---

crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}"
crio_conmon: "/usr/bin/conmon"
crio_enable_metrics: false
crio_log_level: "info"
crio_metrics_port: "9090"
crio_pause_image: "{{ pod_infra_image_repo }}:{{ pod_infra_version }}"

# Trusted registries to pull unqualified images (e.g. alpine:latest) from
# By default unqualified images are not allowed for security reasons
crio_registries: []

crio_seccomp_profile: ""
crio_selinux: "{{ (preinstall_selinux_state == 'enforcing')|lower }}"
crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"

# Override system default for storage driver
# crio_storage_driver: "overlay"

crio_stream_port: "10010"

crio_required_version: "{{ kube_version | regex_replace('^v(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"

crio_kubernetes_version_matrix:
  "1.19": "1.19"
  "1.18": "1.18"
  "1.17": "1.17"

crio_version: "{{ crio_kubernetes_version_matrix[crio_required_version] | default('1.19') }}"

# The crio_runtimes variable defines a list of OCI compatible runtimes.
crio_runtimes:
  - name: runc
    path: /usr/bin/runc
    type: oci
    root: /run/runc

# Kata Containers is an OCI runtime, where containers are run inside lightweight
# VMs. Kata provides additional isolation towards the host, minimizing the host attack
# surface and mitigating the consequences of containers breakout.
kata_runtimes:
  # Kata Containers with the default configured VMM
  - name: kata-runtime
    path: /opt/kata/bin/kata-runtime
    type: oci
    root: /run/kata-containers
  # Kata Containers with the QEMU VMM
  - name: kata-qemu
    path: /opt/kata/bin/kata-qemu
    type: oci
    root: /run/kata-containers