$ mkdir /etc/containers
$ echo '
{
    "default": [{"type": "insecureAcceptAnything"}]
}' > /etc/containers/policy.json

registries = ['docker.io']
plugin_dir = "/opt/cni/bin"

#default_mounts = [
#       "/run/secrets",
#]

$ sudo systemctl enable crio
Created symlink /etc/systemd/system/multi-user.target.wants/crio.service -> /usr/lib/systemd/system/crio.service.
$ sudo systemctl start crio

[Unit]
After=crio.service
Requires=crio.service

[Service]
RestartSec=60

KUBE_ALLOW_PRIV="--allow-privileged=true"
KUBE_MASTER=""

KUBELET_HOSTNAME=""
KUBELET_KUBECONFIG="--kubeconfig=/etc/kubernetes/kubelet.conf --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf"
KUBELET_ARGS="--cluster-domain=cluster.local --cluster-dns=10.96.0.10 --cgroup-driver=systemd --fail-swap-on=false --network-plugin=kubenet --container-runtime=remote --container-runtime-endpoint=unix:///var/run/crio/crio.sock"

$ sudo systemctl enable kubelet.service
Created symlink /etc/systemd/system/multi-user.target.wants/kubelet.service -> /usr/lib/systemd/system/kubelet.service.

$ echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/30-ipforward.conf

$ sudo kubeadm join 10.23.15.110:6443 --ignore-preflight-errors Swap --cri-socket=/var/run/crio/crio.sock --token nnnxv2.2p7n2zwuddqedg25 --discovery-token-ca-cert-hash sha256:7563bc0dcf826a37e96f820725147a61d9970a094e1428832283f803aad91cd3

	[WARNING Swap]: running with swap on is not supported. Please disable swap
I0729 18:37:32.057489     595 kernel_validator.go:81] Validating kernel version
I0729 18:37:32.057981     595 kernel_validator.go:96] Validating kernel config
[discovery] Trying to connect to API Server "10.23.15.110:6443"
[discovery] Created cluster-info discovery client, requesting info from "https://10.23.15.110:6443"
[discovery] Requesting info from "https://10.23.15.110:6443" again to validate TLS against the pinned public key
[discovery] Cluster info signature and contents are valid and TLS certificate validates against pinned roots, will use API Server "10.23.15.110:6443"
[discovery] Successfully established connection with API Server "10.23.15.110:6443"
[kubelet] Downloading configuration for the kubelet from the "kubelet-config-1.11" ConfigMap in the kube-system namespace
[kubelet] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[preflight] Activating the kubelet service
[tlsbootstrap] Waiting for the kubelet to perform the TLS Bootstrap...
[patchnode] Uploading the CRI Socket information "/var/run/crio/crio.sock" to the Node API object "c2-worker2" as an annotation

This node has joined the cluster:
* Certificate signing request was sent to master and a response
  was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the master to see this node join the cluster.