Containerd

Use named CRICustomizationConfig documents to customize the CRI containerd configuration. Talos merges each document’s TOML fragment with the physical CRI configuration parts in lexicographical order by name. Applying, updating, or removing a CRICustomizationConfig regenerates the CRI configuration and restarts CRI automatically. A Talos node reboot is not required. The deprecated /etc/cri/conf.d/20-customization.part machine file remains supported during the deprecation period. Talos includes this legacy fragment under the reserved name customization, which a CRICustomizationConfig document cannot use.

Examples

The following examples show common CRI containerd customizations.

Exposing metrics

Patch the machine config by adding the following:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

After Talos applies the document and restarts CRI, metrics are available:

curl ${IP}:11234/v1/metrics
# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive
# TYPE container_blkio_io_service_bytes_recursive_bytes gauge
container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0
container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0
...
...

Pause image

This change is often required for air-gapped environments, as containerd CRI plugin has a reference to the pause image which is used to create pods, and it can’t be controlled with Kubernetes pod definitions.

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: pause-image
content: |
  [plugins]
    [plugins."io.containerd.cri.v1.images".pinned_images]
      sandbox = "registry.k8s.io/pause:3.8"

Now the pause image is set to registry.k8s.io/pause:3.8:

talosctl containers --kubernetes
NODE         NAMESPACE   ID                                                              IMAGE                                                      PID    STATUS
20.0.5   k8s.io      kube-system/kube-flannel-6hfck                                  registry.k8s.io/pause:3.8                                  1773   SANDBOX_READY
20.0.5   k8s.io      └─ kube-system/kube-flannel-6hfck:install-cni:bc39fec3cbac      ghcr.io/siderolabs/install-cni:v1.3.0-alpha.0-2-gb155fa0   0      CONTAINER_EXITED
20.0.5   k8s.io      └─ kube-system/kube-flannel-6hfck:install-config:5c3989353b98   ghcr.io/siderolabs/flannel:v0.20.1                         0      CONTAINER_EXITED
20.0.5   k8s.io      └─ kube-system/kube-flannel-6hfck:kube-flannel:116c67b50da8     ghcr.io/siderolabs/flannel:v0.20.1                         2092   CONTAINER_RUNNING
20.0.5   k8s.io      kube-system/kube-proxy-xp7jq                                    registry.k8s.io/pause:3.8                                  1780   SANDBOX_READY
20.0.5   k8s.io      └─ kube-system/kube-proxy-xp7jq:kube-proxy:84fc77c59e17         registry.k8s.io/kube-proxy:v1.26.0-alpha.3                 1843   CONTAINER_RUNNING

Disabling NRI plugins

Talos 1.14 enables NRI (Node Resource Interface) for the CRI containerd instance by default. NRI plugins can be deployed without a machine configuration patch, for example plugins from the NRI plugins repository. To restore the previous behavior and disable NRI, add the following configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

⌘I

Overview

Getting Started

Platform specific installation

Deploying and managing workloads

Networking

Security

Build and extend Talos

Configure your Talos cluster

Advanced guides

Reference

Troubleshooting and support

Learn more

Examples

Exposing metrics

Pause image

Disabling NRI plugins

​Examples

​Exposing metrics

​Pause image

​Disabling NRI plugins

Examples

Exposing metrics

Pause image

Disabling NRI plugins