Learn how to – Using Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm.
Welcome to this guide on how to use Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm. The Mirantis Container Runtime(MCR) formerly known as the Docker Engine (Enterprise), is a secure container runtime that provides a base for the Mirantis Kubernetes Engine and Container Cloud. It provides increased security using the Mirantis Secure Registry, incorporated with Content Trust and FIPS 140-2 encryption.
The Mirantis Container Runtime(MCR) installation has been made easy with the introduction of an automation script. Although there are still circumstances where you are required to perform a manual installation. For example, installing Mirantis Container Runtime(MCR) to prepare a server/node to be added to an existing Mirantis Kubernetes Engine cluster that originally wasn’t managed by Mirantis Container Cloud.
There are many features and capabilities provided by the Mirantis Container Runtime(MCR). Some of them are:
- Intrinsic Security: It is secure by default. Containers are deployed with restricted host access, end-to-end encryption, secure mutual TLS authentication, and cryptographic node identity.
- Multiple Operating Systems and Infrastructures: It is certified to run on multiple operating systems that include RHEL, Ubuntu, CentOS, and Windows systems.
- Certified Plugins: There are certified plugins that let you extend the functionality of Mirantis Container Runtime(MCR). They include; Calico, Kubernetes ingress solutions like Istio e.t.c
- Enforce Signed Images: Proper digital signing of images is required to validate the container provenance before they are deployed. This prevents users from using images from unknown sources.
By following this guide to the end, you will gain the required knowledge on how to use Mirantis Container Runtime in Kubernetes and Docker Swarm.
System Requirements
This guide will work with the following:
Minimum Hardware Requirements for MKE nodes
- 8GB of RAM for manager nodes
- 4GB of RAM for worker nodes
- 2 vCPUs for manager nodes
- 25GB of free disk space
Production Hardware Requirements for MKE nodes
- 16GB of RAM for manager nodes
- 4 vCPUs for manager nodes
- 25-100GB of free disk space. SSD is recommended.
Step 1 – Prepare your Server
This guide demonstrates how to install the Mirantis Container Runtime(MCR) on several Linux distributions from the repository.
Begin by removing previous docker installations:
- On CentOS/Rhel
sudo yum remove docker
docker-client
docker-client-latest
docker-common
docker-latest
docker-latest-logrotate
docker-logrotate
docker-selinux
runc
docker-engine-selinux
docker-engine
- On Ubuntu
sudo apt-get remove docker docker-engine docker-ce docker-ce-cli docker.io
- On SLES
sudo zypper rm docker docker-engine runc
##OR
sudo rpm -e docker-engine
Step 2 – Add the Mirantis Container Runtime(MCR) Repository
Add the Mirantis Container Runtime(MCR) Repository to your system.
- On Rhel/CentOS
Remove the available docker repo:
sudo rm /etc/yum.repos.d/docker*.repo
sudo yum install -y yum-utils
export DOCKERURL="https://repos.mirantis.com"
Enable the extras Rhel repo to install container-selinux packages
##On CentOS 7
sudo -E sh -c 'echo "$DOCKERURL/centos" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "7" > /etc/yum/vars/dockerosversion'
sudo yum-config-manager --enable rhel-7-server-extras-rpms
##On RHEL 7
sudo -E sh -c 'echo "$DOCKERURL/rhel" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "7" > /etc/yum/vars/dockerosversion'
sudo yum-config-manager --enable rhel-7-server-extras-rpms
##On CentOS 8
sudo -E sh -c 'echo "$DOCKERURL/centos" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "8" > /etc/yum/vars/dockerosversion'
##On Rocky Linux 8
sudo -E sh -c 'echo "$DOCKERURL/rocky" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "8" > /etc/yum/vars/dockerosversion'
##On RHEL 8
sudo -E sh -c 'echo "$DOCKERURL/rhel" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "8" > /etc/yum/vars/dockerosversion'
Now add the MCR stable repository:
sudo -E yum-config-manager
--add-repo
"$DOCKERURL/centos/docker-ee.repo"
- On Ubuntu
Begin by installing the required packages:
sudo apt install
apt-transport-https
ca-certificates
curl
software-properties-common
Export the variables:
DOCKER_EE_URL="https://repos.mirantis.com"
DOCKER_EE_VERSION=20.10
Add the GPG keys for the repository:
curl -fsSL "${DOCKER_EE_URL}/ubuntu/gpg" | sudo apt-key add -
Finally, add the stable repository to the system.
### Ubuntu 22.04 / 20.04 ###
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] $DOCKER_EE_URL/ubuntu focal stable"
### Ubuntu 18.04 ###
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] $DOCKER_EE_URL/ubuntu bionic stable"
- On SLES
Export the variables:
DOCKER_EE_BASE_URL="https://repos.mirantis.com"
DOCKER_EE_URL="${DOCKER_EE_BASE_URL}/sles/<SLES_VERSION>/<ARCH>/stable-<DOCKER_VERSION>"
Remember to replace the values for:
- SLES_VERSION – 15 or 12.3.
- ARCH – x86_64.
- DOCKER_VERSION – 20.10, there are also older releases such as 19.03, 18.09, 18.03 e.t.c
Using the variables, set up the repository:
sudo zypper addrepo $DOCKER_EE_URL docker-ee-stable
Import the GPG keys:
sudo rpm --import "${DOCKER_EE_BASE_URL}/sles/gpg"
Step 3 – Install Mirantis Container Runtime(MCR)
Once the repository has been configured, proceed and install Mirantis Container Runtime(MCR) with the command:
##On CentOS/RHEL
sudo yum -y install docker-ee docker-ee-cli containerd.io
##On Ubuntu
sudo apt update
sudo apt install docker-ee docker-ee-cli containerd.io
##On SLES
sudo zypper refresh
sudo zypper install docker-ee docker-ee-cli containerd.io
You can also install a specific version for production purposes:
##On CentOS/RHEL
sudo yum -y install docker-ee-<VERSION_STRING> docker-ee-cli-<VERSION_STRING> containerd.io
##On Ubuntu
sudo apt-get install docker-ee=<VERSION_STRING> docker-ee-cli=<VERSION_STRING> containerd.io
##On SLES
sudo zypper install docker-ee-<VERSION_STRING> docker-ee-cli-<VERSION_STRING> containerd.io
Replace the VERSION_STRING with the appropriate version to install.
Step 4 – Test Mirantis Container Runtime(MCR)
Once installed, start the docker daemon.
sudo systemctl enable --now docker
Verify if it is running:
$ systemctl status docker
● docker.service - Docker Application Container Engine
Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2022-06-02 10:01:03 UTC; 4min 32s ago
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 3811 (dockerd)
Tasks: 8
Memory: 27.6M
CGroup: /system.slice/docker.service
└─3811 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
Add your user to the Docker group.
sudo usermod -aG docker $USER
newgrp docker
Test by running a hello-world container.
docker run hello-world
Sample Output:
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
2db29710123e: Pull complete
Digest: sha256:80f31da1ac7b312ba29d65080fddf797dd76acfb870e677f390d5acba9741b17
Status: Downloaded newer image for hello-world:latest
Hello from Docker!
This message shows that your installation appears to be working correctly.
To generate this message, Docker took the following steps:
1. The Docker client contacted the Docker daemon.
2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
(amd64)
3. The Docker daemon created a new container from that image which runs the
executable that produces the output you are currently reading.
4. The Docker daemon streamed that output to the Docker client, which sent it
to your terminal.
To try something more ambitious, you can run an Ubuntu container with:
$ docker run -it ubuntu bash
Share images, automate workflows, and more with a free Docker ID:
https://hub.docker.com/
For more examples and ideas, visit:
https://docs.docker.com/get-started/
Step 5 – Use MCR with Kubernetes
MCR can be used to provide a container runtime for Kubernetes pods. It is possible to use MCR with Kubernetes directly without MKE. Just enable the cri-docker
plugin.
sudo systemctl enable --now cri-docker.service
Check the status:
$ systemctl status cri-docker.socket
● cri-docker.socket - CRI Docker Socket for the API
Loaded: loaded (/usr/lib/systemd/system/cri-docker.socket; disabled; vendor preset: disabled)
Active: active (running) since Thu 2022-06-02 06:11:59 EDT; 10s ago
Listen: /run/cri-docker.sock (Stream)
Tasks: 0 (limit: 23505)
Memory: 4.0K
CGroup: /system.slice/cri-docker.socket
From the above output, we can identify the default socket:
Listen: /run/cri-docker.sock
Proceed and use the Mirantis Container Runtime(MCR) as preferred. On a new Kubernetes cluster, you can use MCR as shown. I assume you already have Kubeadmin and all the required kubelets installed.
You can use the below guide to achieve this.
- Deploy Kubernetes Cluster on AlmaLinux 8 with Kubeadm
- Install Kubernetes Cluster on Ubuntu 20.04 with kubeadm
Proceed and pull container images
$ sudo kubeadm config images pull --cri-socket /run/cri-docker.sock
[config/images] Pulled k8s.gcr.io/kube-apiserver:v1.24.1
[config/images] Pulled k8s.gcr.io/kube-controller-manager:v1.24.1
[config/images] Pulled k8s.gcr.io/kube-scheduler:v1.24.1
[config/images] Pulled k8s.gcr.io/kube-proxy:v1.24.1
[config/images] Pulled k8s.gcr.io/pause:3.7
[config/images] Pulled k8s.gcr.io/etcd:3.5.3-0
[config/images] Pulled k8s.gcr.io/coredns/coredns:v1.8.6
Use MCR on a New Kubernetes cluster
Now bootstrap the control node. The below example can be used for a single node controller.
sudo kubeadm init
--pod-network-cidr=192.168.0.0/16
--cri-socket /run/cri-docker.sock
Sample Output:
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.205.9:6443 --token 4oga4y.6uhgxfvf2cm0hc3g
--discovery-token-ca-cert-hash sha256:7adf6b202bf0541bd0612b918477d979b6ed671bdcacf0d3910e521f66abc153
If you had the control node initialized, reset it before executing the above command.
sudo kubeadm reset
Once initialized, the certificate file
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Verify if the nodes are running:
$ kubectl get nodes
NAME STATUS ROLES AGE VERSION
localhost.localdomain Ready control-plane 3m21s v1.24.1
Also, verify if the runtime endpoint is configured:
$ sudo cat /var/lib/kubelet/kubeadm-flags.env
KUBELET_KUBEADM_ARGS="--container-runtime=remote --container-runtime-endpoint=unix:///run/cri-docker.sock --pod-infra-container-image=k8s.gcr.io/pause:3.7"
Migrate Existing Nodes to MCR
At times, you might find yourself in a situation where you need to migrate existing nodes from dockershim to MCR
Cordon the node:
kubectl cordon <NODE_NAME>
Proceed and drain the node:
kubectl drain <NODE_NAME> --ignore-daemonsets
Open the file below on the node:
sudo vim /var/lib/kubelet/kubeadm-flags.env
Modify the line:
--container-runtime-endpoint
#TO
unix:///var/run/cri-docker.sock
Finally, edit the YAMLrepresentation for the node socket:
sudo KUBECONFIG=/etc/kubernetes/admin.conf kubectl edit no <NODE_NAME>
In the file, change kubeadm.alpha.kubernetes.io/cri-socket
##FROM
/var/run/dockershim.sock
##TO
unix:///var/run/cri-docker.sock
Restart the kubelet and un cordon the node:
sudo systemctl restart kubelet
kubectl uncordon <NODE_NAME>
Step 6 – Install the Mirantis Container Runtime(MCR) License
Obtain a License from the Mirantis Container Runtime(MCR) page. Follow the provided email link to download your license file.
Copy the file data and paste it to the root directory in a file called docker.lic
.
sudi vim /var/lib/docker/docker.lic
Once the file has been created, restart MCR.
sudo systemctl restart docker
Verify the installation.
sudo docker info | grep -i license
Closing Thoughts.
That was enough learning! We have walked through how to install and use the Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm. I hope this was significant.
See more:
- Install Mirantis cri-dockerd as Docker Engine shim for Kubernetes
- Deploy Kubernetes Cluster on AlmaLinux 8 with Kubeadm
- Install Kubernetes Cluster on Ubuntu 20.04 with kubeadm
Leave a Reply
You must be logged in to post a comment.