Skip to content

Commit 994555c

Browse files
authored
Moving ip forwarding and prereqs to container runtime page (#32946)
1 parent a600066 commit 994555c

File tree

2 files changed

+44
-49
lines changed

2 files changed

+44
-49
lines changed

content/en/docs/setup/production-environment/container-runtimes.md

Lines changed: 44 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,41 @@ check the documentation for that version.
4646

4747

4848
<!-- body -->
49+
## Install and configure prerequisites
50+
51+
The following steps apply common settings for Kubernetes nodes on Linux.
52+
53+
You can skip a particular setting if you're certain you don't need it.
54+
55+
For more information, see [Network Plugin Requirements](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network-plugin-requirements) or the documentation for your specific container runtime.
56+
57+
### Forwarding IPv4 and letting iptables see bridged traffic
58+
59+
Verify that the `br_netfilter` module is loaded by running `lsmod | grep br_netfilter`.
60+
61+
To load it explicitly, run `sudo modprobe br_netfilter`.
62+
63+
In order for a Linux node's iptables to correctly view bridged traffic, verify that `net.bridge.bridge-nf-call-iptables` is set to 1 in your `sysctl` config. For example:
64+
65+
```bash
66+
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
67+
overlay
68+
br_netfilter
69+
EOF
70+
71+
sudo modprobe overlay
72+
sudo modprobe br_netfilter
73+
74+
# sysctl params required by setup, params persist across reboots
75+
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
76+
net.bridge.bridge-nf-call-iptables = 1
77+
net.bridge.bridge-nf-call-ip6tables = 1
78+
net.ipv4.ip_forward = 1
79+
EOF
80+
81+
# Apply sysctl params without reboot
82+
sudo sysctl --system
83+
```
4984

5085
## Cgroup drivers
5186

@@ -139,38 +174,18 @@ This section outlines the necessary steps to use containerd as CRI runtime.
139174

140175
Use the following commands to install Containerd on your system:
141176

142-
1. Install and configure prerequisites:
143-
144-
(these instructions apply to Linux nodes only)
145-
146-
```shell
147-
cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
148-
overlay
149-
br_netfilter
150-
EOF
151-
152-
sudo modprobe overlay
153-
sudo modprobe br_netfilter
154-
155-
# Setup required sysctl params, these persist across reboots.
156-
cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
157-
net.bridge.bridge-nf-call-iptables = 1
158-
net.ipv4.ip_forward = 1
159-
net.bridge.bridge-nf-call-ip6tables = 1
160-
EOF
161177

162-
# Apply sysctl params without reboot
163-
sudo sysctl --system
164-
```
165178

166-
1. Install containerd:
179+
Follow the instructions for [getting started with containerd](https://github.com/containerd/containerd/blob/main/docs/getting-started.md). Return to this step once you've created a valid configuration file, `config.toml`.
167180

168-
Visit
169-
[Getting started with containerd](https://github.com/containerd/containerd/blob/main/docs/getting-started.md)
170-
and follow the instructions there, up to the point where you have a valid
171-
configuration file, config.toml.
172-
On Linux, you can find this file under the path `/etc/containerd/config.toml`.
173-
On Windows, you can find this file under the path `C:\Program Files\containerd\config.toml`.
181+
{{< tabs name="Finding your config.toml file" >}}
182+
{{% tab name="Linux" %}}
183+
You can find this file under the path `/etc/containerd/config.toml`.
184+
{{% /tab %}}
185+
{{< tab name="Windows" >}}
186+
You can find this file under the path `C:\Program Files\containerd\config.toml`.
187+
{{< /tab >}}
188+
{{< /tabs >}}
174189

175190
On Linux the default CRI socket for containerd is `/run/containerd/containerd.sock`.
176191
On Windows the default CRI endpoint is `npipe://./pipe/containerd-containerd`.

content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -45,26 +45,6 @@ may [fail](https://github.com/kubernetes/kubeadm/issues/31).
4545
If you have more than one network adapter, and your Kubernetes components are not reachable on the default
4646
route, we recommend you add IP route(s) so Kubernetes cluster addresses go via the appropriate adapter.
4747

48-
## Letting iptables see bridged traffic
49-
50-
Make sure that the `br_netfilter` module is loaded. This can be done by running `lsmod | grep br_netfilter`. To load it explicitly call `sudo modprobe br_netfilter`.
51-
52-
As a requirement for your Linux Node's iptables to correctly see bridged traffic, you should ensure `net.bridge.bridge-nf-call-iptables` is set to 1 in your `sysctl` config, e.g.
53-
54-
```bash
55-
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
56-
br_netfilter
57-
EOF
58-
59-
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
60-
net.bridge.bridge-nf-call-ip6tables = 1
61-
net.bridge.bridge-nf-call-iptables = 1
62-
EOF
63-
sudo sysctl --system
64-
```
65-
66-
For more details please see the [Network Plugin Requirements](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network-plugin-requirements) page.
67-
6848
## Check required ports
6949
These
7050
[required ports](/docs/reference/ports-and-protocols/)

0 commit comments

Comments
 (0)