crictl doc
This commit is contained in:
180
Containerization-Orchestration/Kubernetes/Crtctl/main.md
Normal file
180
Containerization-Orchestration/Kubernetes/Crtctl/main.md
Normal file
@@ -0,0 +1,180 @@
|
|||||||
|
# **crictl: CLI for CRI-Compatible Container Runtimes**
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
`crictl` is a **command-line interface** for **Container Runtime Interface (CRI)**–compatible runtimes such as **containerd** and **CRI-O**, primarily used within Kubernetes environments.
|
||||||
|
|
||||||
|
It provides node-level visibility and control over pods, containers, and images. While it resembles Docker CLI in syntax, it is designed for **debugging** and **inspection**, not for managing workloads outside Kubernetes control.
|
||||||
|
|
||||||
|
`crictl` is part of the **[cri-tools](https://github.com/kubernetes-sigs/cri-tools)** project, which also includes `critest`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
|
||||||
|
1. Navigate to the [cri-tools releases page](https://github.com/kubernetes-sigs/cri-tools/releases) to find the version compatible with your Kubernetes or CRI runtime.
|
||||||
|
2. Download and install `crictl`:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
VERSION="v1.33.0"
|
||||||
|
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/$VERSION/crictl-$VERSION-linux-amd64.tar.gz
|
||||||
|
tar zxvf crictl-$VERSION-linux-amd64.tar.gz
|
||||||
|
sudo mv crictl /usr/local/bin/
|
||||||
|
```
|
||||||
|
|
||||||
|
*(Adjust version and architecture as needed.)*
|
||||||
|
3. Clean up the tarball if desired.
|
||||||
|
4. Verify installation:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl --version
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Configuration and Endpoints
|
||||||
|
|
||||||
|
`crictl` communicates with CRI runtimes using socket endpoints.
|
||||||
|
|
||||||
|
### Configuration Methods
|
||||||
|
|
||||||
|
You can configure endpoints via:
|
||||||
|
|
||||||
|
* **Command-line flags**: `--runtime-endpoint`, `--image-endpoint`
|
||||||
|
* **Environment variables**:
|
||||||
|
`CONTAINER_RUNTIME_ENDPOINT`, `IMAGE_SERVICE_ENDPOINT`
|
||||||
|
* **Configuration file**: Default path `/etc/crictl.yaml`
|
||||||
|
* **Custom config file**: Use `--config=<path>`
|
||||||
|
|
||||||
|
### Example `/etc/crictl.yaml`
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
runtime-endpoint: unix:///var/run/containerd/containerd.sock
|
||||||
|
image-endpoint: unix:///var/run/containerd/containerd.sock
|
||||||
|
timeout: 10
|
||||||
|
debug: true
|
||||||
|
```
|
||||||
|
|
||||||
|
If no endpoint is provided, `crictl` attempts to connect to a list of known sockets, which can slow operations.
|
||||||
|
|
||||||
|
### Modifying Configuration
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl config --set debug=true
|
||||||
|
crictl config --get debug
|
||||||
|
```
|
||||||
|
|
||||||
|
Additional configuration parameters include:
|
||||||
|
|
||||||
|
* `pull-image-on-create`
|
||||||
|
* `disable-pull-on-run`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Global Options
|
||||||
|
|
||||||
|
| Flag | Description |
|
||||||
|
| --------------------------- | ------------------------------------------ |
|
||||||
|
| `-h`, `--help` | Display help and usage information |
|
||||||
|
| `-v`, `--version` | Display crictl and runtime version details |
|
||||||
|
| `--runtime-endpoint <path>` | Specify CRI runtime socket |
|
||||||
|
| `--image-endpoint <path>` | Specify CRI image service socket |
|
||||||
|
| `--timeout <duration>` | Connection timeout (e.g., `5s`) |
|
||||||
|
| `-D`, `--debug` | Enable verbose output |
|
||||||
|
| `--config <path>` | Specify a custom config file |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Common Commands
|
||||||
|
|
||||||
|
### Status and Information
|
||||||
|
|
||||||
|
| Command | Description |
|
||||||
|
| ---------------- | ----------------------------------------------------- |
|
||||||
|
| `crictl version` | Display version and runtime API info |
|
||||||
|
| `crictl info` | Show runtime health, plugin states, and configuration |
|
||||||
|
|
||||||
|
### Pods / Pod Sandboxes
|
||||||
|
|
||||||
|
| Command | Description |
|
||||||
|
| ----------------------------------- | ---------------------------------- |
|
||||||
|
| `crictl pods` | List all pod sandboxes on the node |
|
||||||
|
| `crictl inspectp <POD_ID>` | Inspect a specific pod sandbox |
|
||||||
|
| `crictl runp <sandbox-config.json>` | Create a new pod sandbox |
|
||||||
|
| `crictl stopp <POD_ID>` | Stop a pod sandbox |
|
||||||
|
| `crictl rmp <POD_ID>` | Remove a pod sandbox |
|
||||||
|
|
||||||
|
### Containers
|
||||||
|
|
||||||
|
| Command | Description |
|
||||||
|
| ---------------------------------------------------------------------- | ---------------------------------------- |
|
||||||
|
| `crictl ps` / `crictl ps -a` | List running / all containers |
|
||||||
|
| `crictl inspect <CONTAINER_ID>` | Inspect a specific container |
|
||||||
|
| `crictl create <POD_ID> <container-config.json> <sandbox-config.json>` | Create a container in a pod |
|
||||||
|
| `crictl start <CONTAINER_ID>` | Start a container |
|
||||||
|
| `crictl exec -i -t <CONTAINER_ID> <command>` | Execute a command inside a container |
|
||||||
|
| `crictl stop <CONTAINER_ID>` | Stop a running container |
|
||||||
|
| `crictl rm <CONTAINER_ID>` | Remove a stopped container |
|
||||||
|
| `crictl stats` | Show CPU and memory usage for containers |
|
||||||
|
|
||||||
|
### Images
|
||||||
|
|
||||||
|
| Command | Description |
|
||||||
|
| ------------------------- | ----------------------------- |
|
||||||
|
| `crictl images` | List available images |
|
||||||
|
| `crictl inspecti <IMAGE>` | Inspect image metadata |
|
||||||
|
| `crictl pull <IMAGE>` | Pull an image from a registry |
|
||||||
|
| `crictl rmi <IMAGE>` | Remove an image |
|
||||||
|
| `crictl load <tarball>` | Load an image from a tar file |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Best Practices and Caveats
|
||||||
|
|
||||||
|
* **Kubelet cleanup:** Containers or pods created manually with `crictl` may be removed by the kubelet since they’re not managed by the Kubernetes control plane. Use for debugging only.
|
||||||
|
* **Permissions:** Root privileges or socket access are often required to communicate with the runtime.
|
||||||
|
* **Version compatibility:** Always match your `crictl` version to your Kubernetes or CRI runtime.
|
||||||
|
* **Timeout tuning:** Adjust `--timeout` or configuration to avoid connection failures.
|
||||||
|
* **Not a Docker replacement:** Although similar in command structure, `crictl` interacts directly with the CRI layer and may not support all Docker features.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Example Debugging Workflow
|
||||||
|
|
||||||
|
1. SSH into a Kubernetes node.
|
||||||
|
2. Check runtime health:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl info
|
||||||
|
crictl version
|
||||||
|
```
|
||||||
|
3. List pod sandboxes:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl pods
|
||||||
|
```
|
||||||
|
4. Inspect a pod:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl inspectp <POD_ID>
|
||||||
|
```
|
||||||
|
5. List and inspect containers:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl ps -a
|
||||||
|
crictl inspect <CONTAINER_ID>
|
||||||
|
```
|
||||||
|
6. Execute into or inspect logs:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl exec -it <CONTAINER_ID> sh
|
||||||
|
```
|
||||||
|
7. Clean up stuck containers or unused images:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
crictl stop <CONTAINER_ID>
|
||||||
|
crictl rm <CONTAINER_ID>
|
||||||
|
crictl rmi <IMAGE>
|
||||||
|
```
|
||||||
|
|
||||||
|
This workflow is typically used for **node-level debugging**, especially when `kubectl` cannot access or display runtime state.
|
||||||
Reference in New Issue
Block a user