Cloud Native Computing Foundation Kubernetes Community Days Bengaluru 2021, 10 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Debugging Kubernetes nodes without Docker

Description

Kubernetes Community Days Bengaluru'21

In 1.20 release Kubernetes has announced that it is going to deprecate docker as a container runtime. It is very convenient to debug containers running on Kubernetes nodes with docker!!. We are all going miss docker in Kubernetes. In this demo we will simply learn to use other container runtimes tools like crictl, ctr and nerdctl. We will use containerd as a container runtime and learn how to run containers, load images, debug k8s node containers, interacting with the Kubernetes CRI interface using the above mentioned container runtime tools.

Slides: https://drive.google.com/file/d/1m7bnJfuD6YkETxSfgwmZ38SX0xZVz5gZ/view

A

Hello, everyone welcome to the talk I am aditi. I work at vmware on tkg platform today me and naveed will share you how you can debug kubernetes note without using docker. So first question that comes to our mind is why we need this. So in kubernetes 1.2 release it is. It was announced that this going to deprecate dockasham to understand what docusim is and how the deprecation can affect you. We need to understand how kubernetes communicates with container.

A

Runtimes to communicate with container runtimes kubernetes uses a grpc interface called as container runtime interface. Docker shim is the cri implementation for docker, which is maintained by kubernetes community kubernetes. Only duplicated use of docker as a container runtime, docker images and docker build tool will work same as before as they follow oci image. Spec.

A

Let's see the reasons behind these applications.

A

If we use dockersham as a container runtime, the request from a cubelet to container runtime goes through many levels and it can have some performance implications. The second reason is docker is a complete set of tools that provides lots of functionalities like building images. Networking storage that kubernetes does not need.

A

The third reason is maintenance burden of docusm.

A

But we are quite familiar to use docker cli to troubleshoot kubernetes, container images issue. Node issues like we are quite used to use like commands like docker images, talker inspect docker xx. So, let's see what other alternatives are available if we do not have docker on our node.

A

So there are some tools to help you the first one is ci cdl. It talks to the cri implementations of the runtime. The second one is nerd ctl. It is a docker like cli for container d. The third one is ctr.

A

It is a b factor, cli that comes with containery. Now, let's explore cricdtl.

A

So using the cri cdl m4, you can get various information about the node.

A

Status of the node network.

A

Status, cni config.

A

What cnn plugins it is using.

A

Information about low level container run times like run c.

A

Cni status, etc.

A

You can also use you can also inspect a container.

A

So this is the container I have created few hours ago.

A

A

A

You can get a lot of information by inspecting a container.

A

Like its status image, it is using locks of the container.

A

Commands that are running in the container container capabilities, if you are running in some into some cap issues, mount information and like it will go on.

A

So it gives you a lot of information about your container. Okay, see group path, what name spaces the containers and.

A

You can also run um you can also use debug option with crictl that prints the whole api response from the container runtime.

A

Let's see this sorry, it is minus 19.

A

Okay, so you can see it will tell you what complete container response. You are getting from container run time and you can figure it out if something is missing or you are facing some issues.

A

Okay, you can also use uh crictl to create containers pods sometime. It happens that you are facing some issues that you are not able to figure out this from cubelet or it is from container runtime or it is from somewhere else so to debug that you can directly create container containers or ports with container runtimes without involving cubelet so to create containers and bots with cricdl.

A

You need to create some json files, okay, so for pod, I have created this json file.

A

I can use the one.

B

A

Command to create a pod.

A

So, let's see the part status.

A

Now we can create containers in the pot.

A

So to create containers, you also need to create a json.

A

A

Need to give the quad id first.

A

Then the container json file, then the pod.json file.

A

We need to start the container.

A

A

So the container is running you can explore lots of other commands with cri ctl, using the help.

A

Option so this is all about cri ctl. Now uh there is uh one more tool called as nerd cdl. Now now we will walk through you, how you can use not cdl. Thank you.

C

Nerd ctl command line interface has same us as of docker, so users can use nut, ctl and docker interchangeably. As you can see on the screen. These are the different command groups being provided by netctl. There is container network volume, namespace system and image command groups and all the functionalities under those command groups.

C

These are the same functionalities as you get on docker cli and the command command paths are same in addition to these utilities. That's retail also gives you login and logout for container registries.

C

It also gives you top events and system info commands, which you can figure out the details, as you would do using the docker cli. Let's look at the demo.

C

Here on this node I've got container deconfigured and not ctl installed.

C

Let's begin with net ctl version command, it prints the client version, as well as the container runtime version here. You can also print the system, information using nerd city info or nerd ctl system info command. These are the alias of the same command.

C

It prints you, the operating system. Details cannot, it is and what all components are configured in your server. What's the storage driver? What's the c group driver and all that information on the right hand, side, I am going to run nerd ctl events command that you can run to monitor the events that are happening in your node.

C

With that in place, we will begin with exploring what all that ctl has to provide.

C

So if you print the help command, we can see here that the command help section looks like how it is for the docker, and here you can see the management commands as well. So, let's begin by creating a simple container.

C

So here I am creating the nginx container. As you can notice, the syntax of the command is exactly the same as the docker cli.

C

It prints the container id after successful creation and, as you can see here, the event is recorded at container create and all the details of the continuous effect are present here.

C

Let's look at ps command is same as the docker ps command, with which you can see the running containers.

C

You can also look at the logs of the container say if you are debugging um your container on a communities node and you want to inspect what are the locks of my container. You can use third city locks command, as you can see, this prints the output in exactly the same fashion as the docker cli, just press, ctrl c, to close that nut ctl also has compose commands. So I'm going to use this composed command to bring up a mongodb, nginx and flask app.

C

This is to duplicate, creating a few containers on the node and looking at you know, various properties of it.

C

So as it's creating content, as you can see, on the right hand, side a bunch of containers have been created, I can notice basic ps commands, they just started. I can see logs of those commands to check if those are static started correctly or not.

C

As you can see, it started the worker process.

C

I can also use the top command to make sure the process is running in my container are extra expectations.

C

So if I have to debug something I can use the top command using nerd studio, as you have been doing with docker, to check the processes, their paths, the commands, that's running inside it all right.

C

Let's look at other aspect of it. For example, we can look at the volume command group. You can see what all it has to provide so now, ctl volume ls will give you what all volumes are present on your node, so you can inspect an individual volume here.

C

And also look at if you want to look inside the volume what all data is present. So if your application is not behaving as expected, you can use all these commands to inspect volumes, go inside the data directory and inspect those files that are relevant to your application.

C

That's for the volume! Let's look at what network section group has so with network sub you can list, you can inspect.

C

Rctl network inspect.

C

So it will give you details about this particular apps network, so it prints you, the cna version, that's being used. The cna plugin here.

C

It gives you other details about, for example, what's the sub? What's the kit subnet, what's a gateway.

C

There's also a port command on not ctl, which you can use to list the ports for a container.

C

So, for example, if you want to see you say, for example, this nginx image, you can see that this nginx container support mapping to the local host.

C

C

You can also list namespace.

C

Netctl namespace and printing ls will give you the. Currently. There are 14 images. There are 19 images that are running in the default name, space with nine volumes and four containers.

C

You can also list all the exited containers here with psiphon a so at the moment. We don't have any. We can um kill a container as well, so I'm going to kill this container and psf and a will show you that it has exited.

C

You can look at the locks.

C

How the container exited! So, I think that's about it for the.

C