Note for SDN x Cloud Native Meetup #9


Kubernetes Container Runtime Interface



Trend Kubernetes

  • 1.3: rktnetes
  • 1.5: CRI
  • 1.7 removed pre-CRI Docker/rkt integration
  • Currently works Kubelet to use CRI
  • CRI-O: released 1.0.x to match Kubernetes 1.7


  • CRI-O
    • OCI-based implementation of Kubernetes Container Runtime Interface
    • 可以用它來跑 Container

  • CRI
    • Kubernetes Container Runtime Interface
  • OCI
    • Open Container Intiative
    • 開源容器促進協議

    • Container 的工業化標準

Projects with Container Runtime

docker, rkt, LXC/LXD, runC, containerd, OpenVZ, ssytemd-nspawn, machinectl, ...

Container Runtime Interface (CRI)

  • Enable Kubernetes to support more runtimes
  • Free kubernetes to focus on orchestration from runtime integration
  • Consists
    • a protocol buffers and gRPC API
    • libraries, additional specifications and tools
  • Architect
    • dockershim
    • cri-containerd


CRI runtimes

  • Docker CRI shim (cri-containerd)
  • CoreOS rktlet
  • fraktal
  • Intel Clear Containers

Open Container Initiative (OCI)

OCI from aspect of user


  • OCI-based implementation of Kubernetes Container Runtime Interface
  • Kubernetes incubator projet also part of the CNCF
  • Dedicated for Kuberntes
  • Enable CRI-O plugin to other runtimes
  • Available on RHEL, Fedora, Centos, Ubuntu, ...
  • 用途
    • 可以讓其他 runtime 以 plugin 的方式被使用
  • cri-o architecutre

CRI-O vs Docker (containerd)

Docker: kubelet -> cri-containerd (shim) -> containerd -> runC -> container CRI-O: kubelet -> cri-o -> runC -> container

  • Lightweight
  • Stability
    • built for Kubernetes
    • No cli, image utilities, ...
    • No swarm, mesosphere integration, ...

Let's use CRI-O


Automatically Renew Your Certificate In Kubernetes


Why we need cert-manager

  • 簡化申請 Let's Encrypt 的步驟
  • 憑證到期自動 renew

What is cert-manager

  • A Native Kubernetes certificate management controller.
  • It can help with issuing certificates from a variety of sources, such as Let's Encrypt, HashiCorp Vault.
  • It will ensure certificates are valid and up to date, and attempt to renew certificates.

Components of cert-manager

  • Issuers
  • cert-manager
  • Certificates
  • Kuberntes Secrets

cert-manager 透過 Kubernetes 的 CustomResourceDefinitions 新增了 clusterissuers, issuers, certificate


  • ACME
    • HTTP01
    • DNS01
      • Provision a TXT resource record containing a designated vaule for a specific validation domain name.
      • Requirement an approach to control the DNS provider
      • For example: If I want to verify
        • I need to create a TXT record in with specific content.
        • Let's Encrypt will query the TXT record of to check it's content.
  • CA
  • Vault
  • Self-signed

How to use cert-manager

  • Install the cert-manager
    • Deployment
    • Service Account
    • RBAC (if you enable it in your cluster)
  • Create a Issuer/ClusterIssuer


  • Use helm to install cert-manager


  • In order to simpilify the configuration.
  • Support
    • Google Cloud DNS
    • Amazon Route53
    • Cloudflare
    • Akamai FastDNS
    • RFC2136
    • ACME-DNS
  • For the Cloudflare
    • you can get your API key from the control panel
    • We need to create a kubernetes secret resource with that API key.

Lightning Talk

Container Platform Information




如果覺得這篇文章對你有幫助, 除了留言讓我知道外, 或許也可以考慮請我喝杯咖啡, 不論金額多寡我都會非常感激且能鼓勵我繼續寫出對你有幫助的文章。

If this blog post happens to be helpful to you, besides of leaving a reply, you may consider buy me a cup of coffee to support me. It would help me write more articles helpful to you in the future and I would really appreciate it.

Related Posts