diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 88e2cae5d5ec8..bd47a9cf0d6d8 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -125,6 +125,7 @@ For a reference to old feature gates that are removed, please refer to | `JobReadyPods` | `true` | Beta | 1.24 | | | `KMSv2` | `false` | Alpha | 1.25 | 1.26 | | `KMSv2` | `true` | Beta | 1.27 | | +| `KubeletCgroupDriverFromCRI` | `false` | Alpha | 1.28 | | | `KubeletInUserNamespace` | `false` | Alpha | 1.22 | | | `KubeletPodResourcesDynamicResources` | `false` | Alpha | 1.27 | | | `KubeletPodResourcesGet` | `false` | Alpha | 1.27 | | @@ -559,6 +560,17 @@ Each feature gate is designed for enabling/disabling a specific feature: The Job controller uses Pod finalizers and a field in the Job status to keep track of the finished Pods to count towards completion. - `KMSv2`: Enables KMS v2 API for encryption at rest. See [Using a KMS Provider for data encryption](/docs/tasks/administer-cluster/kms-provider) for more details. +- `KubeletCgroupDriverFromCRI`: Enable detection of the kubelet cgroup driver + configuration option from the {{}}. + You can use this feature gate on nodes with a kubelet that supports the feature gate + and where there is a CRI container runtime that supports the `RuntimeConfig` + CRI call. If both CRI and kubelet support this feature, the kubelet ignores the + `cgroupDriver` configuration setting (or deprecated `--cgroup-driver` command + line argument). If you enable this feature gate and the container runtime + doesn't support it, the kubelet falls back to using the driver configured using + the `cgroupDriver` configuration setting. + See [Configuring a cgroup driver](/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver) + for more details. - `KubeletCredentialProviders`: Enable kubelet exec credential providers for image pull credentials. - `KubeletInUserNamespace`: Enables support for running kubelet in a diff --git a/content/en/docs/setup/production-environment/container-runtimes.md b/content/en/docs/setup/production-environment/container-runtimes.md index 46ffce3bb9d54..957b8d3c0fe13 100644 --- a/content/en/docs/setup/production-environment/container-runtimes.md +++ b/content/en/docs/setup/production-environment/container-runtimes.md @@ -157,6 +157,12 @@ Starting with v1.22 and later, when creating a cluster with kubeadm, if the user the `cgroupDriver` field under `KubeletConfiguration`, kubeadm defaults it to `systemd`. {{< /note >}} +In Kubernetes v1.28, with the `KubeletCgroupDriverFromCRI` +[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +enabled and a container runtime that supports the `RuntimeConfig` CRI RPC, +the kubelet automatically detects the appropriate cgroup driver from the runtime, +and ignores the `cgroupDriver` setting within the kubelet configuration. + If you configure `systemd` as the cgroup driver for the kubelet, you must also configure `systemd` as the cgroup driver for the container runtime. Refer to the documentation for your container runtime for instructions. For example: @@ -251,6 +257,10 @@ sudo systemctl restart containerd When using kubeadm, manually configure the [cgroup driver for kubelet](/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/#configuring-the-kubelet-cgroup-driver). +In Kubernetes v1.28, you can enable automatic detection of the +cgroup driver as an alpha feature. See [systemd cgroup driver](#systemd-cgroup-driver) +for more details. + #### Overriding the sandbox (pause) image {#override-pause-image-containerd} In your [containerd config](https://github.com/containerd/containerd/blob/main/docs/cri/config.md) you can overwrite the @@ -292,6 +302,10 @@ You should also note the changed `conmon_cgroup`, which has to be set to the val cgroup driver configuration of the kubelet (usually done via kubeadm) and CRI-O in sync. +In Kubernetes v1.28, you can enable automatic detection of the +cgroup driver as an alpha feature. See [systemd cgroup driver](#systemd-cgroup-driver) +for more details. + For CRI-O, the CRI socket is `/var/run/crio/crio.sock` by default. #### Overriding the sandbox (pause) image {#override-pause-image-cri-o} diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md b/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md index f4308c2b0eb35..b811985819c00 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md @@ -36,6 +36,11 @@ driver of the kubelet. {{< note >}} In v1.22 and later, if the user does not set the `cgroupDriver` field under `KubeletConfiguration`, kubeadm defaults it to `systemd`. + +In Kubernetes v1.28, you can enable automatic detection of the +cgroup driver as an alpha feature. +See [systemd cgroup driver](/docs/setup/production-environment/container-runtimes/#systemd-cgroup-driver) +for more details. {{< /note >}} A minimal example of configuring the field explicitly: