refactor: run kubelet and etcd in system containerd #9829
Conversation
This change allows us to ensure their contexts are protected by SELinux policy, as well as making CRI containerd only host containers managed by Kubernetes. Signed-off-by: Dmitry Sharshakov <[email protected]>
|
I'm not sure if we can do that, as system containerd runs from |
|
Well, etcd data is on a mount to where it belongs to be |
but the uncompressed layers and other metadata will fillup tmpfs, just wasting memory |
|
yes, perhaps this solution is not really efficient since those images aren't tiny |
|
Idea: we could create a namespace belonging to the system containerd, but with snapshotter configured to store data on the |
that sounds interesting, if we can actually pull it through, but still it's kubelet/etcd only |
This change allows us to ensure their contexts are protected by SELinux policy, as well as making CRI containerd only host containers managed by Kubernetes.
Signed-off-by: Dmitry Sharshakov [email protected]