Checkpoint Restoration Failing in kubeadm

General Discussions
1

Followed this blog Forensic container checkpointing in Kubernetes | Kubernetes

Facing issues when checkpointing nginx

Cluster information:

Kubernetes version: 1.25
Cloud being used: bare-metal
Installation method: Kubeadm
Host OS: Ubuntu 22.04.1 LTS(ubuntu/jammy64)
CNI and version: Calico v3.24.0
CRI and version: cri-o v1.25.0

Steps taken for enabling checkpoint

  1. Enabled feature gates in all three components of k8s

Checked manifests file .They are enabled
root@kubemaster:/etc/kubernetes/manifests# grep -E 'feature-gates' *.yaml

kube-apiserver.yaml: - --feature-gates=ContainerCheckpoint=true
kube-controller-manager.yaml: - --feature-gates=ContainerCheckpoint=true
kube-scheduler.yaml: - --feature-gates=ContainerCheckpoint=true

2)Enabled enable_criu_support and drop_infra_ctr
root@kubemaster:/etc/crio# grep -E 'enable_criu_support = true|drop_infra_ctr = false' *.conf

drop_infra_ctr = false
enable_criu_support = true

3)Ensure nodes are using crio 1.25 and k8s 1.25

root@kubemaster:/# kubectl get no -o wide

NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
kubemaster Ready control-plane 28m v1.25.0 192.168.56.2 Ubuntu 22.04.1 LTS 5.15.0-56-generic cri-o://1.25.0

Steps to replicate

  1. Created nginx pod
    kubectl run webserver --image=nginx -n default

  2. Tried to checkpoint it

curl -sk -X POST  "https://localhost:10250/checkpoint/default/webserver/webserver" \
>   --key /etc/kubernetes/pki/apiserver-kubelet-client.key \
>   --cacert /etc/kubernetes/pki/ca.crt \
>   --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt

Getting the error

checkpointing of default/webserver/webserver failed (rpc error: code = Unknown desc = checkpoint/restore support not available)

Please help

2

i had the same problem before because i have not runc installed

3

I put the “drop_infra_ctr = false
enable_criu_support = true” simply in the end of crio.conf, which was wrong, it should be behind the [crio.runtime] table, for details: https://github.com/cri-o/cri-o/blob/main/docs/crio.conf.5.md