Configuring a Kubernetes Cluster with Containerd Runtime on CentOS 7

As Kubernetes continues to mature, the community has shifted away from legacy Docker engines toward lightweight, Container Runtime Interface (CRI) compatible runtimes. Containerd is an industry-standard core container runtime that provides absolute simplicity, robustness, and portability for Kubernetes clusters.

In this guide, I will walk you through preparing CentOS 7 operating system baselines, disabling swap and SELinux, configuring kernel routing parameters, installing kubelet, kubeadm, and kubectl, and establishing Containerd as the primary Kubernetes runtime.

Prerequisites

You will need three CentOS 7 virtual machines with root privileges, configured with static IP addressing and internet reachability to Google Cloud package repositories.

Cluster Node Inventory

---

Step 1: Base System Preparation and Host Resolution

First, update system packages, install necessary LVM and persistent data storage utilities, and configure local hostname resolution across all nodes.

# Update system packages
yum update -y

# Install required LVM and persistent storage utilities
yum install epel-release yum-utils bash-completion net-tools device-mapper-persistent-data lvm2 -y

# Enforce static hostname resolution
cat >> /etc/hosts << "EOF"
10.14.7.51 central-dc1-k8s-master.induslevel.com k8s-master
10.14.7.53 central-dc1-k8s-node01.induslevel.com k8s-node01
10.14.7.54 central-dc1-k8s-node02.induslevel.com k8s-node02
EOF

---

Step 2: Disabling Swap and SELinux

Kubernetes kubelet requires swap memory to be entirely disabled so it can accurately allocate resources to pods. We also disable SELinux to allow unhindered container network bridging.

# Disable SELinux
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

# Turn off active swap and remove fstab mounting
swapoff -a
sed -i.bak -r 's/(.+ swap .+)/#\1/' /etc/fstab

# Verify configuration
free -m
cat /etc/fstab

Reboot all virtual machines to apply the clean kernel baseline:

reboot

---

Step 3: Firewall and Kernel Routing Configuration

Kubernetes control planes and worker nodes require open communication across several critical ports.

On Control Plane Master

firewall-cmd --permanent --add-port={6443,2379-2380,10250,10251,10252,10255,8285}/tcp
firewall-cmd --reload && firewall-cmd --list-all

On Worker Nodes

firewall-cmd --permanent --add-port={10250,10251,10255,8285}/tcp
firewall-cmd --reload && firewall-cmd --list-all

Configuring Kernel Routing Parameters (sysctl)

To ensure iptables correctly inspects bridged traffic between pods, apply the following kernel routing rules:

cat << "EOF" > /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl --system

---

Step 4: Installing Kubernetes Utilities and Containerd Runtime

With the OS environment prepared, configure the official Google Kubernetes repository and install core administration packages.

# Configure Kubernetes repository manifest
cat << "EOF" > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOF

# Install Kubernetes node utilities
yum install -y kubelet kubeadm kubectl

Installing Containerd Runtime

Configure the Docker CE repository mirror to pull the latest stable containerd.io runtime package:

yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum install -y containerd.io

# Enable and start Containerd daemon
systemctl enable containerd
systemctl start containerd

---

Step 5: Initializing the Control Plane via kubeadm

On your control plane master node (central-dc1-k8s-master), initialize the cluster using kubeadm. We explicitly pass the --cri-socket flag pointing to Containerd:

kubeadm init --apiserver-advertise-address 10.14.7.51 --pod-network-cidr=172.16.0.0/16 --cri-socket /run/containerd/containerd.sock

Once initialized successfully, copy the generated kubeadm join command and execute it on your worker nodes to join them to the cluster!

# On Worker Nodes
kubeadm join 10.14.7.51:6443 --token Randomtoken --discovery-token-ca-cert-hash sha256:Randomhash --cri-socket /run/containerd/containerd.sock

References

• Installing Containerd as a Kubernetes Runtime