Resolve the inconsistency between the sandbox image used by the container runtime and the sandbox image used by kubeadm

Specific manifestations

[preflight] You can also perform this action beforehand using 'kubeadm config images pull'
W0617 16:13:21.203208   47633 checks.go:846] detected that the sandbox image "registry.k8s.io/pause:3.8" of the container runtime is inconsistent with that used by kubeadm.It is recommended to use "registry.k8s.io/pause:3.10" as the CRI sandbox image.

This is usually because the containerd configuration does not correctly specify the default pause image, causing kubeadm to still use the default value from an older version.

Solution

From your ctr -n=k8s.io images ls As can be seen from the output,registry.k8s.io/pause:3.10 It does indeed already exist in containerd, but kubeadm still reports that it has been detected.pause:3.8. This is usually due to containerd configuration did not correctly specify the default pause image, causing kubeadm to still use the default values from the old version.

Ultimate solution

1. Forcibly modify containerd's sandbox_image Configuration

# Generate default configuration (if it does not exist)
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml

# Modify the configuration to explicitly specify pause:3.10
sudo sed -i 's|sandbox_image = ".*"|sandbox_image = "registry.k8s.io/pause:3.10"|g' /etc/containerd/config.toml

# Restart containerd
sudo systemctl restart containerd

2. Verify whether the containerd configuration takes effect

sudo grep sandbox_image /etc/containerd/config.toml

The output should be:

sandbox_image = "registry.k8s.io/pause:3.10"

3. Reinitialize the cluster

sudo kubeadm reset -f  # Reset first
sudo kubeadm init \
  --kubernetes-version v1.33.0 \
  --pod-network-cidr=192.168.0.0/16 \
  --apiserver-advertise-address=192.168.0.160 \
  --control-plane-endpoint=192.168.0.160 \
  --cri-socket unix:///var/run/containerd/containerd.sock

Why does the problem still exist?

• containerd did not load the configuration correctly

• If /etc/containerd/config.toml is not loaded correctly, containerd will still use the built-in default values (possibly pause:3.8).

• Solution: Ensure containerd The configuration takes effect after the service is restarted:

sudo systemctl restart containerd
sudo systemctl status containerd  # Check whether the restart was successful.

• kubelet cached the old configuration

• The kubelet may have cached the old sandbox image settings.

• Solution: Restart kubelet:

sudo systemctl restart kubelet

• kubeadm defaults are not overridden

• Even if containerd is configured correctly, kubeadm may still check runtime defaults.

• Solution: at kubeadm init explicitly specified when --config file, overriding the default value (see below).

Advanced option: Using a kubeadm configuration file

If the above method still does not work, you can force specify the pause image through the configuration file:

cat <<EOF | sudo tee kubeadm-config.yaml
apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: v1.33.0
imageRepository: registry.k8s.io
networking:
  podSubnet: "192.168.0.0/16"
apiServer:
  extraArgs:
    advertise-address: 192.168.0.160
controlPlaneEndpoint: "192.168.0.160:6443"
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
featureGates:
  KubeletInUserNamespace: true
sandboxImage: registry.k8s.io/pause:3.10
EOF

# Initialize the cluster
sudo kubeadm init --config kubeadm-config.yaml --cri-socket unix:///var/run/containerd/containerd.sock

Verify the final result

• Check whether running Pods use pause:3.10:

kubectl describe pod -n kube-system kube-apiserver-$(hostname) | grep Image:

Expected output:

Image: registry.k8s.io/pause:3.10

• Check the kubelet logs:

journalctl -u kubelet -n 50 --no-pager | grep sandbox

Should be none.pause:3.8 Related warnings.

Other notes

• About cgroups v1 warning

• This is another separate issue; if you need to eliminate the warning, you must upgrade the system to a version that supports cgroups v2 distributions (such as Ubuntu 22.04+).

• Temporarily ignored: does not affect cluster functionality.

• Special handling for offline environments

• Ensure all dependency images (such as kube-apiserver,coredns etc.) have all been imported into containerd:

sudo ctr -n=k8s.io images ls -q

Summary

The root cause is The default configuration of containerd is not specified correctly.pause:3.10, causing kubeadm to detect an old version. This can be completely resolved through the following steps:

• Correction /etc/containerd/config.toml, explicitly set sandbox_image.

• Restart containerd Make the configuration take effect.

• Reinitialize the cluster use when necessary --config File overwrite default value.

After execution,pause:3.8 The warning will disappear, and the cluster will be stable to use.pause:3.10.