概述

CRI - 图1

Kubernetes 依赖于底层的 Container Runtime 来进行容器的创建、启动、停止、删除等操作。Container Runtime 最典型的代表为 Docker。除此之外，还有如：

等 Container Runtime 的实现。

为了支持更多的 Container Runtime，K8S 引入了 CRI 规范。

CRI 规范主要由以下几个部分组成：

主要实现有：

CRI Service

CRI 主要定义了两个 Service。

  • RuntimeService: 管理 Container 生命周期
  1. service RuntimeService {
  2.     // Version returns the runtime name, runtime version, and runtime API version.
  3.     rpc Version(VersionRequest) returns (VersionResponse) {}
  5.     // RunPodSandbox creates and starts a pod-level sandbox. Runtimes must ensure
  6.     // the sandbox is in the ready state on success.
  7.     rpc RunPodSandbox(RunPodSandboxRequest) returns (RunPodSandboxResponse) {}
  8.     // StopPodSandbox stops any running process that is part of the sandbox and
  9.     // reclaims network resources (e.g., IP addresses) allocated to the sandbox.
  10.     // If there are any running containers in the sandbox, they must be forcibly
  11.     // terminated.
  12.     // This call is idempotent, and must not return an error if all relevant
  13.     // resources have already been reclaimed. kubelet will call StopPodSandbox
  14.     // at least once before calling RemovePodSandbox. It will also attempt to
  15.     // reclaim resources eagerly, as soon as a sandbox is not needed. Hence,
  16.     // multiple StopPodSandbox calls are expected.
  17.     rpc StopPodSandbox(StopPodSandboxRequest) returns (StopPodSandboxResponse) {}
  18.     // RemovePodSandbox removes the sandbox. If there are any running containers
  19.     // in the sandbox, they must be forcibly terminated and removed.
  20.     // This call is idempotent, and must not return an error if the sandbox has
  21.     // already been removed.
  22.     rpc RemovePodSandbox(RemovePodSandboxRequest) returns (RemovePodSandboxResponse) {}
  23.     // PodSandboxStatus returns the status of the PodSandbox. If the PodSandbox is not
  24.     // present, returns an error.
  25.     rpc PodSandboxStatus(PodSandboxStatusRequest) returns (PodSandboxStatusResponse) {}
  26.     // ListPodSandbox returns a list of PodSandboxes.
  27.     rpc ListPodSandbox(ListPodSandboxRequest) returns (ListPodSandboxResponse) {}
  29.     // CreateContainer creates a new container in specified PodSandbox
  30.     rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse) {}
  31.     // StartContainer starts the container.
  32.     rpc StartContainer(StartContainerRequest) returns (StartContainerResponse) {}
  33.     // StopContainer stops a running container with a grace period (i.e., timeout).
  34.     // This call is idempotent, and must not return an error if the container has
  35.     // already been stopped.
  36.     // TODO: what must the runtime do after the grace period is reached?
  37.     rpc StopContainer(StopContainerRequest) returns (StopContainerResponse) {}
  38.     // RemoveContainer removes the container. If the container is running, the
  39.     // container must be forcibly removed.
  40.     // This call is idempotent, and must not return an error if the container has
  41.     // already been removed.
  42.     rpc RemoveContainer(RemoveContainerRequest) returns (RemoveContainerResponse) {}
  43.     // ListContainers lists all containers by filters.
  44.     rpc ListContainers(ListContainersRequest) returns (ListContainersResponse) {}
  45.     // ContainerStatus returns status of the container. If the container is not
  46.     // present, returns an error.
  47.     rpc ContainerStatus(ContainerStatusRequest) returns (ContainerStatusResponse) {}
  48.     // UpdateContainerResources updates ContainerConfig of the container.
  49.     rpc UpdateContainerResources(UpdateContainerResourcesRequest) returns (UpdateContainerResourcesResponse) {}
  50.     // ReopenContainerLog asks runtime to reopen the stdout/stderr log file
  51.     // for the container. This is often called after the log file has been
  52.     // rotated. If the container is not running, container runtime can choose
  53.     // to either create a new log file and return nil, or return an error.
  54.     // Once it returns error, new container log file MUST NOT be created.
  55.     rpc ReopenContainerLog(ReopenContainerLogRequest) returns (ReopenContainerLogResponse) {}
  57.     // ExecSync runs a command in a container synchronously.
  58.     rpc ExecSync(ExecSyncRequest) returns (ExecSyncResponse) {}
  59.     // Exec prepares a streaming endpoint to execute a command in the container.
  60.     rpc Exec(ExecRequest) returns (ExecResponse) {}
  61.     // Attach prepares a streaming endpoint to attach to a running container.
  62.     rpc Attach(AttachRequest) returns (AttachResponse) {}
  63.     // PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
  64.     rpc PortForward(PortForwardRequest) returns (PortForwardResponse) {}
  66.     // ContainerStats returns stats of the container. If the container does not
  67.     // exist, the call returns an error.
  68.     rpc ContainerStats(ContainerStatsRequest) returns (ContainerStatsResponse) {}
  69.     // ListContainerStats returns stats of all running containers.
  70.     rpc ListContainerStats(ListContainerStatsRequest) returns (ListContainerStatsResponse) {}
  72.     // UpdateRuntimeConfig updates the runtime configuration based on the given request.
  73.     rpc UpdateRuntimeConfig(UpdateRuntimeConfigRequest) returns (UpdateRuntimeConfigResponse) {}
  75.     // Status returns the status of the runtime.
  76.     rpc Status(StatusRequest) returns (StatusResponse) {}
  77. }
  • ImageService: 镜像的查看、拉取、删除操作
  1. service ImageService {
  2.     // ListImages lists existing images.
  3.     rpc ListImages(ListImagesRequest) returns (ListImagesResponse) {}
  4.     // ImageStatus returns the status of the image. If the image is not
  5.     // present, returns a response with ImageStatusResponse.Image set to
  6.     // nil.
  7.     rpc ImageStatus(ImageStatusRequest) returns (ImageStatusResponse) {}
  8.     // PullImage pulls an image with authentication config.
  9.     rpc PullImage(PullImageRequest) returns (PullImageResponse) {}
  10.     // RemoveImage removes the image.
  11.     // This call is idempotent, and must not return an error if the image has
  12.     // already been removed.
  13.     rpc RemoveImage(RemoveImageRequest) returns (RemoveImageResponse) {}
  14.     // ImageFSInfo returns information of the filesystem that is used to store images.
  15.     rpc ImageFsInfo(ImageFsInfoRequest) returns (ImageFsInfoResponse) {}
  16. }

References