diff --git a/content/zh/docs/concepts/architecture/cri.md b/content/zh/docs/concepts/architecture/cri.md
new file mode 100644
index 0000000000..68cd082fc0
--- /dev/null
+++ b/content/zh/docs/concepts/architecture/cri.md
@@ -0,0 +1,88 @@
+---
+title: 容器运行时接口（CRI）
+content_type: concept
+weight: 50
+---
+
+<!-- 
+title: Container Runtime Interface (CRI)
+content_type: concept
+weight: 50
+-->
+
+<!-- overview -->
+<!-- 
+The CRI is a plugin interface which enables the kubelet to use a wide variety of
+container runtimes, without having a need to recompile the cluster components.
+
+You need a working
+{{<glossary_tooltip text="container runtime" term_id="container-runtime">}} on
+each Node in your cluster, so that the
+{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} can launch
+{{< glossary_tooltip text="Pods" term_id="pod" >}} and their containers.
+-->
+CRI 是一个插件接口，它使 kubelet 能够使用各种容器运行时，无需重新编译集群组件。
+
+你需要在集群中的每个节点上都有一个可以正常工作的
+{{<glossary_tooltip text="容器运行时" term_id="container-runtime">}}，
+这样
+{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} 能启动
+{{< glossary_tooltip text="Pod" term_id="pod" >}} 及其容器。
+
+{{< glossary_definition prepend="容器运行时接口（CRI）是" term_id="container-runtime-interface" length="all" >}}
+
+<!-- body -->
+<!-- ## The API {#api} -->
+## API {#api}
+
+{{< feature-state for_k8s_version="v1.23" state="stable" >}}
+
+<!--
+The kubelet acts as a client when connecting to the container runtime via gRPC.
+The runtime and image service endpoints have to be available in the container
+runtime, which can be configured separately within the kubelet by using the
+`--image-service-endpoint` and `--container-runtime-endpoint` [command line
+flags](/docs/reference/command-line-tools-reference/kubelet)
+-->
+当通过 gRPC 连接到容器运行时时，kubelet 充当客户端。
+运行时和镜像服务端点必须在容器运行时中可用，可以使用
+[命令行标志](/zh/docs/reference/command-line-tools-reference/kubelet)的
+`--image-service-endpoint` 和 `--container-runtime-endpoint`
+在 kubelet 中单独配置。
+
+<!-- 
+For Kubernetes v{{< skew currentVersion >}}, the kubelet prefers to use CRI `v1`.
+If a container runtime does not support `v1` of the CRI, then the kubelet tries to
+negotiate any older supported version.
+The v{{< skew currentVersion >}} kubelet can also negotiate CRI `v1alpha2`, but
+this version is considered as deprecated.
+If the kubelet cannot negotiate a supported CRI version, the kubelet gives up
+and doesn't register as a node.
+-->
+对 Kubernetes v{{< skew currentVersion >}}，kubelet 偏向于使用 CRI `v1` 版本。
+如果容器运行时不支持 CRI 的 `v1` 版本，那么 kubelet 会尝试协商任何旧的其他支持版本。
+如果 kubelet 无法协商支持的 CRI 版本，则 kubelet 放弃并且不会注册为节点。
+
+<!-- 
+## Upgrading
+
+When upgrading Kubernetes, then the kubelet tries to automatically select the
+latest CRI version on restart of the component. If that fails, then the fallback
+will take place as mentioned above. If a gRPC re-dial was required because the
+container runtime has been upgraded, then the container runtime must also
+support the initially selected version or the redial is expected to fail. This
+requires a restart of the kubelet.
+-->
+## 升级  {#upgrading}
+
+升级 Kubernetes 时，kubelet 会尝试在组件重启时自动选择最新的 CRI 版本。
+如果失败，则将如上所述进行回退。如果由于容器运行时已升级而需要 gRPC 重拨，
+则容器运行时还必须支持最初选择的版本，否则重拨预计会失败。
+这需要重新启动 kubelet。
+
+## {{% heading "whatsnext" %}}
+
+<!-- 
+- Learn more about the CRI [protocol definition](https://github.com/kubernetes/cri-api/blob/c75ef5b/pkg/apis/runtime/v1/api.proto)
+-->
+- 了解更多有关 CRI [协议定义](https://github.com/kubernetes/cri-api/blob/c75ef5b/pkg/apis/runtime/v1/api.proto)
diff --git a/content/zh/docs/reference/glossary/container-runtime-interface.md b/content/zh/docs/reference/glossary/container-runtime-interface.md
new file mode 100644
index 0000000000..39bc8d0017
--- /dev/null
+++ b/content/zh/docs/reference/glossary/container-runtime-interface.md
@@ -0,0 +1,42 @@
+---
+title: 容器运行时接口
+id: container-runtime-interface
+date: 2021-11-24
+full_link: /zh/docs/concepts/architecture/cri
+short_description: >
+  kubelet 和容器运行时之间通信的主要协议。
+
+aka:
+tags:
+  - cri
+---
+
+<!--
+title: Container Runtime Interface
+id: container-runtime-interface
+date: 2021-11-24
+full_link: /docs/concepts/architecture/cri
+short_description: >
+  The main protocol for the communication between the kubelet and Container Runtime.
+
+aka:
+tags:
+  - cri
+-->
+
+<!-- The main protocol for the communication between the kubelet and Container Runtime. -->
+kubelet 和容器运行时之间通信的主要协议。
+
+<!--more-->
+
+<!-- 
+The Kubernetes Container Runtime Interface (CRI) defines the main
+[gRPC](https://grpc.io) protocol for the communication between the
+[cluster components](/docs/concepts/overview/components/#node-components)
+{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} and
+{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}.
+-->
+Kubernetes 容器运行时接口（CRI）定义了主要 [gRPC](https://grpc.io) 协议，
+用于[集群组件](/zh/docs/concepts/overview/components/#node-components)
+{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} 和
+{{< glossary_tooltip text="容器运行时" term_id="container-runtime" >}}。
\ No newline at end of file