Add guidance for migrating from dockershim to cri-dockerd

[shannonxtreme]

Related to #30974

Source comment: #30974 (comment)

This does not block 1.24.

---

Description

Add a how-to for users currently on 1.23 and earlier using Docker Engine with dockershim to migrate to cri-dockerd. Link the how-to in the Migrating from dockershim section.

I think the steps would be to install the cri-dockerd binary (https://github.com/mirantis/cri-dockerd), start the service, and add --container-runtime=remote --container-runtime-endpoint=/var/run/cri-docker.sock as extra args to the kubelet config

/sig docs
/language en
/cc @afbjorklund @sftim

[k8s-ci-robot]

@shannonxtreme: This issue is currently awaiting triage.

SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[afbjorklund]

@shannonxtreme : Note that it is supposed to read unix:///var/run/cri-dockerd.sock.

The scheme will soon be mandatory, and Mirantis changed the default socket location.

Otherwise agreed, should be similar to changing from docker to containerd (or to cri-o, new page/story)

https://kubernetes.io/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd/

(this particular instruction would assume that the user already had Docker Engine installed and configured)

If this would have been a new installation from scratch, the user would also need to add the container runtime.

---

Before you begin

• Install cri-dockerd (includes enabling the units and configuring the cri-tools)

Drain the node
Install Docker Engine
Configure the kubelet
Restart the kubelet
Verify that the node is healthy
Remove Docker Engine

The jury is still out on whether we need systemd socket activation, or if we should just start cri-dockerd at boot ?

Since the other runtimes don't bother with on-demand, maybe it would be enough with cri-docker.service

sudo systemctl daemon-reload
sudo systemctl enable --now cri-docker

(the containerd instructions on the other page are still complicated, due to using the Docker installation of it)

sudo systemctl daemon-reload
sudo systemctl enable --now containerd
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml
sudo systemctl restart containerd

[sftim]

/sig node

[sftim]

In my view, it's OK to provide outline instructions and to refer people to https://github.com/mirantis/cri-dockerd if they want more details.

[sftim]

/milestone 1.24

This'd really need to land for the v1.24 release or not at all.

[shannonxtreme]

/assign

[afbjorklund]

I'm still hoping that Mirantis will provide a user-facing webpage and a packaged release, in time for Kubernetes 1.24.

• Add a user-facing documentation home page, for installing and configuring Mirantis/cri-dockerd#37

• Release 0.2.1 with binary packages (deb / rpm) for end-user installation ? Mirantis/cri-dockerd#41

The current development documentation and building might be OK for testing, but raises question about long-term...

[afbjorklund]

@shannonxtreme we should add a warning / mention, that the user need to configure a CNI

It is possible that they were still using kubenet before, by not configuring anything for docker

EDIT: Might have spoken too soon, I think cri-dockerd still has the kubenet added by default ?

        cniPlugins := cni.ProbeNetworkPlugins(
                pluginSettings.PluginConfDir,
                pluginSettings.PluginCacheDir,
                pluginSettings.PluginBinDirs,
        )
        cniPlugins = append(
                cniPlugins,
                kubenet.NewPlugin(pluginSettings.PluginBinDirs, pluginSettings.PluginCacheDir),
        )

[afbjorklund]

@shannonxtreme do we need to add something about how to enable the "cni" network plugin, if used ?

It needs to be configured in the CRI, and the feature (CNI) is still in Alpha stage when it comes to cri-dockerd

• Document how to enable CNI network plugin Mirantis/cri-dockerd#43

Previously it used the --network-plugin kubelet flag, which has been removed.