sudo pacman -S cri-o crun iptables-nft

Create/etc/crio/crio.conf.d/00-crun.conf specifying the default runtimeascrun instead ofrunc.

[crio.runtime]default_runtime = "crun"[crio.runtime.runtimes.crun]runtime_path = "/usr/bin/crun"runtime_type = "oci"runtime_root = "/run/crun"

Create/etc/crio/crio.conf.d/10-plugin-dir.conf to specify what pathscri-o looks for cni plugins.

[crio.network]plugin_dirs = [  "/usr/lib/cni",  "/opt/cni/bin"]

sudo modprobe overlaysudo modprobe br_netfiltersudo systemctl enable crio --now

sudo pacman -S kubeadm kubelet kubectl helm cilium-clisudo systemctl enable kubelet --now

sudo kubeadm init \  --cri-socket='unix:///run/crio/crio.sock' \  --skip-phases=addon/kube-proxy

mkdir -p $HOME/.kubesudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/configsudo chown $(id -u):$(id -g) $HOME/.kube/configexport KUBECONFIG="$HOME/.kube/config"

kubectl taint nodes <node-name> \  node-role.kubernetes.io/control-plane:NoSchedule-

cilium-cli install \  --set l2announcements.enabled=true \  --set kubeProxyReplacement=true

apiVersion:cilium.io/v2alpha1kind:CiliumL2AnnouncementPolicymetadata:name:l2-enp4s0spec:interfaces:    -^enp4s0externalIPs:yesloadBalancerIPs:yes

apiVersion:cilium.io/v2alpha1kind:CiliumLoadBalancerIPPoolmetadata:name:lan-poolspec:blocks:    -start:192.168.0.20stop:192.168.0.49

helm upgrade --install ingress-nginx ingress-nginx \  --repo https://kubernetes.github.io/ingress-nginx \  --namespace ingress-nginx --create-namespace

helm repo add jetstack https://charts.jetstack.io --force-updatehelm repo updatekubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.crds.yamlhelm install \  cert-manager jetstack/cert-manager \  --namespace cert-manager \  --create-namespace \  --version v1.14.4

---apiVersion:cert-manager.io/v1kind:ClusterIssuermetadata:name:letsencrypt-prodspec:acme:email:"lol@lol.com"server:"https://acme-v02.api.letsencrypt.org/directory"privateKeySecretRef:name:letsencrypt-prodsolvers:      -dns01:cloudflare:email:"lol@lol.com"apiTokenSecretRef:name:cloudflare-lol-tokenkey:api-token