Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Install cri-tools #1235

Closed
wants to merge 1 commit into from
Closed

Install cri-tools #1235

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions scripts/install-worker.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,6 +343,9 @@ sudo systemctl daemon-reload
# Disable the kubelet until the proper dropins have been configured
sudo systemctl disable kubelet

# install crictl, critest
sudo yum install -y cri-tools
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this package get updated in the yum repo along with containerd? We'll undoubtedly get some CVEs from this, so want to make sure that it gets updated within reason.

Copy link
Member Author

@cartermckinnon cartermckinnon Mar 28, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought this was versioned with containerd, but it's actually a k8s project. Seems to be versioned with k8s on major + minor. I asked around in the k8s slack, not sure if we should only install something matching the kubelet version. Also not sure how it's ending up in the AL repos, so I don't know how diligently it's updated.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO, we need to understand how it's updated before we install it by default, or we'll just be doing scramble drill when it needs to be updated. As far as we know, that could be right away!

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We'll definitely get pinged to update it, but it's just a CLI tool; shouldn't ever be an emergency. I'll see what the sig-node folks say!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm more interested in how that yum repo gets updated. If it just points to some repo that sig-node folks update, that's fine. As long as we're regularly getting the latest, seems reasonable.


################################################################################
### EKS ########################################################################
################################################################################
Expand Down