Containerd with NRI (Node Resource Interface)

[synthe102]

Hi !
I've been trying to enable NRI, on talos to use with NRI plugins.

The config I used is this one, with the NRI conf coming from the containerd docs:

machine
    files:
      - content: |
          [plugins]
            [plugins."io.containerd.nri.v1.nri"]
              disable_connections = false
              plugin_config_path = "/etc/nri/conf.d"
              plugin_path = "/opt/nri/plugins"
              plugin_registration_timeout = "5s"
              plugin_request_timeout = "2s"
              socket_path = "/var/run/nri/nri.sock"

        path: /etc/cri/conf.d/20-customization.part
        op: create

The configuration is successfully merged, but the NRI socket at /var/run/nri/nri.sock is not created by containerd.
Anyone managed to do this or have insights on why this is failing ?

[synthe102]

I ended up finding a way to make it work, by overwriting the whole /etc/cri/containerd.toml config file to remove the NRI plugin from the list of disabled_plugins. Tried to redeclare the disabled_plugins block in /etc/cri/conf.d/20-customization.part but it doesn't work.

machine:
    files:
      - content: |
          version = 3

          disabled_plugins = [
              "io.containerd.internal.v1.tracing",
              "io.containerd.snapshotter.v1.blockfile",
              "io.containerd.tracing.processor.v1.otlp",
          ]

          imports = [
              "/etc/cri/conf.d/cri.toml",
          ]

          [debug]
          level = "info"
          format = "json"
        path: /etc/cri/containerd.toml
        op: overwrite

@smira is there a more elegant way to do this that I missed or is overwriting the whole containerd conf the only way to enable a disabled plugin ?

[smira]

If you have a specific NRI plugin you would like to use, please open an issue describing that, and put any manual steps you took to activate it, and also a way to test that the plugin works. We can take it from there

[synthe102]

I'd like to use the NRI Plugins from the containers GH org. So the only required thing from Talos is to have the NRI feature enabled.

[smira]

With #10106 merged (and backported to 1.9.2), NRI plugins can be enabled with a simple configuration change, and NRI plugins work out of the box.