02b6e4833a
* Update Kata containers binary to 2.4.1 version * Update overhead kata runtime values * Fix kata-qemu default values in CRI-O
105 lines
3.2 KiB
YAML
105 lines
3.2 KiB
YAML
---
|
|
|
|
crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}"
|
|
crio_conmon: "/usr/bin/conmon"
|
|
crio_enable_metrics: false
|
|
crio_log_level: "info"
|
|
crio_metrics_port: "9090"
|
|
crio_pause_image: "{{ pod_infra_image_repo }}:{{ pod_infra_version }}"
|
|
|
|
# Registries defined within cri-o.
|
|
# By default unqualified images are not allowed for security reasons
|
|
crio_registries: []
|
|
# - prefix: docker.io
|
|
# insecure: false
|
|
# blocked: false
|
|
# location: registry-1.docker.io ## REQUIRED
|
|
# unqualified: false
|
|
# mirrors:
|
|
# - location: 172.20.100.52:5000
|
|
# insecure: true
|
|
# - location: mirror.gcr.io
|
|
# insecure: false
|
|
|
|
crio_registry_auth: []
|
|
# - registry: 10.0.0.2:5000
|
|
# username: user
|
|
# password: pass
|
|
|
|
crio_seccomp_profile: ""
|
|
crio_selinux: "{{ (preinstall_selinux_state == 'enforcing')|lower }}"
|
|
crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
|
|
|
|
# Override system default for storage driver
|
|
# crio_storage_driver: "overlay"
|
|
|
|
crio_stream_port: "10010"
|
|
|
|
crio_required_version: "{{ kube_version | regex_replace('^v(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
|
|
|
|
crio_kubernetes_version_matrix:
|
|
"1.23": "1.23"
|
|
"1.22": "1.22"
|
|
"1.21": "1.21"
|
|
|
|
crio_version: "{{ crio_kubernetes_version_matrix[crio_required_version] | default('1.23') }}"
|
|
|
|
# The crio_runtimes variable defines a list of OCI compatible runtimes.
|
|
crio_runtimes:
|
|
- name: runc
|
|
path: /usr/bin/runc
|
|
type: oci
|
|
root: /run/runc
|
|
|
|
# Kata Containers is an OCI runtime, where containers are run inside lightweight
|
|
# VMs. Kata provides additional isolation towards the host, minimizing the host attack
|
|
# surface and mitigating the consequences of containers breakout.
|
|
kata_runtimes:
|
|
# Kata Containers with the default configured VMM
|
|
- name: kata-qemu
|
|
path: /usr/local/bin/containerd-shim-kata-qemu-v2
|
|
type: vm
|
|
root: /run/kata-containers
|
|
privileged_without_host_devices: true
|
|
|
|
# crun is a fast and low-memory footprint OCI Container Runtime fully written in C.
|
|
crun_runtime:
|
|
name: crun
|
|
path: /usr/bin/crun
|
|
type: oci
|
|
root: /run/crun
|
|
|
|
# youki is an implementation of the OCI runtime-spec in Rust, similar to runc.
|
|
youki_runtime:
|
|
name: youki
|
|
path: "{{ youki_bin_dir }}/youki"
|
|
type: oci
|
|
root: /run/youki
|
|
|
|
# When this is true, CRI-O package repositories are added. Set this to false when using an
|
|
# environment with preconfigured CRI-O package repositories.
|
|
crio_add_repos: true
|
|
|
|
# Allow crio offline installation
|
|
crio_download_base: "download.opensuse.org/repositories/devel:kubic:libcontainers:stable"
|
|
|
|
# Allow crio offline installation
|
|
crio_download_crio: "http://{{ crio_download_base }}:/cri-o:/"
|
|
|
|
# skopeo need for save/load images when download_run_once=true
|
|
skopeo_packages:
|
|
- "skopeo"
|
|
|
|
# Configure the cri-o pids limit, increase this for heavily multi-threaded workloads
|
|
# see https://github.com/cri-o/cri-o/issues/1921
|
|
crio_pids_limit: 1024
|
|
|
|
# Reserve 16M uids and gids for user namespaces (256 pods * 65536 uids/gids)
|
|
# at the end of the uid/gid space
|
|
crio_remap_enable: false
|
|
crio_remap_user: containers
|
|
crio_subuid_start: 2130706432
|
|
crio_subuid_length: 16777216
|
|
crio_subgid_start: 2130706432
|
|
crio_subgid_length: 16777216
|