Documentation
¶
Overview ¶
Package runtime configures containerd from the staged payload: config.toml with the host-matched cgroup driver, the stratum CRI socket, and registry mirrors. There is no package-manager install path: containerd ships in the payload.
Index ¶
- Variables
- func Active() bool
- func CgroupDriver() string
- func ClusterDNSIP(st *nodestate.NodeState) (string, error)
- func ConfinedSince() (time.Time, bool)
- func ConfinedSincePath() string
- func ConfinesContainers() (bool, error)
- func CoreDNSUpstream() string
- func DisableSELinux() (bool, error)
- func EnsureConfig() (bool, error)
- func KubeletConfigPath() string
- func LegacyHostConfig() (path string, present bool)
- func PrepareNodeConfigs(st *nodestate.NodeState) error
- func RemoveLegacyHostConfig(w io.Writer)
- func ServingBootstrapped(st *nodestate.NodeState, pkiDir string) (bool, error)
- func WriteConfig() (bool, error)
- func WriteConfigWithWriter(w io.Writer) (bool, error)
- func WriteCoreDNSUpstream(st *nodestate.NodeState) error
- func WriteKubeletConfig(st *nodestate.NodeState) error
- func WriteNodeConfigs(st *nodestate.NodeState) (bool, error)
- func WriteNodeConfigsWithWriter(w io.Writer, st *nodestate.NodeState) (bool, error)
- type ApplyRegistryResult
Constants ¶
This section is empty.
Variables ¶
var SandboxImage = "ghcr.io/ctrliq/stratum/pause:unknown"
SandboxImage is the pause image containerd starts every pod sandbox from. containerd's built-in default points at registry.k8s.io, which an airgapped node cannot reach and which nothing at runtime is allowed to reference; this is the mirrored pin the payload actually carries (tools/mirror-images.sh). Stamped by the Makefile from build/images.txt, so it cannot drift from the image set `ctr images import` registers.
Functions ¶
func CgroupDriver ¶
func CgroupDriver() string
CgroupDriver reports the driver both containerd and the kubelet must use: "systemd" when systemd is PID 1, "cgroupfs" otherwise.
func ClusterDNSIP ¶
ClusterDNSIP is the cluster DNS Service IP this node's resolver hands its pods, and the one derivation for every renderer of that address — the kubelet's clusterDNS (writeKubeletConfig) and the CoreDNS stack writeBundles stages: the tenth address of the cluster's service CIDR (netcfg.DNSIPFor). Every controller records the CIDR in its state; a worker records it from --service-cidr, which `stratum token create` prints on a cluster with a non-default range. A worker that joined before that records none, and learns the address from the cluster's kube-dns Service instead; the recorded address stands in only where no range is recorded, because the range is the authority where it exists. With neither it is the default 10.96.0.10, as it always was.
func ConfinedSince ¶
ConfinedSince reports when containerd began confining containers; false when it does not confine them, or the record is missing or unreadable. A pod sandbox started before then runs without SELinux labels until the pod is recreated.
func ConfinedSincePath ¶
func ConfinedSincePath() string
ConfinedSincePath is the file recording when containerd began confining containers.
func ConfinesContainers ¶
ConfinesContainers reports whether the containerd config Stratum wrote turns on SELinux labelling: enable_selinux in the CRI runtime plugin's table, read as containerd reads it, so a comment or the key in another table does not count. A missing config confines nothing; one that cannot be read or parsed is an error.
func CoreDNSUpstream ¶
func CoreDNSUpstream() string
CoreDNSUpstream is the file in CoreDNSUpstreamDir CoreDNS forwards through when it exists. Without it, CoreDNS forwards through its pod's resolv.conf, which is the node's.
func DisableSELinux ¶
DisableSELinux turns enable_selinux off in the containerd config Stratum wrote, reporting whether it changed the file. containerd reads it on its next start. A rollback to a build whose control-plane manifests predate spc_t needs it: with it on, those pods run as container_t and are denied the node's PKI and etcd data, and the older build never turns it off.
func EnsureConfig ¶
EnsureConfig writes the containerd config and registry mirrors and reports whether the render changed containerd's config. It touches no running process — the render restarts nothing, and the caller owns the restart: `stratum registry apply` restarts through ApplyRegistry, the in-place upgrade folds the change into its own single host reload, and a node start (`stratum up`, a join) has no containerd running yet, so its supervisor brings containerd up on the config just written. This is the prepare-phase entry point, before the supervisor owns containerd; ApplyRegistry is the live-node path.
func KubeletConfigPath ¶
func KubeletConfigPath() string
KubeletConfigPath is the kubelet.conf writeKubeletConfig renders.
func LegacyHostConfig ¶
LegacyHostConfig returns the legacy host config path and whether a stratum-written config is present there right now — i.e. whether a call to RemoveLegacyHostConfig would delete it. It lets uninstall's dry-run disclose the host-level deletion instead of springing it on the operator at --yes.
func PrepareNodeConfigs ¶
PrepareNodeConfigs writes what kubelet+containerd need: the kubelet config (driver-matched to containerd) and containerd's config.toml. Lives here (not in internal/cluster) so the HA join path can call it without an import cycle through certs — every node runs kubelet.
The render's change flag is dropped here on purpose: a join (and a controller's prepare) run before any supervisor exists, so nothing is running to restart and the supervisor brings containerd up on the config just written.
func RemoveLegacyHostConfig ¶
RemoveLegacyHostConfig deletes /etc/containerd/config.toml when an older stratum build wrote it there, healing a host whose distro containerd (and Docker) would otherwise fail to start after a reboot. It never touches a config it did not write, and is a no-op when the file is absent.
It logs the outcome to w: deleting a file outside stratum's own data dir is the most consequential host mutation in the heal, so a success is surfaced (not only a failure) — otherwise an operator reading the logs of an ordinary `up` or uninstall could not tell a host file had been removed. Owns its logging so both callers (up and uninstall) report it identically and neither retypes the path; `up` passes os.Stdout, the uninstall run its progress writer.
func ServingBootstrapped ¶
ServingBootstrapped reports whether the kubelet writeKubeletConfig configures for st gets its serving cert through a kubelet-serving CSR (serverTLSBootstrap) rather than the static kubelet.crt leaf in pkiDir: when the node's profile bootstraps it, and on a node with no kubelet.crt, which is a token-joined worker. It resolves the profile as the renderer does, and refuses a profile the renderer would refuse.
func WriteConfig ¶
WriteConfig is EnsureConfig without the legacy-config heal, for a node whose running supervisor may still launch containerd with --config at the legacy path: a supervisor that predates reload keeps the argv it was started with across an in-place upgrade, so deleting that file there left containerd unable to start again until the next `stratum up`. The caller removes the legacy file itself, once nothing still passes it.
It reports whether the render changed containerd's config and restarts nothing, like ensureConfig above. changed stays true beside an error raised after the config was written (a failed registry apply), because the file change on disk is the fact a restart decision needs.
func WriteConfigWithWriter ¶
WriteConfigWithWriter writes containerd config and reports progress to w.
func WriteCoreDNSUpstream ¶
WriteCoreDNSUpstream chooses where this node's CoreDNS pods forward names outside the cluster, writes or removes CoreDNSUpstream to match, and reports the choice unless it is the node's own resolv.conf. Only CoreDNS reads it: the kubelet and every other pod keep the node's resolvers.
func WriteKubeletConfig ¶
WriteKubeletConfig renders kubelet.conf alone.
func WriteNodeConfigs ¶
WriteNodeConfigs is PrepareNodeConfigs without the legacy-config heal (see WriteConfig): the in-place upgrade's entry point, which reaps the legacy file only after the supervisor has containerd on the new config path.
It reports whether the render changed containerd's config, so its caller can fold that change into its own single host reload instead of restarting containerd a second time: the render restarts nothing, and the reload the upgrade runs after it is the one restart an upgrade gives containerd.
Types ¶
type ApplyRegistryResult ¶
type ApplyRegistryResult struct {
registry.Result
Restarted bool // the drop-in changed AND containerd was running and came back
}
ApplyRegistryResult is ApplyRegistry's runtime-level outcome: the registry package's apply result plus Restarted, true only when this call actually restarted containerd. registry.Result's Changed alone means only that the conf.d drop-in changed — reporting a restart from it claims one that did not happen wherever containerd is not running.
func ApplyRegistry ¶
func ApplyRegistry() (ApplyRegistryResult, error)
ApplyRegistry re-applies /etc/stratum/registries.yaml to containerd's certs.d and restarts containerd when the config_path enablement changed (hosts.toml alone are read live) and containerd is running to restart. Backs `stratum registry apply` — lets an operator update mirrors without reinstalling. Restarted, not Changed, is the restart fact a caller reports from.
Source Files