一、 切换容器引擎为Containerd

参考资料：

https://kubernetes.io/zh/docs/setup/production-environment/container-runtimes/#containerd

配置先决条件

cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

设置必需的 sysctl 参数，这些参数在重新启动后仍然存在。

cat <<EOF | sudo tee /etc/sysctl.d/99-kubernetes-cri.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sudo sysctl --system

生产环境操作步骤

驱逐节点上的业务

节点标记为不可调度.
kubectl drain <节点名称> --ignore-daemonsets --delete-emptydir-data
kubectl drain node-172.16.2.187 --ignore-daemonsets --delete-emptydir-data

完成后取消节点标记
kubectl uncordon node-172.16.2.187


<节点名称> 是需要维护的节点名称。
--ignore-daemonsets 表示忽略 DaemonSet 管理的 Pod，因为它们通常需要在每个节点上运行。
--delete-emptydir-data 表示删除使用 emptyDir 卷的 Pod，这些卷的数据在驱逐后会被清除

2、安装containerd

yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo
yum install -y containerd.io

3、修改配置文件

containerd config default > /etc/containerd/config.toml

sed -ri 's#(SystemdCgroup = )false#\1true#' /etc/containerd/config.toml
grep SystemdCgroup /etc/containerd/config.toml

sed -i 's#registry.k8s.io/pause:3.6#registry.aliyuncs.com/google_containers/pause:3.8#' /etc/containerd/config.toml
grep sandbox_image /etc/containerd/config.toml

mkdir -p  /etc/containerd/certs.d
sudo sed -i '/\[plugins."io.containerd.grpc.v1.cri".registry\]/{n;s/config_path.*/config_path= "\/etc\/containerd\/certs.d"/}' /etc/containerd/config.toml
grep /etc/containerd/certs.d /etc/containerd/config.toml

systemctl restart containerd

{n;s/configpath.*/configpath= "\/etc\/containerd\/certs.d"/}: 在匹配行之后执行替换操作。n 命令用于读取下一行，s 命令用于替换字符串。

4、 配置镜像仓库

1. containerd配置仓库加速

mkdir -p  /etc/containerd/certs.d/registry.iotcloud.wl
mkdir -p  /etc/containerd/certs.d/registry.iotcloud.wl:443
mkdir -p  /etc/containerd/certs.d/172.16.2.113:8090
mkdir -p  /etc/containerd/certs.d/172.16.2.113:5000
mkdir -p  /etc/containerd/certs.d/docker.io
mkdir -p  /etc/containerd/certs.d/quay.io

cat >/etc/containerd/certs.d/registry.iotcloud.wl/hosts.toml <<EOF
server = "https://registry.iotcloud.wl:443"
[host."https://registry.iotcloud.wl:443"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
EOF

cat >/etc/containerd/certs.d/registry.iotcloud.wl:443/hosts.toml <<EOF
server = "https://registry.iotcloud.wl:443"
[host."https://registry.iotcloud.wl:443"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
EOF

cat >/etc/containerd/certs.d/172.16.2.113:8090/hosts.toml <<EOF
server = "http://172.16.2.113:8090"
[host."http://172.16.2.113:8090"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
EOF

cat >/etc/containerd/certs.d/172.16.2.113:5000/hosts.toml <<EOF
server = "http://172.16.2.113:5000"
[host."http://172.16.2.113:5000"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true
EOF

cat >/etc/containerd/certs.d/docker.io/hosts.toml<<EOF
server = "https://docker.io"
[host."https://dockerproxy.com"]
  capabilities = ["pull", "resolve"]

[host."https://docker.m.daocloud.io"]
  capabilities = ["pull", "resolve"]

[host."https://reg-mirror.qiniu.com"]
  capabilities = ["pull", "resolve"]

[host."https://registry.docker-cn.com"]
  capabilities = ["pull", "resolve"]

[host."http://hub-mirror.c.163.com"]
  capabilities = ["pull", "resolve"]
EOF
cat >/etc/containerd/certs.d/quay.io/hosts.toml <<EOF
server = "https://quay.io"

[host."https://quay.m.daocloud.io"]
  capabilities = ["pull", "resolve", "push"]
EOF

tree /etc/containerd

增加仓库配置不需要重启containerd

运行时更换

1. cri-docker 运行时

vim /var/lib/kubelet/kubeadm-flags.env

KUBELET_KUBEADM_ARGS="--container-runtime=remote --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --pod-infra-container-image=172.16.2.113:8090/google_containers/pause:3.8"

2. containerd 运行时

vim /var/lib/kubelet/kubeadm-flags.env

KUBELET_KUBEADM_ARGS="--container-runtime=remote --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock  --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.8"

3. docker运行时

unix:///var/run/dockershim.sock

5、重启 kubelet 使修改生效

systemctl restart kubelet

6、验证 kubelet 是否使用 containerd

运行以下命令查看 kubelet 当前使用的容器运行时：

kubectl get nodes -o wide | grep $(hostname)
输出示例：

NAME    STATUS   ROLES    AGE   VERSION   INTERNAL-IP    EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
node01  Ready    master   12d   v1.28.0   172.16.2.185   <none>        CentOS Linux 7       5.10.0-136.el7.x86_64   containerd://1.6.0
如果 CONTAINER-RUNTIME 列显示为 containerd://...，说明迁移成功。

7、管理容器工具

containerd提供了ctr命令行工具管理容器，但功能比较简单，所以一般会用crictl工具检查和调试容器。
项目地址：https://github.com/kubernetes-sigs/cri-tools/
设置crictl连接containerd：

cat >/etc/crictl.yaml<<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
EOF

8、停用docker 所有容器

docker rm -f $(docker ps -a -q)
systemctl stop docker

9、总结

1 查看 /var/lib/kubelet/kubeadm-flags.env 内容
2 修改 --container-runtime-endpoint 为 unix:///run/containerd/containerd.sock
3 重启 kubelet：systemctl restart kubelet
4 验证：kubectl get nodes -o wide
通过这种方式，你就能安全地将 kubelet 从 cri-dockerd 迁移到 containerd，而不会破坏 kubeadm 的管理逻辑。更多细节可参考 Kubernetes 官方文档。