Kubernetes CRI 之 dockershim 的实现

dockershim 在 kubelet 中是怎么支持

代码版本：release-1.23

kubernetes v1.24 开始会正式放弃对 dockershim 的维护，将 dockershim 相关的代码从 kubelet 中删除。那么之前 dockershim 这部分的代码在 kubelet 中的组织形式是怎么样的呢？

简单来说就是 kubelet 会在正式开始运行之前先创建 dockershim，也就是启动 dockershim grpc 服务。之后，kubelet 和 dockershim 通过 unix:///var/run/dockershim.sock 来进行通信。kubelet 中的相关代码如下

// cmd/kubelet/app/server.go
func run(ctx context.Context, s *options.KubeletServer, kubeDeps *kubelet.Dependencies, featureGate featuregate.FeatureGate) (err error) {
  ...
	err = kubelet.PreInitRuntimeService(&s.KubeletConfiguration,
		kubeDeps, &s.ContainerRuntimeOptions,
		s.ContainerRuntime,
		s.RuntimeCgroups,
		s.RemoteRuntimeEndpoint,
		s.RemoteImageEndpoint,
		s.NonMasqueradeCIDR)
	if err != nil {
		return err
	}

	if err := RunKubelet(s, kubeDeps, s.RunOnce); err != nil {
		return err
	}
  ...
}

// pkg/kubelet/kubelet.go
func PreInitRuntimeService(kubeCfg *kubeletconfiginternal.KubeletConfiguration,
	kubeDeps *Dependencies,
	crOptions *config.ContainerRuntimeOptions,
	containerRuntime string,
	runtimeCgroups string,
	remoteRuntimeEndpoint string,
	remoteImageEndpoint string,
	nonMasqueradeCIDR string) error {
	if remoteRuntimeEndpoint != "" {
		// remoteImageEndpoint is same as remoteRuntimeEndpoint if not explicitly specified
		if remoteImageEndpoint == "" {
			remoteImageEndpoint = remoteRuntimeEndpoint
		}
	}

	switch containerRuntime {
	case kubetypes.DockerContainerRuntime:
		klog.InfoS("Using dockershim is deprecated, please consider using a full-fledged CRI implementation")
		if err := runDockershim(
			kubeCfg,
			kubeDeps,
			crOptions,
			runtimeCgroups,
			remoteRuntimeEndpoint,
			remoteImageEndpoint,
			nonMasqueradeCIDR,
		); err != nil {
			return err
		}
	case kubetypes.RemoteContainerRuntime:
		// No-op.
		break
	default:
		return fmt.Errorf("unsupported CRI runtime: %q", containerRuntime)
	}
  ...
}

由于 dockershim 是由 kubelet 启动的，因此 dockershim 需要的一些参数，也是由 kubelet 透出。比如 remoteRuntimeEndpoint、 CNI 相关的参数等。需要注意的是，CSI 是 kubelet 调用的，而 CNI 是由相应的 shim（比如 dockershim） 调用的，因此这里也透出了 CNI 相关的参数。

// cmd/kubelet/app/options/options.go
func NewKubeletFlags() *KubeletFlags {
	remoteRuntimeEndpoint := ""
	if runtime.GOOS == "linux" {
		remoteRuntimeEndpoint = "unix:///var/run/dockershim.sock"
	} else if runtime.GOOS == "windows" {
		remoteRuntimeEndpoint = "npipe:////./pipe/dockershim"
	}

	return &KubeletFlags{
		ContainerRuntimeOptions: *NewContainerRuntimeOptions(),
		CertDirectory:           "/var/lib/kubelet/pki",
		RootDirectory:           defaultRootDir,
		MasterServiceNamespace:  metav1.NamespaceDefault,
		MaxContainerCount:       -1,
		MaxPerPodContainerCount: 1,
		MinimumGCAge:            metav1.Duration{Duration: 0},
		NonMasqueradeCIDR:       "10.0.0.0/8",
		RegisterSchedulable:     true,
		RemoteRuntimeEndpoint:   remoteRuntimeEndpoint,
		NodeLabels:              make(map[string]string),
	}
}
// cmd/kubelet/app/options/container_runtime.go
func NewContainerRuntimeOptions() *config.ContainerRuntimeOptions {
	dockerEndpoint := ""
	if runtime.GOOS != "windows" {
		dockerEndpoint = "unix:///var/run/docker.sock"
	}

	return &config.ContainerRuntimeOptions{
		ContainerRuntime:          kubetypes.DockerContainerRuntime,
		DockerEndpoint:            dockerEndpoint,
		DockershimRootDirectory:   "/var/lib/dockershim",
		PodSandboxImage:           defaultPodSandboxImage,
		ImagePullProgressDeadline: metav1.Duration{Duration: 1 * time.Minute},

		CNIBinDir:   "/opt/cni/bin",
		CNIConfDir:  "/etc/cni/net.d",
		CNICacheDir: "/var/lib/cni/cache",
	}
}