
  4517. # ]
  4518.  
  4519.  
  4520. # The crio.network table containers settings pertaining to the management of
  4521. # CNI plugins.
  4522. [crio.network]
  4523.  
  4524. # Path to the directory where CNI configuration files are located.
  4525. # Note this default is changed from the RPM.
  4526. network_dir = "/etc/kubernetes/cni/net.d/"
  4527.  
  4528. # Paths to directories where CNI plugin binaries are located.
  4529. # Note this default is changed from the RPM.
  4530. plugin_dirs = [
  4531. "/var/lib/cni/bin",
  4532. ]
  4533.  
  4534. # A necessary configuration for Prometheus based metrics retrieval
  4535. [crio.metrics]
  4536.  
  4537. # Globally enable or disable metrics support.
  4538. enable_metrics = true
  4539.  
  4540. # The port on which the metrics server will listen.
  4541. metrics_port = 9537
  4542.  
  4543.  
  4544. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  4545.  
  4546. # The path to a file containing credentials specific for pulling the pause_image from
  4547. # above. The file is similar to that of /var/lib/kubelet/config.json
  4548. # This option supports live configuration reload.
  4549. pause_image_auth_file = "/var/lib/kubelet/config.json"
  4550.  
  4551. # The command to run to have a container stay in the paused state.
  4552. # This option supports live configuration reload.
  4553. pause_command = "/usr/bin/pod"
  4554.  
  4555. # Path to the file which decides what sort of policy we use when deciding
  4556. # whether or not to trust an image that we've pulled. It is not recommended that
  4557. # this option be used, as the default behavior of using the system-wide default
  4558. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  4559. # refer to containers-policy.json(5) for more details.
  4560. # signature_policy = ""
  4561.  
  4562. # List of registries to skip TLS verification for pulling images. Please
  4563. # consider configuring the registries via /etc/containers/registries.conf before
  4564. # changing them here.
  4565. #insecure_registries = "[]"
  4566.  
  4567. # Controls how image volumes are handled. The valid values are mkdir, bind and
  4568. # ignore; the latter will ignore volumes entirely.
  4569. # image_volumes = "mkdir"
  4570.  
  4571. # List of registries to be used when pulling an unqualified image (e.g.,
  4572. # "alpine:latest"). By default, registries is set to "docker.io" for
  4573. # compatibility reasons. Depending on your workload and usecase you may add more
  4574. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  4575. # "registry.opensuse.org", etc.).
  4576. #registries = [
  4577. # ]
  4578.  
  4579.  
  4580. # The crio.network table containers settings pertaining to the management of
  4581. # CNI plugins.
  4582. [crio.network]
  4583.  
  4584. # Path to the directory where CNI configuration files are located.
  4585. # Note this default is changed from the RPM.
  4586. network_dir = "/etc/kubernetes/cni/net.d/"
  4587.  
  4588. # Paths to directories where CNI plugin binaries are located.
  4589. # Note this default is changed from the RPM.
  4590. plugin_dirs = [
  4591. "/var/lib/cni/bin",
  4592. ]
  4593.  
  4594. # A necessary configuration for Prometheus based metrics retrieval
  4595. [crio.metrics]
  4596.  
  4597. # Globally enable or disable metrics support.
  4598. enable_metrics = true
  4599.  
  4600. # The port on which the metrics server will listen.
  4601. metrics_port = 9537
  4602.  
  4603.  
  4604. E0115 17:32:05.772666 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  4605. I0115 17:33:05.784886 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  4606. I0115 17:33:05.784911 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  4607. I0115 17:33:05.790280 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  4608. I0115 17:33:05.790301 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  4609. I0115 17:33:05.800499 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  4610. E0115 17:33:05.801180 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  4611. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  4612. # daemon, but in a TOML format that can be more easily modified and versioned.
  4613. #
  4614. # Please refer to crio.conf(5) for details of all configuration options.
  4615.  
  4616. # CRI-O supports partial configuration reload during runtime, which can be
  4617. # done by sending SIGHUP to the running process. Currently supported options
  4618. # are explicitly mentioned with: 'This option supports live configuration
  4619. # reload'.
  4620.  
  4621. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  4622. # located at /etc/containers/storage.conf. Modify this storage configuration if
  4623. # you want to change the system's defaults. If you want to modify storage just
  4624. # for CRI-O, you can change the storage configuration options here.
  4625. [crio]
  4626.  
  4627. # Path to the "root directory". CRI-O stores all of its data, including
  4628. # containers images, in this directory.
  4629. #root = "/var/lib/containers/storage"
  4630.  
  4631. # Path to the "run directory". CRI-O stores all of its state in this directory.
  4632. #runroot = "/run/user/1000"
  4633.  
  4634. # Storage driver used to manage the storage of images and containers. Please
  4635. # refer to containers-storage.conf(5) to see all available storage drivers.
  4636. #storage_driver = "overlay"
  4637.  
  4638. # List to pass options to the storage driver. Please refer to
  4639. # containers-storage.conf(5) to see all available storage options.
  4640. #storage_option = [
  4641. #]
  4642.  
  4643. # The default log directory where all logs will go unless directly specified by
  4644. # the kubelet. The log directory specified must be an absolute directory.
  4645. # log_dir = "/var/log/crio/pods"
  4646.  
  4647. # Location for CRI-O to lay down the version file
  4648. # version_file = "/var/lib/crio/version"
  4649.  
  4650. # The crio.api table contains settings for the kubelet/gRPC interface.
  4651. [crio.api]
  4652.  
  4653. # Path to AF_LOCAL socket on which CRI-O will listen.
  4654. # listen = "/var/run/crio/crio.sock"
  4655.  
  4656. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  4657. # host_ip = ""
  4658.  
  4659. # IP address on which the stream server will listen.
  4660. stream_address = ""
  4661.  
  4662. # The port on which the stream server will listen.
  4663. stream_port = "10010"
  4664.  
  4665. # Enable encrypted TLS transport of the stream server.
  4666. # stream_enable_tls = false
  4667.  
  4668. # Path to the x509 certificate file used to serve the encrypted stream. This
  4669. # file can change, and CRI-O will automatically pick up the changes within 5
  4670. # minutes.
  4671. # stream_tls_cert = ""
  4672.  
  4673. # Path to the key file used to serve the encrypted stream. This file can
  4674. # change and CRI-O will automatically pick up the changes within 5 minutes.
  4675. # stream_tls_key = ""
  4676.  
  4677. # Path to the x509 CA(s) file used to verify and authenticate client
  4678. # communication with the encrypted stream. This file can change and CRI-O will
  4679. # automatically pick up the changes within 5 minutes.
  4680. # stream_tls_ca = ""
  4681.  
  4682. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  4683. # grpc_max_send_msg_size = 16777216
  4684.  
  4685. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  4686. # grpc_max_recv_msg_size = 16777216
  4687.  
  4688. # The crio.runtime table contains settings pertaining to the OCI runtime used
  4689. # and options for how to set up and manage the OCI runtime.
  4690. [crio.runtime]
  4691.  
  4692. # A list of ulimits to be set in containers by default, specified as
  4693. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  4694. # "nofile=1024:2048"
  4695. # If nothing is set here, settings will be inherited from the CRI-O daemon
  4696. #default_ulimits = [
  4697. #]
  4698.  
  4699. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  4700. # The name is matched against the runtimes map below.
  4701. # default_runtime = "runc"
  4702.  
  4703. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  4704. # no_pivot = false
  4705.  
  4706. # Path to the conmon binary, used for monitoring the OCI runtime.
  4707. # Will be searched for using $PATH if empty.
  4708. conmon = "/usr/libexec/crio/conmon"
  4709.  
  4710. # Cgroup setting for conmon
  4711. conmon_cgroup = "pod"
  4712.  
  4713. # Environment variable list for the conmon process, used for passing necessary
  4714. # environment variables to conmon or the runtime.
  4715. # conmon_env = [
  4716. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  4717. # ]
  4718.  
  4719. # If true, SELinux will be used for pod separation on the host.
  4720. # selinux = true
  4721.  
  4722. # Path to the seccomp.json profile which is used as the default seccomp profile
  4723. # for the runtime. If not specified, then the internal default seccomp profile
  4724. # will be used.
  4725. # seccomp_profile = "/etc/crio/seccomp.json"
  4726.  
  4727. # Used to change the name of the default AppArmor profile of CRI-O. The default
  4728. # profile name is "crio-default-" followed by the version string of CRI-O.
  4729. apparmor_profile = "crio-default"
  4730.  
  4731. # Cgroup management implementation used for the runtime.
  4732. cgroup_manager = "systemd"
  4733.  
  4734. # List of default capabilities for containers. If it is empty or commented out,
  4735. # only the capabilities defined in the containers json file by the user/kube
  4736. # will be added.
  4737. # default_capabilities = [
  4738. # "CHOWN",
  4739. # "DAC_OVERRIDE",
  4740. # "FSETID",
  4741. # "FOWNER",
  4742. # "NET_RAW",
  4743. # "SETGID",
  4744. # "SETUID",
  4745. # "SETPCAP",
  4746. # "NET_BIND_SERVICE",
  4747. # "SYS_CHROOT",
  4748. # "KILL",
  4749. # ]
  4750.  
  4751. # List of default sysctls. If it is empty or commented out, only the sysctls
  4752. # defined in the container json file by the user/kube will be added.
  4753. # default_sysctls = [
  4754. # ]
  4755.  
  4756. # List of additional devices. specified as
  4757. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  4758. #If it is empty or commented out, only the devices
  4759. # defined in the container json file by the user/kube will be added.
  4760. # additional_devices = [
  4761. # ]
  4762.  
  4763. # Path to OCI hooks directories for automatically executed hooks.
  4764. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  4765. # so we add /etc/containers/oci/hooks.d as well
  4766. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  4767. hooks_dir = [
  4768. "/etc/containers/oci/hooks.d",
  4769. ]
  4770.  
  4771. # List of default mounts for each container. **Deprecated:** this option will
  4772. # be removed in future versions in favor of default_mounts_file.
  4773. # default_mounts = [
  4774. # "/usr/share/rhel/secrets:/run/secrets",
  4775. # ]
  4776.  
  4777. # Path to the file specifying the defaults mounts for each container. The
  4778. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  4779. # its default mounts from the following two files:
  4780. #
  4781. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  4782. # override file, where users can either add in their own default mounts, or
  4783. # override the default mounts shipped with the package.
  4784. #
  4785. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  4786. # mounts. If you want CRI-O to read from a different, specific mounts file,
  4787. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  4788. # only add mounts it finds in this file.
  4789. #
  4790. #default_mounts_file = ""
  4791.  
  4792. # Maximum number of processes allowed in a container.
  4793. # pids_limit = 1024
  4794.  
  4795. # Maximum sized allowed for the container log file. Negative numbers indicate
  4796. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  4797. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  4798. # limit is never exceeded.
  4799. # log_size_max = -1
  4800.  
  4801. # Whether container output should be logged to journald in addition to the kuberentes log file
  4802. # log_to_journald = false
  4803.  
  4804. # Path to directory in which container exit files are written to by conmon.
  4805. # container_exits_dir = "/var/run/crio/exits"
  4806.  
  4807. # Path to directory for container attach sockets.
  4808. # container_attach_socket_dir = "/var/run/crio"
  4809.  
  4810. # The prefix to use for the source of the bind mounts.
  4811. # bind_mount_prefix = ""
  4812.  
  4813. # If set to true, all containers will run in read-only mode.
  4814. # read_only = false
  4815.  
  4816. # Changes the verbosity of the logs based on the level it is set to. Options
  4817. # are fatal, panic, error, warn, info, and debug. This option supports live
  4818. # configuration reload.
  4819. # log_level = "error"
  4820.  
  4821. # The UID mappings for the user namespace of each container. A range is
  4822. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  4823. # separated by comma.
  4824. # uid_mappings = ""
  4825.  
  4826. # The GID mappings for the user namespace of each container. A range is
  4827. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  4828. # separated by comma.
  4829. # gid_mappings = ""
  4830.  
  4831. # The minimal amount of time in seconds to wait before issuing a timeout
  4832. # regarding the proper termination of the container.
  4833. # ctr_stop_timeout = 0
  4834.  
  4835. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  4836. # and manage its lifecycle.
  4837. # manage_network_ns_lifecycle = false
  4838.  
  4839. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  4840. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  4841. # If no runtime_handler is provided, the runtime will be picked based on the level
  4842. # of trust of the workload. Each entry in the table should follow the format:
  4843. #
  4844. #[crio.runtime.runtimes.runtime-handler]
  4845. # runtime_path = "/path/to/the/executable"
  4846. # runtime_type = "oci"
  4847. # runtime_root = "/path/to/the/root"
  4848. #
  4849. # Where:
  4850. # - runtime-handler: name used to identify the runtime
  4851. # - runtime_path (optional, string): absolute path to the runtime executable in
  4852. # the host filesystem. If omitted, the runtime-handler identifier should match
  4853. # the runtime executable name, and the runtime executable should be placed
  4854. # in $PATH.
  4855. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  4856. # omitted, an "oci" runtime is assumed.
  4857. # - runtime_root (optional, string): root directory for storage of containers
  4858. # state.
  4859.  
  4860.  
  4861. # [crio.runtime.runtimes.runc]
  4862. # runtime_path = ""
  4863. # runtime_type = "oci"
  4864. # runtime_root = "/run/runc"
  4865.  
  4866.  
  4867. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  4868. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  4869. # surface and mitigating the consequences of containers breakout.
  4870.  
  4871. # Kata Containers with the default configured VMM
  4872. #[crio.runtime.runtimes.kata-runtime]
  4873.  
  4874. # Kata Containers with the QEMU VMM
  4875. #[crio.runtime.runtimes.kata-qemu]
  4876.  
  4877. # Kata Containers with the Firecracker VMM
  4878. #[crio.runtime.runtimes.kata-fc]
  4879.  
  4880. # The crio.image table contains settings pertaining to the management of OCI images.
  4881. #
  4882. # CRI-O reads its configured registries defaults from the system wide
  4883. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  4884. # you want to modify just CRI-O, you can change the registries configuration in
  4885. # this file. Otherwise, leave insecure_registries and registries commented out to
  4886. # use the system's defaults from /etc/containers/registries.conf.
  4887. [crio.image]
  4888.  
  4889. # Default transport for pulling images from a remote container storage.
  4890. # default_transport = "docker://"
  4891.  
  4892. # The path to a file containing credentials necessary for pulling images from
  4893. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  4894. global_auth_file = "/var/lib/kubelet/config.json"
  4895.  
  4896. # The image used to instantiate infra containers.
  4897. # This option supports live configuration reload.
  4898. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  4899.  
  4900. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  4901.  
  4902. # The path to a file containing credentials specific for pulling the pause_image from
  4903. # above. The file is similar to that of /var/lib/kubelet/config.json
  4904. # This option supports live configuration reload.
  4905. pause_image_auth_file = "/var/lib/kubelet/config.json"
  4906.  
  4907. # The command to run to have a container stay in the paused state.
  4908. # This option supports live configuration reload.
  4909. pause_command = "/usr/bin/pod"
  4910.  
  4911. # Path to the file which decides what sort of policy we use when deciding
  4912. # whether or not to trust an image that we've pulled. It is not recommended that
  4913. # this option be used, as the default behavior of using the system-wide default
  4914. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  4915. # refer to containers-policy.json(5) for more details.
  4916. # signature_policy = ""
  4917.  
  4918. # List of registries to skip TLS verification for pulling images. Please
  4919. # consider configuring the registries via /etc/containers/registries.conf before
  4920. # changing them here.
  4921. #insecure_registries = "[]"
  4922.  
  4923. # Controls how image volumes are handled. The valid values are mkdir, bind and
  4924. # ignore; the latter will ignore volumes entirely.
  4925. # image_volumes = "mkdir"
  4926.  
  4927. # List of registries to be used when pulling an unqualified image (e.g.,
  4928. # "alpine:latest"). By default, registries is set to "docker.io" for
  4929. # compatibility reasons. Depending on your workload and usecase you may add more
  4930. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  4931. # "registry.opensuse.org", etc.).
  4932. #registries = [
  4933. # ]
  4934.  
  4935.  
  4936. # The crio.network table containers settings pertaining to the management of
  4937. # CNI plugins.
  4938. [crio.network]
  4939.  
  4940. # Path to the directory where CNI configuration files are located.
  4941. # Note this default is changed from the RPM.
  4942. network_dir = "/etc/kubernetes/cni/net.d/"
  4943.  
  4944. # Paths to directories where CNI plugin binaries are located.
  4945. # Note this default is changed from the RPM.
  4946. plugin_dirs = [
  4947. "/var/lib/cni/bin",
  4948. ]
  4949.  
  4950. # A necessary configuration for Prometheus based metrics retrieval
  4951. [crio.metrics]
  4952.  
  4953. # Globally enable or disable metrics support.
  4954. enable_metrics = true
  4955.  
  4956. # The port on which the metrics server will listen.
  4957. metrics_port = 9537
  4958.  
  4959.  
  4960. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  4961.  
  4962. # The path to a file containing credentials specific for pulling the pause_image from
  4963. # above. The file is similar to that of /var/lib/kubelet/config.json
  4964. # This option supports live configuration reload.
  4965. pause_image_auth_file = "/var/lib/kubelet/config.json"
  4966.  
  4967. # The command to run to have a container stay in the paused state.
  4968. # This option supports live configuration reload.
  4969. pause_command = "/usr/bin/pod"
  4970.  
  4971. # Path to the file which decides what sort of policy we use when deciding
  4972. # whether or not to trust an image that we've pulled. It is not recommended that
  4973. # this option be used, as the default behavior of using the system-wide default
  4974. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  4975. # refer to containers-policy.json(5) for more details.
  4976. # signature_policy = ""
  4977.  
  4978. # List of registries to skip TLS verification for pulling images. Please
  4979. # consider configuring the registries via /etc/containers/registries.conf before
  4980. # changing them here.
  4981. #insecure_registries = "[]"
  4982.  
  4983. # Controls how image volumes are handled. The valid values are mkdir, bind and
  4984. # ignore; the latter will ignore volumes entirely.
  4985. # image_volumes = "mkdir"
  4986.  
  4987. # List of registries to be used when pulling an unqualified image (e.g.,
  4988. # "alpine:latest"). By default, registries is set to "docker.io" for
  4989. # compatibility reasons. Depending on your workload and usecase you may add more
  4990. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  4991. # "registry.opensuse.org", etc.).
  4992. #registries = [
  4993. # ]
  4994.  
  4995.  
  4996. # The crio.network table containers settings pertaining to the management of
  4997. # CNI plugins.
  4998. [crio.network]
  4999.  
  5000. # Path to the directory where CNI configuration files are located.
  5001. # Note this default is changed from the RPM.
  5002. network_dir = "/etc/kubernetes/cni/net.d/"
  5003.  
  5004. # Paths to directories where CNI plugin binaries are located.
  5005. # Note this default is changed from the RPM.
  5006. plugin_dirs = [
  5007. "/var/lib/cni/bin",
  5008. ]
  5009.  
  5010. # A necessary configuration for Prometheus based metrics retrieval
  5011. [crio.metrics]
  5012.  
  5013. # Globally enable or disable metrics support.
  5014. enable_metrics = true
  5015.  
  5016. # The port on which the metrics server will listen.
  5017. metrics_port = 9537
  5018.  
  5019.  
  5020. E0115 17:33:05.801215 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5021. I0115 17:34:05.813392 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5022. I0115 17:34:05.813429 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  5023. I0115 17:34:05.818481 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  5024. I0115 17:34:05.818503 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  5025. I0115 17:34:05.827600 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5026. E0115 17:34:05.828310 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  5027. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  5028. # daemon, but in a TOML format that can be more easily modified and versioned.
  5029. #
  5030. # Please refer to crio.conf(5) for details of all configuration options.
  5031.  
  5032. # CRI-O supports partial configuration reload during runtime, which can be
  5033. # done by sending SIGHUP to the running process. Currently supported options
  5034. # are explicitly mentioned with: 'This option supports live configuration
  5035. # reload'.
  5036.  
  5037. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  5038. # located at /etc/containers/storage.conf. Modify this storage configuration if
  5039. # you want to change the system's defaults. If you want to modify storage just
  5040. # for CRI-O, you can change the storage configuration options here.
  5041. [crio]
  5042.  
  5043. # Path to the "root directory". CRI-O stores all of its data, including
  5044. # containers images, in this directory.
  5045. #root = "/var/lib/containers/storage"
  5046.  
  5047. # Path to the "run directory". CRI-O stores all of its state in this directory.
  5048. #runroot = "/run/user/1000"
  5049.  
  5050. # Storage driver used to manage the storage of images and containers. Please
  5051. # refer to containers-storage.conf(5) to see all available storage drivers.
  5052. #storage_driver = "overlay"
  5053.  
  5054. # List to pass options to the storage driver. Please refer to
  5055. # containers-storage.conf(5) to see all available storage options.
  5056. #storage_option = [
  5057. #]
  5058.  
  5059. # The default log directory where all logs will go unless directly specified by
  5060. # the kubelet. The log directory specified must be an absolute directory.
  5061. # log_dir = "/var/log/crio/pods"
  5062.  
  5063. # Location for CRI-O to lay down the version file
  5064. # version_file = "/var/lib/crio/version"
  5065.  
  5066. # The crio.api table contains settings for the kubelet/gRPC interface.
  5067. [crio.api]
  5068.  
  5069. # Path to AF_LOCAL socket on which CRI-O will listen.
  5070. # listen = "/var/run/crio/crio.sock"
  5071.  
  5072. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  5073. # host_ip = ""
  5074.  
  5075. # IP address on which the stream server will listen.
  5076. stream_address = ""
  5077.  
  5078. # The port on which the stream server will listen.
  5079. stream_port = "10010"
  5080.  
  5081. # Enable encrypted TLS transport of the stream server.
  5082. # stream_enable_tls = false
  5083.  
  5084. # Path to the x509 certificate file used to serve the encrypted stream. This
  5085. # file can change, and CRI-O will automatically pick up the changes within 5
  5086. # minutes.
  5087. # stream_tls_cert = ""
  5088.  
  5089. # Path to the key file used to serve the encrypted stream. This file can
  5090. # change and CRI-O will automatically pick up the changes within 5 minutes.
  5091. # stream_tls_key = ""
  5092.  
  5093. # Path to the x509 CA(s) file used to verify and authenticate client
  5094. # communication with the encrypted stream. This file can change and CRI-O will
  5095. # automatically pick up the changes within 5 minutes.
  5096. # stream_tls_ca = ""
  5097.  
  5098. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  5099. # grpc_max_send_msg_size = 16777216
  5100.  
  5101. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  5102. # grpc_max_recv_msg_size = 16777216
  5103.  
  5104. # The crio.runtime table contains settings pertaining to the OCI runtime used
  5105. # and options for how to set up and manage the OCI runtime.
  5106. [crio.runtime]
  5107.  
  5108. # A list of ulimits to be set in containers by default, specified as
  5109. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  5110. # "nofile=1024:2048"
  5111. # If nothing is set here, settings will be inherited from the CRI-O daemon
  5112. #default_ulimits = [
  5113. #]
  5114.  
  5115. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  5116. # The name is matched against the runtimes map below.
  5117. # default_runtime = "runc"
  5118.  
  5119. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  5120. # no_pivot = false
  5121.  
  5122. # Path to the conmon binary, used for monitoring the OCI runtime.
  5123. # Will be searched for using $PATH if empty.
  5124. conmon = "/usr/libexec/crio/conmon"
  5125.  
  5126. # Cgroup setting for conmon
  5127. conmon_cgroup = "pod"
  5128.  
  5129. # Environment variable list for the conmon process, used for passing necessary
  5130. # environment variables to conmon or the runtime.
  5131. # conmon_env = [
  5132. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  5133. # ]
  5134.  
  5135. # If true, SELinux will be used for pod separation on the host.
  5136. # selinux = true
  5137.  
  5138. # Path to the seccomp.json profile which is used as the default seccomp profile
  5139. # for the runtime. If not specified, then the internal default seccomp profile
  5140. # will be used.
  5141. # seccomp_profile = "/etc/crio/seccomp.json"
  5142.  
  5143. # Used to change the name of the default AppArmor profile of CRI-O. The default
  5144. # profile name is "crio-default-" followed by the version string of CRI-O.
  5145. apparmor_profile = "crio-default"
  5146.  
  5147. # Cgroup management implementation used for the runtime.
  5148. cgroup_manager = "systemd"
  5149.  
  5150. # List of default capabilities for containers. If it is empty or commented out,
  5151. # only the capabilities defined in the containers json file by the user/kube
  5152. # will be added.
  5153. # default_capabilities = [
  5154. # "CHOWN",
  5155. # "DAC_OVERRIDE",
  5156. # "FSETID",
  5157. # "FOWNER",
  5158. # "NET_RAW",
  5159. # "SETGID",
  5160. # "SETUID",
  5161. # "SETPCAP",
  5162. # "NET_BIND_SERVICE",
  5163. # "SYS_CHROOT",
  5164. # "KILL",
  5165. # ]
  5166.  
  5167. # List of default sysctls. If it is empty or commented out, only the sysctls
  5168. # defined in the container json file by the user/kube will be added.
  5169. # default_sysctls = [
  5170. # ]
  5171.  
  5172. # List of additional devices. specified as
  5173. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  5174. #If it is empty or commented out, only the devices
  5175. # defined in the container json file by the user/kube will be added.
  5176. # additional_devices = [
  5177. # ]
  5178.  
  5179. # Path to OCI hooks directories for automatically executed hooks.
  5180. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  5181. # so we add /etc/containers/oci/hooks.d as well
  5182. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  5183. hooks_dir = [
  5184. "/etc/containers/oci/hooks.d",
  5185. ]
  5186.  
  5187. # List of default mounts for each container. **Deprecated:** this option will
  5188. # be removed in future versions in favor of default_mounts_file.
  5189. # default_mounts = [
  5190. # "/usr/share/rhel/secrets:/run/secrets",
  5191. # ]
  5192.  
  5193. # Path to the file specifying the defaults mounts for each container. The
  5194. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  5195. # its default mounts from the following two files:
  5196. #
  5197. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  5198. # override file, where users can either add in their own default mounts, or
  5199. # override the default mounts shipped with the package.
  5200. #
  5201. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  5202. # mounts. If you want CRI-O to read from a different, specific mounts file,
  5203. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  5204. # only add mounts it finds in this file.
  5205. #
  5206. #default_mounts_file = ""
  5207.  
  5208. # Maximum number of processes allowed in a container.
  5209. # pids_limit = 1024
  5210.  
  5211. # Maximum sized allowed for the container log file. Negative numbers indicate
  5212. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  5213. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  5214. # limit is never exceeded.
  5215. # log_size_max = -1
  5216.  
  5217. # Whether container output should be logged to journald in addition to the kuberentes log file
  5218. # log_to_journald = false
  5219.  
  5220. # Path to directory in which container exit files are written to by conmon.
  5221. # container_exits_dir = "/var/run/crio/exits"
  5222.  
  5223. # Path to directory for container attach sockets.
  5224. # container_attach_socket_dir = "/var/run/crio"
  5225.  
  5226. # The prefix to use for the source of the bind mounts.
  5227. # bind_mount_prefix = ""
  5228.  
  5229. # If set to true, all containers will run in read-only mode.
  5230. # read_only = false
  5231.  
  5232. # Changes the verbosity of the logs based on the level it is set to. Options
  5233. # are fatal, panic, error, warn, info, and debug. This option supports live
  5234. # configuration reload.
  5235. # log_level = "error"
  5236.  
  5237. # The UID mappings for the user namespace of each container. A range is
  5238. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  5239. # separated by comma.
  5240. # uid_mappings = ""
  5241.  
  5242. # The GID mappings for the user namespace of each container. A range is
  5243. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  5244. # separated by comma.
  5245. # gid_mappings = ""
  5246.  
  5247. # The minimal amount of time in seconds to wait before issuing a timeout
  5248. # regarding the proper termination of the container.
  5249. # ctr_stop_timeout = 0
  5250.  
  5251. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  5252. # and manage its lifecycle.
  5253. # manage_network_ns_lifecycle = false
  5254.  
  5255. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  5256. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  5257. # If no runtime_handler is provided, the runtime will be picked based on the level
  5258. # of trust of the workload. Each entry in the table should follow the format:
  5259. #
  5260. #[crio.runtime.runtimes.runtime-handler]
  5261. # runtime_path = "/path/to/the/executable"
  5262. # runtime_type = "oci"
  5263. # runtime_root = "/path/to/the/root"
  5264. #
  5265. # Where:
  5266. # - runtime-handler: name used to identify the runtime
  5267. # - runtime_path (optional, string): absolute path to the runtime executable in
  5268. # the host filesystem. If omitted, the runtime-handler identifier should match
  5269. # the runtime executable name, and the runtime executable should be placed
  5270. # in $PATH.
  5271. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  5272. # omitted, an "oci" runtime is assumed.
  5273. # - runtime_root (optional, string): root directory for storage of containers
  5274. # state.
  5275.  
  5276.  
  5277. # [crio.runtime.runtimes.runc]
  5278. # runtime_path = ""
  5279. # runtime_type = "oci"
  5280. # runtime_root = "/run/runc"
  5281.  
  5282.  
  5283. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  5284. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  5285. # surface and mitigating the consequences of containers breakout.
  5286.  
  5287. # Kata Containers with the default configured VMM
  5288. #[crio.runtime.runtimes.kata-runtime]
  5289.  
  5290. # Kata Containers with the QEMU VMM
  5291. #[crio.runtime.runtimes.kata-qemu]
  5292.  
  5293. # Kata Containers with the Firecracker VMM
  5294. #[crio.runtime.runtimes.kata-fc]
  5295.  
  5296. # The crio.image table contains settings pertaining to the management of OCI images.
  5297. #
  5298. # CRI-O reads its configured registries defaults from the system wide
  5299. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  5300. # you want to modify just CRI-O, you can change the registries configuration in
  5301. # this file. Otherwise, leave insecure_registries and registries commented out to
  5302. # use the system's defaults from /etc/containers/registries.conf.
  5303. [crio.image]
  5304.  
  5305. # Default transport for pulling images from a remote container storage.
  5306. # default_transport = "docker://"
  5307.  
  5308. # The path to a file containing credentials necessary for pulling images from
  5309. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  5310. global_auth_file = "/var/lib/kubelet/config.json"
  5311.  
  5312. # The image used to instantiate infra containers.
  5313. # This option supports live configuration reload.
  5314. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  5315.  
  5316. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  5317.  
  5318. # The path to a file containing credentials specific for pulling the pause_image from
  5319. # above. The file is similar to that of /var/lib/kubelet/config.json
  5320. # This option supports live configuration reload.
  5321. pause_image_auth_file = "/var/lib/kubelet/config.json"
  5322.  
  5323. # The command to run to have a container stay in the paused state.
  5324. # This option supports live configuration reload.
  5325. pause_command = "/usr/bin/pod"
  5326.  
  5327. # Path to the file which decides what sort of policy we use when deciding
  5328. # whether or not to trust an image that we've pulled. It is not recommended that
  5329. # this option be used, as the default behavior of using the system-wide default
  5330. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  5331. # refer to containers-policy.json(5) for more details.
  5332. # signature_policy = ""
  5333.  
  5334. # List of registries to skip TLS verification for pulling images. Please
  5335. # consider configuring the registries via /etc/containers/registries.conf before
  5336. # changing them here.
  5337. #insecure_registries = "[]"
  5338.  
  5339. # Controls how image volumes are handled. The valid values are mkdir, bind and
  5340. # ignore; the latter will ignore volumes entirely.
  5341. # image_volumes = "mkdir"
  5342.  
  5343. # List of registries to be used when pulling an unqualified image (e.g.,
  5344. # "alpine:latest"). By default, registries is set to "docker.io" for
  5345. # compatibility reasons. Depending on your workload and usecase you may add more
  5346. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  5347. # "registry.opensuse.org", etc.).
  5348. #registries = [
  5349. # ]
  5350.  
  5351.  
  5352. # The crio.network table containers settings pertaining to the management of
  5353. # CNI plugins.
  5354. [crio.network]
  5355.  
  5356. # Path to the directory where CNI configuration files are located.
  5357. # Note this default is changed from the RPM.
  5358. network_dir = "/etc/kubernetes/cni/net.d/"
  5359.  
  5360. # Paths to directories where CNI plugin binaries are located.
  5361. # Note this default is changed from the RPM.
  5362. plugin_dirs = [
  5363. "/var/lib/cni/bin",
  5364. ]
  5365.  
  5366. # A necessary configuration for Prometheus based metrics retrieval
  5367. [crio.metrics]
  5368.  
  5369. # Globally enable or disable metrics support.
  5370. enable_metrics = true
  5371.  
  5372. # The port on which the metrics server will listen.
  5373. metrics_port = 9537
  5374.  
  5375.  
  5376. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  5377.  
  5378. # The path to a file containing credentials specific for pulling the pause_image from
  5379. # above. The file is similar to that of /var/lib/kubelet/config.json
  5380. # This option supports live configuration reload.
  5381. pause_image_auth_file = "/var/lib/kubelet/config.json"
  5382.  
  5383. # The command to run to have a container stay in the paused state.
  5384. # This option supports live configuration reload.
  5385. pause_command = "/usr/bin/pod"
  5386.  
  5387. # Path to the file which decides what sort of policy we use when deciding
  5388. # whether or not to trust an image that we've pulled. It is not recommended that
  5389. # this option be used, as the default behavior of using the system-wide default
  5390. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  5391. # refer to containers-policy.json(5) for more details.
  5392. # signature_policy = ""
  5393.  
  5394. # List of registries to skip TLS verification for pulling images. Please
  5395. # consider configuring the registries via /etc/containers/registries.conf before
  5396. # changing them here.
  5397. #insecure_registries = "[]"
  5398.  
  5399. # Controls how image volumes are handled. The valid values are mkdir, bind and
  5400. # ignore; the latter will ignore volumes entirely.
  5401. # image_volumes = "mkdir"
  5402.  
  5403. # List of registries to be used when pulling an unqualified image (e.g.,
  5404. # "alpine:latest"). By default, registries is set to "docker.io" for
  5405. # compatibility reasons. Depending on your workload and usecase you may add more
  5406. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  5407. # "registry.opensuse.org", etc.).
  5408. #registries = [
  5409. # ]
  5410.  
  5411.  
  5412. # The crio.network table containers settings pertaining to the management of
  5413. # CNI plugins.
  5414. [crio.network]
  5415.  
  5416. # Path to the directory where CNI configuration files are located.
  5417. # Note this default is changed from the RPM.
  5418. network_dir = "/etc/kubernetes/cni/net.d/"
  5419.  
  5420. # Paths to directories where CNI plugin binaries are located.
  5421. # Note this default is changed from the RPM.
  5422. plugin_dirs = [
  5423. "/var/lib/cni/bin",
  5424. ]
  5425.  
  5426. # A necessary configuration for Prometheus based metrics retrieval
  5427. [crio.metrics]
  5428.  
  5429. # Globally enable or disable metrics support.
  5430. enable_metrics = true
  5431.  
  5432. # The port on which the metrics server will listen.
  5433. metrics_port = 9537
  5434.  
  5435.  
  5436. E0115 17:34:05.828348 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5437. I0115 17:35:05.839022 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5438. I0115 17:35:05.839045 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  5439. I0115 17:35:05.844030 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  5440. I0115 17:35:05.844055 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  5441. I0115 17:35:05.853359 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5442. E0115 17:35:05.854052 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  5443. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  5444. # daemon, but in a TOML format that can be more easily modified and versioned.
  5445. #
  5446. # Please refer to crio.conf(5) for details of all configuration options.
  5447.  
  5448. # CRI-O supports partial configuration reload during runtime, which can be
  5449. # done by sending SIGHUP to the running process. Currently supported options
  5450. # are explicitly mentioned with: 'This option supports live configuration
  5451. # reload'.
  5452.  
  5453. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  5454. # located at /etc/containers/storage.conf. Modify this storage configuration if
  5455. # you want to change the system's defaults. If you want to modify storage just
  5456. # for CRI-O, you can change the storage configuration options here.
  5457. [crio]
  5458.  
  5459. # Path to the "root directory". CRI-O stores all of its data, including
  5460. # containers images, in this directory.
  5461. #root = "/var/lib/containers/storage"
  5462.  
  5463. # Path to the "run directory". CRI-O stores all of its state in this directory.
  5464. #runroot = "/run/user/1000"
  5465.  
  5466. # Storage driver used to manage the storage of images and containers. Please
  5467. # refer to containers-storage.conf(5) to see all available storage drivers.
  5468. #storage_driver = "overlay"
  5469.  
  5470. # List to pass options to the storage driver. Please refer to
  5471. # containers-storage.conf(5) to see all available storage options.
  5472. #storage_option = [
  5473. #]
  5474.  
  5475. # The default log directory where all logs will go unless directly specified by
  5476. # the kubelet. The log directory specified must be an absolute directory.
  5477. # log_dir = "/var/log/crio/pods"
  5478.  
  5479. # Location for CRI-O to lay down the version file
  5480. # version_file = "/var/lib/crio/version"
  5481.  
  5482. # The crio.api table contains settings for the kubelet/gRPC interface.
  5483. [crio.api]
  5484.  
  5485. # Path to AF_LOCAL socket on which CRI-O will listen.
  5486. # listen = "/var/run/crio/crio.sock"
  5487.  
  5488. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  5489. # host_ip = ""
  5490.  
  5491. # IP address on which the stream server will listen.
  5492. stream_address = ""
  5493.  
  5494. # The port on which the stream server will listen.
  5495. stream_port = "10010"
  5496.  
  5497. # Enable encrypted TLS transport of the stream server.
  5498. # stream_enable_tls = false
  5499.  
  5500. # Path to the x509 certificate file used to serve the encrypted stream. This
  5501. # file can change, and CRI-O will automatically pick up the changes within 5
  5502. # minutes.
  5503. # stream_tls_cert = ""
  5504.  
  5505. # Path to the key file used to serve the encrypted stream. This file can
  5506. # change and CRI-O will automatically pick up the changes within 5 minutes.
  5507. # stream_tls_key = ""
  5508.  
  5509. # Path to the x509 CA(s) file used to verify and authenticate client
  5510. # communication with the encrypted stream. This file can change and CRI-O will
  5511. # automatically pick up the changes within 5 minutes.
  5512. # stream_tls_ca = ""
  5513.  
  5514. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  5515. # grpc_max_send_msg_size = 16777216
  5516.  
  5517. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  5518. # grpc_max_recv_msg_size = 16777216
  5519.  
  5520. # The crio.runtime table contains settings pertaining to the OCI runtime used
  5521. # and options for how to set up and manage the OCI runtime.
  5522. [crio.runtime]
  5523.  
  5524. # A list of ulimits to be set in containers by default, specified as
  5525. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  5526. # "nofile=1024:2048"
  5527. # If nothing is set here, settings will be inherited from the CRI-O daemon
  5528. #default_ulimits = [
  5529. #]
  5530.  
  5531. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  5532. # The name is matched against the runtimes map below.
  5533. # default_runtime = "runc"
  5534.  
  5535. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  5536. # no_pivot = false
  5537.  
  5538. # Path to the conmon binary, used for monitoring the OCI runtime.
  5539. # Will be searched for using $PATH if empty.
  5540. conmon = "/usr/libexec/crio/conmon"
  5541.  
  5542. # Cgroup setting for conmon
  5543. conmon_cgroup = "pod"
  5544.  
  5545. # Environment variable list for the conmon process, used for passing necessary
  5546. # environment variables to conmon or the runtime.
  5547. # conmon_env = [
  5548. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  5549. # ]
  5550.  
  5551. # If true, SELinux will be used for pod separation on the host.
  5552. # selinux = true
  5553.  
  5554. # Path to the seccomp.json profile which is used as the default seccomp profile
  5555. # for the runtime. If not specified, then the internal default seccomp profile
  5556. # will be used.
  5557. # seccomp_profile = "/etc/crio/seccomp.json"
  5558.  
  5559. # Used to change the name of the default AppArmor profile of CRI-O. The default
  5560. # profile name is "crio-default-" followed by the version string of CRI-O.
  5561. apparmor_profile = "crio-default"
  5562.  
  5563. # Cgroup management implementation used for the runtime.
  5564. cgroup_manager = "systemd"
  5565.  
  5566. # List of default capabilities for containers. If it is empty or commented out,
  5567. # only the capabilities defined in the containers json file by the user/kube
  5568. # will be added.
  5569. # default_capabilities = [
  5570. # "CHOWN",
  5571. # "DAC_OVERRIDE",
  5572. # "FSETID",
  5573. # "FOWNER",
  5574. # "NET_RAW",
  5575. # "SETGID",
  5576. # "SETUID",
  5577. # "SETPCAP",
  5578. # "NET_BIND_SERVICE",
  5579. # "SYS_CHROOT",
  5580. # "KILL",
  5581. # ]
  5582.  
  5583. # List of default sysctls. If it is empty or commented out, only the sysctls
  5584. # defined in the container json file by the user/kube will be added.
  5585. # default_sysctls = [
  5586. # ]
  5587.  
  5588. # List of additional devices. specified as
  5589. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  5590. #If it is empty or commented out, only the devices
  5591. # defined in the container json file by the user/kube will be added.
  5592. # additional_devices = [
  5593. # ]
  5594.  
  5595. # Path to OCI hooks directories for automatically executed hooks.
  5596. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  5597. # so we add /etc/containers/oci/hooks.d as well
  5598. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  5599. hooks_dir = [
  5600. "/etc/containers/oci/hooks.d",
  5601. ]
  5602.  
  5603. # List of default mounts for each container. **Deprecated:** this option will
  5604. # be removed in future versions in favor of default_mounts_file.
  5605. # default_mounts = [
  5606. # "/usr/share/rhel/secrets:/run/secrets",
  5607. # ]
  5608.  
  5609. # Path to the file specifying the defaults mounts for each container. The
  5610. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  5611. # its default mounts from the following two files:
  5612. #
  5613. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  5614. # override file, where users can either add in their own default mounts, or
  5615. # override the default mounts shipped with the package.
  5616. #
  5617. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  5618. # mounts. If you want CRI-O to read from a different, specific mounts file,
  5619. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  5620. # only add mounts it finds in this file.
  5621. #
  5622. #default_mounts_file = ""
  5623.  
  5624. # Maximum number of processes allowed in a container.
  5625. # pids_limit = 1024
  5626.  
  5627. # Maximum sized allowed for the container log file. Negative numbers indicate
  5628. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  5629. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  5630. # limit is never exceeded.
  5631. # log_size_max = -1
  5632.  
  5633. # Whether container output should be logged to journald in addition to the kuberentes log file
  5634. # log_to_journald = false
  5635.  
  5636. # Path to directory in which container exit files are written to by conmon.
  5637. # container_exits_dir = "/var/run/crio/exits"
  5638.  
  5639. # Path to directory for container attach sockets.
  5640. # container_attach_socket_dir = "/var/run/crio"
  5641.  
  5642. # The prefix to use for the source of the bind mounts.
  5643. # bind_mount_prefix = ""
  5644.  
  5645. # If set to true, all containers will run in read-only mode.
  5646. # read_only = false
  5647.  
  5648. # Changes the verbosity of the logs based on the level it is set to. Options
  5649. # are fatal, panic, error, warn, info, and debug. This option supports live
  5650. # configuration reload.
  5651. # log_level = "error"
  5652.  
  5653. # The UID mappings for the user namespace of each container. A range is
  5654. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  5655. # separated by comma.
  5656. # uid_mappings = ""
  5657.  
  5658. # The GID mappings for the user namespace of each container. A range is
  5659. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  5660. # separated by comma.
  5661. # gid_mappings = ""
  5662.  
  5663. # The minimal amount of time in seconds to wait before issuing a timeout
  5664. # regarding the proper termination of the container.
  5665. # ctr_stop_timeout = 0
  5666.  
  5667. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  5668. # and manage its lifecycle.
  5669. # manage_network_ns_lifecycle = false
  5670.  
  5671. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  5672. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  5673. # If no runtime_handler is provided, the runtime will be picked based on the level
  5674. # of trust of the workload. Each entry in the table should follow the format:
  5675. #
  5676. #[crio.runtime.runtimes.runtime-handler]
  5677. # runtime_path = "/path/to/the/executable"
  5678. # runtime_type = "oci"
  5679. # runtime_root = "/path/to/the/root"
  5680. #
  5681. # Where:
  5682. # - runtime-handler: name used to identify the runtime
  5683. # - runtime_path (optional, string): absolute path to the runtime executable in
  5684. # the host filesystem. If omitted, the runtime-handler identifier should match
  5685. # the runtime executable name, and the runtime executable should be placed
  5686. # in $PATH.
  5687. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  5688. # omitted, an "oci" runtime is assumed.
  5689. # - runtime_root (optional, string): root directory for storage of containers
  5690. # state.
  5691.  
  5692.  
  5693. # [crio.runtime.runtimes.runc]
  5694. # runtime_path = ""
  5695. # runtime_type = "oci"
  5696. # runtime_root = "/run/runc"
  5697.  
  5698.  
  5699. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  5700. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  5701. # surface and mitigating the consequences of containers breakout.
  5702.  
  5703. # Kata Containers with the default configured VMM
  5704. #[crio.runtime.runtimes.kata-runtime]
  5705.  
  5706. # Kata Containers with the QEMU VMM
  5707. #[crio.runtime.runtimes.kata-qemu]
  5708.  
  5709. # Kata Containers with the Firecracker VMM
  5710. #[crio.runtime.runtimes.kata-fc]
  5711.  
  5712. # The crio.image table contains settings pertaining to the management of OCI images.
  5713. #
  5714. # CRI-O reads its configured registries defaults from the system wide
  5715. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  5716. # you want to modify just CRI-O, you can change the registries configuration in
  5717. # this file. Otherwise, leave insecure_registries and registries commented out to
  5718. # use the system's defaults from /etc/containers/registries.conf.
  5719. [crio.image]
  5720.  
  5721. # Default transport for pulling images from a remote container storage.
  5722. # default_transport = "docker://"
  5723.  
  5724. # The path to a file containing credentials necessary for pulling images from
  5725. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  5726. global_auth_file = "/var/lib/kubelet/config.json"
  5727.  
  5728. # The image used to instantiate infra containers.
  5729. # This option supports live configuration reload.
  5730. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  5731.  
  5732. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  5733.  
  5734. # The path to a file containing credentials specific for pulling the pause_image from
  5735. # above. The file is similar to that of /var/lib/kubelet/config.json
  5736. # This option supports live configuration reload.
  5737. pause_image_auth_file = "/var/lib/kubelet/config.json"
  5738.  
  5739. # The command to run to have a container stay in the paused state.
  5740. # This option supports live configuration reload.
  5741. pause_command = "/usr/bin/pod"
  5742.  
  5743. # Path to the file which decides what sort of policy we use when deciding
  5744. # whether or not to trust an image that we've pulled. It is not recommended that
  5745. # this option be used, as the default behavior of using the system-wide default
  5746. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  5747. # refer to containers-policy.json(5) for more details.
  5748. # signature_policy = ""
  5749.  
  5750. # List of registries to skip TLS verification for pulling images. Please
  5751. # consider configuring the registries via /etc/containers/registries.conf before
  5752. # changing them here.
  5753. #insecure_registries = "[]"
  5754.  
  5755. # Controls how image volumes are handled. The valid values are mkdir, bind and
  5756. # ignore; the latter will ignore volumes entirely.
  5757. # image_volumes = "mkdir"
  5758.  
  5759. # List of registries to be used when pulling an unqualified image (e.g.,
  5760. # "alpine:latest"). By default, registries is set to "docker.io" for
  5761. # compatibility reasons. Depending on your workload and usecase you may add more
  5762. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  5763. # "registry.opensuse.org", etc.).
  5764. #registries = [
  5765. # ]
  5766.  
  5767.  
  5768. # The crio.network table containers settings pertaining to the management of
  5769. # CNI plugins.
  5770. [crio.network]
  5771.  
  5772. # Path to the directory where CNI configuration files are located.
  5773. # Note this default is changed from the RPM.
  5774. network_dir = "/etc/kubernetes/cni/net.d/"
  5775.  
  5776. # Paths to directories where CNI plugin binaries are located.
  5777. # Note this default is changed from the RPM.
  5778. plugin_dirs = [
  5779. "/var/lib/cni/bin",
  5780. ]
  5781.  
  5782. # A necessary configuration for Prometheus based metrics retrieval
  5783. [crio.metrics]
  5784.  
  5785. # Globally enable or disable metrics support.
  5786. enable_metrics = true
  5787.  
  5788. # The port on which the metrics server will listen.
  5789. metrics_port = 9537
  5790.  
  5791.  
  5792. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  5793.  
  5794. # The path to a file containing credentials specific for pulling the pause_image from
  5795. # above. The file is similar to that of /var/lib/kubelet/config.json
  5796. # This option supports live configuration reload.
  5797. pause_image_auth_file = "/var/lib/kubelet/config.json"
  5798.  
  5799. # The command to run to have a container stay in the paused state.
  5800. # This option supports live configuration reload.
  5801. pause_command = "/usr/bin/pod"
  5802.  
  5803. # Path to the file which decides what sort of policy we use when deciding
  5804. # whether or not to trust an image that we've pulled. It is not recommended that
  5805. # this option be used, as the default behavior of using the system-wide default
  5806. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  5807. # refer to containers-policy.json(5) for more details.
  5808. # signature_policy = ""
  5809.  
  5810. # List of registries to skip TLS verification for pulling images. Please
  5811. # consider configuring the registries via /etc/containers/registries.conf before
  5812. # changing them here.
  5813. #insecure_registries = "[]"
  5814.  
  5815. # Controls how image volumes are handled. The valid values are mkdir, bind and
  5816. # ignore; the latter will ignore volumes entirely.
  5817. # image_volumes = "mkdir"
  5818.  
  5819. # List of registries to be used when pulling an unqualified image (e.g.,
  5820. # "alpine:latest"). By default, registries is set to "docker.io" for
  5821. # compatibility reasons. Depending on your workload and usecase you may add more
  5822. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  5823. # "registry.opensuse.org", etc.).
  5824. #registries = [
  5825. # ]
  5826.  
  5827.  
  5828. # The crio.network table containers settings pertaining to the management of
  5829. # CNI plugins.
  5830. [crio.network]
  5831.  
  5832. # Path to the directory where CNI configuration files are located.
  5833. # Note this default is changed from the RPM.
  5834. network_dir = "/etc/kubernetes/cni/net.d/"
  5835.  
  5836. # Paths to directories where CNI plugin binaries are located.
  5837. # Note this default is changed from the RPM.
  5838. plugin_dirs = [
  5839. "/var/lib/cni/bin",
  5840. ]
  5841.  
  5842. # A necessary configuration for Prometheus based metrics retrieval
  5843. [crio.metrics]
  5844.  
  5845. # Globally enable or disable metrics support.
  5846. enable_metrics = true
  5847.  
  5848. # The port on which the metrics server will listen.
  5849. metrics_port = 9537
  5850.  
  5851.  
  5852. E0115 17:35:05.854082 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5853. I0115 17:36:05.865173 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5854. I0115 17:36:05.865196 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  5855. I0115 17:36:05.869998 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  5856. I0115 17:36:05.870020 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  5857. I0115 17:36:05.879205 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  5858. E0115 17:36:05.879896 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  5859. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  5860. # daemon, but in a TOML format that can be more easily modified and versioned.
  5861. #
  5862. # Please refer to crio.conf(5) for details of all configuration options.
  5863.  
  5864. # CRI-O supports partial configuration reload during runtime, which can be
  5865. # done by sending SIGHUP to the running process. Currently supported options
  5866. # are explicitly mentioned with: 'This option supports live configuration
  5867. # reload'.
  5868.  
  5869. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  5870. # located at /etc/containers/storage.conf. Modify this storage configuration if
  5871. # you want to change the system's defaults. If you want to modify storage just
  5872. # for CRI-O, you can change the storage configuration options here.
  5873. [crio]
  5874.  
  5875. # Path to the "root directory". CRI-O stores all of its data, including
  5876. # containers images, in this directory.
  5877. #root = "/var/lib/containers/storage"
  5878.  
  5879. # Path to the "run directory". CRI-O stores all of its state in this directory.
  5880. #runroot = "/run/user/1000"
  5881.  
  5882. # Storage driver used to manage the storage of images and containers. Please
  5883. # refer to containers-storage.conf(5) to see all available storage drivers.
  5884. #storage_driver = "overlay"
  5885.  
  5886. # List to pass options to the storage driver. Please refer to
  5887. # containers-storage.conf(5) to see all available storage options.
  5888. #storage_option = [
  5889. #]
  5890.  
  5891. # The default log directory where all logs will go unless directly specified by
  5892. # the kubelet. The log directory specified must be an absolute directory.
  5893. # log_dir = "/var/log/crio/pods"
  5894.  
  5895. # Location for CRI-O to lay down the version file
  5896. # version_file = "/var/lib/crio/version"
  5897.  
  5898. # The crio.api table contains settings for the kubelet/gRPC interface.
  5899. [crio.api]
  5900.  
  5901. # Path to AF_LOCAL socket on which CRI-O will listen.
  5902. # listen = "/var/run/crio/crio.sock"
  5903.  
  5904. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  5905. # host_ip = ""
  5906.  
  5907. # IP address on which the stream server will listen.
  5908. stream_address = ""
  5909.  
  5910. # The port on which the stream server will listen.
  5911. stream_port = "10010"
  5912.  
  5913. # Enable encrypted TLS transport of the stream server.
  5914. # stream_enable_tls = false
  5915.  
  5916. # Path to the x509 certificate file used to serve the encrypted stream. This
  5917. # file can change, and CRI-O will automatically pick up the changes within 5
  5918. # minutes.
  5919. # stream_tls_cert = ""
  5920.  
  5921. # Path to the key file used to serve the encrypted stream. This file can
  5922. # change and CRI-O will automatically pick up the changes within 5 minutes.
  5923. # stream_tls_key = ""
  5924.  
  5925. # Path to the x509 CA(s) file used to verify and authenticate client
  5926. # communication with the encrypted stream. This file can change and CRI-O will
  5927. # automatically pick up the changes within 5 minutes.
  5928. # stream_tls_ca = ""
  5929.  
  5930. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  5931. # grpc_max_send_msg_size = 16777216
  5932.  
  5933. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  5934. # grpc_max_recv_msg_size = 16777216
  5935.  
  5936. # The crio.runtime table contains settings pertaining to the OCI runtime used
  5937. # and options for how to set up and manage the OCI runtime.
  5938. [crio.runtime]
  5939.  
  5940. # A list of ulimits to be set in containers by default, specified as
  5941. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  5942. # "nofile=1024:2048"
  5943. # If nothing is set here, settings will be inherited from the CRI-O daemon
  5944. #default_ulimits = [
  5945. #]
  5946.  
  5947. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  5948. # The name is matched against the runtimes map below.
  5949. # default_runtime = "runc"
  5950.  
  5951. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  5952. # no_pivot = false
  5953.  
  5954. # Path to the conmon binary, used for monitoring the OCI runtime.
  5955. # Will be searched for using $PATH if empty.
  5956. conmon = "/usr/libexec/crio/conmon"
  5957.  
  5958. # Cgroup setting for conmon
  5959. conmon_cgroup = "pod"
  5960.  
  5961. # Environment variable list for the conmon process, used for passing necessary
  5962. # environment variables to conmon or the runtime.
  5963. # conmon_env = [
  5964. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  5965. # ]
  5966.  
  5967. # If true, SELinux will be used for pod separation on the host.
  5968. # selinux = true
  5969.  
  5970. # Path to the seccomp.json profile which is used as the default seccomp profile
  5971. # for the runtime. If not specified, then the internal default seccomp profile
  5972. # will be used.
  5973. # seccomp_profile = "/etc/crio/seccomp.json"
  5974.  
  5975. # Used to change the name of the default AppArmor profile of CRI-O. The default
  5976. # profile name is "crio-default-" followed by the version string of CRI-O.
  5977. apparmor_profile = "crio-default"
  5978.  
  5979. # Cgroup management implementation used for the runtime.
  5980. cgroup_manager = "systemd"
  5981.  
  5982. # List of default capabilities for containers. If it is empty or commented out,
  5983. # only the capabilities defined in the containers json file by the user/kube
  5984. # will be added.
  5985. # default_capabilities = [
  5986. # "CHOWN",
  5987. # "DAC_OVERRIDE",
  5988. # "FSETID",
  5989. # "FOWNER",
  5990. # "NET_RAW",
  5991. # "SETGID",
  5992. # "SETUID",
  5993. # "SETPCAP",
  5994. # "NET_BIND_SERVICE",
  5995. # "SYS_CHROOT",
  5996. # "KILL",
  5997. # ]
  5998.  
  5999. # List of default sysctls. If it is empty or commented out, only the sysctls
  6000. # defined in the container json file by the user/kube will be added.
  6001. # default_sysctls = [
  6002. # ]
  6003.  
  6004. # List of additional devices. specified as
  6005. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  6006. #If it is empty or commented out, only the devices
  6007. # defined in the container json file by the user/kube will be added.
  6008. # additional_devices = [
  6009. # ]
  6010.  
  6011. # Path to OCI hooks directories for automatically executed hooks.
  6012. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  6013. # so we add /etc/containers/oci/hooks.d as well
  6014. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  6015. hooks_dir = [
  6016. "/etc/containers/oci/hooks.d",
  6017. ]
  6018.  
  6019. # List of default mounts for each container. **Deprecated:** this option will
  6020. # be removed in future versions in favor of default_mounts_file.
  6021. # default_mounts = [
  6022. # "/usr/share/rhel/secrets:/run/secrets",
  6023. # ]
  6024.  
  6025. # Path to the file specifying the defaults mounts for each container. The
  6026. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  6027. # its default mounts from the following two files:
  6028. #
  6029. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  6030. # override file, where users can either add in their own default mounts, or
  6031. # override the default mounts shipped with the package.
  6032. #
  6033. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  6034. # mounts. If you want CRI-O to read from a different, specific mounts file,
  6035. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  6036. # only add mounts it finds in this file.
  6037. #
  6038. #default_mounts_file = ""
  6039.  
  6040. # Maximum number of processes allowed in a container.
  6041. # pids_limit = 1024
  6042.  
  6043. # Maximum sized allowed for the container log file. Negative numbers indicate
  6044. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  6045. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  6046. # limit is never exceeded.
  6047. # log_size_max = -1
  6048.  
  6049. # Whether container output should be logged to journald in addition to the kuberentes log file
  6050. # log_to_journald = false
  6051.  
  6052. # Path to directory in which container exit files are written to by conmon.
  6053. # container_exits_dir = "/var/run/crio/exits"
  6054.  
  6055. # Path to directory for container attach sockets.
  6056. # container_attach_socket_dir = "/var/run/crio"
  6057.  
  6058. # The prefix to use for the source of the bind mounts.
  6059. # bind_mount_prefix = ""
  6060.  
  6061. # If set to true, all containers will run in read-only mode.
  6062. # read_only = false
  6063.  
  6064. # Changes the verbosity of the logs based on the level it is set to. Options
  6065. # are fatal, panic, error, warn, info, and debug. This option supports live
  6066. # configuration reload.
  6067. # log_level = "error"
  6068.  
  6069. # The UID mappings for the user namespace of each container. A range is
  6070. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  6071. # separated by comma.
  6072. # uid_mappings = ""
  6073.  
  6074. # The GID mappings for the user namespace of each container. A range is
  6075. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  6076. # separated by comma.
  6077. # gid_mappings = ""
  6078.  
  6079. # The minimal amount of time in seconds to wait before issuing a timeout
  6080. # regarding the proper termination of the container.
  6081. # ctr_stop_timeout = 0
  6082.  
  6083. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  6084. # and manage its lifecycle.
  6085. # manage_network_ns_lifecycle = false
  6086.  
  6087. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  6088. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  6089. # If no runtime_handler is provided, the runtime will be picked based on the level
  6090. # of trust of the workload. Each entry in the table should follow the format:
  6091. #
  6092. #[crio.runtime.runtimes.runtime-handler]
  6093. # runtime_path = "/path/to/the/executable"
  6094. # runtime_type = "oci"
  6095. # runtime_root = "/path/to/the/root"
  6096. #
  6097. # Where:
  6098. # - runtime-handler: name used to identify the runtime
  6099. # - runtime_path (optional, string): absolute path to the runtime executable in
  6100. # the host filesystem. If omitted, the runtime-handler identifier should match
  6101. # the runtime executable name, and the runtime executable should be placed
  6102. # in $PATH.
  6103. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  6104. # omitted, an "oci" runtime is assumed.
  6105. # - runtime_root (optional, string): root directory for storage of containers
  6106. # state.
  6107.  
  6108.  
  6109. # [crio.runtime.runtimes.runc]
  6110. # runtime_path = ""
  6111. # runtime_type = "oci"
  6112. # runtime_root = "/run/runc"
  6113.  
  6114.  
  6115. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  6116. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  6117. # surface and mitigating the consequences of containers breakout.
  6118.  
  6119. # Kata Containers with the default configured VMM
  6120. #[crio.runtime.runtimes.kata-runtime]
  6121.  
  6122. # Kata Containers with the QEMU VMM
  6123. #[crio.runtime.runtimes.kata-qemu]
  6124.  
  6125. # Kata Containers with the Firecracker VMM
  6126. #[crio.runtime.runtimes.kata-fc]
  6127.  
  6128. # The crio.image table contains settings pertaining to the management of OCI images.
  6129. #
  6130. # CRI-O reads its configured registries defaults from the system wide
  6131. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  6132. # you want to modify just CRI-O, you can change the registries configuration in
  6133. # this file. Otherwise, leave insecure_registries and registries commented out to
  6134. # use the system's defaults from /etc/containers/registries.conf.
  6135. [crio.image]
  6136.  
  6137. # Default transport for pulling images from a remote container storage.
  6138. # default_transport = "docker://"
  6139.  
  6140. # The path to a file containing credentials necessary for pulling images from
  6141. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  6142. global_auth_file = "/var/lib/kubelet/config.json"
  6143.  
  6144. # The image used to instantiate infra containers.
  6145. # This option supports live configuration reload.
  6146. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  6147.  
  6148. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  6149.  
  6150. # The path to a file containing credentials specific for pulling the pause_image from
  6151. # above. The file is similar to that of /var/lib/kubelet/config.json
  6152. # This option supports live configuration reload.
  6153. pause_image_auth_file = "/var/lib/kubelet/config.json"
  6154.  
  6155. # The command to run to have a container stay in the paused state.
  6156. # This option supports live configuration reload.
  6157. pause_command = "/usr/bin/pod"
  6158.  
  6159. # Path to the file which decides what sort of policy we use when deciding
  6160. # whether or not to trust an image that we've pulled. It is not recommended that
  6161. # this option be used, as the default behavior of using the system-wide default
  6162. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  6163. # refer to containers-policy.json(5) for more details.
  6164. # signature_policy = ""
  6165.  
  6166. # List of registries to skip TLS verification for pulling images. Please
  6167. # consider configuring the registries via /etc/containers/registries.conf before
  6168. # changing them here.
  6169. #insecure_registries = "[]"
  6170.  
  6171. # Controls how image volumes are handled. The valid values are mkdir, bind and
  6172. # ignore; the latter will ignore volumes entirely.
  6173. # image_volumes = "mkdir"
  6174.  
  6175. # List of registries to be used when pulling an unqualified image (e.g.,
  6176. # "alpine:latest"). By default, registries is set to "docker.io" for
  6177. # compatibility reasons. Depending on your workload and usecase you may add more
  6178. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  6179. # "registry.opensuse.org", etc.).
  6180. #registries = [
  6181. # ]
  6182.  
  6183.  
  6184. # The crio.network table containers settings pertaining to the management of
  6185. # CNI plugins.
  6186. [crio.network]
  6187.  
  6188. # Path to the directory where CNI configuration files are located.
  6189. # Note this default is changed from the RPM.
  6190. network_dir = "/etc/kubernetes/cni/net.d/"
  6191.  
  6192. # Paths to directories where CNI plugin binaries are located.
  6193. # Note this default is changed from the RPM.
  6194. plugin_dirs = [
  6195. "/var/lib/cni/bin",
  6196. ]
  6197.  
  6198. # A necessary configuration for Prometheus based metrics retrieval
  6199. [crio.metrics]
  6200.  
  6201. # Globally enable or disable metrics support.
  6202. enable_metrics = true
  6203.  
  6204. # The port on which the metrics server will listen.
  6205. metrics_port = 9537
  6206.  
  6207.  
  6208. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  6209.  
  6210. # The path to a file containing credentials specific for pulling the pause_image from
  6211. # above. The file is similar to that of /var/lib/kubelet/config.json
  6212. # This option supports live configuration reload.
  6213. pause_image_auth_file = "/var/lib/kubelet/config.json"
  6214.  
  6215. # The command to run to have a container stay in the paused state.
  6216. # This option supports live configuration reload.
  6217. pause_command = "/usr/bin/pod"
  6218.  
  6219. # Path to the file which decides what sort of policy we use when deciding
  6220. # whether or not to trust an image that we've pulled. It is not recommended that
  6221. # this option be used, as the default behavior of using the system-wide default
  6222. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  6223. # refer to containers-policy.json(5) for more details.
  6224. # signature_policy = ""
  6225.  
  6226. # List of registries to skip TLS verification for pulling images. Please
  6227. # consider configuring the registries via /etc/containers/registries.conf before
  6228. # changing them here.
  6229. #insecure_registries = "[]"
  6230.  
  6231. # Controls how image volumes are handled. The valid values are mkdir, bind and
  6232. # ignore; the latter will ignore volumes entirely.
  6233. # image_volumes = "mkdir"
  6234.  
  6235. # List of registries to be used when pulling an unqualified image (e.g.,
  6236. # "alpine:latest"). By default, registries is set to "docker.io" for
  6237. # compatibility reasons. Depending on your workload and usecase you may add more
  6238. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  6239. # "registry.opensuse.org", etc.).
  6240. #registries = [
  6241. # ]
  6242.  
  6243.  
  6244. # The crio.network table containers settings pertaining to the management of
  6245. # CNI plugins.
  6246. [crio.network]
  6247.  
  6248. # Path to the directory where CNI configuration files are located.
  6249. # Note this default is changed from the RPM.
  6250. network_dir = "/etc/kubernetes/cni/net.d/"
  6251.  
  6252. # Paths to directories where CNI plugin binaries are located.
  6253. # Note this default is changed from the RPM.
  6254. plugin_dirs = [
  6255. "/var/lib/cni/bin",
  6256. ]
  6257.  
  6258. # A necessary configuration for Prometheus based metrics retrieval
  6259. [crio.metrics]
  6260.  
  6261. # Globally enable or disable metrics support.
  6262. enable_metrics = true
  6263.  
  6264. # The port on which the metrics server will listen.
  6265. metrics_port = 9537
  6266.  
  6267.  
  6268. E0115 17:36:05.879928 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  6269. I0115 17:37:05.892234 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  6270. I0115 17:37:05.892266 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  6271. I0115 17:37:05.897621 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  6272. I0115 17:37:05.897641 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  6273. I0115 17:37:05.907140 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  6274. E0115 17:37:05.907880 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  6275. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  6276. # daemon, but in a TOML format that can be more easily modified and versioned.
  6277. #
  6278. # Please refer to crio.conf(5) for details of all configuration options.
  6279.  
  6280. # CRI-O supports partial configuration reload during runtime, which can be
  6281. # done by sending SIGHUP to the running process. Currently supported options
  6282. # are explicitly mentioned with: 'This option supports live configuration
  6283. # reload'.
  6284.  
  6285. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  6286. # located at /etc/containers/storage.conf. Modify this storage configuration if
  6287. # you want to change the system's defaults. If you want to modify storage just
  6288. # for CRI-O, you can change the storage configuration options here.
  6289. [crio]
  6290.  
  6291. # Path to the "root directory". CRI-O stores all of its data, including
  6292. # containers images, in this directory.
  6293. #root = "/var/lib/containers/storage"
  6294.  
  6295. # Path to the "run directory". CRI-O stores all of its state in this directory.
  6296. #runroot = "/run/user/1000"
  6297.  
  6298. # Storage driver used to manage the storage of images and containers. Please
  6299. # refer to containers-storage.conf(5) to see all available storage drivers.
  6300. #storage_driver = "overlay"
  6301.  
  6302. # List to pass options to the storage driver. Please refer to
  6303. # containers-storage.conf(5) to see all available storage options.
  6304. #storage_option = [
  6305. #]
  6306.  
  6307. # The default log directory where all logs will go unless directly specified by
  6308. # the kubelet. The log directory specified must be an absolute directory.
  6309. # log_dir = "/var/log/crio/pods"
  6310.  
  6311. # Location for CRI-O to lay down the version file
  6312. # version_file = "/var/lib/crio/version"
  6313.  
  6314. # The crio.api table contains settings for the kubelet/gRPC interface.
  6315. [crio.api]
  6316.  
  6317. # Path to AF_LOCAL socket on which CRI-O will listen.
  6318. # listen = "/var/run/crio/crio.sock"
  6319.  
  6320. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  6321. # host_ip = ""
  6322.  
  6323. # IP address on which the stream server will listen.
  6324. stream_address = ""
  6325.  
  6326. # The port on which the stream server will listen.
  6327. stream_port = "10010"
  6328.  
  6329. # Enable encrypted TLS transport of the stream server.
  6330. # stream_enable_tls = false
  6331.  
  6332. # Path to the x509 certificate file used to serve the encrypted stream. This
  6333. # file can change, and CRI-O will automatically pick up the changes within 5
  6334. # minutes.
  6335. # stream_tls_cert = ""
  6336.  
  6337. # Path to the key file used to serve the encrypted stream. This file can
  6338. # change and CRI-O will automatically pick up the changes within 5 minutes.
  6339. # stream_tls_key = ""
  6340.  
  6341. # Path to the x509 CA(s) file used to verify and authenticate client
  6342. # communication with the encrypted stream. This file can change and CRI-O will
  6343. # automatically pick up the changes within 5 minutes.
  6344. # stream_tls_ca = ""
  6345.  
  6346. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  6347. # grpc_max_send_msg_size = 16777216
  6348.  
  6349. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  6350. # grpc_max_recv_msg_size = 16777216
  6351.  
  6352. # The crio.runtime table contains settings pertaining to the OCI runtime used
  6353. # and options for how to set up and manage the OCI runtime.
  6354. [crio.runtime]
  6355.  
  6356. # A list of ulimits to be set in containers by default, specified as
  6357. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  6358. # "nofile=1024:2048"
  6359. # If nothing is set here, settings will be inherited from the CRI-O daemon
  6360. #default_ulimits = [
  6361. #]
  6362.  
  6363. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  6364. # The name is matched against the runtimes map below.
  6365. # default_runtime = "runc"
  6366.  
  6367. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  6368. # no_pivot = false
  6369.  
  6370. # Path to the conmon binary, used for monitoring the OCI runtime.
  6371. # Will be searched for using $PATH if empty.
  6372. conmon = "/usr/libexec/crio/conmon"
  6373.  
  6374. # Cgroup setting for conmon
  6375. conmon_cgroup = "pod"
  6376.  
  6377. # Environment variable list for the conmon process, used for passing necessary
  6378. # environment variables to conmon or the runtime.
  6379. # conmon_env = [
  6380. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  6381. # ]
  6382.  
  6383. # If true, SELinux will be used for pod separation on the host.
  6384. # selinux = true
  6385.  
  6386. # Path to the seccomp.json profile which is used as the default seccomp profile
  6387. # for the runtime. If not specified, then the internal default seccomp profile
  6388. # will be used.
  6389. # seccomp_profile = "/etc/crio/seccomp.json"
  6390.  
  6391. # Used to change the name of the default AppArmor profile of CRI-O. The default
  6392. # profile name is "crio-default-" followed by the version string of CRI-O.
  6393. apparmor_profile = "crio-default"
  6394.  
  6395. # Cgroup management implementation used for the runtime.
  6396. cgroup_manager = "systemd"
  6397.  
  6398. # List of default capabilities for containers. If it is empty or commented out,
  6399. # only the capabilities defined in the containers json file by the user/kube
  6400. # will be added.
  6401. # default_capabilities = [
  6402. # "CHOWN",
  6403. # "DAC_OVERRIDE",
  6404. # "FSETID",
  6405. # "FOWNER",
  6406. # "NET_RAW",
  6407. # "SETGID",
  6408. # "SETUID",
  6409. # "SETPCAP",
  6410. # "NET_BIND_SERVICE",
  6411. # "SYS_CHROOT",
  6412. # "KILL",
  6413. # ]
  6414.  
  6415. # List of default sysctls. If it is empty or commented out, only the sysctls
  6416. # defined in the container json file by the user/kube will be added.
  6417. # default_sysctls = [
  6418. # ]
  6419.  
  6420. # List of additional devices. specified as
  6421. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  6422. #If it is empty or commented out, only the devices
  6423. # defined in the container json file by the user/kube will be added.
  6424. # additional_devices = [
  6425. # ]
  6426.  
  6427. # Path to OCI hooks directories for automatically executed hooks.
  6428. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  6429. # so we add /etc/containers/oci/hooks.d as well
  6430. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  6431. hooks_dir = [
  6432. "/etc/containers/oci/hooks.d",
  6433. ]
  6434.  
  6435. # List of default mounts for each container. **Deprecated:** this option will
  6436. # be removed in future versions in favor of default_mounts_file.
  6437. # default_mounts = [
  6438. # "/usr/share/rhel/secrets:/run/secrets",
  6439. # ]
  6440.  
  6441. # Path to the file specifying the defaults mounts for each container. The
  6442. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  6443. # its default mounts from the following two files:
  6444. #
  6445. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  6446. # override file, where users can either add in their own default mounts, or
  6447. # override the default mounts shipped with the package.
  6448. #
  6449. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  6450. # mounts. If you want CRI-O to read from a different, specific mounts file,
  6451. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  6452. # only add mounts it finds in this file.
  6453. #
  6454. #default_mounts_file = ""
  6455.  
  6456. # Maximum number of processes allowed in a container.
  6457. # pids_limit = 1024
  6458.  
  6459. # Maximum sized allowed for the container log file. Negative numbers indicate
  6460. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  6461. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  6462. # limit is never exceeded.
  6463. # log_size_max = -1
  6464.  
  6465. # Whether container output should be logged to journald in addition to the kuberentes log file
  6466. # log_to_journald = false
  6467.  
  6468. # Path to directory in which container exit files are written to by conmon.
  6469. # container_exits_dir = "/var/run/crio/exits"
  6470.  
  6471. # Path to directory for container attach sockets.
  6472. # container_attach_socket_dir = "/var/run/crio"
  6473.  
  6474. # The prefix to use for the source of the bind mounts.
  6475. # bind_mount_prefix = ""
  6476.  
  6477. # If set to true, all containers will run in read-only mode.
  6478. # read_only = false
  6479.  
  6480. # Changes the verbosity of the logs based on the level it is set to. Options
  6481. # are fatal, panic, error, warn, info, and debug. This option supports live
  6482. # configuration reload.
  6483. # log_level = "error"
  6484.  
  6485. # The UID mappings for the user namespace of each container. A range is
  6486. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  6487. # separated by comma.
  6488. # uid_mappings = ""
  6489.  
  6490. # The GID mappings for the user namespace of each container. A range is
  6491. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  6492. # separated by comma.
  6493. # gid_mappings = ""
  6494.  
  6495. # The minimal amount of time in seconds to wait before issuing a timeout
  6496. # regarding the proper termination of the container.
  6497. # ctr_stop_timeout = 0
  6498.  
  6499. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  6500. # and manage its lifecycle.
  6501. # manage_network_ns_lifecycle = false
  6502.  
  6503. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  6504. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  6505. # If no runtime_handler is provided, the runtime will be picked based on the level
  6506. # of trust of the workload. Each entry in the table should follow the format:
  6507. #
  6508. #[crio.runtime.runtimes.runtime-handler]
  6509. # runtime_path = "/path/to/the/executable"
  6510. # runtime_type = "oci"
  6511. # runtime_root = "/path/to/the/root"
  6512. #
  6513. # Where:
  6514. # - runtime-handler: name used to identify the runtime
  6515. # - runtime_path (optional, string): absolute path to the runtime executable in
  6516. # the host filesystem. If omitted, the runtime-handler identifier should match
  6517. # the runtime executable name, and the runtime executable should be placed
  6518. # in $PATH.
  6519. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  6520. # omitted, an "oci" runtime is assumed.
  6521. # - runtime_root (optional, string): root directory for storage of containers
  6522. # state.
  6523.  
  6524.  
  6525. # [crio.runtime.runtimes.runc]
  6526. # runtime_path = ""
  6527. # runtime_type = "oci"
  6528. # runtime_root = "/run/runc"
  6529.  
  6530.  
  6531. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  6532. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  6533. # surface and mitigating the consequences of containers breakout.
  6534.  
  6535. # Kata Containers with the default configured VMM
  6536. #[crio.runtime.runtimes.kata-runtime]
  6537.  
  6538. # Kata Containers with the QEMU VMM
  6539. #[crio.runtime.runtimes.kata-qemu]
  6540.  
  6541. # Kata Containers with the Firecracker VMM
  6542. #[crio.runtime.runtimes.kata-fc]
  6543.  
  6544. # The crio.image table contains settings pertaining to the management of OCI images.
  6545. #
  6546. # CRI-O reads its configured registries defaults from the system wide
  6547. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  6548. # you want to modify just CRI-O, you can change the registries configuration in
  6549. # this file. Otherwise, leave insecure_registries and registries commented out to
  6550. # use the system's defaults from /etc/containers/registries.conf.
  6551. [crio.image]
  6552.  
  6553. # Default transport for pulling images from a remote container storage.
  6554. # default_transport = "docker://"
  6555.  
  6556. # The path to a file containing credentials necessary for pulling images from
  6557. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  6558. global_auth_file = "/var/lib/kubelet/config.json"
  6559.  
  6560. # The image used to instantiate infra containers.
  6561. # This option supports live configuration reload.
  6562. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  6563.  
  6564. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  6565.  
  6566. # The path to a file containing credentials specific for pulling the pause_image from
  6567. # above. The file is similar to that of /var/lib/kubelet/config.json
  6568. # This option supports live configuration reload.
  6569. pause_image_auth_file = "/var/lib/kubelet/config.json"
  6570.  
  6571. # The command to run to have a container stay in the paused state.
  6572. # This option supports live configuration reload.
  6573. pause_command = "/usr/bin/pod"
  6574.  
  6575. # Path to the file which decides what sort of policy we use when deciding
  6576. # whether or not to trust an image that we've pulled. It is not recommended that
  6577. # this option be used, as the default behavior of using the system-wide default
  6578. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  6579. # refer to containers-policy.json(5) for more details.
  6580. # signature_policy = ""
  6581.  
  6582. # List of registries to skip TLS verification for pulling images. Please
  6583. # consider configuring the registries via /etc/containers/registries.conf before
  6584. # changing them here.
  6585. #insecure_registries = "[]"
  6586.  
  6587. # Controls how image volumes are handled. The valid values are mkdir, bind and
  6588. # ignore; the latter will ignore volumes entirely.
  6589. # image_volumes = "mkdir"
  6590.  
  6591. # List of registries to be used when pulling an unqualified image (e.g.,
  6592. # "alpine:latest"). By default, registries is set to "docker.io" for
  6593. # compatibility reasons. Depending on your workload and usecase you may add more
  6594. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  6595. # "registry.opensuse.org", etc.).
  6596. #registries = [
  6597. # ]
  6598.  
  6599.  
  6600. # The crio.network table containers settings pertaining to the management of
  6601. # CNI plugins.
  6602. [crio.network]
  6603.  
  6604. # Path to the directory where CNI configuration files are located.
  6605. # Note this default is changed from the RPM.
  6606. network_dir = "/etc/kubernetes/cni/net.d/"
  6607.  
  6608. # Paths to directories where CNI plugin binaries are located.
  6609. # Note this default is changed from the RPM.
  6610. plugin_dirs = [
  6611. "/var/lib/cni/bin",
  6612. ]
  6613.  
  6614. # A necessary configuration for Prometheus based metrics retrieval
  6615. [crio.metrics]
  6616.  
  6617. # Globally enable or disable metrics support.
  6618. enable_metrics = true
  6619.  
  6620. # The port on which the metrics server will listen.
  6621. metrics_port = 9537
  6622.  
  6623.  
  6624. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  6625.  
  6626. # The path to a file containing credentials specific for pulling the pause_image from
  6627. # above. The file is similar to that of /var/lib/kubelet/config.json
  6628. # This option supports live configuration reload.
  6629. pause_image_auth_file = "/var/lib/kubelet/config.json"
  6630.  
  6631. # The command to run to have a container stay in the paused state.
  6632. # This option supports live configuration reload.
  6633. pause_command = "/usr/bin/pod"
  6634.  
  6635. # Path to the file which decides what sort of policy we use when deciding
  6636. # whether or not to trust an image that we've pulled. It is not recommended that
  6637. # this option be used, as the default behavior of using the system-wide default
  6638. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  6639. # refer to containers-policy.json(5) for more details.
  6640. # signature_policy = ""
  6641.  
  6642. # List of registries to skip TLS verification for pulling images. Please
  6643. # consider configuring the registries via /etc/containers/registries.conf before
  6644. # changing them here.
  6645. #insecure_registries = "[]"
  6646.  
  6647. # Controls how image volumes are handled. The valid values are mkdir, bind and
  6648. # ignore; the latter will ignore volumes entirely.
  6649. # image_volumes = "mkdir"
  6650.  
  6651. # List of registries to be used when pulling an unqualified image (e.g.,
  6652. # "alpine:latest"). By default, registries is set to "docker.io" for
  6653. # compatibility reasons. Depending on your workload and usecase you may add more
  6654. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  6655. # "registry.opensuse.org", etc.).
  6656. #registries = [
  6657. # ]
  6658.  
  6659.  
  6660. # The crio.network table containers settings pertaining to the management of
  6661. # CNI plugins.
  6662. [crio.network]
  6663.  
  6664. # Path to the directory where CNI configuration files are located.
  6665. # Note this default is changed from the RPM.
  6666. network_dir = "/etc/kubernetes/cni/net.d/"
  6667.  
  6668. # Paths to directories where CNI plugin binaries are located.
  6669. # Note this default is changed from the RPM.
  6670. plugin_dirs = [
  6671. "/var/lib/cni/bin",
  6672. ]
  6673.  
  6674. # A necessary configuration for Prometheus based metrics retrieval
  6675. [crio.metrics]
  6676.  
  6677. # Globally enable or disable metrics support.
  6678. enable_metrics = true
  6679.  
  6680. # The port on which the metrics server will listen.
  6681. metrics_port = 9537
  6682.  
  6683.  
  6684. E0115 17:37:05.907911 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  6685. I0115 17:38:05.919499 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  6686. I0115 17:38:05.919523 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  6687. I0115 17:38:05.924520 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  6688. I0115 17:38:05.924541 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  6689. I0115 17:38:05.933992 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  6690. E0115 17:38:05.934726 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  6691. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  6692. # daemon, but in a TOML format that can be more easily modified and versioned.
  6693. #
  6694. # Please refer to crio.conf(5) for details of all configuration options.
  6695.  
  6696. # CRI-O supports partial configuration reload during runtime, which can be
  6697. # done by sending SIGHUP to the running process. Currently supported options
  6698. # are explicitly mentioned with: 'This option supports live configuration
  6699. # reload'.
  6700.  
  6701. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  6702. # located at /etc/containers/storage.conf. Modify this storage configuration if
  6703. # you want to change the system's defaults. If you want to modify storage just
  6704. # for CRI-O, you can change the storage configuration options here.
  6705. [crio]
  6706.  
  6707. # Path to the "root directory". CRI-O stores all of its data, including
  6708. # containers images, in this directory.
  6709. #root = "/var/lib/containers/storage"
  6710.  
  6711. # Path to the "run directory". CRI-O stores all of its state in this directory.
  6712. #runroot = "/run/user/1000"
  6713.  
  6714. # Storage driver used to manage the storage of images and containers. Please
  6715. # refer to containers-storage.conf(5) to see all available storage drivers.
  6716. #storage_driver = "overlay"
  6717.  
  6718. # List to pass options to the storage driver. Please refer to
  6719. # containers-storage.conf(5) to see all available storage options.
  6720. #storage_option = [
  6721. #]
  6722.  
  6723. # The default log directory where all logs will go unless directly specified by
  6724. # the kubelet. The log directory specified must be an absolute directory.
  6725. # log_dir = "/var/log/crio/pods"
  6726.  
  6727. # Location for CRI-O to lay down the version file
  6728. # version_file = "/var/lib/crio/version"
  6729.  
  6730. # The crio.api table contains settings for the kubelet/gRPC interface.
  6731. [crio.api]
  6732.  
  6733. # Path to AF_LOCAL socket on which CRI-O will listen.
  6734. # listen = "/var/run/crio/crio.sock"
  6735.  
  6736. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  6737. # host_ip = ""
  6738.  
  6739. # IP address on which the stream server will listen.
  6740. stream_address = ""
  6741.  
  6742. # The port on which the stream server will listen.
  6743. stream_port = "10010"
  6744.  
  6745. # Enable encrypted TLS transport of the stream server.
  6746. # stream_enable_tls = false
  6747.  
  6748. # Path to the x509 certificate file used to serve the encrypted stream. This
  6749. # file can change, and CRI-O will automatically pick up the changes within 5
  6750. # minutes.
  6751. # stream_tls_cert = ""
  6752.  
  6753. # Path to the key file used to serve the encrypted stream. This file can
  6754. # change and CRI-O will automatically pick up the changes within 5 minutes.
  6755. # stream_tls_key = ""
  6756.  
  6757. # Path to the x509 CA(s) file used to verify and authenticate client
  6758. # communication with the encrypted stream. This file can change and CRI-O will
  6759. # automatically pick up the changes within 5 minutes.
  6760. # stream_tls_ca = ""
  6761.  
  6762. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  6763. # grpc_max_send_msg_size = 16777216
  6764.  
  6765. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  6766. # grpc_max_recv_msg_size = 16777216
  6767.  
  6768. # The crio.runtime table contains settings pertaining to the OCI runtime used
  6769. # and options for how to set up and manage the OCI runtime.
  6770. [crio.runtime]
  6771.  
  6772. # A list of ulimits to be set in containers by default, specified as
  6773. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  6774. # "nofile=1024:2048"
  6775. # If nothing is set here, settings will be inherited from the CRI-O daemon
  6776. #default_ulimits = [
  6777. #]
  6778.  
  6779. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  6780. # The name is matched against the runtimes map below.
  6781. # default_runtime = "runc"
  6782.  
  6783. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  6784. # no_pivot = false
  6785.  
  6786. # Path to the conmon binary, used for monitoring the OCI runtime.
  6787. # Will be searched for using $PATH if empty.
  6788. conmon = "/usr/libexec/crio/conmon"
  6789.  
  6790. # Cgroup setting for conmon
  6791. conmon_cgroup = "pod"
  6792.  
  6793. # Environment variable list for the conmon process, used for passing necessary
  6794. # environment variables to conmon or the runtime.
  6795. # conmon_env = [
  6796. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  6797. # ]
  6798.  
  6799. # If true, SELinux will be used for pod separation on the host.
  6800. # selinux = true
  6801.  
  6802. # Path to the seccomp.json profile which is used as the default seccomp profile
  6803. # for the runtime. If not specified, then the internal default seccomp profile
  6804. # will be used.
  6805. # seccomp_profile = "/etc/crio/seccomp.json"
  6806.  
  6807. # Used to change the name of the default AppArmor profile of CRI-O. The default
  6808. # profile name is "crio-default-" followed by the version string of CRI-O.
  6809. apparmor_profile = "crio-default"
  6810.  
  6811. # Cgroup management implementation used for the runtime.
  6812. cgroup_manager = "systemd"
  6813.  
  6814. # List of default capabilities for containers. If it is empty or commented out,
  6815. # only the capabilities defined in the containers json file by the user/kube
  6816. # will be added.
  6817. # default_capabilities = [
  6818. # "CHOWN",
  6819. # "DAC_OVERRIDE",
  6820. # "FSETID",
  6821. # "FOWNER",
  6822. # "NET_RAW",
  6823. # "SETGID",
  6824. # "SETUID",
  6825. # "SETPCAP",
  6826. # "NET_BIND_SERVICE",
  6827. # "SYS_CHROOT",
  6828. # "KILL",
  6829. # ]
  6830.  
  6831. # List of default sysctls. If it is empty or commented out, only the sysctls
  6832. # defined in the container json file by the user/kube will be added.
  6833. # default_sysctls = [
  6834. # ]
  6835.  
  6836. # List of additional devices. specified as
  6837. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  6838. #If it is empty or commented out, only the devices
  6839. # defined in the container json file by the user/kube will be added.
  6840. # additional_devices = [
  6841. # ]
  6842.  
  6843. # Path to OCI hooks directories for automatically executed hooks.
  6844. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  6845. # so we add /etc/containers/oci/hooks.d as well
  6846. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  6847. hooks_dir = [
  6848. "/etc/containers/oci/hooks.d",
  6849. ]
  6850.  
  6851. # List of default mounts for each container. **Deprecated:** this option will
  6852. # be removed in future versions in favor of default_mounts_file.
  6853. # default_mounts = [
  6854. # "/usr/share/rhel/secrets:/run/secrets",
  6855. # ]
  6856.  
  6857. # Path to the file specifying the defaults mounts for each container. The
  6858. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  6859. # its default mounts from the following two files:
  6860. #
  6861. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  6862. # override file, where users can either add in their own default mounts, or
  6863. # override the default mounts shipped with the package.
  6864. #
  6865. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  6866. # mounts. If you want CRI-O to read from a different, specific mounts file,
  6867. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  6868. # only add mounts it finds in this file.
  6869. #
  6870. #default_mounts_file = ""
  6871.  
  6872. # Maximum number of processes allowed in a container.
  6873. # pids_limit = 1024
  6874.  
  6875. # Maximum sized allowed for the container log file. Negative numbers indicate
  6876. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  6877. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  6878. # limit is never exceeded.
  6879. # log_size_max = -1
  6880.  
  6881. # Whether container output should be logged to journald in addition to the kuberentes log file
  6882. # log_to_journald = false
  6883.  
  6884. # Path to directory in which container exit files are written to by conmon.
  6885. # container_exits_dir = "/var/run/crio/exits"
  6886.  
  6887. # Path to directory for container attach sockets.
  6888. # container_attach_socket_dir = "/var/run/crio"
  6889.  
  6890. # The prefix to use for the source of the bind mounts.
  6891. # bind_mount_prefix = ""
  6892.  
  6893. # If set to true, all containers will run in read-only mode.
  6894. # read_only = false
  6895.  
  6896. # Changes the verbosity of the logs based on the level it is set to. Options
  6897. # are fatal, panic, error, warn, info, and debug. This option supports live
  6898. # configuration reload.
  6899. # log_level = "error"
  6900.  
  6901. # The UID mappings for the user namespace of each container. A range is
  6902. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  6903. # separated by comma.
  6904. # uid_mappings = ""
  6905.  
  6906. # The GID mappings for the user namespace of each container. A range is
  6907. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  6908. # separated by comma.
  6909. # gid_mappings = ""
  6910.  
  6911. # The minimal amount of time in seconds to wait before issuing a timeout
  6912. # regarding the proper termination of the container.
  6913. # ctr_stop_timeout = 0
  6914.  
  6915. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  6916. # and manage its lifecycle.
  6917. # manage_network_ns_lifecycle = false
  6918.  
  6919. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  6920. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  6921. # If no runtime_handler is provided, the runtime will be picked based on the level
  6922. # of trust of the workload. Each entry in the table should follow the format:
  6923. #
  6924. #[crio.runtime.runtimes.runtime-handler]
  6925. # runtime_path = "/path/to/the/executable"
  6926. # runtime_type = "oci"
  6927. # runtime_root = "/path/to/the/root"
  6928. #
  6929. # Where:
  6930. # - runtime-handler: name used to identify the runtime
  6931. # - runtime_path (optional, string): absolute path to the runtime executable in
  6932. # the host filesystem. If omitted, the runtime-handler identifier should match
  6933. # the runtime executable name, and the runtime executable should be placed
  6934. # in $PATH.
  6935. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  6936. # omitted, an "oci" runtime is assumed.
  6937. # - runtime_root (optional, string): root directory for storage of containers
  6938. # state.
  6939.  
  6940.  
  6941. # [crio.runtime.runtimes.runc]
  6942. # runtime_path = ""
  6943. # runtime_type = "oci"
  6944. # runtime_root = "/run/runc"
  6945.  
  6946.  
  6947. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  6948. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  6949. # surface and mitigating the consequences of containers breakout.
  6950.  
  6951. # Kata Containers with the default configured VMM
  6952. #[crio.runtime.runtimes.kata-runtime]
  6953.  
  6954. # Kata Containers with the QEMU VMM
  6955. #[crio.runtime.runtimes.kata-qemu]
  6956.  
  6957. # Kata Containers with the Firecracker VMM
  6958. #[crio.runtime.runtimes.kata-fc]
  6959.  
  6960. # The crio.image table contains settings pertaining to the management of OCI images.
  6961. #
  6962. # CRI-O reads its configured registries defaults from the system wide
  6963. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  6964. # you want to modify just CRI-O, you can change the registries configuration in
  6965. # this file. Otherwise, leave insecure_registries and registries commented out to
  6966. # use the system's defaults from /etc/containers/registries.conf.
  6967. [crio.image]
  6968.  
  6969. # Default transport for pulling images from a remote container storage.
  6970. # default_transport = "docker://"
  6971.  
  6972. # The path to a file containing credentials necessary for pulling images from
  6973. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  6974. global_auth_file = "/var/lib/kubelet/config.json"
  6975.  
  6976. # The image used to instantiate infra containers.
  6977. # This option supports live configuration reload.
  6978. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  6979.  
  6980. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  6981.  
  6982. # The path to a file containing credentials specific for pulling the pause_image from
  6983. # above. The file is similar to that of /var/lib/kubelet/config.json
  6984. # This option supports live configuration reload.
  6985. pause_image_auth_file = "/var/lib/kubelet/config.json"
  6986.  
  6987. # The command to run to have a container stay in the paused state.
  6988. # This option supports live configuration reload.
  6989. pause_command = "/usr/bin/pod"
  6990.  
  6991. # Path to the file which decides what sort of policy we use when deciding
  6992. # whether or not to trust an image that we've pulled. It is not recommended that
  6993. # this option be used, as the default behavior of using the system-wide default
  6994. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  6995. # refer to containers-policy.json(5) for more details.
  6996. # signature_policy = ""
  6997.  
  6998. # List of registries to skip TLS verification for pulling images. Please
  6999. # consider configuring the registries via /etc/containers/registries.conf before
  7000. # changing them here.
  7001. #insecure_registries = "[]"
  7002.  
  7003. # Controls how image volumes are handled. The valid values are mkdir, bind and
  7004. # ignore; the latter will ignore volumes entirely.
  7005. # image_volumes = "mkdir"
  7006.  
  7007. # List of registries to be used when pulling an unqualified image (e.g.,
  7008. # "alpine:latest"). By default, registries is set to "docker.io" for
  7009. # compatibility reasons. Depending on your workload and usecase you may add more
  7010. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  7011. # "registry.opensuse.org", etc.).
  7012. #registries = [
  7013. # ]
  7014.  
  7015.  
  7016. # The crio.network table containers settings pertaining to the management of
  7017. # CNI plugins.
  7018. [crio.network]
  7019.  
  7020. # Path to the directory where CNI configuration files are located.
  7021. # Note this default is changed from the RPM.
  7022. network_dir = "/etc/kubernetes/cni/net.d/"
  7023.  
  7024. # Paths to directories where CNI plugin binaries are located.
  7025. # Note this default is changed from the RPM.
  7026. plugin_dirs = [
  7027. "/var/lib/cni/bin",
  7028. ]
  7029.  
  7030. # A necessary configuration for Prometheus based metrics retrieval
  7031. [crio.metrics]
  7032.  
  7033. # Globally enable or disable metrics support.
  7034. enable_metrics = true
  7035.  
  7036. # The port on which the metrics server will listen.
  7037. metrics_port = 9537
  7038.  
  7039.  
  7040. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  7041.  
  7042. # The path to a file containing credentials specific for pulling the pause_image from
  7043. # above. The file is similar to that of /var/lib/kubelet/config.json
  7044. # This option supports live configuration reload.
  7045. pause_image_auth_file = "/var/lib/kubelet/config.json"
  7046.  
  7047. # The command to run to have a container stay in the paused state.
  7048. # This option supports live configuration reload.
  7049. pause_command = "/usr/bin/pod"
  7050.  
  7051. # Path to the file which decides what sort of policy we use when deciding
  7052. # whether or not to trust an image that we've pulled. It is not recommended that
  7053. # this option be used, as the default behavior of using the system-wide default
  7054. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  7055. # refer to containers-policy.json(5) for more details.
  7056. # signature_policy = ""
  7057.  
  7058. # List of registries to skip TLS verification for pulling images. Please
  7059. # consider configuring the registries via /etc/containers/registries.conf before
  7060. # changing them here.
  7061. #insecure_registries = "[]"
  7062.  
  7063. # Controls how image volumes are handled. The valid values are mkdir, bind and
  7064. # ignore; the latter will ignore volumes entirely.
  7065. # image_volumes = "mkdir"
  7066.  
  7067. # List of registries to be used when pulling an unqualified image (e.g.,
  7068. # "alpine:latest"). By default, registries is set to "docker.io" for
  7069. # compatibility reasons. Depending on your workload and usecase you may add more
  7070. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  7071. # "registry.opensuse.org", etc.).
  7072. #registries = [
  7073. # ]
  7074.  
  7075.  
  7076. # The crio.network table containers settings pertaining to the management of
  7077. # CNI plugins.
  7078. [crio.network]
  7079.  
  7080. # Path to the directory where CNI configuration files are located.
  7081. # Note this default is changed from the RPM.
  7082. network_dir = "/etc/kubernetes/cni/net.d/"
  7083.  
  7084. # Paths to directories where CNI plugin binaries are located.
  7085. # Note this default is changed from the RPM.
  7086. plugin_dirs = [
  7087. "/var/lib/cni/bin",
  7088. ]
  7089.  
  7090. # A necessary configuration for Prometheus based metrics retrieval
  7091. [crio.metrics]
  7092.  
  7093. # Globally enable or disable metrics support.
  7094. enable_metrics = true
  7095.  
  7096. # The port on which the metrics server will listen.
  7097. metrics_port = 9537
  7098.  
  7099.  
  7100. E0115 17:38:05.934754 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7101. I0115 17:39:05.947667 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7102. I0115 17:39:05.947693 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  7103. I0115 17:39:05.952560 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  7104. I0115 17:39:05.952590 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  7105. I0115 17:39:05.962790 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7106. E0115 17:39:05.963492 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  7107. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  7108. # daemon, but in a TOML format that can be more easily modified and versioned.
  7109. #
  7110. # Please refer to crio.conf(5) for details of all configuration options.
  7111.  
  7112. # CRI-O supports partial configuration reload during runtime, which can be
  7113. # done by sending SIGHUP to the running process. Currently supported options
  7114. # are explicitly mentioned with: 'This option supports live configuration
  7115. # reload'.
  7116.  
  7117. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  7118. # located at /etc/containers/storage.conf. Modify this storage configuration if
  7119. # you want to change the system's defaults. If you want to modify storage just
  7120. # for CRI-O, you can change the storage configuration options here.
  7121. [crio]
  7122.  
  7123. # Path to the "root directory". CRI-O stores all of its data, including
  7124. # containers images, in this directory.
  7125. #root = "/var/lib/containers/storage"
  7126.  
  7127. # Path to the "run directory". CRI-O stores all of its state in this directory.
  7128. #runroot = "/run/user/1000"
  7129.  
  7130. # Storage driver used to manage the storage of images and containers. Please
  7131. # refer to containers-storage.conf(5) to see all available storage drivers.
  7132. #storage_driver = "overlay"
  7133.  
  7134. # List to pass options to the storage driver. Please refer to
  7135. # containers-storage.conf(5) to see all available storage options.
  7136. #storage_option = [
  7137. #]
  7138.  
  7139. # The default log directory where all logs will go unless directly specified by
  7140. # the kubelet. The log directory specified must be an absolute directory.
  7141. # log_dir = "/var/log/crio/pods"
  7142.  
  7143. # Location for CRI-O to lay down the version file
  7144. # version_file = "/var/lib/crio/version"
  7145.  
  7146. # The crio.api table contains settings for the kubelet/gRPC interface.
  7147. [crio.api]
  7148.  
  7149. # Path to AF_LOCAL socket on which CRI-O will listen.
  7150. # listen = "/var/run/crio/crio.sock"
  7151.  
  7152. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  7153. # host_ip = ""
  7154.  
  7155. # IP address on which the stream server will listen.
  7156. stream_address = ""
  7157.  
  7158. # The port on which the stream server will listen.
  7159. stream_port = "10010"
  7160.  
  7161. # Enable encrypted TLS transport of the stream server.
  7162. # stream_enable_tls = false
  7163.  
  7164. # Path to the x509 certificate file used to serve the encrypted stream. This
  7165. # file can change, and CRI-O will automatically pick up the changes within 5
  7166. # minutes.
  7167. # stream_tls_cert = ""
  7168.  
  7169. # Path to the key file used to serve the encrypted stream. This file can
  7170. # change and CRI-O will automatically pick up the changes within 5 minutes.
  7171. # stream_tls_key = ""
  7172.  
  7173. # Path to the x509 CA(s) file used to verify and authenticate client
  7174. # communication with the encrypted stream. This file can change and CRI-O will
  7175. # automatically pick up the changes within 5 minutes.
  7176. # stream_tls_ca = ""
  7177.  
  7178. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  7179. # grpc_max_send_msg_size = 16777216
  7180.  
  7181. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  7182. # grpc_max_recv_msg_size = 16777216
  7183.  
  7184. # The crio.runtime table contains settings pertaining to the OCI runtime used
  7185. # and options for how to set up and manage the OCI runtime.
  7186. [crio.runtime]
  7187.  
  7188. # A list of ulimits to be set in containers by default, specified as
  7189. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  7190. # "nofile=1024:2048"
  7191. # If nothing is set here, settings will be inherited from the CRI-O daemon
  7192. #default_ulimits = [
  7193. #]
  7194.  
  7195. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  7196. # The name is matched against the runtimes map below.
  7197. # default_runtime = "runc"
  7198.  
  7199. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  7200. # no_pivot = false
  7201.  
  7202. # Path to the conmon binary, used for monitoring the OCI runtime.
  7203. # Will be searched for using $PATH if empty.
  7204. conmon = "/usr/libexec/crio/conmon"
  7205.  
  7206. # Cgroup setting for conmon
  7207. conmon_cgroup = "pod"
  7208.  
  7209. # Environment variable list for the conmon process, used for passing necessary
  7210. # environment variables to conmon or the runtime.
  7211. # conmon_env = [
  7212. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  7213. # ]
  7214.  
  7215. # If true, SELinux will be used for pod separation on the host.
  7216. # selinux = true
  7217.  
  7218. # Path to the seccomp.json profile which is used as the default seccomp profile
  7219. # for the runtime. If not specified, then the internal default seccomp profile
  7220. # will be used.
  7221. # seccomp_profile = "/etc/crio/seccomp.json"
  7222.  
  7223. # Used to change the name of the default AppArmor profile of CRI-O. The default
  7224. # profile name is "crio-default-" followed by the version string of CRI-O.
  7225. apparmor_profile = "crio-default"
  7226.  
  7227. # Cgroup management implementation used for the runtime.
  7228. cgroup_manager = "systemd"
  7229.  
  7230. # List of default capabilities for containers. If it is empty or commented out,
  7231. # only the capabilities defined in the containers json file by the user/kube
  7232. # will be added.
  7233. # default_capabilities = [
  7234. # "CHOWN",
  7235. # "DAC_OVERRIDE",
  7236. # "FSETID",
  7237. # "FOWNER",
  7238. # "NET_RAW",
  7239. # "SETGID",
  7240. # "SETUID",
  7241. # "SETPCAP",
  7242. # "NET_BIND_SERVICE",
  7243. # "SYS_CHROOT",
  7244. # "KILL",
  7245. # ]
  7246.  
  7247. # List of default sysctls. If it is empty or commented out, only the sysctls
  7248. # defined in the container json file by the user/kube will be added.
  7249. # default_sysctls = [
  7250. # ]
  7251.  
  7252. # List of additional devices. specified as
  7253. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  7254. #If it is empty or commented out, only the devices
  7255. # defined in the container json file by the user/kube will be added.
  7256. # additional_devices = [
  7257. # ]
  7258.  
  7259. # Path to OCI hooks directories for automatically executed hooks.
  7260. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  7261. # so we add /etc/containers/oci/hooks.d as well
  7262. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  7263. hooks_dir = [
  7264. "/etc/containers/oci/hooks.d",
  7265. ]
  7266.  
  7267. # List of default mounts for each container. **Deprecated:** this option will
  7268. # be removed in future versions in favor of default_mounts_file.
  7269. # default_mounts = [
  7270. # "/usr/share/rhel/secrets:/run/secrets",
  7271. # ]
  7272.  
  7273. # Path to the file specifying the defaults mounts for each container. The
  7274. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  7275. # its default mounts from the following two files:
  7276. #
  7277. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  7278. # override file, where users can either add in their own default mounts, or
  7279. # override the default mounts shipped with the package.
  7280. #
  7281. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  7282. # mounts. If you want CRI-O to read from a different, specific mounts file,
  7283. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  7284. # only add mounts it finds in this file.
  7285. #
  7286. #default_mounts_file = ""
  7287.  
  7288. # Maximum number of processes allowed in a container.
  7289. # pids_limit = 1024
  7290.  
  7291. # Maximum sized allowed for the container log file. Negative numbers indicate
  7292. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  7293. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  7294. # limit is never exceeded.
  7295. # log_size_max = -1
  7296.  
  7297. # Whether container output should be logged to journald in addition to the kuberentes log file
  7298. # log_to_journald = false
  7299.  
  7300. # Path to directory in which container exit files are written to by conmon.
  7301. # container_exits_dir = "/var/run/crio/exits"
  7302.  
  7303. # Path to directory for container attach sockets.
  7304. # container_attach_socket_dir = "/var/run/crio"
  7305.  
  7306. # The prefix to use for the source of the bind mounts.
  7307. # bind_mount_prefix = ""
  7308.  
  7309. # If set to true, all containers will run in read-only mode.
  7310. # read_only = false
  7311.  
  7312. # Changes the verbosity of the logs based on the level it is set to. Options
  7313. # are fatal, panic, error, warn, info, and debug. This option supports live
  7314. # configuration reload.
  7315. # log_level = "error"
  7316.  
  7317. # The UID mappings for the user namespace of each container. A range is
  7318. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  7319. # separated by comma.
  7320. # uid_mappings = ""
  7321.  
  7322. # The GID mappings for the user namespace of each container. A range is
  7323. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  7324. # separated by comma.
  7325. # gid_mappings = ""
  7326.  
  7327. # The minimal amount of time in seconds to wait before issuing a timeout
  7328. # regarding the proper termination of the container.
  7329. # ctr_stop_timeout = 0
  7330.  
  7331. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  7332. # and manage its lifecycle.
  7333. # manage_network_ns_lifecycle = false
  7334.  
  7335. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  7336. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  7337. # If no runtime_handler is provided, the runtime will be picked based on the level
  7338. # of trust of the workload. Each entry in the table should follow the format:
  7339. #
  7340. #[crio.runtime.runtimes.runtime-handler]
  7341. # runtime_path = "/path/to/the/executable"
  7342. # runtime_type = "oci"
  7343. # runtime_root = "/path/to/the/root"
  7344. #
  7345. # Where:
  7346. # - runtime-handler: name used to identify the runtime
  7347. # - runtime_path (optional, string): absolute path to the runtime executable in
  7348. # the host filesystem. If omitted, the runtime-handler identifier should match
  7349. # the runtime executable name, and the runtime executable should be placed
  7350. # in $PATH.
  7351. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  7352. # omitted, an "oci" runtime is assumed.
  7353. # - runtime_root (optional, string): root directory for storage of containers
  7354. # state.
  7355.  
  7356.  
  7357. # [crio.runtime.runtimes.runc]
  7358. # runtime_path = ""
  7359. # runtime_type = "oci"
  7360. # runtime_root = "/run/runc"
  7361.  
  7362.  
  7363. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  7364. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  7365. # surface and mitigating the consequences of containers breakout.
  7366.  
  7367. # Kata Containers with the default configured VMM
  7368. #[crio.runtime.runtimes.kata-runtime]
  7369.  
  7370. # Kata Containers with the QEMU VMM
  7371. #[crio.runtime.runtimes.kata-qemu]
  7372.  
  7373. # Kata Containers with the Firecracker VMM
  7374. #[crio.runtime.runtimes.kata-fc]
  7375.  
  7376. # The crio.image table contains settings pertaining to the management of OCI images.
  7377. #
  7378. # CRI-O reads its configured registries defaults from the system wide
  7379. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  7380. # you want to modify just CRI-O, you can change the registries configuration in
  7381. # this file. Otherwise, leave insecure_registries and registries commented out to
  7382. # use the system's defaults from /etc/containers/registries.conf.
  7383. [crio.image]
  7384.  
  7385. # Default transport for pulling images from a remote container storage.
  7386. # default_transport = "docker://"
  7387.  
  7388. # The path to a file containing credentials necessary for pulling images from
  7389. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  7390. global_auth_file = "/var/lib/kubelet/config.json"
  7391.  
  7392. # The image used to instantiate infra containers.
  7393. # This option supports live configuration reload.
  7394. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  7395.  
  7396. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  7397.  
  7398. # The path to a file containing credentials specific for pulling the pause_image from
  7399. # above. The file is similar to that of /var/lib/kubelet/config.json
  7400. # This option supports live configuration reload.
  7401. pause_image_auth_file = "/var/lib/kubelet/config.json"
  7402.  
  7403. # The command to run to have a container stay in the paused state.
  7404. # This option supports live configuration reload.
  7405. pause_command = "/usr/bin/pod"
  7406.  
  7407. # Path to the file which decides what sort of policy we use when deciding
  7408. # whether or not to trust an image that we've pulled. It is not recommended that
  7409. # this option be used, as the default behavior of using the system-wide default
  7410. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  7411. # refer to containers-policy.json(5) for more details.
  7412. # signature_policy = ""
  7413.  
  7414. # List of registries to skip TLS verification for pulling images. Please
  7415. # consider configuring the registries via /etc/containers/registries.conf before
  7416. # changing them here.
  7417. #insecure_registries = "[]"
  7418.  
  7419. # Controls how image volumes are handled. The valid values are mkdir, bind and
  7420. # ignore; the latter will ignore volumes entirely.
  7421. # image_volumes = "mkdir"
  7422.  
  7423. # List of registries to be used when pulling an unqualified image (e.g.,
  7424. # "alpine:latest"). By default, registries is set to "docker.io" for
  7425. # compatibility reasons. Depending on your workload and usecase you may add more
  7426. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  7427. # "registry.opensuse.org", etc.).
  7428. #registries = [
  7429. # ]
  7430.  
  7431.  
  7432. # The crio.network table containers settings pertaining to the management of
  7433. # CNI plugins.
  7434. [crio.network]
  7435.  
  7436. # Path to the directory where CNI configuration files are located.
  7437. # Note this default is changed from the RPM.
  7438. network_dir = "/etc/kubernetes/cni/net.d/"
  7439.  
  7440. # Paths to directories where CNI plugin binaries are located.
  7441. # Note this default is changed from the RPM.
  7442. plugin_dirs = [
  7443. "/var/lib/cni/bin",
  7444. ]
  7445.  
  7446. # A necessary configuration for Prometheus based metrics retrieval
  7447. [crio.metrics]
  7448.  
  7449. # Globally enable or disable metrics support.
  7450. enable_metrics = true
  7451.  
  7452. # The port on which the metrics server will listen.
  7453. metrics_port = 9537
  7454.  
  7455.  
  7456. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  7457.  
  7458. # The path to a file containing credentials specific for pulling the pause_image from
  7459. # above. The file is similar to that of /var/lib/kubelet/config.json
  7460. # This option supports live configuration reload.
  7461. pause_image_auth_file = "/var/lib/kubelet/config.json"
  7462.  
  7463. # The command to run to have a container stay in the paused state.
  7464. # This option supports live configuration reload.
  7465. pause_command = "/usr/bin/pod"
  7466.  
  7467. # Path to the file which decides what sort of policy we use when deciding
  7468. # whether or not to trust an image that we've pulled. It is not recommended that
  7469. # this option be used, as the default behavior of using the system-wide default
  7470. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  7471. # refer to containers-policy.json(5) for more details.
  7472. # signature_policy = ""
  7473.  
  7474. # List of registries to skip TLS verification for pulling images. Please
  7475. # consider configuring the registries via /etc/containers/registries.conf before
  7476. # changing them here.
  7477. #insecure_registries = "[]"
  7478.  
  7479. # Controls how image volumes are handled. The valid values are mkdir, bind and
  7480. # ignore; the latter will ignore volumes entirely.
  7481. # image_volumes = "mkdir"
  7482.  
  7483. # List of registries to be used when pulling an unqualified image (e.g.,
  7484. # "alpine:latest"). By default, registries is set to "docker.io" for
  7485. # compatibility reasons. Depending on your workload and usecase you may add more
  7486. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  7487. # "registry.opensuse.org", etc.).
  7488. #registries = [
  7489. # ]
  7490.  
  7491.  
  7492. # The crio.network table containers settings pertaining to the management of
  7493. # CNI plugins.
  7494. [crio.network]
  7495.  
  7496. # Path to the directory where CNI configuration files are located.
  7497. # Note this default is changed from the RPM.
  7498. network_dir = "/etc/kubernetes/cni/net.d/"
  7499.  
  7500. # Paths to directories where CNI plugin binaries are located.
  7501. # Note this default is changed from the RPM.
  7502. plugin_dirs = [
  7503. "/var/lib/cni/bin",
  7504. ]
  7505.  
  7506. # A necessary configuration for Prometheus based metrics retrieval
  7507. [crio.metrics]
  7508.  
  7509. # Globally enable or disable metrics support.
  7510. enable_metrics = true
  7511.  
  7512. # The port on which the metrics server will listen.
  7513. metrics_port = 9537
  7514.  
  7515.  
  7516. E0115 17:39:05.963519 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7517. I0115 17:40:05.975687 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7518. I0115 17:40:05.975715 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  7519. I0115 17:40:05.980598 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  7520. I0115 17:40:05.980620 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  7521. I0115 17:40:05.989363 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7522. E0115 17:40:05.990073 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  7523. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  7524. # daemon, but in a TOML format that can be more easily modified and versioned.
  7525. #
  7526. # Please refer to crio.conf(5) for details of all configuration options.
  7527.  
  7528. # CRI-O supports partial configuration reload during runtime, which can be
  7529. # done by sending SIGHUP to the running process. Currently supported options
  7530. # are explicitly mentioned with: 'This option supports live configuration
  7531. # reload'.
  7532.  
  7533. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  7534. # located at /etc/containers/storage.conf. Modify this storage configuration if
  7535. # you want to change the system's defaults. If you want to modify storage just
  7536. # for CRI-O, you can change the storage configuration options here.
  7537. [crio]
  7538.  
  7539. # Path to the "root directory". CRI-O stores all of its data, including
  7540. # containers images, in this directory.
  7541. #root = "/var/lib/containers/storage"
  7542.  
  7543. # Path to the "run directory". CRI-O stores all of its state in this directory.
  7544. #runroot = "/run/user/1000"
  7545.  
  7546. # Storage driver used to manage the storage of images and containers. Please
  7547. # refer to containers-storage.conf(5) to see all available storage drivers.
  7548. #storage_driver = "overlay"
  7549.  
  7550. # List to pass options to the storage driver. Please refer to
  7551. # containers-storage.conf(5) to see all available storage options.
  7552. #storage_option = [
  7553. #]
  7554.  
  7555. # The default log directory where all logs will go unless directly specified by
  7556. # the kubelet. The log directory specified must be an absolute directory.
  7557. # log_dir = "/var/log/crio/pods"
  7558.  
  7559. # Location for CRI-O to lay down the version file
  7560. # version_file = "/var/lib/crio/version"
  7561.  
  7562. # The crio.api table contains settings for the kubelet/gRPC interface.
  7563. [crio.api]
  7564.  
  7565. # Path to AF_LOCAL socket on which CRI-O will listen.
  7566. # listen = "/var/run/crio/crio.sock"
  7567.  
  7568. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  7569. # host_ip = ""
  7570.  
  7571. # IP address on which the stream server will listen.
  7572. stream_address = ""
  7573.  
  7574. # The port on which the stream server will listen.
  7575. stream_port = "10010"
  7576.  
  7577. # Enable encrypted TLS transport of the stream server.
  7578. # stream_enable_tls = false
  7579.  
  7580. # Path to the x509 certificate file used to serve the encrypted stream. This
  7581. # file can change, and CRI-O will automatically pick up the changes within 5
  7582. # minutes.
  7583. # stream_tls_cert = ""
  7584.  
  7585. # Path to the key file used to serve the encrypted stream. This file can
  7586. # change and CRI-O will automatically pick up the changes within 5 minutes.
  7587. # stream_tls_key = ""
  7588.  
  7589. # Path to the x509 CA(s) file used to verify and authenticate client
  7590. # communication with the encrypted stream. This file can change and CRI-O will
  7591. # automatically pick up the changes within 5 minutes.
  7592. # stream_tls_ca = ""
  7593.  
  7594. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  7595. # grpc_max_send_msg_size = 16777216
  7596.  
  7597. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  7598. # grpc_max_recv_msg_size = 16777216
  7599.  
  7600. # The crio.runtime table contains settings pertaining to the OCI runtime used
  7601. # and options for how to set up and manage the OCI runtime.
  7602. [crio.runtime]
  7603.  
  7604. # A list of ulimits to be set in containers by default, specified as
  7605. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  7606. # "nofile=1024:2048"
  7607. # If nothing is set here, settings will be inherited from the CRI-O daemon
  7608. #default_ulimits = [
  7609. #]
  7610.  
  7611. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  7612. # The name is matched against the runtimes map below.
  7613. # default_runtime = "runc"
  7614.  
  7615. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  7616. # no_pivot = false
  7617.  
  7618. # Path to the conmon binary, used for monitoring the OCI runtime.
  7619. # Will be searched for using $PATH if empty.
  7620. conmon = "/usr/libexec/crio/conmon"
  7621.  
  7622. # Cgroup setting for conmon
  7623. conmon_cgroup = "pod"
  7624.  
  7625. # Environment variable list for the conmon process, used for passing necessary
  7626. # environment variables to conmon or the runtime.
  7627. # conmon_env = [
  7628. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  7629. # ]
  7630.  
  7631. # If true, SELinux will be used for pod separation on the host.
  7632. # selinux = true
  7633.  
  7634. # Path to the seccomp.json profile which is used as the default seccomp profile
  7635. # for the runtime. If not specified, then the internal default seccomp profile
  7636. # will be used.
  7637. # seccomp_profile = "/etc/crio/seccomp.json"
  7638.  
  7639. # Used to change the name of the default AppArmor profile of CRI-O. The default
  7640. # profile name is "crio-default-" followed by the version string of CRI-O.
  7641. apparmor_profile = "crio-default"
  7642.  
  7643. # Cgroup management implementation used for the runtime.
  7644. cgroup_manager = "systemd"
  7645.  
  7646. # List of default capabilities for containers. If it is empty or commented out,
  7647. # only the capabilities defined in the containers json file by the user/kube
  7648. # will be added.
  7649. # default_capabilities = [
  7650. # "CHOWN",
  7651. # "DAC_OVERRIDE",
  7652. # "FSETID",
  7653. # "FOWNER",
  7654. # "NET_RAW",
  7655. # "SETGID",
  7656. # "SETUID",
  7657. # "SETPCAP",
  7658. # "NET_BIND_SERVICE",
  7659. # "SYS_CHROOT",
  7660. # "KILL",
  7661. # ]
  7662.  
  7663. # List of default sysctls. If it is empty or commented out, only the sysctls
  7664. # defined in the container json file by the user/kube will be added.
  7665. # default_sysctls = [
  7666. # ]
  7667.  
  7668. # List of additional devices. specified as
  7669. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  7670. #If it is empty or commented out, only the devices
  7671. # defined in the container json file by the user/kube will be added.
  7672. # additional_devices = [
  7673. # ]
  7674.  
  7675. # Path to OCI hooks directories for automatically executed hooks.
  7676. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  7677. # so we add /etc/containers/oci/hooks.d as well
  7678. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  7679. hooks_dir = [
  7680. "/etc/containers/oci/hooks.d",
  7681. ]
  7682.  
  7683. # List of default mounts for each container. **Deprecated:** this option will
  7684. # be removed in future versions in favor of default_mounts_file.
  7685. # default_mounts = [
  7686. # "/usr/share/rhel/secrets:/run/secrets",
  7687. # ]
  7688.  
  7689. # Path to the file specifying the defaults mounts for each container. The
  7690. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  7691. # its default mounts from the following two files:
  7692. #
  7693. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  7694. # override file, where users can either add in their own default mounts, or
  7695. # override the default mounts shipped with the package.
  7696. #
  7697. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  7698. # mounts. If you want CRI-O to read from a different, specific mounts file,
  7699. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  7700. # only add mounts it finds in this file.
  7701. #
  7702. #default_mounts_file = ""
  7703.  
  7704. # Maximum number of processes allowed in a container.
  7705. # pids_limit = 1024
  7706.  
  7707. # Maximum sized allowed for the container log file. Negative numbers indicate
  7708. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  7709. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  7710. # limit is never exceeded.
  7711. # log_size_max = -1
  7712.  
  7713. # Whether container output should be logged to journald in addition to the kuberentes log file
  7714. # log_to_journald = false
  7715.  
  7716. # Path to directory in which container exit files are written to by conmon.
  7717. # container_exits_dir = "/var/run/crio/exits"
  7718.  
  7719. # Path to directory for container attach sockets.
  7720. # container_attach_socket_dir = "/var/run/crio"
  7721.  
  7722. # The prefix to use for the source of the bind mounts.
  7723. # bind_mount_prefix = ""
  7724.  
  7725. # If set to true, all containers will run in read-only mode.
  7726. # read_only = false
  7727.  
  7728. # Changes the verbosity of the logs based on the level it is set to. Options
  7729. # are fatal, panic, error, warn, info, and debug. This option supports live
  7730. # configuration reload.
  7731. # log_level = "error"
  7732.  
  7733. # The UID mappings for the user namespace of each container. A range is
  7734. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  7735. # separated by comma.
  7736. # uid_mappings = ""
  7737.  
  7738. # The GID mappings for the user namespace of each container. A range is
  7739. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  7740. # separated by comma.
  7741. # gid_mappings = ""
  7742.  
  7743. # The minimal amount of time in seconds to wait before issuing a timeout
  7744. # regarding the proper termination of the container.
  7745. # ctr_stop_timeout = 0
  7746.  
  7747. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  7748. # and manage its lifecycle.
  7749. # manage_network_ns_lifecycle = false
  7750.  
  7751. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  7752. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  7753. # If no runtime_handler is provided, the runtime will be picked based on the level
  7754. # of trust of the workload. Each entry in the table should follow the format:
  7755. #
  7756. #[crio.runtime.runtimes.runtime-handler]
  7757. # runtime_path = "/path/to/the/executable"
  7758. # runtime_type = "oci"
  7759. # runtime_root = "/path/to/the/root"
  7760. #
  7761. # Where:
  7762. # - runtime-handler: name used to identify the runtime
  7763. # - runtime_path (optional, string): absolute path to the runtime executable in
  7764. # the host filesystem. If omitted, the runtime-handler identifier should match
  7765. # the runtime executable name, and the runtime executable should be placed
  7766. # in $PATH.
  7767. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  7768. # omitted, an "oci" runtime is assumed.
  7769. # - runtime_root (optional, string): root directory for storage of containers
  7770. # state.
  7771.  
  7772.  
  7773. # [crio.runtime.runtimes.runc]
  7774. # runtime_path = ""
  7775. # runtime_type = "oci"
  7776. # runtime_root = "/run/runc"
  7777.  
  7778.  
  7779. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  7780. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  7781. # surface and mitigating the consequences of containers breakout.
  7782.  
  7783. # Kata Containers with the default configured VMM
  7784. #[crio.runtime.runtimes.kata-runtime]
  7785.  
  7786. # Kata Containers with the QEMU VMM
  7787. #[crio.runtime.runtimes.kata-qemu]
  7788.  
  7789. # Kata Containers with the Firecracker VMM
  7790. #[crio.runtime.runtimes.kata-fc]
  7791.  
  7792. # The crio.image table contains settings pertaining to the management of OCI images.
  7793. #
  7794. # CRI-O reads its configured registries defaults from the system wide
  7795. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  7796. # you want to modify just CRI-O, you can change the registries configuration in
  7797. # this file. Otherwise, leave insecure_registries and registries commented out to
  7798. # use the system's defaults from /etc/containers/registries.conf.
  7799. [crio.image]
  7800.  
  7801. # Default transport for pulling images from a remote container storage.
  7802. # default_transport = "docker://"
  7803.  
  7804. # The path to a file containing credentials necessary for pulling images from
  7805. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  7806. global_auth_file = "/var/lib/kubelet/config.json"
  7807.  
  7808. # The image used to instantiate infra containers.
  7809. # This option supports live configuration reload.
  7810. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  7811.  
  7812. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  7813.  
  7814. # The path to a file containing credentials specific for pulling the pause_image from
  7815. # above. The file is similar to that of /var/lib/kubelet/config.json
  7816. # This option supports live configuration reload.
  7817. pause_image_auth_file = "/var/lib/kubelet/config.json"
  7818.  
  7819. # The command to run to have a container stay in the paused state.
  7820. # This option supports live configuration reload.
  7821. pause_command = "/usr/bin/pod"
  7822.  
  7823. # Path to the file which decides what sort of policy we use when deciding
  7824. # whether or not to trust an image that we've pulled. It is not recommended that
  7825. # this option be used, as the default behavior of using the system-wide default
  7826. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  7827. # refer to containers-policy.json(5) for more details.
  7828. # signature_policy = ""
  7829.  
  7830. # List of registries to skip TLS verification for pulling images. Please
  7831. # consider configuring the registries via /etc/containers/registries.conf before
  7832. # changing them here.
  7833. #insecure_registries = "[]"
  7834.  
  7835. # Controls how image volumes are handled. The valid values are mkdir, bind and
  7836. # ignore; the latter will ignore volumes entirely.
  7837. # image_volumes = "mkdir"
  7838.  
  7839. # List of registries to be used when pulling an unqualified image (e.g.,
  7840. # "alpine:latest"). By default, registries is set to "docker.io" for
  7841. # compatibility reasons. Depending on your workload and usecase you may add more
  7842. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  7843. # "registry.opensuse.org", etc.).
  7844. #registries = [
  7845. # ]
  7846.  
  7847.  
  7848. # The crio.network table containers settings pertaining to the management of
  7849. # CNI plugins.
  7850. [crio.network]
  7851.  
  7852. # Path to the directory where CNI configuration files are located.
  7853. # Note this default is changed from the RPM.
  7854. network_dir = "/etc/kubernetes/cni/net.d/"
  7855.  
  7856. # Paths to directories where CNI plugin binaries are located.
  7857. # Note this default is changed from the RPM.
  7858. plugin_dirs = [
  7859. "/var/lib/cni/bin",
  7860. ]
  7861.  
  7862. # A necessary configuration for Prometheus based metrics retrieval
  7863. [crio.metrics]
  7864.  
  7865. # Globally enable or disable metrics support.
  7866. enable_metrics = true
  7867.  
  7868. # The port on which the metrics server will listen.
  7869. metrics_port = 9537
  7870.  
  7871.  
  7872. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  7873.  
  7874. # The path to a file containing credentials specific for pulling the pause_image from
  7875. # above. The file is similar to that of /var/lib/kubelet/config.json
  7876. # This option supports live configuration reload.
  7877. pause_image_auth_file = "/var/lib/kubelet/config.json"
  7878.  
  7879. # The command to run to have a container stay in the paused state.
  7880. # This option supports live configuration reload.
  7881. pause_command = "/usr/bin/pod"
  7882.  
  7883. # Path to the file which decides what sort of policy we use when deciding
  7884. # whether or not to trust an image that we've pulled. It is not recommended that
  7885. # this option be used, as the default behavior of using the system-wide default
  7886. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  7887. # refer to containers-policy.json(5) for more details.
  7888. # signature_policy = ""
  7889.  
  7890. # List of registries to skip TLS verification for pulling images. Please
  7891. # consider configuring the registries via /etc/containers/registries.conf before
  7892. # changing them here.
  7893. #insecure_registries = "[]"
  7894.  
  7895. # Controls how image volumes are handled. The valid values are mkdir, bind and
  7896. # ignore; the latter will ignore volumes entirely.
  7897. # image_volumes = "mkdir"
  7898.  
  7899. # List of registries to be used when pulling an unqualified image (e.g.,
  7900. # "alpine:latest"). By default, registries is set to "docker.io" for
  7901. # compatibility reasons. Depending on your workload and usecase you may add more
  7902. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  7903. # "registry.opensuse.org", etc.).
  7904. #registries = [
  7905. # ]
  7906.  
  7907.  
  7908. # The crio.network table containers settings pertaining to the management of
  7909. # CNI plugins.
  7910. [crio.network]
  7911.  
  7912. # Path to the directory where CNI configuration files are located.
  7913. # Note this default is changed from the RPM.
  7914. network_dir = "/etc/kubernetes/cni/net.d/"
  7915.  
  7916. # Paths to directories where CNI plugin binaries are located.
  7917. # Note this default is changed from the RPM.
  7918. plugin_dirs = [
  7919. "/var/lib/cni/bin",
  7920. ]
  7921.  
  7922. # A necessary configuration for Prometheus based metrics retrieval
  7923. [crio.metrics]
  7924.  
  7925. # Globally enable or disable metrics support.
  7926. enable_metrics = true
  7927.  
  7928. # The port on which the metrics server will listen.
  7929. metrics_port = 9537
  7930.  
  7931.  
  7932. E0115 17:40:05.990112 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7933. I0115 17:41:06.002502 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7934. I0115 17:41:06.002526 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  7935. I0115 17:41:06.007510 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  7936. I0115 17:41:06.007533 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  7937. I0115 17:41:06.017207 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  7938. E0115 17:41:06.017893 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  7939. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  7940. # daemon, but in a TOML format that can be more easily modified and versioned.
  7941. #
  7942. # Please refer to crio.conf(5) for details of all configuration options.
  7943.  
  7944. # CRI-O supports partial configuration reload during runtime, which can be
  7945. # done by sending SIGHUP to the running process. Currently supported options
  7946. # are explicitly mentioned with: 'This option supports live configuration
  7947. # reload'.
  7948.  
  7949. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  7950. # located at /etc/containers/storage.conf. Modify this storage configuration if
  7951. # you want to change the system's defaults. If you want to modify storage just
  7952. # for CRI-O, you can change the storage configuration options here.
  7953. [crio]
  7954.  
  7955. # Path to the "root directory". CRI-O stores all of its data, including
  7956. # containers images, in this directory.
  7957. #root = "/var/lib/containers/storage"
  7958.  
  7959. # Path to the "run directory". CRI-O stores all of its state in this directory.
  7960. #runroot = "/run/user/1000"
  7961.  
  7962. # Storage driver used to manage the storage of images and containers. Please
  7963. # refer to containers-storage.conf(5) to see all available storage drivers.
  7964. #storage_driver = "overlay"
  7965.  
  7966. # List to pass options to the storage driver. Please refer to
  7967. # containers-storage.conf(5) to see all available storage options.
  7968. #storage_option = [
  7969. #]
  7970.  
  7971. # The default log directory where all logs will go unless directly specified by
  7972. # the kubelet. The log directory specified must be an absolute directory.
  7973. # log_dir = "/var/log/crio/pods"
  7974.  
  7975. # Location for CRI-O to lay down the version file
  7976. # version_file = "/var/lib/crio/version"
  7977.  
  7978. # The crio.api table contains settings for the kubelet/gRPC interface.
  7979. [crio.api]
  7980.  
  7981. # Path to AF_LOCAL socket on which CRI-O will listen.
  7982. # listen = "/var/run/crio/crio.sock"
  7983.  
  7984. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  7985. # host_ip = ""
  7986.  
  7987. # IP address on which the stream server will listen.
  7988. stream_address = ""
  7989.  
  7990. # The port on which the stream server will listen.
  7991. stream_port = "10010"
  7992.  
  7993. # Enable encrypted TLS transport of the stream server.
  7994. # stream_enable_tls = false
  7995.  
  7996. # Path to the x509 certificate file used to serve the encrypted stream. This
  7997. # file can change, and CRI-O will automatically pick up the changes within 5
  7998. # minutes.
  7999. # stream_tls_cert = ""
  8000.  
  8001. # Path to the key file used to serve the encrypted stream. This file can
  8002. # change and CRI-O will automatically pick up the changes within 5 minutes.
  8003. # stream_tls_key = ""
  8004.  
  8005. # Path to the x509 CA(s) file used to verify and authenticate client
  8006. # communication with the encrypted stream. This file can change and CRI-O will
  8007. # automatically pick up the changes within 5 minutes.
  8008. # stream_tls_ca = ""
  8009.  
  8010. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  8011. # grpc_max_send_msg_size = 16777216
  8012.  
  8013. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  8014. # grpc_max_recv_msg_size = 16777216
  8015.  
  8016. # The crio.runtime table contains settings pertaining to the OCI runtime used
  8017. # and options for how to set up and manage the OCI runtime.
  8018. [crio.runtime]
  8019.  
  8020. # A list of ulimits to be set in containers by default, specified as
  8021. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  8022. # "nofile=1024:2048"
  8023. # If nothing is set here, settings will be inherited from the CRI-O daemon
  8024. #default_ulimits = [
  8025. #]
  8026.  
  8027. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  8028. # The name is matched against the runtimes map below.
  8029. # default_runtime = "runc"
  8030.  
  8031. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  8032. # no_pivot = false
  8033.  
  8034. # Path to the conmon binary, used for monitoring the OCI runtime.
  8035. # Will be searched for using $PATH if empty.
  8036. conmon = "/usr/libexec/crio/conmon"
  8037.  
  8038. # Cgroup setting for conmon
  8039. conmon_cgroup = "pod"
  8040.  
  8041. # Environment variable list for the conmon process, used for passing necessary
  8042. # environment variables to conmon or the runtime.
  8043. # conmon_env = [
  8044. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  8045. # ]
  8046.  
  8047. # If true, SELinux will be used for pod separation on the host.
  8048. # selinux = true
  8049.  
  8050. # Path to the seccomp.json profile which is used as the default seccomp profile
  8051. # for the runtime. If not specified, then the internal default seccomp profile
  8052. # will be used.
  8053. # seccomp_profile = "/etc/crio/seccomp.json"
  8054.  
  8055. # Used to change the name of the default AppArmor profile of CRI-O. The default
  8056. # profile name is "crio-default-" followed by the version string of CRI-O.
  8057. apparmor_profile = "crio-default"
  8058.  
  8059. # Cgroup management implementation used for the runtime.
  8060. cgroup_manager = "systemd"
  8061.  
  8062. # List of default capabilities for containers. If it is empty or commented out,
  8063. # only the capabilities defined in the containers json file by the user/kube
  8064. # will be added.
  8065. # default_capabilities = [
  8066. # "CHOWN",
  8067. # "DAC_OVERRIDE",
  8068. # "FSETID",
  8069. # "FOWNER",
  8070. # "NET_RAW",
  8071. # "SETGID",
  8072. # "SETUID",
  8073. # "SETPCAP",
  8074. # "NET_BIND_SERVICE",
  8075. # "SYS_CHROOT",
  8076. # "KILL",
  8077. # ]
  8078.  
  8079. # List of default sysctls. If it is empty or commented out, only the sysctls
  8080. # defined in the container json file by the user/kube will be added.
  8081. # default_sysctls = [
  8082. # ]
  8083.  
  8084. # List of additional devices. specified as
  8085. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  8086. #If it is empty or commented out, only the devices
  8087. # defined in the container json file by the user/kube will be added.
  8088. # additional_devices = [
  8089. # ]
  8090.  
  8091. # Path to OCI hooks directories for automatically executed hooks.
  8092. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  8093. # so we add /etc/containers/oci/hooks.d as well
  8094. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  8095. hooks_dir = [
  8096. "/etc/containers/oci/hooks.d",
  8097. ]
  8098.  
  8099. # List of default mounts for each container. **Deprecated:** this option will
  8100. # be removed in future versions in favor of default_mounts_file.
  8101. # default_mounts = [
  8102. # "/usr/share/rhel/secrets:/run/secrets",
  8103. # ]
  8104.  
  8105. # Path to the file specifying the defaults mounts for each container. The
  8106. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  8107. # its default mounts from the following two files:
  8108. #
  8109. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  8110. # override file, where users can either add in their own default mounts, or
  8111. # override the default mounts shipped with the package.
  8112. #
  8113. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  8114. # mounts. If you want CRI-O to read from a different, specific mounts file,
  8115. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  8116. # only add mounts it finds in this file.
  8117. #
  8118. #default_mounts_file = ""
  8119.  
  8120. # Maximum number of processes allowed in a container.
  8121. # pids_limit = 1024
  8122.  
  8123. # Maximum sized allowed for the container log file. Negative numbers indicate
  8124. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  8125. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  8126. # limit is never exceeded.
  8127. # log_size_max = -1
  8128.  
  8129. # Whether container output should be logged to journald in addition to the kuberentes log file
  8130. # log_to_journald = false
  8131.  
  8132. # Path to directory in which container exit files are written to by conmon.
  8133. # container_exits_dir = "/var/run/crio/exits"
  8134.  
  8135. # Path to directory for container attach sockets.
  8136. # container_attach_socket_dir = "/var/run/crio"
  8137.  
  8138. # The prefix to use for the source of the bind mounts.
  8139. # bind_mount_prefix = ""
  8140.  
  8141. # If set to true, all containers will run in read-only mode.
  8142. # read_only = false
  8143.  
  8144. # Changes the verbosity of the logs based on the level it is set to. Options
  8145. # are fatal, panic, error, warn, info, and debug. This option supports live
  8146. # configuration reload.
  8147. # log_level = "error"
  8148.  
  8149. # The UID mappings for the user namespace of each container. A range is
  8150. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  8151. # separated by comma.
  8152. # uid_mappings = ""
  8153.  
  8154. # The GID mappings for the user namespace of each container. A range is
  8155. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  8156. # separated by comma.
  8157. # gid_mappings = ""
  8158.  
  8159. # The minimal amount of time in seconds to wait before issuing a timeout
  8160. # regarding the proper termination of the container.
  8161. # ctr_stop_timeout = 0
  8162.  
  8163. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  8164. # and manage its lifecycle.
  8165. # manage_network_ns_lifecycle = false
  8166.  
  8167. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  8168. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  8169. # If no runtime_handler is provided, the runtime will be picked based on the level
  8170. # of trust of the workload. Each entry in the table should follow the format:
  8171. #
  8172. #[crio.runtime.runtimes.runtime-handler]
  8173. # runtime_path = "/path/to/the/executable"
  8174. # runtime_type = "oci"
  8175. # runtime_root = "/path/to/the/root"
  8176. #
  8177. # Where:
  8178. # - runtime-handler: name used to identify the runtime
  8179. # - runtime_path (optional, string): absolute path to the runtime executable in
  8180. # the host filesystem. If omitted, the runtime-handler identifier should match
  8181. # the runtime executable name, and the runtime executable should be placed
  8182. # in $PATH.
  8183. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  8184. # omitted, an "oci" runtime is assumed.
  8185. # - runtime_root (optional, string): root directory for storage of containers
  8186. # state.
  8187.  
  8188.  
  8189. # [crio.runtime.runtimes.runc]
  8190. # runtime_path = ""
  8191. # runtime_type = "oci"
  8192. # runtime_root = "/run/runc"
  8193.  
  8194.  
  8195. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  8196. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  8197. # surface and mitigating the consequences of containers breakout.
  8198.  
  8199. # Kata Containers with the default configured VMM
  8200. #[crio.runtime.runtimes.kata-runtime]
  8201.  
  8202. # Kata Containers with the QEMU VMM
  8203. #[crio.runtime.runtimes.kata-qemu]
  8204.  
  8205. # Kata Containers with the Firecracker VMM
  8206. #[crio.runtime.runtimes.kata-fc]
  8207.  
  8208. # The crio.image table contains settings pertaining to the management of OCI images.
  8209. #
  8210. # CRI-O reads its configured registries defaults from the system wide
  8211. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  8212. # you want to modify just CRI-O, you can change the registries configuration in
  8213. # this file. Otherwise, leave insecure_registries and registries commented out to
  8214. # use the system's defaults from /etc/containers/registries.conf.
  8215. [crio.image]
  8216.  
  8217. # Default transport for pulling images from a remote container storage.
  8218. # default_transport = "docker://"
  8219.  
  8220. # The path to a file containing credentials necessary for pulling images from
  8221. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  8222. global_auth_file = "/var/lib/kubelet/config.json"
  8223.  
  8224. # The image used to instantiate infra containers.
  8225. # This option supports live configuration reload.
  8226. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  8227.  
  8228. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  8229.  
  8230. # The path to a file containing credentials specific for pulling the pause_image from
  8231. # above. The file is similar to that of /var/lib/kubelet/config.json
  8232. # This option supports live configuration reload.
  8233. pause_image_auth_file = "/var/lib/kubelet/config.json"
  8234.  
  8235. # The command to run to have a container stay in the paused state.
  8236. # This option supports live configuration reload.
  8237. pause_command = "/usr/bin/pod"
  8238.  
  8239. # Path to the file which decides what sort of policy we use when deciding
  8240. # whether or not to trust an image that we've pulled. It is not recommended that
  8241. # this option be used, as the default behavior of using the system-wide default
  8242. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  8243. # refer to containers-policy.json(5) for more details.
  8244. # signature_policy = ""
  8245.  
  8246. # List of registries to skip TLS verification for pulling images. Please
  8247. # consider configuring the registries via /etc/containers/registries.conf before
  8248. # changing them here.
  8249. #insecure_registries = "[]"
  8250.  
  8251. # Controls how image volumes are handled. The valid values are mkdir, bind and
  8252. # ignore; the latter will ignore volumes entirely.
  8253. # image_volumes = "mkdir"
  8254.  
  8255. # List of registries to be used when pulling an unqualified image (e.g.,
  8256. # "alpine:latest"). By default, registries is set to "docker.io" for
  8257. # compatibility reasons. Depending on your workload and usecase you may add more
  8258. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  8259. # "registry.opensuse.org", etc.).
  8260. #registries = [
  8261. # ]
  8262.  
  8263.  
  8264. # The crio.network table containers settings pertaining to the management of
  8265. # CNI plugins.
  8266. [crio.network]
  8267.  
  8268. # Path to the directory where CNI configuration files are located.
  8269. # Note this default is changed from the RPM.
  8270. network_dir = "/etc/kubernetes/cni/net.d/"
  8271.  
  8272. # Paths to directories where CNI plugin binaries are located.
  8273. # Note this default is changed from the RPM.
  8274. plugin_dirs = [
  8275. "/var/lib/cni/bin",
  8276. ]
  8277.  
  8278. # A necessary configuration for Prometheus based metrics retrieval
  8279. [crio.metrics]
  8280.  
  8281. # Globally enable or disable metrics support.
  8282. enable_metrics = true
  8283.  
  8284. # The port on which the metrics server will listen.
  8285. metrics_port = 9537
  8286.  
  8287.  
  8288. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  8289.  
  8290. # The path to a file containing credentials specific for pulling the pause_image from
  8291. # above. The file is similar to that of /var/lib/kubelet/config.json
  8292. # This option supports live configuration reload.
  8293. pause_image_auth_file = "/var/lib/kubelet/config.json"
  8294.  
  8295. # The command to run to have a container stay in the paused state.
  8296. # This option supports live configuration reload.
  8297. pause_command = "/usr/bin/pod"
  8298.  
  8299. # Path to the file which decides what sort of policy we use when deciding
  8300. # whether or not to trust an image that we've pulled. It is not recommended that
  8301. # this option be used, as the default behavior of using the system-wide default
  8302. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  8303. # refer to containers-policy.json(5) for more details.
  8304. # signature_policy = ""
  8305.  
  8306. # List of registries to skip TLS verification for pulling images. Please
  8307. # consider configuring the registries via /etc/containers/registries.conf before
  8308. # changing them here.
  8309. #insecure_registries = "[]"
  8310.  
  8311. # Controls how image volumes are handled. The valid values are mkdir, bind and
  8312. # ignore; the latter will ignore volumes entirely.
  8313. # image_volumes = "mkdir"
  8314.  
  8315. # List of registries to be used when pulling an unqualified image (e.g.,
  8316. # "alpine:latest"). By default, registries is set to "docker.io" for
  8317. # compatibility reasons. Depending on your workload and usecase you may add more
  8318. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  8319. # "registry.opensuse.org", etc.).
  8320. #registries = [
  8321. # ]
  8322.  
  8323.  
  8324. # The crio.network table containers settings pertaining to the management of
  8325. # CNI plugins.
  8326. [crio.network]
  8327.  
  8328. # Path to the directory where CNI configuration files are located.
  8329. # Note this default is changed from the RPM.
  8330. network_dir = "/etc/kubernetes/cni/net.d/"
  8331.  
  8332. # Paths to directories where CNI plugin binaries are located.
  8333. # Note this default is changed from the RPM.
  8334. plugin_dirs = [
  8335. "/var/lib/cni/bin",
  8336. ]
  8337.  
  8338. # A necessary configuration for Prometheus based metrics retrieval
  8339. [crio.metrics]
  8340.  
  8341. # Globally enable or disable metrics support.
  8342. enable_metrics = true
  8343.  
  8344. # The port on which the metrics server will listen.
  8345. metrics_port = 9537
  8346.  
  8347.  
  8348. E0115 17:41:06.017923 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  8349. I0115 17:42:06.029922 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  8350. I0115 17:42:06.029947 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  8351. I0115 17:42:06.034938 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  8352. I0115 17:42:06.034958 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  8353. I0115 17:42:06.045072 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  8354. E0115 17:42:06.045763 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  8355. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  8356. # daemon, but in a TOML format that can be more easily modified and versioned.
  8357. #
  8358. # Please refer to crio.conf(5) for details of all configuration options.
  8359.  
  8360. # CRI-O supports partial configuration reload during runtime, which can be
  8361. # done by sending SIGHUP to the running process. Currently supported options
  8362. # are explicitly mentioned with: 'This option supports live configuration
  8363. # reload'.
  8364.  
  8365. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  8366. # located at /etc/containers/storage.conf. Modify this storage configuration if
  8367. # you want to change the system's defaults. If you want to modify storage just
  8368. # for CRI-O, you can change the storage configuration options here.
  8369. [crio]
  8370.  
  8371. # Path to the "root directory". CRI-O stores all of its data, including
  8372. # containers images, in this directory.
  8373. #root = "/var/lib/containers/storage"
  8374.  
  8375. # Path to the "run directory". CRI-O stores all of its state in this directory.
  8376. #runroot = "/run/user/1000"
  8377.  
  8378. # Storage driver used to manage the storage of images and containers. Please
  8379. # refer to containers-storage.conf(5) to see all available storage drivers.
  8380. #storage_driver = "overlay"
  8381.  
  8382. # List to pass options to the storage driver. Please refer to
  8383. # containers-storage.conf(5) to see all available storage options.
  8384. #storage_option = [
  8385. #]
  8386.  
  8387. # The default log directory where all logs will go unless directly specified by
  8388. # the kubelet. The log directory specified must be an absolute directory.
  8389. # log_dir = "/var/log/crio/pods"
  8390.  
  8391. # Location for CRI-O to lay down the version file
  8392. # version_file = "/var/lib/crio/version"
  8393.  
  8394. # The crio.api table contains settings for the kubelet/gRPC interface.
  8395. [crio.api]
  8396.  
  8397. # Path to AF_LOCAL socket on which CRI-O will listen.
  8398. # listen = "/var/run/crio/crio.sock"
  8399.  
  8400. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  8401. # host_ip = ""
  8402.  
  8403. # IP address on which the stream server will listen.
  8404. stream_address = ""
  8405.  
  8406. # The port on which the stream server will listen.
  8407. stream_port = "10010"
  8408.  
  8409. # Enable encrypted TLS transport of the stream server.
  8410. # stream_enable_tls = false
  8411.  
  8412. # Path to the x509 certificate file used to serve the encrypted stream. This
  8413. # file can change, and CRI-O will automatically pick up the changes within 5
  8414. # minutes.
  8415. # stream_tls_cert = ""
  8416.  
  8417. # Path to the key file used to serve the encrypted stream. This file can
  8418. # change and CRI-O will automatically pick up the changes within 5 minutes.
  8419. # stream_tls_key = ""
  8420.  
  8421. # Path to the x509 CA(s) file used to verify and authenticate client
  8422. # communication with the encrypted stream. This file can change and CRI-O will
  8423. # automatically pick up the changes within 5 minutes.
  8424. # stream_tls_ca = ""
  8425.  
  8426. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  8427. # grpc_max_send_msg_size = 16777216
  8428.  
  8429. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  8430. # grpc_max_recv_msg_size = 16777216
  8431.  
  8432. # The crio.runtime table contains settings pertaining to the OCI runtime used
  8433. # and options for how to set up and manage the OCI runtime.
  8434. [crio.runtime]
  8435.  
  8436. # A list of ulimits to be set in containers by default, specified as
  8437. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  8438. # "nofile=1024:2048"
  8439. # If nothing is set here, settings will be inherited from the CRI-O daemon
  8440. #default_ulimits = [
  8441. #]
  8442.  
  8443. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  8444. # The name is matched against the runtimes map below.
  8445. # default_runtime = "runc"
  8446.  
  8447. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  8448. # no_pivot = false
  8449.  
  8450. # Path to the conmon binary, used for monitoring the OCI runtime.
  8451. # Will be searched for using $PATH if empty.
  8452. conmon = "/usr/libexec/crio/conmon"
  8453.  
  8454. # Cgroup setting for conmon
  8455. conmon_cgroup = "pod"
  8456.  
  8457. # Environment variable list for the conmon process, used for passing necessary
  8458. # environment variables to conmon or the runtime.
  8459. # conmon_env = [
  8460. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  8461. # ]
  8462.  
  8463. # If true, SELinux will be used for pod separation on the host.
  8464. # selinux = true
  8465.  
  8466. # Path to the seccomp.json profile which is used as the default seccomp profile
  8467. # for the runtime. If not specified, then the internal default seccomp profile
  8468. # will be used.
  8469. # seccomp_profile = "/etc/crio/seccomp.json"
  8470.  
  8471. # Used to change the name of the default AppArmor profile of CRI-O. The default
  8472. # profile name is "crio-default-" followed by the version string of CRI-O.
  8473. apparmor_profile = "crio-default"
  8474.  
  8475. # Cgroup management implementation used for the runtime.
  8476. cgroup_manager = "systemd"
  8477.  
  8478. # List of default capabilities for containers. If it is empty or commented out,
  8479. # only the capabilities defined in the containers json file by the user/kube
  8480. # will be added.
  8481. # default_capabilities = [
  8482. # "CHOWN",
  8483. # "DAC_OVERRIDE",
  8484. # "FSETID",
  8485. # "FOWNER",
  8486. # "NET_RAW",
  8487. # "SETGID",
  8488. # "SETUID",
  8489. # "SETPCAP",
  8490. # "NET_BIND_SERVICE",
  8491. # "SYS_CHROOT",
  8492. # "KILL",
  8493. # ]
  8494.  
  8495. # List of default sysctls. If it is empty or commented out, only the sysctls
  8496. # defined in the container json file by the user/kube will be added.
  8497. # default_sysctls = [
  8498. # ]
  8499.  
  8500. # List of additional devices. specified as
  8501. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  8502. #If it is empty or commented out, only the devices
  8503. # defined in the container json file by the user/kube will be added.
  8504. # additional_devices = [
  8505. # ]
  8506.  
  8507. # Path to OCI hooks directories for automatically executed hooks.
  8508. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  8509. # so we add /etc/containers/oci/hooks.d as well
  8510. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  8511. hooks_dir = [
  8512. "/etc/containers/oci/hooks.d",
  8513. ]
  8514.  
  8515. # List of default mounts for each container. **Deprecated:** this option will
  8516. # be removed in future versions in favor of default_mounts_file.
  8517. # default_mounts = [
  8518. # "/usr/share/rhel/secrets:/run/secrets",
  8519. # ]
  8520.  
  8521. # Path to the file specifying the defaults mounts for each container. The
  8522. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  8523. # its default mounts from the following two files:
  8524. #
  8525. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  8526. # override file, where users can either add in their own default mounts, or
  8527. # override the default mounts shipped with the package.
  8528. #
  8529. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  8530. # mounts. If you want CRI-O to read from a different, specific mounts file,
  8531. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  8532. # only add mounts it finds in this file.
  8533. #
  8534. #default_mounts_file = ""
  8535.  
  8536. # Maximum number of processes allowed in a container.
  8537. # pids_limit = 1024
  8538.  
  8539. # Maximum sized allowed for the container log file. Negative numbers indicate
  8540. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  8541. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  8542. # limit is never exceeded.
  8543. # log_size_max = -1
  8544.  
  8545. # Whether container output should be logged to journald in addition to the kuberentes log file
  8546. # log_to_journald = false
  8547.  
  8548. # Path to directory in which container exit files are written to by conmon.
  8549. # container_exits_dir = "/var/run/crio/exits"
  8550.  
  8551. # Path to directory for container attach sockets.
  8552. # container_attach_socket_dir = "/var/run/crio"
  8553.  
  8554. # The prefix to use for the source of the bind mounts.
  8555. # bind_mount_prefix = ""
  8556.  
  8557. # If set to true, all containers will run in read-only mode.
  8558. # read_only = false
  8559.  
  8560. # Changes the verbosity of the logs based on the level it is set to. Options
  8561. # are fatal, panic, error, warn, info, and debug. This option supports live
  8562. # configuration reload.
  8563. # log_level = "error"
  8564.  
  8565. # The UID mappings for the user namespace of each container. A range is
  8566. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  8567. # separated by comma.
  8568. # uid_mappings = ""
  8569.  
  8570. # The GID mappings for the user namespace of each container. A range is
  8571. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  8572. # separated by comma.
  8573. # gid_mappings = ""
  8574.  
  8575. # The minimal amount of time in seconds to wait before issuing a timeout
  8576. # regarding the proper termination of the container.
  8577. # ctr_stop_timeout = 0
  8578.  
  8579. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  8580. # and manage its lifecycle.
  8581. # manage_network_ns_lifecycle = false
  8582.  
  8583. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  8584. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  8585. # If no runtime_handler is provided, the runtime will be picked based on the level
  8586. # of trust of the workload. Each entry in the table should follow the format:
  8587. #
  8588. #[crio.runtime.runtimes.runtime-handler]
  8589. # runtime_path = "/path/to/the/executable"
  8590. # runtime_type = "oci"
  8591. # runtime_root = "/path/to/the/root"
  8592. #
  8593. # Where:
  8594. # - runtime-handler: name used to identify the runtime
  8595. # - runtime_path (optional, string): absolute path to the runtime executable in
  8596. # the host filesystem. If omitted, the runtime-handler identifier should match
  8597. # the runtime executable name, and the runtime executable should be placed
  8598. # in $PATH.
  8599. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  8600. # omitted, an "oci" runtime is assumed.
  8601. # - runtime_root (optional, string): root directory for storage of containers
  8602. # state.
  8603.  
  8604.  
  8605. # [crio.runtime.runtimes.runc]
  8606. # runtime_path = ""
  8607. # runtime_type = "oci"
  8608. # runtime_root = "/run/runc"
  8609.  
  8610.  
  8611. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  8612. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  8613. # surface and mitigating the consequences of containers breakout.
  8614.  
  8615. # Kata Containers with the default configured VMM
  8616. #[crio.runtime.runtimes.kata-runtime]
  8617.  
  8618. # Kata Containers with the QEMU VMM
  8619. #[crio.runtime.runtimes.kata-qemu]
  8620.  
  8621. # Kata Containers with the Firecracker VMM
  8622. #[crio.runtime.runtimes.kata-fc]
  8623.  
  8624. # The crio.image table contains settings pertaining to the management of OCI images.
  8625. #
  8626. # CRI-O reads its configured registries defaults from the system wide
  8627. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  8628. # you want to modify just CRI-O, you can change the registries configuration in
  8629. # this file. Otherwise, leave insecure_registries and registries commented out to
  8630. # use the system's defaults from /etc/containers/registries.conf.
  8631. [crio.image]
  8632.  
  8633. # Default transport for pulling images from a remote container storage.
  8634. # default_transport = "docker://"
  8635.  
  8636. # The path to a file containing credentials necessary for pulling images from
  8637. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  8638. global_auth_file = "/var/lib/kubelet/config.json"
  8639.  
  8640. # The image used to instantiate infra containers.
  8641. # This option supports live configuration reload.
  8642. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  8643.  
  8644. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  8645.  
  8646. # The path to a file containing credentials specific for pulling the pause_image from
  8647. # above. The file is similar to that of /var/lib/kubelet/config.json
  8648. # This option supports live configuration reload.
  8649. pause_image_auth_file = "/var/lib/kubelet/config.json"
  8650.  
  8651. # The command to run to have a container stay in the paused state.
  8652. # This option supports live configuration reload.
  8653. pause_command = "/usr/bin/pod"
  8654.  
  8655. # Path to the file which decides what sort of policy we use when deciding
  8656. # whether or not to trust an image that we've pulled. It is not recommended that
  8657. # this option be used, as the default behavior of using the system-wide default
  8658. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  8659. # refer to containers-policy.json(5) for more details.
  8660. # signature_policy = ""
  8661.  
  8662. # List of registries to skip TLS verification for pulling images. Please
  8663. # consider configuring the registries via /etc/containers/registries.conf before
  8664. # changing them here.
  8665. #insecure_registries = "[]"
  8666.  
  8667. # Controls how image volumes are handled. The valid values are mkdir, bind and
  8668. # ignore; the latter will ignore volumes entirely.
  8669. # image_volumes = "mkdir"
  8670.  
  8671. # List of registries to be used when pulling an unqualified image (e.g.,
  8672. # "alpine:latest"). By default, registries is set to "docker.io" for
  8673. # compatibility reasons. Depending on your workload and usecase you may add more
  8674. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  8675. # "registry.opensuse.org", etc.).
  8676. #registries = [
  8677. # ]
  8678.  
  8679.  
  8680. # The crio.network table containers settings pertaining to the management of
  8681. # CNI plugins.
  8682. [crio.network]
  8683.  
  8684. # Path to the directory where CNI configuration files are located.
  8685. # Note this default is changed from the RPM.
  8686. network_dir = "/etc/kubernetes/cni/net.d/"
  8687.  
  8688. # Paths to directories where CNI plugin binaries are located.
  8689. # Note this default is changed from the RPM.
  8690. plugin_dirs = [
  8691. "/var/lib/cni/bin",
  8692. ]
  8693.  
  8694. # A necessary configuration for Prometheus based metrics retrieval
  8695. [crio.metrics]
  8696.  
  8697. # Globally enable or disable metrics support.
  8698. enable_metrics = true
  8699.  
  8700. # The port on which the metrics server will listen.
  8701. metrics_port = 9537
  8702.  
  8703.  
  8704. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  8705.  
  8706. # The path to a file containing credentials specific for pulling the pause_image from
  8707. # above. The file is similar to that of /var/lib/kubelet/config.json
  8708. # This option supports live configuration reload.
  8709. pause_image_auth_file = "/var/lib/kubelet/config.json"
  8710.  
  8711. # The command to run to have a container stay in the paused state.
  8712. # This option supports live configuration reload.
  8713. pause_command = "/usr/bin/pod"
  8714.  
  8715. # Path to the file which decides what sort of policy we use when deciding
  8716. # whether or not to trust an image that we've pulled. It is not recommended that
  8717. # this option be used, as the default behavior of using the system-wide default
  8718. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  8719. # refer to containers-policy.json(5) for more details.
  8720. # signature_policy = ""
  8721.  
  8722. # List of registries to skip TLS verification for pulling images. Please
  8723. # consider configuring the registries via /etc/containers/registries.conf before
  8724. # changing them here.
  8725. #insecure_registries = "[]"
  8726.  
  8727. # Controls how image volumes are handled. The valid values are mkdir, bind and
  8728. # ignore; the latter will ignore volumes entirely.
  8729. # image_volumes = "mkdir"
  8730.  
  8731. # List of registries to be used when pulling an unqualified image (e.g.,
  8732. # "alpine:latest"). By default, registries is set to "docker.io" for
  8733. # compatibility reasons. Depending on your workload and usecase you may add more
  8734. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  8735. # "registry.opensuse.org", etc.).
  8736. #registries = [
  8737. # ]
  8738.  
  8739.  
  8740. # The crio.network table containers settings pertaining to the management of
  8741. # CNI plugins.
  8742. [crio.network]
  8743.  
  8744. # Path to the directory where CNI configuration files are located.
  8745. # Note this default is changed from the RPM.
  8746. network_dir = "/etc/kubernetes/cni/net.d/"
  8747.  
  8748. # Paths to directories where CNI plugin binaries are located.
  8749. # Note this default is changed from the RPM.
  8750. plugin_dirs = [
  8751. "/var/lib/cni/bin",
  8752. ]
  8753.  
  8754. # A necessary configuration for Prometheus based metrics retrieval
  8755. [crio.metrics]
  8756.  
  8757. # Globally enable or disable metrics support.
  8758. enable_metrics = true
  8759.  
  8760. # The port on which the metrics server will listen.
  8761. metrics_port = 9537
  8762.  
  8763.  
  8764. E0115 17:42:06.045791 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  8765. I0115 17:43:06.057845 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  8766. I0115 17:43:06.057869 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  8767. I0115 17:43:06.063605 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  8768. I0115 17:43:06.063636 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  8769. I0115 17:43:06.072488 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  8770. E0115 17:43:06.073900 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  8771. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  8772. # daemon, but in a TOML format that can be more easily modified and versioned.
  8773. #
  8774. # Please refer to crio.conf(5) for details of all configuration options.
  8775.  
  8776. # CRI-O supports partial configuration reload during runtime, which can be
  8777. # done by sending SIGHUP to the running process. Currently supported options
  8778. # are explicitly mentioned with: 'This option supports live configuration
  8779. # reload'.
  8780.  
  8781. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  8782. # located at /etc/containers/storage.conf. Modify this storage configuration if
  8783. # you want to change the system's defaults. If you want to modify storage just
  8784. # for CRI-O, you can change the storage configuration options here.
  8785. [crio]
  8786.  
  8787. # Path to the "root directory". CRI-O stores all of its data, including
  8788. # containers images, in this directory.
  8789. #root = "/var/lib/containers/storage"
  8790.  
  8791. # Path to the "run directory". CRI-O stores all of its state in this directory.
  8792. #runroot = "/run/user/1000"
  8793.  
  8794. # Storage driver used to manage the storage of images and containers. Please
  8795. # refer to containers-storage.conf(5) to see all available storage drivers.
  8796. #storage_driver = "overlay"
  8797.  
  8798. # List to pass options to the storage driver. Please refer to
  8799. # containers-storage.conf(5) to see all available storage options.
  8800. #storage_option = [
  8801. #]
  8802.  
  8803. # The default log directory where all logs will go unless directly specified by
  8804. # the kubelet. The log directory specified must be an absolute directory.
  8805. # log_dir = "/var/log/crio/pods"
  8806.  
  8807. # Location for CRI-O to lay down the version file
  8808. # version_file = "/var/lib/crio/version"
  8809.  
  8810. # The crio.api table contains settings for the kubelet/gRPC interface.
  8811. [crio.api]
  8812.  
  8813. # Path to AF_LOCAL socket on which CRI-O will listen.
  8814. # listen = "/var/run/crio/crio.sock"
  8815.  
  8816. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  8817. # host_ip = ""
  8818.  
  8819. # IP address on which the stream server will listen.
  8820. stream_address = ""
  8821.  
  8822. # The port on which the stream server will listen.
  8823. stream_port = "10010"
  8824.  
  8825. # Enable encrypted TLS transport of the stream server.
  8826. # stream_enable_tls = false
  8827.  
  8828. # Path to the x509 certificate file used to serve the encrypted stream. This
  8829. # file can change, and CRI-O will automatically pick up the changes within 5
  8830. # minutes.
  8831. # stream_tls_cert = ""
  8832.  
  8833. # Path to the key file used to serve the encrypted stream. This file can
  8834. # change and CRI-O will automatically pick up the changes within 5 minutes.
  8835. # stream_tls_key = ""
  8836.  
  8837. # Path to the x509 CA(s) file used to verify and authenticate client
  8838. # communication with the encrypted stream. This file can change and CRI-O will
  8839. # automatically pick up the changes within 5 minutes.
  8840. # stream_tls_ca = ""
  8841.  
  8842. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  8843. # grpc_max_send_msg_size = 16777216
  8844.  
  8845. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  8846. # grpc_max_recv_msg_size = 16777216
  8847.  
  8848. # The crio.runtime table contains settings pertaining to the OCI runtime used
  8849. # and options for how to set up and manage the OCI runtime.
  8850. [crio.runtime]
  8851.  
  8852. # A list of ulimits to be set in containers by default, specified as
  8853. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  8854. # "nofile=1024:2048"
  8855. # If nothing is set here, settings will be inherited from the CRI-O daemon
  8856. #default_ulimits = [
  8857. #]
  8858.  
  8859. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  8860. # The name is matched against the runtimes map below.
  8861. # default_runtime = "runc"
  8862.  
  8863. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  8864. # no_pivot = false
  8865.  
  8866. # Path to the conmon binary, used for monitoring the OCI runtime.
  8867. # Will be searched for using $PATH if empty.
  8868. conmon = "/usr/libexec/crio/conmon"
  8869.  
  8870. # Cgroup setting for conmon
  8871. conmon_cgroup = "pod"
  8872.  
  8873. # Environment variable list for the conmon process, used for passing necessary
  8874. # environment variables to conmon or the runtime.
  8875. # conmon_env = [
  8876. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  8877. # ]
  8878.  
  8879. # If true, SELinux will be used for pod separation on the host.
  8880. # selinux = true
  8881.  
  8882. # Path to the seccomp.json profile which is used as the default seccomp profile
  8883. # for the runtime. If not specified, then the internal default seccomp profile
  8884. # will be used.
  8885. # seccomp_profile = "/etc/crio/seccomp.json"
  8886.  
  8887. # Used to change the name of the default AppArmor profile of CRI-O. The default
  8888. # profile name is "crio-default-" followed by the version string of CRI-O.
  8889. apparmor_profile = "crio-default"
  8890.  
  8891. # Cgroup management implementation used for the runtime.
  8892. cgroup_manager = "systemd"
  8893.  
  8894. # List of default capabilities for containers. If it is empty or commented out,
  8895. # only the capabilities defined in the containers json file by the user/kube
  8896. # will be added.
  8897. # default_capabilities = [
  8898. # "CHOWN",
  8899. # "DAC_OVERRIDE",
  8900. # "FSETID",
  8901. # "FOWNER",
  8902. # "NET_RAW",
  8903. # "SETGID",
  8904. # "SETUID",
  8905. # "SETPCAP",
  8906. # "NET_BIND_SERVICE",
  8907. # "SYS_CHROOT",
  8908. # "KILL",
  8909. # ]
  8910.  
  8911. # List of default sysctls. If it is empty or commented out, only the sysctls
  8912. # defined in the container json file by the user/kube will be added.
  8913. # default_sysctls = [
  8914. # ]
  8915.  
  8916. # List of additional devices. specified as
  8917. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  8918. #If it is empty or commented out, only the devices
  8919. # defined in the container json file by the user/kube will be added.
  8920. # additional_devices = [
  8921. # ]
  8922.  
  8923. # Path to OCI hooks directories for automatically executed hooks.
  8924. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  8925. # so we add /etc/containers/oci/hooks.d as well
  8926. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  8927. hooks_dir = [
  8928. "/etc/containers/oci/hooks.d",
  8929. ]
  8930.  
  8931. # List of default mounts for each container. **Deprecated:** this option will
  8932. # be removed in future versions in favor of default_mounts_file.
  8933. # default_mounts = [
  8934. # "/usr/share/rhel/secrets:/run/secrets",
  8935. # ]
  8936.  
  8937. # Path to the file specifying the defaults mounts for each container. The
  8938. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  8939. # its default mounts from the following two files:
  8940. #
  8941. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  8942. # override file, where users can either add in their own default mounts, or
  8943. # override the default mounts shipped with the package.
  8944. #
  8945. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  8946. # mounts. If you want CRI-O to read from a different, specific mounts file,
  8947. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  8948. # only add mounts it finds in this file.
  8949. #
  8950. #default_mounts_file = ""
  8951.  
  8952. # Maximum number of processes allowed in a container.
  8953. # pids_limit = 1024
  8954.  
  8955. # Maximum sized allowed for the container log file. Negative numbers indicate
  8956. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  8957. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  8958. # limit is never exceeded.
  8959. # log_size_max = -1
  8960.  
  8961. # Whether container output should be logged to journald in addition to the kuberentes log file
  8962. # log_to_journald = false
  8963.  
  8964. # Path to directory in which container exit files are written to by conmon.
  8965. # container_exits_dir = "/var/run/crio/exits"
  8966.  
  8967. # Path to directory for container attach sockets.
  8968. # container_attach_socket_dir = "/var/run/crio"
  8969.  
  8970. # The prefix to use for the source of the bind mounts.
  8971. # bind_mount_prefix = ""
  8972.  
  8973. # If set to true, all containers will run in read-only mode.
  8974. # read_only = false
  8975.  
  8976. # Changes the verbosity of the logs based on the level it is set to. Options
  8977. # are fatal, panic, error, warn, info, and debug. This option supports live
  8978. # configuration reload.
  8979. # log_level = "error"
  8980.  
  8981. # The UID mappings for the user namespace of each container. A range is
  8982. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  8983. # separated by comma.
  8984. # uid_mappings = ""
  8985.  
  8986. # The GID mappings for the user namespace of each container. A range is
  8987. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  8988. # separated by comma.
  8989. # gid_mappings = ""
  8990.  
  8991. # The minimal amount of time in seconds to wait before issuing a timeout
  8992. # regarding the proper termination of the container.
  8993. # ctr_stop_timeout = 0
  8994.  
  8995. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  8996. # and manage its lifecycle.
  8997. # manage_network_ns_lifecycle = false
  8998.  
  8999. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  9000. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  9001. # If no runtime_handler is provided, the runtime will be picked based on the level
  9002. # of trust of the workload. Each entry in the table should follow the format:
  9003. #
  9004. #[crio.runtime.runtimes.runtime-handler]
  9005. # runtime_path = "/path/to/the/executable"
  9006. # runtime_type = "oci"
  9007. # runtime_root = "/path/to/the/root"
  9008. #
  9009. # Where:
  9010. # - runtime-handler: name used to identify the runtime
  9011. # - runtime_path (optional, string): absolute path to the runtime executable in
  9012. # the host filesystem. If omitted, the runtime-handler identifier should match
  9013. # the runtime executable name, and the runtime executable should be placed
  9014. # in $PATH.
  9015. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  9016. # omitted, an "oci" runtime is assumed.
  9017. # - runtime_root (optional, string): root directory for storage of containers
  9018. # state.
  9019.  
  9020.  
  9021. # [crio.runtime.runtimes.runc]
  9022. # runtime_path = ""
  9023. # runtime_type = "oci"
  9024. # runtime_root = "/run/runc"
  9025.  
  9026.  
  9027. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  9028. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  9029. # surface and mitigating the consequences of containers breakout.
  9030.  
  9031. # Kata Containers with the default configured VMM
  9032. #[crio.runtime.runtimes.kata-runtime]
  9033.  
  9034. # Kata Containers with the QEMU VMM
  9035. #[crio.runtime.runtimes.kata-qemu]
  9036.  
  9037. # Kata Containers with the Firecracker VMM
  9038. #[crio.runtime.runtimes.kata-fc]
  9039.  
  9040. # The crio.image table contains settings pertaining to the management of OCI images.
  9041. #
  9042. # CRI-O reads its configured registries defaults from the system wide
  9043. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  9044. # you want to modify just CRI-O, you can change the registries configuration in
  9045. # this file. Otherwise, leave insecure_registries and registries commented out to
  9046. # use the system's defaults from /etc/containers/registries.conf.
  9047. [crio.image]
  9048.  
  9049. # Default transport for pulling images from a remote container storage.
  9050. # default_transport = "docker://"
  9051.  
  9052. # The path to a file containing credentials necessary for pulling images from
  9053. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  9054. global_auth_file = "/var/lib/kubelet/config.json"
  9055.  
  9056. # The image used to instantiate infra containers.
  9057. # This option supports live configuration reload.
  9058. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  9059.  
  9060. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  9061.  
  9062. # The path to a file containing credentials specific for pulling the pause_image from
  9063. # above. The file is similar to that of /var/lib/kubelet/config.json
  9064. # This option supports live configuration reload.
  9065. pause_image_auth_file = "/var/lib/kubelet/config.json"
  9066.  
  9067. # The command to run to have a container stay in the paused state.
  9068. # This option supports live configuration reload.
  9069. pause_command = "/usr/bin/pod"
  9070.  
  9071. # Path to the file which decides what sort of policy we use when deciding
  9072. # whether or not to trust an image that we've pulled. It is not recommended that
  9073. # this option be used, as the default behavior of using the system-wide default
  9074. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  9075. # refer to containers-policy.json(5) for more details.
  9076. # signature_policy = ""
  9077.  
  9078. # List of registries to skip TLS verification for pulling images. Please
  9079. # consider configuring the registries via /etc/containers/registries.conf before
  9080. # changing them here.
  9081. #insecure_registries = "[]"
  9082.  
  9083. # Controls how image volumes are handled. The valid values are mkdir, bind and
  9084. # ignore; the latter will ignore volumes entirely.
  9085. # image_volumes = "mkdir"
  9086.  
  9087. # List of registries to be used when pulling an unqualified image (e.g.,
  9088. # "alpine:latest"). By default, registries is set to "docker.io" for
  9089. # compatibility reasons. Depending on your workload and usecase you may add more
  9090. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  9091. # "registry.opensuse.org", etc.).
  9092. #registries = [
  9093. # ]
  9094.  
  9095.  
  9096. # The crio.network table containers settings pertaining to the management of
  9097. # CNI plugins.
  9098. [crio.network]
  9099.  
  9100. # Path to the directory where CNI configuration files are located.
  9101. # Note this default is changed from the RPM.
  9102. network_dir = "/etc/kubernetes/cni/net.d/"
  9103.  
  9104. # Paths to directories where CNI plugin binaries are located.
  9105. # Note this default is changed from the RPM.
  9106. plugin_dirs = [
  9107. "/var/lib/cni/bin",
  9108. ]
  9109.  
  9110. # A necessary configuration for Prometheus based metrics retrieval
  9111. [crio.metrics]
  9112.  
  9113. # Globally enable or disable metrics support.
  9114. enable_metrics = true
  9115.  
  9116. # The port on which the metrics server will listen.
  9117. metrics_port = 9537
  9118.  
  9119.  
  9120. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  9121.  
  9122. # The path to a file containing credentials specific for pulling the pause_image from
  9123. # above. The file is similar to that of /var/lib/kubelet/config.json
  9124. # This option supports live configuration reload.
  9125. pause_image_auth_file = "/var/lib/kubelet/config.json"
  9126.  
  9127. # The command to run to have a container stay in the paused state.
  9128. # This option supports live configuration reload.
  9129. pause_command = "/usr/bin/pod"
  9130.  
  9131. # Path to the file which decides what sort of policy we use when deciding
  9132. # whether or not to trust an image that we've pulled. It is not recommended that
  9133. # this option be used, as the default behavior of using the system-wide default
  9134. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  9135. # refer to containers-policy.json(5) for more details.
  9136. # signature_policy = ""
  9137.  
  9138. # List of registries to skip TLS verification for pulling images. Please
  9139. # consider configuring the registries via /etc/containers/registries.conf before
  9140. # changing them here.
  9141. #insecure_registries = "[]"
  9142.  
  9143. # Controls how image volumes are handled. The valid values are mkdir, bind and
  9144. # ignore; the latter will ignore volumes entirely.
  9145. # image_volumes = "mkdir"
  9146.  
  9147. # List of registries to be used when pulling an unqualified image (e.g.,
  9148. # "alpine:latest"). By default, registries is set to "docker.io" for
  9149. # compatibility reasons. Depending on your workload and usecase you may add more
  9150. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  9151. # "registry.opensuse.org", etc.).
  9152. #registries = [
  9153. # ]
  9154.  
  9155.  
  9156. # The crio.network table containers settings pertaining to the management of
  9157. # CNI plugins.
  9158. [crio.network]
  9159.  
  9160. # Path to the directory where CNI configuration files are located.
  9161. # Note this default is changed from the RPM.
  9162. network_dir = "/etc/kubernetes/cni/net.d/"
  9163.  
  9164. # Paths to directories where CNI plugin binaries are located.
  9165. # Note this default is changed from the RPM.
  9166. plugin_dirs = [
  9167. "/var/lib/cni/bin",
  9168. ]
  9169.  
  9170. # A necessary configuration for Prometheus based metrics retrieval
  9171. [crio.metrics]
  9172.  
  9173. # Globally enable or disable metrics support.
  9174. enable_metrics = true
  9175.  
  9176. # The port on which the metrics server will listen.
  9177. metrics_port = 9537
  9178.  
  9179.  
  9180. E0115 17:43:06.074199 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  9181. I0115 17:44:06.085488 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  9182. I0115 17:44:06.085511 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  9183. I0115 17:44:06.090673 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  9184. I0115 17:44:06.090705 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  9185. I0115 17:44:06.100500 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  9186. E0115 17:44:06.101221 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  9187. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  9188. # daemon, but in a TOML format that can be more easily modified and versioned.
  9189. #
  9190. # Please refer to crio.conf(5) for details of all configuration options.
  9191.  
  9192. # CRI-O supports partial configuration reload during runtime, which can be
  9193. # done by sending SIGHUP to the running process. Currently supported options
  9194. # are explicitly mentioned with: 'This option supports live configuration
  9195. # reload'.
  9196.  
  9197. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  9198. # located at /etc/containers/storage.conf. Modify this storage configuration if
  9199. # you want to change the system's defaults. If you want to modify storage just
  9200. # for CRI-O, you can change the storage configuration options here.
  9201. [crio]
  9202.  
  9203. # Path to the "root directory". CRI-O stores all of its data, including
  9204. # containers images, in this directory.
  9205. #root = "/var/lib/containers/storage"
  9206.  
  9207. # Path to the "run directory". CRI-O stores all of its state in this directory.
  9208. #runroot = "/run/user/1000"
  9209.  
  9210. # Storage driver used to manage the storage of images and containers. Please
  9211. # refer to containers-storage.conf(5) to see all available storage drivers.
  9212. #storage_driver = "overlay"
  9213.  
  9214. # List to pass options to the storage driver. Please refer to
  9215. # containers-storage.conf(5) to see all available storage options.
  9216. #storage_option = [
  9217. #]
  9218.  
  9219. # The default log directory where all logs will go unless directly specified by
  9220. # the kubelet. The log directory specified must be an absolute directory.
  9221. # log_dir = "/var/log/crio/pods"
  9222.  
  9223. # Location for CRI-O to lay down the version file
  9224. # version_file = "/var/lib/crio/version"
  9225.  
  9226. # The crio.api table contains settings for the kubelet/gRPC interface.
  9227. [crio.api]
  9228.  
  9229. # Path to AF_LOCAL socket on which CRI-O will listen.
  9230. # listen = "/var/run/crio/crio.sock"
  9231.  
  9232. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  9233. # host_ip = ""
  9234.  
  9235. # IP address on which the stream server will listen.
  9236. stream_address = ""
  9237.  
  9238. # The port on which the stream server will listen.
  9239. stream_port = "10010"
  9240.  
  9241. # Enable encrypted TLS transport of the stream server.
  9242. # stream_enable_tls = false
  9243.  
  9244. # Path to the x509 certificate file used to serve the encrypted stream. This
  9245. # file can change, and CRI-O will automatically pick up the changes within 5
  9246. # minutes.
  9247. # stream_tls_cert = ""
  9248.  
  9249. # Path to the key file used to serve the encrypted stream. This file can
  9250. # change and CRI-O will automatically pick up the changes within 5 minutes.
  9251. # stream_tls_key = ""
  9252.  
  9253. # Path to the x509 CA(s) file used to verify and authenticate client
  9254. # communication with the encrypted stream. This file can change and CRI-O will
  9255. # automatically pick up the changes within 5 minutes.
  9256. # stream_tls_ca = ""
  9257.  
  9258. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  9259. # grpc_max_send_msg_size = 16777216
  9260.  
  9261. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  9262. # grpc_max_recv_msg_size = 16777216
  9263.  
  9264. # The crio.runtime table contains settings pertaining to the OCI runtime used
  9265. # and options for how to set up and manage the OCI runtime.
  9266. [crio.runtime]
  9267.  
  9268. # A list of ulimits to be set in containers by default, specified as
  9269. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  9270. # "nofile=1024:2048"
  9271. # If nothing is set here, settings will be inherited from the CRI-O daemon
  9272. #default_ulimits = [
  9273. #]
  9274.  
  9275. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  9276. # The name is matched against the runtimes map below.
  9277. # default_runtime = "runc"
  9278.  
  9279. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  9280. # no_pivot = false
  9281.  
  9282. # Path to the conmon binary, used for monitoring the OCI runtime.
  9283. # Will be searched for using $PATH if empty.
  9284. conmon = "/usr/libexec/crio/conmon"
  9285.  
  9286. # Cgroup setting for conmon
  9287. conmon_cgroup = "pod"
  9288.  
  9289. # Environment variable list for the conmon process, used for passing necessary
  9290. # environment variables to conmon or the runtime.
  9291. # conmon_env = [
  9292. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  9293. # ]
  9294.  
  9295. # If true, SELinux will be used for pod separation on the host.
  9296. # selinux = true
  9297.  
  9298. # Path to the seccomp.json profile which is used as the default seccomp profile
  9299. # for the runtime. If not specified, then the internal default seccomp profile
  9300. # will be used.
  9301. # seccomp_profile = "/etc/crio/seccomp.json"
  9302.  
  9303. # Used to change the name of the default AppArmor profile of CRI-O. The default
  9304. # profile name is "crio-default-" followed by the version string of CRI-O.
  9305. apparmor_profile = "crio-default"
  9306.  
  9307. # Cgroup management implementation used for the runtime.
  9308. cgroup_manager = "systemd"
  9309.  
  9310. # List of default capabilities for containers. If it is empty or commented out,
  9311. # only the capabilities defined in the containers json file by the user/kube
  9312. # will be added.
  9313. # default_capabilities = [
  9314. # "CHOWN",
  9315. # "DAC_OVERRIDE",
  9316. # "FSETID",
  9317. # "FOWNER",
  9318. # "NET_RAW",
  9319. # "SETGID",
  9320. # "SETUID",
  9321. # "SETPCAP",
  9322. # "NET_BIND_SERVICE",
  9323. # "SYS_CHROOT",
  9324. # "KILL",
  9325. # ]
  9326.  
  9327. # List of default sysctls. If it is empty or commented out, only the sysctls
  9328. # defined in the container json file by the user/kube will be added.
  9329. # default_sysctls = [
  9330. # ]
  9331.  
  9332. # List of additional devices. specified as
  9333. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  9334. #If it is empty or commented out, only the devices
  9335. # defined in the container json file by the user/kube will be added.
  9336. # additional_devices = [
  9337. # ]
  9338.  
  9339. # Path to OCI hooks directories for automatically executed hooks.
  9340. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  9341. # so we add /etc/containers/oci/hooks.d as well
  9342. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  9343. hooks_dir = [
  9344. "/etc/containers/oci/hooks.d",
  9345. ]
  9346.  
  9347. # List of default mounts for each container. **Deprecated:** this option will
  9348. # be removed in future versions in favor of default_mounts_file.
  9349. # default_mounts = [
  9350. # "/usr/share/rhel/secrets:/run/secrets",
  9351. # ]
  9352.  
  9353. # Path to the file specifying the defaults mounts for each container. The
  9354. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  9355. # its default mounts from the following two files:
  9356. #
  9357. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  9358. # override file, where users can either add in their own default mounts, or
  9359. # override the default mounts shipped with the package.
  9360. #
  9361. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  9362. # mounts. If you want CRI-O to read from a different, specific mounts file,
  9363. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  9364. # only add mounts it finds in this file.
  9365. #
  9366. #default_mounts_file = ""
  9367.  
  9368. # Maximum number of processes allowed in a container.
  9369. # pids_limit = 1024
  9370.  
  9371. # Maximum sized allowed for the container log file. Negative numbers indicate
  9372. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  9373. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  9374. # limit is never exceeded.
  9375. # log_size_max = -1
  9376.  
  9377. # Whether container output should be logged to journald in addition to the kuberentes log file
  9378. # log_to_journald = false
  9379.  
  9380. # Path to directory in which container exit files are written to by conmon.
  9381. # container_exits_dir = "/var/run/crio/exits"
  9382.  
  9383. # Path to directory for container attach sockets.
  9384. # container_attach_socket_dir = "/var/run/crio"
  9385.  
  9386. # The prefix to use for the source of the bind mounts.
  9387. # bind_mount_prefix = ""
  9388.  
  9389. # If set to true, all containers will run in read-only mode.
  9390. # read_only = false
  9391.  
  9392. # Changes the verbosity of the logs based on the level it is set to. Options
  9393. # are fatal, panic, error, warn, info, and debug. This option supports live
  9394. # configuration reload.
  9395. # log_level = "error"
  9396.  
  9397. # The UID mappings for the user namespace of each container. A range is
  9398. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  9399. # separated by comma.
  9400. # uid_mappings = ""
  9401.  
  9402. # The GID mappings for the user namespace of each container. A range is
  9403. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  9404. # separated by comma.
  9405. # gid_mappings = ""
  9406.  
  9407. # The minimal amount of time in seconds to wait before issuing a timeout
  9408. # regarding the proper termination of the container.
  9409. # ctr_stop_timeout = 0
  9410.  
  9411. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  9412. # and manage its lifecycle.
  9413. # manage_network_ns_lifecycle = false
  9414.  
  9415. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  9416. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  9417. # If no runtime_handler is provided, the runtime will be picked based on the level
  9418. # of trust of the workload. Each entry in the table should follow the format:
  9419. #
  9420. #[crio.runtime.runtimes.runtime-handler]
  9421. # runtime_path = "/path/to/the/executable"
  9422. # runtime_type = "oci"
  9423. # runtime_root = "/path/to/the/root"
  9424. #
  9425. # Where:
  9426. # - runtime-handler: name used to identify the runtime
  9427. # - runtime_path (optional, string): absolute path to the runtime executable in
  9428. # the host filesystem. If omitted, the runtime-handler identifier should match
  9429. # the runtime executable name, and the runtime executable should be placed
  9430. # in $PATH.
  9431. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  9432. # omitted, an "oci" runtime is assumed.
  9433. # - runtime_root (optional, string): root directory for storage of containers
  9434. # state.
  9435.  
  9436.  
  9437. # [crio.runtime.runtimes.runc]
  9438. # runtime_path = ""
  9439. # runtime_type = "oci"
  9440. # runtime_root = "/run/runc"
  9441.  
  9442.  
  9443. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  9444. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  9445. # surface and mitigating the consequences of containers breakout.
  9446.  
  9447. # Kata Containers with the default configured VMM
  9448. #[crio.runtime.runtimes.kata-runtime]
  9449.  
  9450. # Kata Containers with the QEMU VMM
  9451. #[crio.runtime.runtimes.kata-qemu]
  9452.  
  9453. # Kata Containers with the Firecracker VMM
  9454. #[crio.runtime.runtimes.kata-fc]
  9455.  
  9456. # The crio.image table contains settings pertaining to the management of OCI images.
  9457. #
  9458. # CRI-O reads its configured registries defaults from the system wide
  9459. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  9460. # you want to modify just CRI-O, you can change the registries configuration in
  9461. # this file. Otherwise, leave insecure_registries and registries commented out to
  9462. # use the system's defaults from /etc/containers/registries.conf.
  9463. [crio.image]
  9464.  
  9465. # Default transport for pulling images from a remote container storage.
  9466. # default_transport = "docker://"
  9467.  
  9468. # The path to a file containing credentials necessary for pulling images from
  9469. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  9470. global_auth_file = "/var/lib/kubelet/config.json"
  9471.  
  9472. # The image used to instantiate infra containers.
  9473. # This option supports live configuration reload.
  9474. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  9475.  
  9476. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  9477.  
  9478. # The path to a file containing credentials specific for pulling the pause_image from
  9479. # above. The file is similar to that of /var/lib/kubelet/config.json
  9480. # This option supports live configuration reload.
  9481. pause_image_auth_file = "/var/lib/kubelet/config.json"
  9482.  
  9483. # The command to run to have a container stay in the paused state.
  9484. # This option supports live configuration reload.
  9485. pause_command = "/usr/bin/pod"
  9486.  
  9487. # Path to the file which decides what sort of policy we use when deciding
  9488. # whether or not to trust an image that we've pulled. It is not recommended that
  9489. # this option be used, as the default behavior of using the system-wide default
  9490. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  9491. # refer to containers-policy.json(5) for more details.
  9492. # signature_policy = ""
  9493.  
  9494. # List of registries to skip TLS verification for pulling images. Please
  9495. # consider configuring the registries via /etc/containers/registries.conf before
  9496. # changing them here.
  9497. #insecure_registries = "[]"
  9498.  
  9499. # Controls how image volumes are handled. The valid values are mkdir, bind and
  9500. # ignore; the latter will ignore volumes entirely.
  9501. # image_volumes = "mkdir"
  9502.  
  9503. # List of registries to be used when pulling an unqualified image (e.g.,
  9504. # "alpine:latest"). By default, registries is set to "docker.io" for
  9505. # compatibility reasons. Depending on your workload and usecase you may add more
  9506. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  9507. # "registry.opensuse.org", etc.).
  9508. #registries = [
  9509. # ]
  9510.  
  9511.  
  9512. # The crio.network table containers settings pertaining to the management of
  9513. # CNI plugins.
  9514. [crio.network]
  9515.  
  9516. # Path to the directory where CNI configuration files are located.
  9517. # Note this default is changed from the RPM.
  9518. network_dir = "/etc/kubernetes/cni/net.d/"
  9519.  
  9520. # Paths to directories where CNI plugin binaries are located.
  9521. # Note this default is changed from the RPM.
  9522. plugin_dirs = [
  9523. "/var/lib/cni/bin",
  9524. ]
  9525.  
  9526. # A necessary configuration for Prometheus based metrics retrieval
  9527. [crio.metrics]
  9528.  
  9529. # Globally enable or disable metrics support.
  9530. enable_metrics = true
  9531.  
  9532. # The port on which the metrics server will listen.
  9533. metrics_port = 9537
  9534.  
  9535.  
  9536. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  9537.  
  9538. # The path to a file containing credentials specific for pulling the pause_image from
  9539. # above. The file is similar to that of /var/lib/kubelet/config.json
  9540. # This option supports live configuration reload.
  9541. pause_image_auth_file = "/var/lib/kubelet/config.json"
  9542.  
  9543. # The command to run to have a container stay in the paused state.
  9544. # This option supports live configuration reload.
  9545. pause_command = "/usr/bin/pod"
  9546.  
  9547. # Path to the file which decides what sort of policy we use when deciding
  9548. # whether or not to trust an image that we've pulled. It is not recommended that
  9549. # this option be used, as the default behavior of using the system-wide default
  9550. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  9551. # refer to containers-policy.json(5) for more details.
  9552. # signature_policy = ""
  9553.  
  9554. # List of registries to skip TLS verification for pulling images. Please
  9555. # consider configuring the registries via /etc/containers/registries.conf before
  9556. # changing them here.
  9557. #insecure_registries = "[]"
  9558.  
  9559. # Controls how image volumes are handled. The valid values are mkdir, bind and
  9560. # ignore; the latter will ignore volumes entirely.
  9561. # image_volumes = "mkdir"
  9562.  
  9563. # List of registries to be used when pulling an unqualified image (e.g.,
  9564. # "alpine:latest"). By default, registries is set to "docker.io" for
  9565. # compatibility reasons. Depending on your workload and usecase you may add more
  9566. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  9567. # "registry.opensuse.org", etc.).
  9568. #registries = [
  9569. # ]
  9570.  
  9571.  
  9572. # The crio.network table containers settings pertaining to the management of
  9573. # CNI plugins.
  9574. [crio.network]
  9575.  
  9576. # Path to the directory where CNI configuration files are located.
  9577. # Note this default is changed from the RPM.
  9578. network_dir = "/etc/kubernetes/cni/net.d/"
  9579.  
  9580. # Paths to directories where CNI plugin binaries are located.
  9581. # Note this default is changed from the RPM.
  9582. plugin_dirs = [
  9583. "/var/lib/cni/bin",
  9584. ]
  9585.  
  9586. # A necessary configuration for Prometheus based metrics retrieval
  9587. [crio.metrics]
  9588.  
  9589. # Globally enable or disable metrics support.
  9590. enable_metrics = true
  9591.  
  9592. # The port on which the metrics server will listen.
  9593. metrics_port = 9537
  9594.  
  9595.  
  9596. E0115 17:44:06.101260 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  9597. I0115 17:45:06.113302 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  9598. I0115 17:45:06.113325 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  9599. I0115 17:45:06.118459 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  9600. I0115 17:45:06.118479 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  9601. I0115 17:45:06.126986 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  9602. E0115 17:45:06.127686 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  9603. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  9604. # daemon, but in a TOML format that can be more easily modified and versioned.
  9605. #
  9606. # Please refer to crio.conf(5) for details of all configuration options.
  9607.  
  9608. # CRI-O supports partial configuration reload during runtime, which can be
  9609. # done by sending SIGHUP to the running process. Currently supported options
  9610. # are explicitly mentioned with: 'This option supports live configuration
  9611. # reload'.
  9612.  
  9613. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  9614. # located at /etc/containers/storage.conf. Modify this storage configuration if
  9615. # you want to change the system's defaults. If you want to modify storage just
  9616. # for CRI-O, you can change the storage configuration options here.
  9617. [crio]
  9618.  
  9619. # Path to the "root directory". CRI-O stores all of its data, including
  9620. # containers images, in this directory.
  9621. #root = "/var/lib/containers/storage"
  9622.  
  9623. # Path to the "run directory". CRI-O stores all of its state in this directory.
  9624. #runroot = "/run/user/1000"
  9625.  
  9626. # Storage driver used to manage the storage of images and containers. Please
  9627. # refer to containers-storage.conf(5) to see all available storage drivers.
  9628. #storage_driver = "overlay"
  9629.  
  9630. # List to pass options to the storage driver. Please refer to
  9631. # containers-storage.conf(5) to see all available storage options.
  9632. #storage_option = [
  9633. #]
  9634.  
  9635. # The default log directory where all logs will go unless directly specified by
  9636. # the kubelet. The log directory specified must be an absolute directory.
  9637. # log_dir = "/var/log/crio/pods"
  9638.  
  9639. # Location for CRI-O to lay down the version file
  9640. # version_file = "/var/lib/crio/version"
  9641.  
  9642. # The crio.api table contains settings for the kubelet/gRPC interface.
  9643. [crio.api]
  9644.  
  9645. # Path to AF_LOCAL socket on which CRI-O will listen.
  9646. # listen = "/var/run/crio/crio.sock"
  9647.  
  9648. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  9649. # host_ip = ""
  9650.  
  9651. # IP address on which the stream server will listen.
  9652. stream_address = ""
  9653.  
  9654. # The port on which the stream server will listen.
  9655. stream_port = "10010"
  9656.  
  9657. # Enable encrypted TLS transport of the stream server.
  9658. # stream_enable_tls = false
  9659.  
  9660. # Path to the x509 certificate file used to serve the encrypted stream. This
  9661. # file can change, and CRI-O will automatically pick up the changes within 5
  9662. # minutes.
  9663. # stream_tls_cert = ""
  9664.  
  9665. # Path to the key file used to serve the encrypted stream. This file can
  9666. # change and CRI-O will automatically pick up the changes within 5 minutes.
  9667. # stream_tls_key = ""
  9668.  
  9669. # Path to the x509 CA(s) file used to verify and authenticate client
  9670. # communication with the encrypted stream. This file can change and CRI-O will
  9671. # automatically pick up the changes within 5 minutes.
  9672. # stream_tls_ca = ""
  9673.  
  9674. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  9675. # grpc_max_send_msg_size = 16777216
  9676.  
  9677. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  9678. # grpc_max_recv_msg_size = 16777216
  9679.  
  9680. # The crio.runtime table contains settings pertaining to the OCI runtime used
  9681. # and options for how to set up and manage the OCI runtime.
  9682. [crio.runtime]
  9683.  
  9684. # A list of ulimits to be set in containers by default, specified as
  9685. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  9686. # "nofile=1024:2048"
  9687. # If nothing is set here, settings will be inherited from the CRI-O daemon
  9688. #default_ulimits = [
  9689. #]
  9690.  
  9691. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  9692. # The name is matched against the runtimes map below.
  9693. # default_runtime = "runc"
  9694.  
  9695. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  9696. # no_pivot = false
  9697.  
  9698. # Path to the conmon binary, used for monitoring the OCI runtime.
  9699. # Will be searched for using $PATH if empty.
  9700. conmon = "/usr/libexec/crio/conmon"
  9701.  
  9702. # Cgroup setting for conmon
  9703. conmon_cgroup = "pod"
  9704.  
  9705. # Environment variable list for the conmon process, used for passing necessary
  9706. # environment variables to conmon or the runtime.
  9707. # conmon_env = [
  9708. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  9709. # ]
  9710.  
  9711. # If true, SELinux will be used for pod separation on the host.
  9712. # selinux = true
  9713.  
  9714. # Path to the seccomp.json profile which is used as the default seccomp profile
  9715. # for the runtime. If not specified, then the internal default seccomp profile
  9716. # will be used.
  9717. # seccomp_profile = "/etc/crio/seccomp.json"
  9718.  
  9719. # Used to change the name of the default AppArmor profile of CRI-O. The default
  9720. # profile name is "crio-default-" followed by the version string of CRI-O.
  9721. apparmor_profile = "crio-default"
  9722.  
  9723. # Cgroup management implementation used for the runtime.
  9724. cgroup_manager = "systemd"
  9725.  
  9726. # List of default capabilities for containers. If it is empty or commented out,
  9727. # only the capabilities defined in the containers json file by the user/kube
  9728. # will be added.
  9729. # default_capabilities = [
  9730. # "CHOWN",
  9731. # "DAC_OVERRIDE",
  9732. # "FSETID",
  9733. # "FOWNER",
  9734. # "NET_RAW",
  9735. # "SETGID",
  9736. # "SETUID",
  9737. # "SETPCAP",
  9738. # "NET_BIND_SERVICE",
  9739. # "SYS_CHROOT",
  9740. # "KILL",
  9741. # ]
  9742.  
  9743. # List of default sysctls. If it is empty or commented out, only the sysctls
  9744. # defined in the container json file by the user/kube will be added.
  9745. # default_sysctls = [
  9746. # ]
  9747.  
  9748. # List of additional devices. specified as
  9749. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  9750. #If it is empty or commented out, only the devices
  9751. # defined in the container json file by the user/kube will be added.
  9752. # additional_devices = [
  9753. # ]
  9754.  
  9755. # Path to OCI hooks directories for automatically executed hooks.
  9756. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  9757. # so we add /etc/containers/oci/hooks.d as well
  9758. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  9759. hooks_dir = [
  9760. "/etc/containers/oci/hooks.d",
  9761. ]
  9762.  
  9763. # List of default mounts for each container. **Deprecated:** this option will
  9764. # be removed in future versions in favor of default_mounts_file.
  9765. # default_mounts = [
  9766. # "/usr/share/rhel/secrets:/run/secrets",
  9767. # ]
  9768.  
  9769. # Path to the file specifying the defaults mounts for each container. The
  9770. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  9771. # its default mounts from the following two files:
  9772. #
  9773. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  9774. # override file, where users can either add in their own default mounts, or
  9775. # override the default mounts shipped with the package.
  9776. #
  9777. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  9778. # mounts. If you want CRI-O to read from a different, specific mounts file,
  9779. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  9780. # only add mounts it finds in this file.
  9781. #
  9782. #default_mounts_file = ""
  9783.  
  9784. # Maximum number of processes allowed in a container.
  9785. # pids_limit = 1024
  9786.  
  9787. # Maximum sized allowed for the container log file. Negative numbers indicate
  9788. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  9789. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  9790. # limit is never exceeded.
  9791. # log_size_max = -1
  9792.  
  9793. # Whether container output should be logged to journald in addition to the kuberentes log file
  9794. # log_to_journald = false
  9795.  
  9796. # Path to directory in which container exit files are written to by conmon.
  9797. # container_exits_dir = "/var/run/crio/exits"
  9798.  
  9799. # Path to directory for container attach sockets.
  9800. # container_attach_socket_dir = "/var/run/crio"
  9801.  
  9802. # The prefix to use for the source of the bind mounts.
  9803. # bind_mount_prefix = ""
  9804.  
  9805. # If set to true, all containers will run in read-only mode.
  9806. # read_only = false
  9807.  
  9808. # Changes the verbosity of the logs based on the level it is set to. Options
  9809. # are fatal, panic, error, warn, info, and debug. This option supports live
  9810. # configuration reload.
  9811. # log_level = "error"
  9812.  
  9813. # The UID mappings for the user namespace of each container. A range is
  9814. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  9815. # separated by comma.
  9816. # uid_mappings = ""
  9817.  
  9818. # The GID mappings for the user namespace of each container. A range is
  9819. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  9820. # separated by comma.
  9821. # gid_mappings = ""
  9822.  
  9823. # The minimal amount of time in seconds to wait before issuing a timeout
  9824. # regarding the proper termination of the container.
  9825. # ctr_stop_timeout = 0
  9826.  
  9827. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  9828. # and manage its lifecycle.
  9829. # manage_network_ns_lifecycle = false
  9830.  
  9831. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  9832. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  9833. # If no runtime_handler is provided, the runtime will be picked based on the level
  9834. # of trust of the workload. Each entry in the table should follow the format:
  9835. #
  9836. #[crio.runtime.runtimes.runtime-handler]
  9837. # runtime_path = "/path/to/the/executable"
  9838. # runtime_type = "oci"
  9839. # runtime_root = "/path/to/the/root"
  9840. #
  9841. # Where:
  9842. # - runtime-handler: name used to identify the runtime
  9843. # - runtime_path (optional, string): absolute path to the runtime executable in
  9844. # the host filesystem. If omitted, the runtime-handler identifier should match
  9845. # the runtime executable name, and the runtime executable should be placed
  9846. # in $PATH.
  9847. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  9848. # omitted, an "oci" runtime is assumed.
  9849. # - runtime_root (optional, string): root directory for storage of containers
  9850. # state.
  9851.  
  9852.  
  9853. # [crio.runtime.runtimes.runc]
  9854. # runtime_path = ""
  9855. # runtime_type = "oci"
  9856. # runtime_root = "/run/runc"
  9857.  
  9858.  
  9859. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  9860. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  9861. # surface and mitigating the consequences of containers breakout.
  9862.  
  9863. # Kata Containers with the default configured VMM
  9864. #[crio.runtime.runtimes.kata-runtime]
  9865.  
  9866. # Kata Containers with the QEMU VMM
  9867. #[crio.runtime.runtimes.kata-qemu]
  9868.  
  9869. # Kata Containers with the Firecracker VMM
  9870. #[crio.runtime.runtimes.kata-fc]
  9871.  
  9872. # The crio.image table contains settings pertaining to the management of OCI images.
  9873. #
  9874. # CRI-O reads its configured registries defaults from the system wide
  9875. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  9876. # you want to modify just CRI-O, you can change the registries configuration in
  9877. # this file. Otherwise, leave insecure_registries and registries commented out to
  9878. # use the system's defaults from /etc/containers/registries.conf.
  9879. [crio.image]
  9880.  
  9881. # Default transport for pulling images from a remote container storage.
  9882. # default_transport = "docker://"
  9883.  
  9884. # The path to a file containing credentials necessary for pulling images from
  9885. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  9886. global_auth_file = "/var/lib/kubelet/config.json"
  9887.  
  9888. # The image used to instantiate infra containers.
  9889. # This option supports live configuration reload.
  9890. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  9891.  
  9892. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  9893.  
  9894. # The path to a file containing credentials specific for pulling the pause_image from
  9895. # above. The file is similar to that of /var/lib/kubelet/config.json
  9896. # This option supports live configuration reload.
  9897. pause_image_auth_file = "/var/lib/kubelet/config.json"
  9898.  
  9899. # The command to run to have a container stay in the paused state.
  9900. # This option supports live configuration reload.
  9901. pause_command = "/usr/bin/pod"
  9902.  
  9903. # Path to the file which decides what sort of policy we use when deciding
  9904. # whether or not to trust an image that we've pulled. It is not recommended that
  9905. # this option be used, as the default behavior of using the system-wide default
  9906. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  9907. # refer to containers-policy.json(5) for more details.
  9908. # signature_policy = ""
  9909.  
  9910. # List of registries to skip TLS verification for pulling images. Please
  9911. # consider configuring the registries via /etc/containers/registries.conf before
  9912. # changing them here.
  9913. #insecure_registries = "[]"
  9914.  
  9915. # Controls how image volumes are handled. The valid values are mkdir, bind and
  9916. # ignore; the latter will ignore volumes entirely.
  9917. # image_volumes = "mkdir"
  9918.  
  9919. # List of registries to be used when pulling an unqualified image (e.g.,
  9920. # "alpine:latest"). By default, registries is set to "docker.io" for
  9921. # compatibility reasons. Depending on your workload and usecase you may add more
  9922. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  9923. # "registry.opensuse.org", etc.).
  9924. #registries = [
  9925. # ]
  9926.  
  9927.  
  9928. # The crio.network table containers settings pertaining to the management of
  9929. # CNI plugins.
  9930. [crio.network]
  9931.  
  9932. # Path to the directory where CNI configuration files are located.
  9933. # Note this default is changed from the RPM.
  9934. network_dir = "/etc/kubernetes/cni/net.d/"
  9935.  
  9936. # Paths to directories where CNI plugin binaries are located.
  9937. # Note this default is changed from the RPM.
  9938. plugin_dirs = [
  9939. "/var/lib/cni/bin",
  9940. ]
  9941.  
  9942. # A necessary configuration for Prometheus based metrics retrieval
  9943. [crio.metrics]
  9944.  
  9945. # Globally enable or disable metrics support.
  9946. enable_metrics = true
  9947.  
  9948. # The port on which the metrics server will listen.
  9949. metrics_port = 9537
  9950.  
  9951.  
  9952. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  9953.  
  9954. # The path to a file containing credentials specific for pulling the pause_image from
  9955. # above. The file is similar to that of /var/lib/kubelet/config.json
  9956. # This option supports live configuration reload.
  9957. pause_image_auth_file = "/var/lib/kubelet/config.json"
  9958.  
  9959. # The command to run to have a container stay in the paused state.
  9960. # This option supports live configuration reload.
  9961. pause_command = "/usr/bin/pod"
  9962.  
  9963. # Path to the file which decides what sort of policy we use when deciding
  9964. # whether or not to trust an image that we've pulled. It is not recommended that
  9965. # this option be used, as the default behavior of using the system-wide default
  9966. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  9967. # refer to containers-policy.json(5) for more details.
  9968. # signature_policy = ""
  9969.  
  9970. # List of registries to skip TLS verification for pulling images. Please
  9971. # consider configuring the registries via /etc/containers/registries.conf before
  9972. # changing them here.
  9973. #insecure_registries = "[]"
  9974.  
  9975. # Controls how image volumes are handled. The valid values are mkdir, bind and
  9976. # ignore; the latter will ignore volumes entirely.
  9977. # image_volumes = "mkdir"
  9978.  
  9979. # List of registries to be used when pulling an unqualified image (e.g.,
  9980. # "alpine:latest"). By default, registries is set to "docker.io" for
  9981. # compatibility reasons. Depending on your workload and usecase you may add more
  9982. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  9983. # "registry.opensuse.org", etc.).
  9984. #registries = [
  9985. # ]
  9986.  
  9987.  
  9988. # The crio.network table containers settings pertaining to the management of
  9989. # CNI plugins.
  9990. [crio.network]
  9991.  
  9992. # Path to the directory where CNI configuration files are located.
  9993. # Note this default is changed from the RPM.
  9994. network_dir = "/etc/kubernetes/cni/net.d/"
  9995.  
  9996. # Paths to directories where CNI plugin binaries are located.
  9997. # Note this default is changed from the RPM.
  9998. plugin_dirs = [
  9999. "/var/lib/cni/bin",
  10000. ]
  10001.  
  10002. # A necessary configuration for Prometheus based metrics retrieval
  10003. [crio.metrics]
  10004.  
  10005. # Globally enable or disable metrics support.
  10006. enable_metrics = true
  10007.  
  10008. # The port on which the metrics server will listen.
  10009. metrics_port = 9537
  10010.  
  10011.  
  10012. E0115 17:45:06.127711 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10013. I0115 17:46:06.138927 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10014. I0115 17:46:06.138951 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  10015. I0115 17:46:06.143912 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  10016. I0115 17:46:06.143936 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  10017. I0115 17:46:06.152491 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10018. E0115 17:46:06.153249 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  10019. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  10020. # daemon, but in a TOML format that can be more easily modified and versioned.
  10021. #
  10022. # Please refer to crio.conf(5) for details of all configuration options.
  10023.  
  10024. # CRI-O supports partial configuration reload during runtime, which can be
  10025. # done by sending SIGHUP to the running process. Currently supported options
  10026. # are explicitly mentioned with: 'This option supports live configuration
  10027. # reload'.
  10028.  
  10029. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  10030. # located at /etc/containers/storage.conf. Modify this storage configuration if
  10031. # you want to change the system's defaults. If you want to modify storage just
  10032. # for CRI-O, you can change the storage configuration options here.
  10033. [crio]
  10034.  
  10035. # Path to the "root directory". CRI-O stores all of its data, including
  10036. # containers images, in this directory.
  10037. #root = "/var/lib/containers/storage"
  10038.  
  10039. # Path to the "run directory". CRI-O stores all of its state in this directory.
  10040. #runroot = "/run/user/1000"
  10041.  
  10042. # Storage driver used to manage the storage of images and containers. Please
  10043. # refer to containers-storage.conf(5) to see all available storage drivers.
  10044. #storage_driver = "overlay"
  10045.  
  10046. # List to pass options to the storage driver. Please refer to
  10047. # containers-storage.conf(5) to see all available storage options.
  10048. #storage_option = [
  10049. #]
  10050.  
  10051. # The default log directory where all logs will go unless directly specified by
  10052. # the kubelet. The log directory specified must be an absolute directory.
  10053. # log_dir = "/var/log/crio/pods"
  10054.  
  10055. # Location for CRI-O to lay down the version file
  10056. # version_file = "/var/lib/crio/version"
  10057.  
  10058. # The crio.api table contains settings for the kubelet/gRPC interface.
  10059. [crio.api]
  10060.  
  10061. # Path to AF_LOCAL socket on which CRI-O will listen.
  10062. # listen = "/var/run/crio/crio.sock"
  10063.  
  10064. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  10065. # host_ip = ""
  10066.  
  10067. # IP address on which the stream server will listen.
  10068. stream_address = ""
  10069.  
  10070. # The port on which the stream server will listen.
  10071. stream_port = "10010"
  10072.  
  10073. # Enable encrypted TLS transport of the stream server.
  10074. # stream_enable_tls = false
  10075.  
  10076. # Path to the x509 certificate file used to serve the encrypted stream. This
  10077. # file can change, and CRI-O will automatically pick up the changes within 5
  10078. # minutes.
  10079. # stream_tls_cert = ""
  10080.  
  10081. # Path to the key file used to serve the encrypted stream. This file can
  10082. # change and CRI-O will automatically pick up the changes within 5 minutes.
  10083. # stream_tls_key = ""
  10084.  
  10085. # Path to the x509 CA(s) file used to verify and authenticate client
  10086. # communication with the encrypted stream. This file can change and CRI-O will
  10087. # automatically pick up the changes within 5 minutes.
  10088. # stream_tls_ca = ""
  10089.  
  10090. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  10091. # grpc_max_send_msg_size = 16777216
  10092.  
  10093. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  10094. # grpc_max_recv_msg_size = 16777216
  10095.  
  10096. # The crio.runtime table contains settings pertaining to the OCI runtime used
  10097. # and options for how to set up and manage the OCI runtime.
  10098. [crio.runtime]
  10099.  
  10100. # A list of ulimits to be set in containers by default, specified as
  10101. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  10102. # "nofile=1024:2048"
  10103. # If nothing is set here, settings will be inherited from the CRI-O daemon
  10104. #default_ulimits = [
  10105. #]
  10106.  
  10107. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  10108. # The name is matched against the runtimes map below.
  10109. # default_runtime = "runc"
  10110.  
  10111. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  10112. # no_pivot = false
  10113.  
  10114. # Path to the conmon binary, used for monitoring the OCI runtime.
  10115. # Will be searched for using $PATH if empty.
  10116. conmon = "/usr/libexec/crio/conmon"
  10117.  
  10118. # Cgroup setting for conmon
  10119. conmon_cgroup = "pod"
  10120.  
  10121. # Environment variable list for the conmon process, used for passing necessary
  10122. # environment variables to conmon or the runtime.
  10123. # conmon_env = [
  10124. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  10125. # ]
  10126.  
  10127. # If true, SELinux will be used for pod separation on the host.
  10128. # selinux = true
  10129.  
  10130. # Path to the seccomp.json profile which is used as the default seccomp profile
  10131. # for the runtime. If not specified, then the internal default seccomp profile
  10132. # will be used.
  10133. # seccomp_profile = "/etc/crio/seccomp.json"
  10134.  
  10135. # Used to change the name of the default AppArmor profile of CRI-O. The default
  10136. # profile name is "crio-default-" followed by the version string of CRI-O.
  10137. apparmor_profile = "crio-default"
  10138.  
  10139. # Cgroup management implementation used for the runtime.
  10140. cgroup_manager = "systemd"
  10141.  
  10142. # List of default capabilities for containers. If it is empty or commented out,
  10143. # only the capabilities defined in the containers json file by the user/kube
  10144. # will be added.
  10145. # default_capabilities = [
  10146. # "CHOWN",
  10147. # "DAC_OVERRIDE",
  10148. # "FSETID",
  10149. # "FOWNER",
  10150. # "NET_RAW",
  10151. # "SETGID",
  10152. # "SETUID",
  10153. # "SETPCAP",
  10154. # "NET_BIND_SERVICE",
  10155. # "SYS_CHROOT",
  10156. # "KILL",
  10157. # ]
  10158.  
  10159. # List of default sysctls. If it is empty or commented out, only the sysctls
  10160. # defined in the container json file by the user/kube will be added.
  10161. # default_sysctls = [
  10162. # ]
  10163.  
  10164. # List of additional devices. specified as
  10165. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  10166. #If it is empty or commented out, only the devices
  10167. # defined in the container json file by the user/kube will be added.
  10168. # additional_devices = [
  10169. # ]
  10170.  
  10171. # Path to OCI hooks directories for automatically executed hooks.
  10172. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  10173. # so we add /etc/containers/oci/hooks.d as well
  10174. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  10175. hooks_dir = [
  10176. "/etc/containers/oci/hooks.d",
  10177. ]
  10178.  
  10179. # List of default mounts for each container. **Deprecated:** this option will
  10180. # be removed in future versions in favor of default_mounts_file.
  10181. # default_mounts = [
  10182. # "/usr/share/rhel/secrets:/run/secrets",
  10183. # ]
  10184.  
  10185. # Path to the file specifying the defaults mounts for each container. The
  10186. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  10187. # its default mounts from the following two files:
  10188. #
  10189. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  10190. # override file, where users can either add in their own default mounts, or
  10191. # override the default mounts shipped with the package.
  10192. #
  10193. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  10194. # mounts. If you want CRI-O to read from a different, specific mounts file,
  10195. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  10196. # only add mounts it finds in this file.
  10197. #
  10198. #default_mounts_file = ""
  10199.  
  10200. # Maximum number of processes allowed in a container.
  10201. # pids_limit = 1024
  10202.  
  10203. # Maximum sized allowed for the container log file. Negative numbers indicate
  10204. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  10205. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  10206. # limit is never exceeded.
  10207. # log_size_max = -1
  10208.  
  10209. # Whether container output should be logged to journald in addition to the kuberentes log file
  10210. # log_to_journald = false
  10211.  
  10212. # Path to directory in which container exit files are written to by conmon.
  10213. # container_exits_dir = "/var/run/crio/exits"
  10214.  
  10215. # Path to directory for container attach sockets.
  10216. # container_attach_socket_dir = "/var/run/crio"
  10217.  
  10218. # The prefix to use for the source of the bind mounts.
  10219. # bind_mount_prefix = ""
  10220.  
  10221. # If set to true, all containers will run in read-only mode.
  10222. # read_only = false
  10223.  
  10224. # Changes the verbosity of the logs based on the level it is set to. Options
  10225. # are fatal, panic, error, warn, info, and debug. This option supports live
  10226. # configuration reload.
  10227. # log_level = "error"
  10228.  
  10229. # The UID mappings for the user namespace of each container. A range is
  10230. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  10231. # separated by comma.
  10232. # uid_mappings = ""
  10233.  
  10234. # The GID mappings for the user namespace of each container. A range is
  10235. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  10236. # separated by comma.
  10237. # gid_mappings = ""
  10238.  
  10239. # The minimal amount of time in seconds to wait before issuing a timeout
  10240. # regarding the proper termination of the container.
  10241. # ctr_stop_timeout = 0
  10242.  
  10243. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  10244. # and manage its lifecycle.
  10245. # manage_network_ns_lifecycle = false
  10246.  
  10247. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  10248. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  10249. # If no runtime_handler is provided, the runtime will be picked based on the level
  10250. # of trust of the workload. Each entry in the table should follow the format:
  10251. #
  10252. #[crio.runtime.runtimes.runtime-handler]
  10253. # runtime_path = "/path/to/the/executable"
  10254. # runtime_type = "oci"
  10255. # runtime_root = "/path/to/the/root"
  10256. #
  10257. # Where:
  10258. # - runtime-handler: name used to identify the runtime
  10259. # - runtime_path (optional, string): absolute path to the runtime executable in
  10260. # the host filesystem. If omitted, the runtime-handler identifier should match
  10261. # the runtime executable name, and the runtime executable should be placed
  10262. # in $PATH.
  10263. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  10264. # omitted, an "oci" runtime is assumed.
  10265. # - runtime_root (optional, string): root directory for storage of containers
  10266. # state.
  10267.  
  10268.  
  10269. # [crio.runtime.runtimes.runc]
  10270. # runtime_path = ""
  10271. # runtime_type = "oci"
  10272. # runtime_root = "/run/runc"
  10273.  
  10274.  
  10275. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  10276. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  10277. # surface and mitigating the consequences of containers breakout.
  10278.  
  10279. # Kata Containers with the default configured VMM
  10280. #[crio.runtime.runtimes.kata-runtime]
  10281.  
  10282. # Kata Containers with the QEMU VMM
  10283. #[crio.runtime.runtimes.kata-qemu]
  10284.  
  10285. # Kata Containers with the Firecracker VMM
  10286. #[crio.runtime.runtimes.kata-fc]
  10287.  
  10288. # The crio.image table contains settings pertaining to the management of OCI images.
  10289. #
  10290. # CRI-O reads its configured registries defaults from the system wide
  10291. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  10292. # you want to modify just CRI-O, you can change the registries configuration in
  10293. # this file. Otherwise, leave insecure_registries and registries commented out to
  10294. # use the system's defaults from /etc/containers/registries.conf.
  10295. [crio.image]
  10296.  
  10297. # Default transport for pulling images from a remote container storage.
  10298. # default_transport = "docker://"
  10299.  
  10300. # The path to a file containing credentials necessary for pulling images from
  10301. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  10302. global_auth_file = "/var/lib/kubelet/config.json"
  10303.  
  10304. # The image used to instantiate infra containers.
  10305. # This option supports live configuration reload.
  10306. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  10307.  
  10308. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  10309.  
  10310. # The path to a file containing credentials specific for pulling the pause_image from
  10311. # above. The file is similar to that of /var/lib/kubelet/config.json
  10312. # This option supports live configuration reload.
  10313. pause_image_auth_file = "/var/lib/kubelet/config.json"
  10314.  
  10315. # The command to run to have a container stay in the paused state.
  10316. # This option supports live configuration reload.
  10317. pause_command = "/usr/bin/pod"
  10318.  
  10319. # Path to the file which decides what sort of policy we use when deciding
  10320. # whether or not to trust an image that we've pulled. It is not recommended that
  10321. # this option be used, as the default behavior of using the system-wide default
  10322. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  10323. # refer to containers-policy.json(5) for more details.
  10324. # signature_policy = ""
  10325.  
  10326. # List of registries to skip TLS verification for pulling images. Please
  10327. # consider configuring the registries via /etc/containers/registries.conf before
  10328. # changing them here.
  10329. #insecure_registries = "[]"
  10330.  
  10331. # Controls how image volumes are handled. The valid values are mkdir, bind and
  10332. # ignore; the latter will ignore volumes entirely.
  10333. # image_volumes = "mkdir"
  10334.  
  10335. # List of registries to be used when pulling an unqualified image (e.g.,
  10336. # "alpine:latest"). By default, registries is set to "docker.io" for
  10337. # compatibility reasons. Depending on your workload and usecase you may add more
  10338. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  10339. # "registry.opensuse.org", etc.).
  10340. #registries = [
  10341. # ]
  10342.  
  10343.  
  10344. # The crio.network table containers settings pertaining to the management of
  10345. # CNI plugins.
  10346. [crio.network]
  10347.  
  10348. # Path to the directory where CNI configuration files are located.
  10349. # Note this default is changed from the RPM.
  10350. network_dir = "/etc/kubernetes/cni/net.d/"
  10351.  
  10352. # Paths to directories where CNI plugin binaries are located.
  10353. # Note this default is changed from the RPM.
  10354. plugin_dirs = [
  10355. "/var/lib/cni/bin",
  10356. ]
  10357.  
  10358. # A necessary configuration for Prometheus based metrics retrieval
  10359. [crio.metrics]
  10360.  
  10361. # Globally enable or disable metrics support.
  10362. enable_metrics = true
  10363.  
  10364. # The port on which the metrics server will listen.
  10365. metrics_port = 9537
  10366.  
  10367.  
  10368. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  10369.  
  10370. # The path to a file containing credentials specific for pulling the pause_image from
  10371. # above. The file is similar to that of /var/lib/kubelet/config.json
  10372. # This option supports live configuration reload.
  10373. pause_image_auth_file = "/var/lib/kubelet/config.json"
  10374.  
  10375. # The command to run to have a container stay in the paused state.
  10376. # This option supports live configuration reload.
  10377. pause_command = "/usr/bin/pod"
  10378.  
  10379. # Path to the file which decides what sort of policy we use when deciding
  10380. # whether or not to trust an image that we've pulled. It is not recommended that
  10381. # this option be used, as the default behavior of using the system-wide default
  10382. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  10383. # refer to containers-policy.json(5) for more details.
  10384. # signature_policy = ""
  10385.  
  10386. # List of registries to skip TLS verification for pulling images. Please
  10387. # consider configuring the registries via /etc/containers/registries.conf before
  10388. # changing them here.
  10389. #insecure_registries = "[]"
  10390.  
  10391. # Controls how image volumes are handled. The valid values are mkdir, bind and
  10392. # ignore; the latter will ignore volumes entirely.
  10393. # image_volumes = "mkdir"
  10394.  
  10395. # List of registries to be used when pulling an unqualified image (e.g.,
  10396. # "alpine:latest"). By default, registries is set to "docker.io" for
  10397. # compatibility reasons. Depending on your workload and usecase you may add more
  10398. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  10399. # "registry.opensuse.org", etc.).
  10400. #registries = [
  10401. # ]
  10402.  
  10403.  
  10404. # The crio.network table containers settings pertaining to the management of
  10405. # CNI plugins.
  10406. [crio.network]
  10407.  
  10408. # Path to the directory where CNI configuration files are located.
  10409. # Note this default is changed from the RPM.
  10410. network_dir = "/etc/kubernetes/cni/net.d/"
  10411.  
  10412. # Paths to directories where CNI plugin binaries are located.
  10413. # Note this default is changed from the RPM.
  10414. plugin_dirs = [
  10415. "/var/lib/cni/bin",
  10416. ]
  10417.  
  10418. # A necessary configuration for Prometheus based metrics retrieval
  10419. [crio.metrics]
  10420.  
  10421. # Globally enable or disable metrics support.
  10422. enable_metrics = true
  10423.  
  10424. # The port on which the metrics server will listen.
  10425. metrics_port = 9537
  10426.  
  10427.  
  10428. E0115 17:46:06.153282 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10429. I0115 17:47:06.164512 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10430. I0115 17:47:06.164537 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  10431. I0115 17:47:06.169515 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  10432. I0115 17:47:06.169544 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  10433. I0115 17:47:06.178911 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10434. E0115 17:47:06.179674 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  10435. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  10436. # daemon, but in a TOML format that can be more easily modified and versioned.
  10437. #
  10438. # Please refer to crio.conf(5) for details of all configuration options.
  10439.  
  10440. # CRI-O supports partial configuration reload during runtime, which can be
  10441. # done by sending SIGHUP to the running process. Currently supported options
  10442. # are explicitly mentioned with: 'This option supports live configuration
  10443. # reload'.
  10444.  
  10445. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  10446. # located at /etc/containers/storage.conf. Modify this storage configuration if
  10447. # you want to change the system's defaults. If you want to modify storage just
  10448. # for CRI-O, you can change the storage configuration options here.
  10449. [crio]
  10450.  
  10451. # Path to the "root directory". CRI-O stores all of its data, including
  10452. # containers images, in this directory.
  10453. #root = "/var/lib/containers/storage"
  10454.  
  10455. # Path to the "run directory". CRI-O stores all of its state in this directory.
  10456. #runroot = "/run/user/1000"
  10457.  
  10458. # Storage driver used to manage the storage of images and containers. Please
  10459. # refer to containers-storage.conf(5) to see all available storage drivers.
  10460. #storage_driver = "overlay"
  10461.  
  10462. # List to pass options to the storage driver. Please refer to
  10463. # containers-storage.conf(5) to see all available storage options.
  10464. #storage_option = [
  10465. #]
  10466.  
  10467. # The default log directory where all logs will go unless directly specified by
  10468. # the kubelet. The log directory specified must be an absolute directory.
  10469. # log_dir = "/var/log/crio/pods"
  10470.  
  10471. # Location for CRI-O to lay down the version file
  10472. # version_file = "/var/lib/crio/version"
  10473.  
  10474. # The crio.api table contains settings for the kubelet/gRPC interface.
  10475. [crio.api]
  10476.  
  10477. # Path to AF_LOCAL socket on which CRI-O will listen.
  10478. # listen = "/var/run/crio/crio.sock"
  10479.  
  10480. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  10481. # host_ip = ""
  10482.  
  10483. # IP address on which the stream server will listen.
  10484. stream_address = ""
  10485.  
  10486. # The port on which the stream server will listen.
  10487. stream_port = "10010"
  10488.  
  10489. # Enable encrypted TLS transport of the stream server.
  10490. # stream_enable_tls = false
  10491.  
  10492. # Path to the x509 certificate file used to serve the encrypted stream. This
  10493. # file can change, and CRI-O will automatically pick up the changes within 5
  10494. # minutes.
  10495. # stream_tls_cert = ""
  10496.  
  10497. # Path to the key file used to serve the encrypted stream. This file can
  10498. # change and CRI-O will automatically pick up the changes within 5 minutes.
  10499. # stream_tls_key = ""
  10500.  
  10501. # Path to the x509 CA(s) file used to verify and authenticate client
  10502. # communication with the encrypted stream. This file can change and CRI-O will
  10503. # automatically pick up the changes within 5 minutes.
  10504. # stream_tls_ca = ""
  10505.  
  10506. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  10507. # grpc_max_send_msg_size = 16777216
  10508.  
  10509. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  10510. # grpc_max_recv_msg_size = 16777216
  10511.  
  10512. # The crio.runtime table contains settings pertaining to the OCI runtime used
  10513. # and options for how to set up and manage the OCI runtime.
  10514. [crio.runtime]
  10515.  
  10516. # A list of ulimits to be set in containers by default, specified as
  10517. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  10518. # "nofile=1024:2048"
  10519. # If nothing is set here, settings will be inherited from the CRI-O daemon
  10520. #default_ulimits = [
  10521. #]
  10522.  
  10523. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  10524. # The name is matched against the runtimes map below.
  10525. # default_runtime = "runc"
  10526.  
  10527. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  10528. # no_pivot = false
  10529.  
  10530. # Path to the conmon binary, used for monitoring the OCI runtime.
  10531. # Will be searched for using $PATH if empty.
  10532. conmon = "/usr/libexec/crio/conmon"
  10533.  
  10534. # Cgroup setting for conmon
  10535. conmon_cgroup = "pod"
  10536.  
  10537. # Environment variable list for the conmon process, used for passing necessary
  10538. # environment variables to conmon or the runtime.
  10539. # conmon_env = [
  10540. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  10541. # ]
  10542.  
  10543. # If true, SELinux will be used for pod separation on the host.
  10544. # selinux = true
  10545.  
  10546. # Path to the seccomp.json profile which is used as the default seccomp profile
  10547. # for the runtime. If not specified, then the internal default seccomp profile
  10548. # will be used.
  10549. # seccomp_profile = "/etc/crio/seccomp.json"
  10550.  
  10551. # Used to change the name of the default AppArmor profile of CRI-O. The default
  10552. # profile name is "crio-default-" followed by the version string of CRI-O.
  10553. apparmor_profile = "crio-default"
  10554.  
  10555. # Cgroup management implementation used for the runtime.
  10556. cgroup_manager = "systemd"
  10557.  
  10558. # List of default capabilities for containers. If it is empty or commented out,
  10559. # only the capabilities defined in the containers json file by the user/kube
  10560. # will be added.
  10561. # default_capabilities = [
  10562. # "CHOWN",
  10563. # "DAC_OVERRIDE",
  10564. # "FSETID",
  10565. # "FOWNER",
  10566. # "NET_RAW",
  10567. # "SETGID",
  10568. # "SETUID",
  10569. # "SETPCAP",
  10570. # "NET_BIND_SERVICE",
  10571. # "SYS_CHROOT",
  10572. # "KILL",
  10573. # ]
  10574.  
  10575. # List of default sysctls. If it is empty or commented out, only the sysctls
  10576. # defined in the container json file by the user/kube will be added.
  10577. # default_sysctls = [
  10578. # ]
  10579.  
  10580. # List of additional devices. specified as
  10581. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  10582. #If it is empty or commented out, only the devices
  10583. # defined in the container json file by the user/kube will be added.
  10584. # additional_devices = [
  10585. # ]
  10586.  
  10587. # Path to OCI hooks directories for automatically executed hooks.
  10588. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  10589. # so we add /etc/containers/oci/hooks.d as well
  10590. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  10591. hooks_dir = [
  10592. "/etc/containers/oci/hooks.d",
  10593. ]
  10594.  
  10595. # List of default mounts for each container. **Deprecated:** this option will
  10596. # be removed in future versions in favor of default_mounts_file.
  10597. # default_mounts = [
  10598. # "/usr/share/rhel/secrets:/run/secrets",
  10599. # ]
  10600.  
  10601. # Path to the file specifying the defaults mounts for each container. The
  10602. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  10603. # its default mounts from the following two files:
  10604. #
  10605. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  10606. # override file, where users can either add in their own default mounts, or
  10607. # override the default mounts shipped with the package.
  10608. #
  10609. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  10610. # mounts. If you want CRI-O to read from a different, specific mounts file,
  10611. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  10612. # only add mounts it finds in this file.
  10613. #
  10614. #default_mounts_file = ""
  10615.  
  10616. # Maximum number of processes allowed in a container.
  10617. # pids_limit = 1024
  10618.  
  10619. # Maximum sized allowed for the container log file. Negative numbers indicate
  10620. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  10621. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  10622. # limit is never exceeded.
  10623. # log_size_max = -1
  10624.  
  10625. # Whether container output should be logged to journald in addition to the kuberentes log file
  10626. # log_to_journald = false
  10627.  
  10628. # Path to directory in which container exit files are written to by conmon.
  10629. # container_exits_dir = "/var/run/crio/exits"
  10630.  
  10631. # Path to directory for container attach sockets.
  10632. # container_attach_socket_dir = "/var/run/crio"
  10633.  
  10634. # The prefix to use for the source of the bind mounts.
  10635. # bind_mount_prefix = ""
  10636.  
  10637. # If set to true, all containers will run in read-only mode.
  10638. # read_only = false
  10639.  
  10640. # Changes the verbosity of the logs based on the level it is set to. Options
  10641. # are fatal, panic, error, warn, info, and debug. This option supports live
  10642. # configuration reload.
  10643. # log_level = "error"
  10644.  
  10645. # The UID mappings for the user namespace of each container. A range is
  10646. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  10647. # separated by comma.
  10648. # uid_mappings = ""
  10649.  
  10650. # The GID mappings for the user namespace of each container. A range is
  10651. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  10652. # separated by comma.
  10653. # gid_mappings = ""
  10654.  
  10655. # The minimal amount of time in seconds to wait before issuing a timeout
  10656. # regarding the proper termination of the container.
  10657. # ctr_stop_timeout = 0
  10658.  
  10659. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  10660. # and manage its lifecycle.
  10661. # manage_network_ns_lifecycle = false
  10662.  
  10663. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  10664. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  10665. # If no runtime_handler is provided, the runtime will be picked based on the level
  10666. # of trust of the workload. Each entry in the table should follow the format:
  10667. #
  10668. #[crio.runtime.runtimes.runtime-handler]
  10669. # runtime_path = "/path/to/the/executable"
  10670. # runtime_type = "oci"
  10671. # runtime_root = "/path/to/the/root"
  10672. #
  10673. # Where:
  10674. # - runtime-handler: name used to identify the runtime
  10675. # - runtime_path (optional, string): absolute path to the runtime executable in
  10676. # the host filesystem. If omitted, the runtime-handler identifier should match
  10677. # the runtime executable name, and the runtime executable should be placed
  10678. # in $PATH.
  10679. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  10680. # omitted, an "oci" runtime is assumed.
  10681. # - runtime_root (optional, string): root directory for storage of containers
  10682. # state.
  10683.  
  10684.  
  10685. # [crio.runtime.runtimes.runc]
  10686. # runtime_path = ""
  10687. # runtime_type = "oci"
  10688. # runtime_root = "/run/runc"
  10689.  
  10690.  
  10691. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  10692. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  10693. # surface and mitigating the consequences of containers breakout.
  10694.  
  10695. # Kata Containers with the default configured VMM
  10696. #[crio.runtime.runtimes.kata-runtime]
  10697.  
  10698. # Kata Containers with the QEMU VMM
  10699. #[crio.runtime.runtimes.kata-qemu]
  10700.  
  10701. # Kata Containers with the Firecracker VMM
  10702. #[crio.runtime.runtimes.kata-fc]
  10703.  
  10704. # The crio.image table contains settings pertaining to the management of OCI images.
  10705. #
  10706. # CRI-O reads its configured registries defaults from the system wide
  10707. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  10708. # you want to modify just CRI-O, you can change the registries configuration in
  10709. # this file. Otherwise, leave insecure_registries and registries commented out to
  10710. # use the system's defaults from /etc/containers/registries.conf.
  10711. [crio.image]
  10712.  
  10713. # Default transport for pulling images from a remote container storage.
  10714. # default_transport = "docker://"
  10715.  
  10716. # The path to a file containing credentials necessary for pulling images from
  10717. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  10718. global_auth_file = "/var/lib/kubelet/config.json"
  10719.  
  10720. # The image used to instantiate infra containers.
  10721. # This option supports live configuration reload.
  10722. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  10723.  
  10724. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  10725.  
  10726. # The path to a file containing credentials specific for pulling the pause_image from
  10727. # above. The file is similar to that of /var/lib/kubelet/config.json
  10728. # This option supports live configuration reload.
  10729. pause_image_auth_file = "/var/lib/kubelet/config.json"
  10730.  
  10731. # The command to run to have a container stay in the paused state.
  10732. # This option supports live configuration reload.
  10733. pause_command = "/usr/bin/pod"
  10734.  
  10735. # Path to the file which decides what sort of policy we use when deciding
  10736. # whether or not to trust an image that we've pulled. It is not recommended that
  10737. # this option be used, as the default behavior of using the system-wide default
  10738. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  10739. # refer to containers-policy.json(5) for more details.
  10740. # signature_policy = ""
  10741.  
  10742. # List of registries to skip TLS verification for pulling images. Please
  10743. # consider configuring the registries via /etc/containers/registries.conf before
  10744. # changing them here.
  10745. #insecure_registries = "[]"
  10746.  
  10747. # Controls how image volumes are handled. The valid values are mkdir, bind and
  10748. # ignore; the latter will ignore volumes entirely.
  10749. # image_volumes = "mkdir"
  10750.  
  10751. # List of registries to be used when pulling an unqualified image (e.g.,
  10752. # "alpine:latest"). By default, registries is set to "docker.io" for
  10753. # compatibility reasons. Depending on your workload and usecase you may add more
  10754. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  10755. # "registry.opensuse.org", etc.).
  10756. #registries = [
  10757. # ]
  10758.  
  10759.  
  10760. # The crio.network table containers settings pertaining to the management of
  10761. # CNI plugins.
  10762. [crio.network]
  10763.  
  10764. # Path to the directory where CNI configuration files are located.
  10765. # Note this default is changed from the RPM.
  10766. network_dir = "/etc/kubernetes/cni/net.d/"
  10767.  
  10768. # Paths to directories where CNI plugin binaries are located.
  10769. # Note this default is changed from the RPM.
  10770. plugin_dirs = [
  10771. "/var/lib/cni/bin",
  10772. ]
  10773.  
  10774. # A necessary configuration for Prometheus based metrics retrieval
  10775. [crio.metrics]
  10776.  
  10777. # Globally enable or disable metrics support.
  10778. enable_metrics = true
  10779.  
  10780. # The port on which the metrics server will listen.
  10781. metrics_port = 9537
  10782.  
  10783.  
  10784. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  10785.  
  10786. # The path to a file containing credentials specific for pulling the pause_image from
  10787. # above. The file is similar to that of /var/lib/kubelet/config.json
  10788. # This option supports live configuration reload.
  10789. pause_image_auth_file = "/var/lib/kubelet/config.json"
  10790.  
  10791. # The command to run to have a container stay in the paused state.
  10792. # This option supports live configuration reload.
  10793. pause_command = "/usr/bin/pod"
  10794.  
  10795. # Path to the file which decides what sort of policy we use when deciding
  10796. # whether or not to trust an image that we've pulled. It is not recommended that
  10797. # this option be used, as the default behavior of using the system-wide default
  10798. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  10799. # refer to containers-policy.json(5) for more details.
  10800. # signature_policy = ""
  10801.  
  10802. # List of registries to skip TLS verification for pulling images. Please
  10803. # consider configuring the registries via /etc/containers/registries.conf before
  10804. # changing them here.
  10805. #insecure_registries = "[]"
  10806.  
  10807. # Controls how image volumes are handled. The valid values are mkdir, bind and
  10808. # ignore; the latter will ignore volumes entirely.
  10809. # image_volumes = "mkdir"
  10810.  
  10811. # List of registries to be used when pulling an unqualified image (e.g.,
  10812. # "alpine:latest"). By default, registries is set to "docker.io" for
  10813. # compatibility reasons. Depending on your workload and usecase you may add more
  10814. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  10815. # "registry.opensuse.org", etc.).
  10816. #registries = [
  10817. # ]
  10818.  
  10819.  
  10820. # The crio.network table containers settings pertaining to the management of
  10821. # CNI plugins.
  10822. [crio.network]
  10823.  
  10824. # Path to the directory where CNI configuration files are located.
  10825. # Note this default is changed from the RPM.
  10826. network_dir = "/etc/kubernetes/cni/net.d/"
  10827.  
  10828. # Paths to directories where CNI plugin binaries are located.
  10829. # Note this default is changed from the RPM.
  10830. plugin_dirs = [
  10831. "/var/lib/cni/bin",
  10832. ]
  10833.  
  10834. # A necessary configuration for Prometheus based metrics retrieval
  10835. [crio.metrics]
  10836.  
  10837. # Globally enable or disable metrics support.
  10838. enable_metrics = true
  10839.  
  10840. # The port on which the metrics server will listen.
  10841. metrics_port = 9537
  10842.  
  10843.  
  10844. E0115 17:47:06.179700 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10845. I0115 17:48:06.190415 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10846. I0115 17:48:06.190439 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  10847. I0115 17:48:06.195223 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  10848. I0115 17:48:06.195243 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  10849. I0115 17:48:06.204056 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  10850. E0115 17:48:06.204755 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  10851. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  10852. # daemon, but in a TOML format that can be more easily modified and versioned.
  10853. #
  10854. # Please refer to crio.conf(5) for details of all configuration options.
  10855.  
  10856. # CRI-O supports partial configuration reload during runtime, which can be
  10857. # done by sending SIGHUP to the running process. Currently supported options
  10858. # are explicitly mentioned with: 'This option supports live configuration
  10859. # reload'.
  10860.  
  10861. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  10862. # located at /etc/containers/storage.conf. Modify this storage configuration if
  10863. # you want to change the system's defaults. If you want to modify storage just
  10864. # for CRI-O, you can change the storage configuration options here.
  10865. [crio]
  10866.  
  10867. # Path to the "root directory". CRI-O stores all of its data, including
  10868. # containers images, in this directory.
  10869. #root = "/var/lib/containers/storage"
  10870.  
  10871. # Path to the "run directory". CRI-O stores all of its state in this directory.
  10872. #runroot = "/run/user/1000"
  10873.  
  10874. # Storage driver used to manage the storage of images and containers. Please
  10875. # refer to containers-storage.conf(5) to see all available storage drivers.
  10876. #storage_driver = "overlay"
  10877.  
  10878. # List to pass options to the storage driver. Please refer to
  10879. # containers-storage.conf(5) to see all available storage options.
  10880. #storage_option = [
  10881. #]
  10882.  
  10883. # The default log directory where all logs will go unless directly specified by
  10884. # the kubelet. The log directory specified must be an absolute directory.
  10885. # log_dir = "/var/log/crio/pods"
  10886.  
  10887. # Location for CRI-O to lay down the version file
  10888. # version_file = "/var/lib/crio/version"
  10889.  
  10890. # The crio.api table contains settings for the kubelet/gRPC interface.
  10891. [crio.api]
  10892.  
  10893. # Path to AF_LOCAL socket on which CRI-O will listen.
  10894. # listen = "/var/run/crio/crio.sock"
  10895.  
  10896. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  10897. # host_ip = ""
  10898.  
  10899. # IP address on which the stream server will listen.
  10900. stream_address = ""
  10901.  
  10902. # The port on which the stream server will listen.
  10903. stream_port = "10010"
  10904.  
  10905. # Enable encrypted TLS transport of the stream server.
  10906. # stream_enable_tls = false
  10907.  
  10908. # Path to the x509 certificate file used to serve the encrypted stream. This
  10909. # file can change, and CRI-O will automatically pick up the changes within 5
  10910. # minutes.
  10911. # stream_tls_cert = ""
  10912.  
  10913. # Path to the key file used to serve the encrypted stream. This file can
  10914. # change and CRI-O will automatically pick up the changes within 5 minutes.
  10915. # stream_tls_key = ""
  10916.  
  10917. # Path to the x509 CA(s) file used to verify and authenticate client
  10918. # communication with the encrypted stream. This file can change and CRI-O will
  10919. # automatically pick up the changes within 5 minutes.
  10920. # stream_tls_ca = ""
  10921.  
  10922. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  10923. # grpc_max_send_msg_size = 16777216
  10924.  
  10925. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  10926. # grpc_max_recv_msg_size = 16777216
  10927.  
  10928. # The crio.runtime table contains settings pertaining to the OCI runtime used
  10929. # and options for how to set up and manage the OCI runtime.
  10930. [crio.runtime]
  10931.  
  10932. # A list of ulimits to be set in containers by default, specified as
  10933. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  10934. # "nofile=1024:2048"
  10935. # If nothing is set here, settings will be inherited from the CRI-O daemon
  10936. #default_ulimits = [
  10937. #]
  10938.  
  10939. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  10940. # The name is matched against the runtimes map below.
  10941. # default_runtime = "runc"
  10942.  
  10943. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  10944. # no_pivot = false
  10945.  
  10946. # Path to the conmon binary, used for monitoring the OCI runtime.
  10947. # Will be searched for using $PATH if empty.
  10948. conmon = "/usr/libexec/crio/conmon"
  10949.  
  10950. # Cgroup setting for conmon
  10951. conmon_cgroup = "pod"
  10952.  
  10953. # Environment variable list for the conmon process, used for passing necessary
  10954. # environment variables to conmon or the runtime.
  10955. # conmon_env = [
  10956. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  10957. # ]
  10958.  
  10959. # If true, SELinux will be used for pod separation on the host.
  10960. # selinux = true
  10961.  
  10962. # Path to the seccomp.json profile which is used as the default seccomp profile
  10963. # for the runtime. If not specified, then the internal default seccomp profile
  10964. # will be used.
  10965. # seccomp_profile = "/etc/crio/seccomp.json"
  10966.  
  10967. # Used to change the name of the default AppArmor profile of CRI-O. The default
  10968. # profile name is "crio-default-" followed by the version string of CRI-O.
  10969. apparmor_profile = "crio-default"
  10970.  
  10971. # Cgroup management implementation used for the runtime.
  10972. cgroup_manager = "systemd"
  10973.  
  10974. # List of default capabilities for containers. If it is empty or commented out,
  10975. # only the capabilities defined in the containers json file by the user/kube
  10976. # will be added.
  10977. # default_capabilities = [
  10978. # "CHOWN",
  10979. # "DAC_OVERRIDE",
  10980. # "FSETID",
  10981. # "FOWNER",
  10982. # "NET_RAW",
  10983. # "SETGID",
  10984. # "SETUID",
  10985. # "SETPCAP",
  10986. # "NET_BIND_SERVICE",
  10987. # "SYS_CHROOT",
  10988. # "KILL",
  10989. # ]
  10990.  
  10991. # List of default sysctls. If it is empty or commented out, only the sysctls
  10992. # defined in the container json file by the user/kube will be added.
  10993. # default_sysctls = [
  10994. # ]
  10995.  
  10996. # List of additional devices. specified as
  10997. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  10998. #If it is empty or commented out, only the devices
  10999. # defined in the container json file by the user/kube will be added.
  11000. # additional_devices = [
  11001. # ]
  11002.  
  11003. # Path to OCI hooks directories for automatically executed hooks.
  11004. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  11005. # so we add /etc/containers/oci/hooks.d as well
  11006. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  11007. hooks_dir = [
  11008. "/etc/containers/oci/hooks.d",
  11009. ]
  11010.  
  11011. # List of default mounts for each container. **Deprecated:** this option will
  11012. # be removed in future versions in favor of default_mounts_file.
  11013. # default_mounts = [
  11014. # "/usr/share/rhel/secrets:/run/secrets",
  11015. # ]
  11016.  
  11017. # Path to the file specifying the defaults mounts for each container. The
  11018. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  11019. # its default mounts from the following two files:
  11020. #
  11021. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  11022. # override file, where users can either add in their own default mounts, or
  11023. # override the default mounts shipped with the package.
  11024. #
  11025. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  11026. # mounts. If you want CRI-O to read from a different, specific mounts file,
  11027. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  11028. # only add mounts it finds in this file.
  11029. #
  11030. #default_mounts_file = ""
  11031.  
  11032. # Maximum number of processes allowed in a container.
  11033. # pids_limit = 1024
  11034.  
  11035. # Maximum sized allowed for the container log file. Negative numbers indicate
  11036. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  11037. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  11038. # limit is never exceeded.
  11039. # log_size_max = -1
  11040.  
  11041. # Whether container output should be logged to journald in addition to the kuberentes log file
  11042. # log_to_journald = false
  11043.  
  11044. # Path to directory in which container exit files are written to by conmon.
  11045. # container_exits_dir = "/var/run/crio/exits"
  11046.  
  11047. # Path to directory for container attach sockets.
  11048. # container_attach_socket_dir = "/var/run/crio"
  11049.  
  11050. # The prefix to use for the source of the bind mounts.
  11051. # bind_mount_prefix = ""
  11052.  
  11053. # If set to true, all containers will run in read-only mode.
  11054. # read_only = false
  11055.  
  11056. # Changes the verbosity of the logs based on the level it is set to. Options
  11057. # are fatal, panic, error, warn, info, and debug. This option supports live
  11058. # configuration reload.
  11059. # log_level = "error"
  11060.  
  11061. # The UID mappings for the user namespace of each container. A range is
  11062. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  11063. # separated by comma.
  11064. # uid_mappings = ""
  11065.  
  11066. # The GID mappings for the user namespace of each container. A range is
  11067. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  11068. # separated by comma.
  11069. # gid_mappings = ""
  11070.  
  11071. # The minimal amount of time in seconds to wait before issuing a timeout
  11072. # regarding the proper termination of the container.
  11073. # ctr_stop_timeout = 0
  11074.  
  11075. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  11076. # and manage its lifecycle.
  11077. # manage_network_ns_lifecycle = false
  11078.  
  11079. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  11080. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  11081. # If no runtime_handler is provided, the runtime will be picked based on the level
  11082. # of trust of the workload. Each entry in the table should follow the format:
  11083. #
  11084. #[crio.runtime.runtimes.runtime-handler]
  11085. # runtime_path = "/path/to/the/executable"
  11086. # runtime_type = "oci"
  11087. # runtime_root = "/path/to/the/root"
  11088. #
  11089. # Where:
  11090. # - runtime-handler: name used to identify the runtime
  11091. # - runtime_path (optional, string): absolute path to the runtime executable in
  11092. # the host filesystem. If omitted, the runtime-handler identifier should match
  11093. # the runtime executable name, and the runtime executable should be placed
  11094. # in $PATH.
  11095. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  11096. # omitted, an "oci" runtime is assumed.
  11097. # - runtime_root (optional, string): root directory for storage of containers
  11098. # state.
  11099.  
  11100.  
  11101. # [crio.runtime.runtimes.runc]
  11102. # runtime_path = ""
  11103. # runtime_type = "oci"
  11104. # runtime_root = "/run/runc"
  11105.  
  11106.  
  11107. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  11108. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  11109. # surface and mitigating the consequences of containers breakout.
  11110.  
  11111. # Kata Containers with the default configured VMM
  11112. #[crio.runtime.runtimes.kata-runtime]
  11113.  
  11114. # Kata Containers with the QEMU VMM
  11115. #[crio.runtime.runtimes.kata-qemu]
  11116.  
  11117. # Kata Containers with the Firecracker VMM
  11118. #[crio.runtime.runtimes.kata-fc]
  11119.  
  11120. # The crio.image table contains settings pertaining to the management of OCI images.
  11121. #
  11122. # CRI-O reads its configured registries defaults from the system wide
  11123. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  11124. # you want to modify just CRI-O, you can change the registries configuration in
  11125. # this file. Otherwise, leave insecure_registries and registries commented out to
  11126. # use the system's defaults from /etc/containers/registries.conf.
  11127. [crio.image]
  11128.  
  11129. # Default transport for pulling images from a remote container storage.
  11130. # default_transport = "docker://"
  11131.  
  11132. # The path to a file containing credentials necessary for pulling images from
  11133. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  11134. global_auth_file = "/var/lib/kubelet/config.json"
  11135.  
  11136. # The image used to instantiate infra containers.
  11137. # This option supports live configuration reload.
  11138. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  11139.  
  11140. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  11141.  
  11142. # The path to a file containing credentials specific for pulling the pause_image from
  11143. # above. The file is similar to that of /var/lib/kubelet/config.json
  11144. # This option supports live configuration reload.
  11145. pause_image_auth_file = "/var/lib/kubelet/config.json"
  11146.  
  11147. # The command to run to have a container stay in the paused state.
  11148. # This option supports live configuration reload.
  11149. pause_command = "/usr/bin/pod"
  11150.  
  11151. # Path to the file which decides what sort of policy we use when deciding
  11152. # whether or not to trust an image that we've pulled. It is not recommended that
  11153. # this option be used, as the default behavior of using the system-wide default
  11154. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  11155. # refer to containers-policy.json(5) for more details.
  11156. # signature_policy = ""
  11157.  
  11158. # List of registries to skip TLS verification for pulling images. Please
  11159. # consider configuring the registries via /etc/containers/registries.conf before
  11160. # changing them here.
  11161. #insecure_registries = "[]"
  11162.  
  11163. # Controls how image volumes are handled. The valid values are mkdir, bind and
  11164. # ignore; the latter will ignore volumes entirely.
  11165. # image_volumes = "mkdir"
  11166.  
  11167. # List of registries to be used when pulling an unqualified image (e.g.,
  11168. # "alpine:latest"). By default, registries is set to "docker.io" for
  11169. # compatibility reasons. Depending on your workload and usecase you may add more
  11170. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  11171. # "registry.opensuse.org", etc.).
  11172. #registries = [
  11173. # ]
  11174.  
  11175.  
  11176. # The crio.network table containers settings pertaining to the management of
  11177. # CNI plugins.
  11178. [crio.network]
  11179.  
  11180. # Path to the directory where CNI configuration files are located.
  11181. # Note this default is changed from the RPM.
  11182. network_dir = "/etc/kubernetes/cni/net.d/"
  11183.  
  11184. # Paths to directories where CNI plugin binaries are located.
  11185. # Note this default is changed from the RPM.
  11186. plugin_dirs = [
  11187. "/var/lib/cni/bin",
  11188. ]
  11189.  
  11190. # A necessary configuration for Prometheus based metrics retrieval
  11191. [crio.metrics]
  11192.  
  11193. # Globally enable or disable metrics support.
  11194. enable_metrics = true
  11195.  
  11196. # The port on which the metrics server will listen.
  11197. metrics_port = 9537
  11198.  
  11199.  
  11200. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  11201.  
  11202. # The path to a file containing credentials specific for pulling the pause_image from
  11203. # above. The file is similar to that of /var/lib/kubelet/config.json
  11204. # This option supports live configuration reload.
  11205. pause_image_auth_file = "/var/lib/kubelet/config.json"
  11206.  
  11207. # The command to run to have a container stay in the paused state.
  11208. # This option supports live configuration reload.
  11209. pause_command = "/usr/bin/pod"
  11210.  
  11211. # Path to the file which decides what sort of policy we use when deciding
  11212. # whether or not to trust an image that we've pulled. It is not recommended that
  11213. # this option be used, as the default behavior of using the system-wide default
  11214. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  11215. # refer to containers-policy.json(5) for more details.
  11216. # signature_policy = ""
  11217.  
  11218. # List of registries to skip TLS verification for pulling images. Please
  11219. # consider configuring the registries via /etc/containers/registries.conf before
  11220. # changing them here.
  11221. #insecure_registries = "[]"
  11222.  
  11223. # Controls how image volumes are handled. The valid values are mkdir, bind and
  11224. # ignore; the latter will ignore volumes entirely.
  11225. # image_volumes = "mkdir"
  11226.  
  11227. # List of registries to be used when pulling an unqualified image (e.g.,
  11228. # "alpine:latest"). By default, registries is set to "docker.io" for
  11229. # compatibility reasons. Depending on your workload and usecase you may add more
  11230. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  11231. # "registry.opensuse.org", etc.).
  11232. #registries = [
  11233. # ]
  11234.  
  11235.  
  11236. # The crio.network table containers settings pertaining to the management of
  11237. # CNI plugins.
  11238. [crio.network]
  11239.  
  11240. # Path to the directory where CNI configuration files are located.
  11241. # Note this default is changed from the RPM.
  11242. network_dir = "/etc/kubernetes/cni/net.d/"
  11243.  
  11244. # Paths to directories where CNI plugin binaries are located.
  11245. # Note this default is changed from the RPM.
  11246. plugin_dirs = [
  11247. "/var/lib/cni/bin",
  11248. ]
  11249.  
  11250. # A necessary configuration for Prometheus based metrics retrieval
  11251. [crio.metrics]
  11252.  
  11253. # Globally enable or disable metrics support.
  11254. enable_metrics = true
  11255.  
  11256. # The port on which the metrics server will listen.
  11257. metrics_port = 9537
  11258.  
  11259.  
  11260. E0115 17:48:06.204783 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  11261. I0115 17:49:06.216409 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  11262. I0115 17:49:06.216435 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  11263. I0115 17:49:06.221340 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  11264. I0115 17:49:06.221361 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  11265. I0115 17:49:06.230894 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  11266. E0115 17:49:06.231611 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  11267. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  11268. # daemon, but in a TOML format that can be more easily modified and versioned.
  11269. #
  11270. # Please refer to crio.conf(5) for details of all configuration options.
  11271.  
  11272. # CRI-O supports partial configuration reload during runtime, which can be
  11273. # done by sending SIGHUP to the running process. Currently supported options
  11274. # are explicitly mentioned with: 'This option supports live configuration
  11275. # reload'.
  11276.  
  11277. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  11278. # located at /etc/containers/storage.conf. Modify this storage configuration if
  11279. # you want to change the system's defaults. If you want to modify storage just
  11280. # for CRI-O, you can change the storage configuration options here.
  11281. [crio]
  11282.  
  11283. # Path to the "root directory". CRI-O stores all of its data, including
  11284. # containers images, in this directory.
  11285. #root = "/var/lib/containers/storage"
  11286.  
  11287. # Path to the "run directory". CRI-O stores all of its state in this directory.
  11288. #runroot = "/run/user/1000"
  11289.  
  11290. # Storage driver used to manage the storage of images and containers. Please
  11291. # refer to containers-storage.conf(5) to see all available storage drivers.
  11292. #storage_driver = "overlay"
  11293.  
  11294. # List to pass options to the storage driver. Please refer to
  11295. # containers-storage.conf(5) to see all available storage options.
  11296. #storage_option = [
  11297. #]
  11298.  
  11299. # The default log directory where all logs will go unless directly specified by
  11300. # the kubelet. The log directory specified must be an absolute directory.
  11301. # log_dir = "/var/log/crio/pods"
  11302.  
  11303. # Location for CRI-O to lay down the version file
  11304. # version_file = "/var/lib/crio/version"
  11305.  
  11306. # The crio.api table contains settings for the kubelet/gRPC interface.
  11307. [crio.api]
  11308.  
  11309. # Path to AF_LOCAL socket on which CRI-O will listen.
  11310. # listen = "/var/run/crio/crio.sock"
  11311.  
  11312. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  11313. # host_ip = ""
  11314.  
  11315. # IP address on which the stream server will listen.
  11316. stream_address = ""
  11317.  
  11318. # The port on which the stream server will listen.
  11319. stream_port = "10010"
  11320.  
  11321. # Enable encrypted TLS transport of the stream server.
  11322. # stream_enable_tls = false
  11323.  
  11324. # Path to the x509 certificate file used to serve the encrypted stream. This
  11325. # file can change, and CRI-O will automatically pick up the changes within 5
  11326. # minutes.
  11327. # stream_tls_cert = ""
  11328.  
  11329. # Path to the key file used to serve the encrypted stream. This file can
  11330. # change and CRI-O will automatically pick up the changes within 5 minutes.
  11331. # stream_tls_key = ""
  11332.  
  11333. # Path to the x509 CA(s) file used to verify and authenticate client
  11334. # communication with the encrypted stream. This file can change and CRI-O will
  11335. # automatically pick up the changes within 5 minutes.
  11336. # stream_tls_ca = ""
  11337.  
  11338. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  11339. # grpc_max_send_msg_size = 16777216
  11340.  
  11341. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  11342. # grpc_max_recv_msg_size = 16777216
  11343.  
  11344. # The crio.runtime table contains settings pertaining to the OCI runtime used
  11345. # and options for how to set up and manage the OCI runtime.
  11346. [crio.runtime]
  11347.  
  11348. # A list of ulimits to be set in containers by default, specified as
  11349. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  11350. # "nofile=1024:2048"
  11351. # If nothing is set here, settings will be inherited from the CRI-O daemon
  11352. #default_ulimits = [
  11353. #]
  11354.  
  11355. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  11356. # The name is matched against the runtimes map below.
  11357. # default_runtime = "runc"
  11358.  
  11359. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  11360. # no_pivot = false
  11361.  
  11362. # Path to the conmon binary, used for monitoring the OCI runtime.
  11363. # Will be searched for using $PATH if empty.
  11364. conmon = "/usr/libexec/crio/conmon"
  11365.  
  11366. # Cgroup setting for conmon
  11367. conmon_cgroup = "pod"
  11368.  
  11369. # Environment variable list for the conmon process, used for passing necessary
  11370. # environment variables to conmon or the runtime.
  11371. # conmon_env = [
  11372. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  11373. # ]
  11374.  
  11375. # If true, SELinux will be used for pod separation on the host.
  11376. # selinux = true
  11377.  
  11378. # Path to the seccomp.json profile which is used as the default seccomp profile
  11379. # for the runtime. If not specified, then the internal default seccomp profile
  11380. # will be used.
  11381. # seccomp_profile = "/etc/crio/seccomp.json"
  11382.  
  11383. # Used to change the name of the default AppArmor profile of CRI-O. The default
  11384. # profile name is "crio-default-" followed by the version string of CRI-O.
  11385. apparmor_profile = "crio-default"
  11386.  
  11387. # Cgroup management implementation used for the runtime.
  11388. cgroup_manager = "systemd"
  11389.  
  11390. # List of default capabilities for containers. If it is empty or commented out,
  11391. # only the capabilities defined in the containers json file by the user/kube
  11392. # will be added.
  11393. # default_capabilities = [
  11394. # "CHOWN",
  11395. # "DAC_OVERRIDE",
  11396. # "FSETID",
  11397. # "FOWNER",
  11398. # "NET_RAW",
  11399. # "SETGID",
  11400. # "SETUID",
  11401. # "SETPCAP",
  11402. # "NET_BIND_SERVICE",
  11403. # "SYS_CHROOT",
  11404. # "KILL",
  11405. # ]
  11406.  
  11407. # List of default sysctls. If it is empty or commented out, only the sysctls
  11408. # defined in the container json file by the user/kube will be added.
  11409. # default_sysctls = [
  11410. # ]
  11411.  
  11412. # List of additional devices. specified as
  11413. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  11414. #If it is empty or commented out, only the devices
  11415. # defined in the container json file by the user/kube will be added.
  11416. # additional_devices = [
  11417. # ]
  11418.  
  11419. # Path to OCI hooks directories for automatically executed hooks.
  11420. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  11421. # so we add /etc/containers/oci/hooks.d as well
  11422. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  11423. hooks_dir = [
  11424. "/etc/containers/oci/hooks.d",
  11425. ]
  11426.  
  11427. # List of default mounts for each container. **Deprecated:** this option will
  11428. # be removed in future versions in favor of default_mounts_file.
  11429. # default_mounts = [
  11430. # "/usr/share/rhel/secrets:/run/secrets",
  11431. # ]
  11432.  
  11433. # Path to the file specifying the defaults mounts for each container. The
  11434. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  11435. # its default mounts from the following two files:
  11436. #
  11437. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  11438. # override file, where users can either add in their own default mounts, or
  11439. # override the default mounts shipped with the package.
  11440. #
  11441. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  11442. # mounts. If you want CRI-O to read from a different, specific mounts file,
  11443. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  11444. # only add mounts it finds in this file.
  11445. #
  11446. #default_mounts_file = ""
  11447.  
  11448. # Maximum number of processes allowed in a container.
  11449. # pids_limit = 1024
  11450.  
  11451. # Maximum sized allowed for the container log file. Negative numbers indicate
  11452. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  11453. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  11454. # limit is never exceeded.
  11455. # log_size_max = -1
  11456.  
  11457. # Whether container output should be logged to journald in addition to the kuberentes log file
  11458. # log_to_journald = false
  11459.  
  11460. # Path to directory in which container exit files are written to by conmon.
  11461. # container_exits_dir = "/var/run/crio/exits"
  11462.  
  11463. # Path to directory for container attach sockets.
  11464. # container_attach_socket_dir = "/var/run/crio"
  11465.  
  11466. # The prefix to use for the source of the bind mounts.
  11467. # bind_mount_prefix = ""
  11468.  
  11469. # If set to true, all containers will run in read-only mode.
  11470. # read_only = false
  11471.  
  11472. # Changes the verbosity of the logs based on the level it is set to. Options
  11473. # are fatal, panic, error, warn, info, and debug. This option supports live
  11474. # configuration reload.
  11475. # log_level = "error"
  11476.  
  11477. # The UID mappings for the user namespace of each container. A range is
  11478. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  11479. # separated by comma.
  11480. # uid_mappings = ""
  11481.  
  11482. # The GID mappings for the user namespace of each container. A range is
  11483. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  11484. # separated by comma.
  11485. # gid_mappings = ""
  11486.  
  11487. # The minimal amount of time in seconds to wait before issuing a timeout
  11488. # regarding the proper termination of the container.
  11489. # ctr_stop_timeout = 0
  11490.  
  11491. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  11492. # and manage its lifecycle.
  11493. # manage_network_ns_lifecycle = false
  11494.  
  11495. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  11496. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  11497. # If no runtime_handler is provided, the runtime will be picked based on the level
  11498. # of trust of the workload. Each entry in the table should follow the format:
  11499. #
  11500. #[crio.runtime.runtimes.runtime-handler]
  11501. # runtime_path = "/path/to/the/executable"
  11502. # runtime_type = "oci"
  11503. # runtime_root = "/path/to/the/root"
  11504. #
  11505. # Where:
  11506. # - runtime-handler: name used to identify the runtime
  11507. # - runtime_path (optional, string): absolute path to the runtime executable in
  11508. # the host filesystem. If omitted, the runtime-handler identifier should match
  11509. # the runtime executable name, and the runtime executable should be placed
  11510. # in $PATH.
  11511. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  11512. # omitted, an "oci" runtime is assumed.
  11513. # - runtime_root (optional, string): root directory for storage of containers
  11514. # state.
  11515.  
  11516.  
  11517. # [crio.runtime.runtimes.runc]
  11518. # runtime_path = ""
  11519. # runtime_type = "oci"
  11520. # runtime_root = "/run/runc"
  11521.  
  11522.  
  11523. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  11524. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  11525. # surface and mitigating the consequences of containers breakout.
  11526.  
  11527. # Kata Containers with the default configured VMM
  11528. #[crio.runtime.runtimes.kata-runtime]
  11529.  
  11530. # Kata Containers with the QEMU VMM
  11531. #[crio.runtime.runtimes.kata-qemu]
  11532.  
  11533. # Kata Containers with the Firecracker VMM
  11534. #[crio.runtime.runtimes.kata-fc]
  11535.  
  11536. # The crio.image table contains settings pertaining to the management of OCI images.
  11537. #
  11538. # CRI-O reads its configured registries defaults from the system wide
  11539. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  11540. # you want to modify just CRI-O, you can change the registries configuration in
  11541. # this file. Otherwise, leave insecure_registries and registries commented out to
  11542. # use the system's defaults from /etc/containers/registries.conf.
  11543. [crio.image]
  11544.  
  11545. # Default transport for pulling images from a remote container storage.
  11546. # default_transport = "docker://"
  11547.  
  11548. # The path to a file containing credentials necessary for pulling images from
  11549. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  11550. global_auth_file = "/var/lib/kubelet/config.json"
  11551.  
  11552. # The image used to instantiate infra containers.
  11553. # This option supports live configuration reload.
  11554. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  11555.  
  11556. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  11557.  
  11558. # The path to a file containing credentials specific for pulling the pause_image from
  11559. # above. The file is similar to that of /var/lib/kubelet/config.json
  11560. # This option supports live configuration reload.
  11561. pause_image_auth_file = "/var/lib/kubelet/config.json"
  11562.  
  11563. # The command to run to have a container stay in the paused state.
  11564. # This option supports live configuration reload.
  11565. pause_command = "/usr/bin/pod"
  11566.  
  11567. # Path to the file which decides what sort of policy we use when deciding
  11568. # whether or not to trust an image that we've pulled. It is not recommended that
  11569. # this option be used, as the default behavior of using the system-wide default
  11570. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  11571. # refer to containers-policy.json(5) for more details.
  11572. # signature_policy = ""
  11573.  
  11574. # List of registries to skip TLS verification for pulling images. Please
  11575. # consider configuring the registries via /etc/containers/registries.conf before
  11576. # changing them here.
  11577. #insecure_registries = "[]"
  11578.  
  11579. # Controls how image volumes are handled. The valid values are mkdir, bind and
  11580. # ignore; the latter will ignore volumes entirely.
  11581. # image_volumes = "mkdir"
  11582.  
  11583. # List of registries to be used when pulling an unqualified image (e.g.,
  11584. # "alpine:latest"). By default, registries is set to "docker.io" for
  11585. # compatibility reasons. Depending on your workload and usecase you may add more
  11586. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  11587. # "registry.opensuse.org", etc.).
  11588. #registries = [
  11589. # ]
  11590.  
  11591.  
  11592. # The crio.network table containers settings pertaining to the management of
  11593. # CNI plugins.
  11594. [crio.network]
  11595.  
  11596. # Path to the directory where CNI configuration files are located.
  11597. # Note this default is changed from the RPM.
  11598. network_dir = "/etc/kubernetes/cni/net.d/"
  11599.  
  11600. # Paths to directories where CNI plugin binaries are located.
  11601. # Note this default is changed from the RPM.
  11602. plugin_dirs = [
  11603. "/var/lib/cni/bin",
  11604. ]
  11605.  
  11606. # A necessary configuration for Prometheus based metrics retrieval
  11607. [crio.metrics]
  11608.  
  11609. # Globally enable or disable metrics support.
  11610. enable_metrics = true
  11611.  
  11612. # The port on which the metrics server will listen.
  11613. metrics_port = 9537
  11614.  
  11615.  
  11616. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  11617.  
  11618. # The path to a file containing credentials specific for pulling the pause_image from
  11619. # above. The file is similar to that of /var/lib/kubelet/config.json
  11620. # This option supports live configuration reload.
  11621. pause_image_auth_file = "/var/lib/kubelet/config.json"
  11622.  
  11623. # The command to run to have a container stay in the paused state.
  11624. # This option supports live configuration reload.
  11625. pause_command = "/usr/bin/pod"
  11626.  
  11627. # Path to the file which decides what sort of policy we use when deciding
  11628. # whether or not to trust an image that we've pulled. It is not recommended that
  11629. # this option be used, as the default behavior of using the system-wide default
  11630. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  11631. # refer to containers-policy.json(5) for more details.
  11632. # signature_policy = ""
  11633.  
  11634. # List of registries to skip TLS verification for pulling images. Please
  11635. # consider configuring the registries via /etc/containers/registries.conf before
  11636. # changing them here.
  11637. #insecure_registries = "[]"
  11638.  
  11639. # Controls how image volumes are handled. The valid values are mkdir, bind and
  11640. # ignore; the latter will ignore volumes entirely.
  11641. # image_volumes = "mkdir"
  11642.  
  11643. # List of registries to be used when pulling an unqualified image (e.g.,
  11644. # "alpine:latest"). By default, registries is set to "docker.io" for
  11645. # compatibility reasons. Depending on your workload and usecase you may add more
  11646. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  11647. # "registry.opensuse.org", etc.).
  11648. #registries = [
  11649. # ]
  11650.  
  11651.  
  11652. # The crio.network table containers settings pertaining to the management of
  11653. # CNI plugins.
  11654. [crio.network]
  11655.  
  11656. # Path to the directory where CNI configuration files are located.
  11657. # Note this default is changed from the RPM.
  11658. network_dir = "/etc/kubernetes/cni/net.d/"
  11659.  
  11660. # Paths to directories where CNI plugin binaries are located.
  11661. # Note this default is changed from the RPM.
  11662. plugin_dirs = [
  11663. "/var/lib/cni/bin",
  11664. ]
  11665.  
  11666. # A necessary configuration for Prometheus based metrics retrieval
  11667. [crio.metrics]
  11668.  
  11669. # Globally enable or disable metrics support.
  11670. enable_metrics = true
  11671.  
  11672. # The port on which the metrics server will listen.
  11673. metrics_port = 9537
  11674.  
  11675.  
  11676. E0115 17:49:06.231646 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
  11677. I0115 17:50:06.244394 302697 daemon.go:732] Current config: rendered-master-e2a805b316c5016aff453a0d6ec14a67
  11678. I0115 17:50:06.244424 302697 daemon.go:733] Desired config: rendered-master-f7c90a51aac7e8130e54f1006f194ed0
  11679. I0115 17:50:06.249372 302697 daemon.go:423] Detected a login session before the daemon took over on first boot
  11680. I0115 17:50:06.249393 302697 daemon.go:424] Applying annotation: machineconfiguration.openshift.io/ssh
  11681. I0115 17:50:06.259453 302697 daemon.go:959] Validating against current config rendered-master-e2a805b316c5016aff453a0d6ec14a67
  11682. E0115 17:50:06.260156 302697 daemon.go:1351] content mismatch for file /etc/crio/crio.conf: # The CRI-O configuration file specifies all of the available configuration
  11683. # options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
  11684. # daemon, but in a TOML format that can be more easily modified and versioned.
  11685. #
  11686. # Please refer to crio.conf(5) for details of all configuration options.
  11687.  
  11688. # CRI-O supports partial configuration reload during runtime, which can be
  11689. # done by sending SIGHUP to the running process. Currently supported options
  11690. # are explicitly mentioned with: 'This option supports live configuration
  11691. # reload'.
  11692.  
  11693. # CRI-O reads its storage defaults from the containers-storage.conf(5) file
  11694. # located at /etc/containers/storage.conf. Modify this storage configuration if
  11695. # you want to change the system's defaults. If you want to modify storage just
  11696. # for CRI-O, you can change the storage configuration options here.
  11697. [crio]
  11698.  
  11699. # Path to the "root directory". CRI-O stores all of its data, including
  11700. # containers images, in this directory.
  11701. #root = "/var/lib/containers/storage"
  11702.  
  11703. # Path to the "run directory". CRI-O stores all of its state in this directory.
  11704. #runroot = "/run/user/1000"
  11705.  
  11706. # Storage driver used to manage the storage of images and containers. Please
  11707. # refer to containers-storage.conf(5) to see all available storage drivers.
  11708. #storage_driver = "overlay"
  11709.  
  11710. # List to pass options to the storage driver. Please refer to
  11711. # containers-storage.conf(5) to see all available storage options.
  11712. #storage_option = [
  11713. #]
  11714.  
  11715. # The default log directory where all logs will go unless directly specified by
  11716. # the kubelet. The log directory specified must be an absolute directory.
  11717. # log_dir = "/var/log/crio/pods"
  11718.  
  11719. # Location for CRI-O to lay down the version file
  11720. # version_file = "/var/lib/crio/version"
  11721.  
  11722. # The crio.api table contains settings for the kubelet/gRPC interface.
  11723. [crio.api]
  11724.  
  11725. # Path to AF_LOCAL socket on which CRI-O will listen.
  11726. # listen = "/var/run/crio/crio.sock"
  11727.  
  11728. # Host IP considered as the primary IP to use by CRI-O for things such as host network IP.
  11729. # host_ip = ""
  11730.  
  11731. # IP address on which the stream server will listen.
  11732. stream_address = ""
  11733.  
  11734. # The port on which the stream server will listen.
  11735. stream_port = "10010"
  11736.  
  11737. # Enable encrypted TLS transport of the stream server.
  11738. # stream_enable_tls = false
  11739.  
  11740. # Path to the x509 certificate file used to serve the encrypted stream. This
  11741. # file can change, and CRI-O will automatically pick up the changes within 5
  11742. # minutes.
  11743. # stream_tls_cert = ""
  11744.  
  11745. # Path to the key file used to serve the encrypted stream. This file can
  11746. # change and CRI-O will automatically pick up the changes within 5 minutes.
  11747. # stream_tls_key = ""
  11748.  
  11749. # Path to the x509 CA(s) file used to verify and authenticate client
  11750. # communication with the encrypted stream. This file can change and CRI-O will
  11751. # automatically pick up the changes within 5 minutes.
  11752. # stream_tls_ca = ""
  11753.  
  11754. # Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
  11755. # grpc_max_send_msg_size = 16777216
  11756.  
  11757. # Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
  11758. # grpc_max_recv_msg_size = 16777216
  11759.  
  11760. # The crio.runtime table contains settings pertaining to the OCI runtime used
  11761. # and options for how to set up and manage the OCI runtime.
  11762. [crio.runtime]
  11763.  
  11764. # A list of ulimits to be set in containers by default, specified as
  11765. # "<ulimit name>=<soft limit>:<hard limit>", for example:
  11766. # "nofile=1024:2048"
  11767. # If nothing is set here, settings will be inherited from the CRI-O daemon
  11768. #default_ulimits = [
  11769. #]
  11770.  
  11771. # default_runtime is the _name_ of the OCI runtime to be used as the default.
  11772. # The name is matched against the runtimes map below.
  11773. # default_runtime = "runc"
  11774.  
  11775. # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
  11776. # no_pivot = false
  11777.  
  11778. # Path to the conmon binary, used for monitoring the OCI runtime.
  11779. # Will be searched for using $PATH if empty.
  11780. conmon = "/usr/libexec/crio/conmon"
  11781.  
  11782. # Cgroup setting for conmon
  11783. conmon_cgroup = "pod"
  11784.  
  11785. # Environment variable list for the conmon process, used for passing necessary
  11786. # environment variables to conmon or the runtime.
  11787. # conmon_env = [
  11788. # "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  11789. # ]
  11790.  
  11791. # If true, SELinux will be used for pod separation on the host.
  11792. # selinux = true
  11793.  
  11794. # Path to the seccomp.json profile which is used as the default seccomp profile
  11795. # for the runtime. If not specified, then the internal default seccomp profile
  11796. # will be used.
  11797. # seccomp_profile = "/etc/crio/seccomp.json"
  11798.  
  11799. # Used to change the name of the default AppArmor profile of CRI-O. The default
  11800. # profile name is "crio-default-" followed by the version string of CRI-O.
  11801. apparmor_profile = "crio-default"
  11802.  
  11803. # Cgroup management implementation used for the runtime.
  11804. cgroup_manager = "systemd"
  11805.  
  11806. # List of default capabilities for containers. If it is empty or commented out,
  11807. # only the capabilities defined in the containers json file by the user/kube
  11808. # will be added.
  11809. # default_capabilities = [
  11810. # "CHOWN",
  11811. # "DAC_OVERRIDE",
  11812. # "FSETID",
  11813. # "FOWNER",
  11814. # "NET_RAW",
  11815. # "SETGID",
  11816. # "SETUID",
  11817. # "SETPCAP",
  11818. # "NET_BIND_SERVICE",
  11819. # "SYS_CHROOT",
  11820. # "KILL",
  11821. # ]
  11822.  
  11823. # List of default sysctls. If it is empty or commented out, only the sysctls
  11824. # defined in the container json file by the user/kube will be added.
  11825. # default_sysctls = [
  11826. # ]
  11827.  
  11828. # List of additional devices. specified as
  11829. # "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
  11830. #If it is empty or commented out, only the devices
  11831. # defined in the container json file by the user/kube will be added.
  11832. # additional_devices = [
  11833. # ]
  11834.  
  11835. # Path to OCI hooks directories for automatically executed hooks.
  11836. # Note: the default is just /usr/share/containers/oci/hooks.d, but /usr is immutable in RHCOS
  11837. # so we add /etc/containers/oci/hooks.d as well
  11838. # /usr/share/containers/oci/hooks.d is not available in recent CRI-O
  11839. hooks_dir = [
  11840. "/etc/containers/oci/hooks.d",
  11841. ]
  11842.  
  11843. # List of default mounts for each container. **Deprecated:** this option will
  11844. # be removed in future versions in favor of default_mounts_file.
  11845. # default_mounts = [
  11846. # "/usr/share/rhel/secrets:/run/secrets",
  11847. # ]
  11848.  
  11849. # Path to the file specifying the defaults mounts for each container. The
  11850. # format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
  11851. # its default mounts from the following two files:
  11852. #
  11853. # 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
  11854. # override file, where users can either add in their own default mounts, or
  11855. # override the default mounts shipped with the package.
  11856. #
  11857. # 2) /usr/share/containers/mounts.conf: This is the default file read for
  11858. # mounts. If you want CRI-O to read from a different, specific mounts file,
  11859. # you can change the default_mounts_file. Note, if this is done, CRI-O will
  11860. # only add mounts it finds in this file.
  11861. #
  11862. #default_mounts_file = ""
  11863.  
  11864. # Maximum number of processes allowed in a container.
  11865. # pids_limit = 1024
  11866.  
  11867. # Maximum sized allowed for the container log file. Negative numbers indicate
  11868. # that no size limit is imposed. If it is positive, it must be >= 8192 to
  11869. # match/exceed conmon's read buffer. The file is truncated and re-opened so the
  11870. # limit is never exceeded.
  11871. # log_size_max = -1
  11872.  
  11873. # Whether container output should be logged to journald in addition to the kuberentes log file
  11874. # log_to_journald = false
  11875.  
  11876. # Path to directory in which container exit files are written to by conmon.
  11877. # container_exits_dir = "/var/run/crio/exits"
  11878.  
  11879. # Path to directory for container attach sockets.
  11880. # container_attach_socket_dir = "/var/run/crio"
  11881.  
  11882. # The prefix to use for the source of the bind mounts.
  11883. # bind_mount_prefix = ""
  11884.  
  11885. # If set to true, all containers will run in read-only mode.
  11886. # read_only = false
  11887.  
  11888. # Changes the verbosity of the logs based on the level it is set to. Options
  11889. # are fatal, panic, error, warn, info, and debug. This option supports live
  11890. # configuration reload.
  11891. # log_level = "error"
  11892.  
  11893. # The UID mappings for the user namespace of each container. A range is
  11894. # specified in the form containerUID:HostUID:Size. Multiple ranges must be
  11895. # separated by comma.
  11896. # uid_mappings = ""
  11897.  
  11898. # The GID mappings for the user namespace of each container. A range is
  11899. # specified in the form containerGID:HostGID:Size. Multiple ranges must be
  11900. # separated by comma.
  11901. # gid_mappings = ""
  11902.  
  11903. # The minimal amount of time in seconds to wait before issuing a timeout
  11904. # regarding the proper termination of the container.
  11905. # ctr_stop_timeout = 0
  11906.  
  11907. # ManageNetworkNSLifecycle determines whether we pin and remove network namespace
  11908. # and manage its lifecycle.
  11909. # manage_network_ns_lifecycle = false
  11910.  
  11911. # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
  11912. # The runtime to use is picked based on the runtime_handler provided by the CRI.
  11913. # If no runtime_handler is provided, the runtime will be picked based on the level
  11914. # of trust of the workload. Each entry in the table should follow the format:
  11915. #
  11916. #[crio.runtime.runtimes.runtime-handler]
  11917. # runtime_path = "/path/to/the/executable"
  11918. # runtime_type = "oci"
  11919. # runtime_root = "/path/to/the/root"
  11920. #
  11921. # Where:
  11922. # - runtime-handler: name used to identify the runtime
  11923. # - runtime_path (optional, string): absolute path to the runtime executable in
  11924. # the host filesystem. If omitted, the runtime-handler identifier should match
  11925. # the runtime executable name, and the runtime executable should be placed
  11926. # in $PATH.
  11927. # - runtime_type (optional, string): type of runtime, one of: "oci", "vm". If
  11928. # omitted, an "oci" runtime is assumed.
  11929. # - runtime_root (optional, string): root directory for storage of containers
  11930. # state.
  11931.  
  11932.  
  11933. # [crio.runtime.runtimes.runc]
  11934. # runtime_path = ""
  11935. # runtime_type = "oci"
  11936. # runtime_root = "/run/runc"
  11937.  
  11938.  
  11939. # Kata Containers is an OCI runtime, where containers are run inside lightweight
  11940. # VMs. Kata provides additional isolation towards the host, minimizing the host attack
  11941. # surface and mitigating the consequences of containers breakout.
  11942.  
  11943. # Kata Containers with the default configured VMM
  11944. #[crio.runtime.runtimes.kata-runtime]
  11945.  
  11946. # Kata Containers with the QEMU VMM
  11947. #[crio.runtime.runtimes.kata-qemu]
  11948.  
  11949. # Kata Containers with the Firecracker VMM
  11950. #[crio.runtime.runtimes.kata-fc]
  11951.  
  11952. # The crio.image table contains settings pertaining to the management of OCI images.
  11953. #
  11954. # CRI-O reads its configured registries defaults from the system wide
  11955. # containers-registries.conf(5) located in /etc/containers/registries.conf. If
  11956. # you want to modify just CRI-O, you can change the registries configuration in
  11957. # this file. Otherwise, leave insecure_registries and registries commented out to
  11958. # use the system's defaults from /etc/containers/registries.conf.
  11959. [crio.image]
  11960.  
  11961. # Default transport for pulling images from a remote container storage.
  11962. # default_transport = "docker://"
  11963.  
  11964. # The path to a file containing credentials necessary for pulling images from
  11965. # secure registries. The file is similar to that of /var/lib/kubelet/config.json
  11966. global_auth_file = "/var/lib/kubelet/config.json"
  11967.  
  11968. # The image used to instantiate infra containers.
  11969. # This option supports live configuration reload.
  11970. pause_image = "registry.svc.ci.openshift.org/origin/4.4-2020-01-1
  11971.  
  11972. A: 5-152306@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  11973.  
  11974. # The path to a file containing credentials specific for pulling the pause_image from
  11975. # above. The file is similar to that of /var/lib/kubelet/config.json
  11976. # This option supports live configuration reload.
  11977. pause_image_auth_file = "/var/lib/kubelet/config.json"
  11978.  
  11979. # The command to run to have a container stay in the paused state.
  11980. # This option supports live configuration reload.
  11981. pause_command = "/usr/bin/pod"
  11982.  
  11983. # Path to the file which decides what sort of policy we use when deciding
  11984. # whether or not to trust an image that we've pulled. It is not recommended that
  11985. # this option be used, as the default behavior of using the system-wide default
  11986. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  11987. # refer to containers-policy.json(5) for more details.
  11988. # signature_policy = ""
  11989.  
  11990. # List of registries to skip TLS verification for pulling images. Please
  11991. # consider configuring the registries via /etc/containers/registries.conf before
  11992. # changing them here.
  11993. #insecure_registries = "[]"
  11994.  
  11995. # Controls how image volumes are handled. The valid values are mkdir, bind and
  11996. # ignore; the latter will ignore volumes entirely.
  11997. # image_volumes = "mkdir"
  11998.  
  11999. # List of registries to be used when pulling an unqualified image (e.g.,
  12000. # "alpine:latest"). By default, registries is set to "docker.io" for
  12001. # compatibility reasons. Depending on your workload and usecase you may add more
  12002. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  12003. # "registry.opensuse.org", etc.).
  12004. #registries = [
  12005. # ]
  12006.  
  12007.  
  12008. # The crio.network table containers settings pertaining to the management of
  12009. # CNI plugins.
  12010. [crio.network]
  12011.  
  12012. # Path to the directory where CNI configuration files are located.
  12013. # Note this default is changed from the RPM.
  12014. network_dir = "/etc/kubernetes/cni/net.d/"
  12015.  
  12016. # Paths to directories where CNI plugin binaries are located.
  12017. # Note this default is changed from the RPM.
  12018. plugin_dirs = [
  12019. "/var/lib/cni/bin",
  12020. ]
  12021.  
  12022. # A necessary configuration for Prometheus based metrics retrieval
  12023. [crio.metrics]
  12024.  
  12025. # Globally enable or disable metrics support.
  12026. enable_metrics = true
  12027.  
  12028. # The port on which the metrics server will listen.
  12029. metrics_port = 9537
  12030.  
  12031.  
  12032. B: 4-215321@sha256:2f68508143d397e98e2aa53967d28357263a10d0832d611bee1656b3a32ecbc2"
  12033.  
  12034. # The path to a file containing credentials specific for pulling the pause_image from
  12035. # above. The file is similar to that of /var/lib/kubelet/config.json
  12036. # This option supports live configuration reload.
  12037. pause_image_auth_file = "/var/lib/kubelet/config.json"
  12038.  
  12039. # The command to run to have a container stay in the paused state.
  12040. # This option supports live configuration reload.
  12041. pause_command = "/usr/bin/pod"
  12042.  
  12043. # Path to the file which decides what sort of policy we use when deciding
  12044. # whether or not to trust an image that we've pulled. It is not recommended that
  12045. # this option be used, as the default behavior of using the system-wide default
  12046. # policy (i.e., /etc/containers/policy.json) is most often preferred. Please
  12047. # refer to containers-policy.json(5) for more details.
  12048. # signature_policy = ""
  12049.  
  12050. # List of registries to skip TLS verification for pulling images. Please
  12051. # consider configuring the registries via /etc/containers/registries.conf before
  12052. # changing them here.
  12053. #insecure_registries = "[]"
  12054.  
  12055. # Controls how image volumes are handled. The valid values are mkdir, bind and
  12056. # ignore; the latter will ignore volumes entirely.
  12057. # image_volumes = "mkdir"
  12058.  
  12059. # List of registries to be used when pulling an unqualified image (e.g.,
  12060. # "alpine:latest"). By default, registries is set to "docker.io" for
  12061. # compatibility reasons. Depending on your workload and usecase you may add more
  12062. # registries (e.g., "quay.io", "registry.fedoraproject.org",
  12063. # "registry.opensuse.org", etc.).
  12064. #registries = [
  12065. # ]
  12066.  
  12067.  
  12068. # The crio.network table containers settings pertaining to the management of
  12069. # CNI plugins.
  12070. [crio.network]
  12071.  
  12072. # Path to the directory where CNI configuration files are located.
  12073. # Note this default is changed from the RPM.
  12074. network_dir = "/etc/kubernetes/cni/net.d/"
  12075.  
  12076. # Paths to directories where CNI plugin binaries are located.
  12077. # Note this default is changed from the RPM.
  12078. plugin_dirs = [
  12079. "/var/lib/cni/bin",
  12080. ]
  12081.  
  12082. # A necessary configuration for Prometheus based metrics retrieval
  12083. [crio.metrics]
  12084.  
  12085. # Globally enable or disable metrics support.
  12086. enable_metrics = true
  12087.  
  12088. # The port on which the metrics server will listen.
  12089. metrics_port = 9537
  12090.  
  12091.  
  12092. E0115 17:50:06.260183 302697 writer.go:130] Marking Degraded due to: unexpected on-disk state validating against rendered-master-e2a805b316c5016aff453a0d6ec14a67
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!