e03e3c4582
* Enable Kata Containers for CRI-O runtime Kata Containers is an OCI runtime where containers are run inside lightweight VMs. This runtime has been enabled for containerd runtime thru the kata_containers_enabled variable. This change enables Kata Containers to CRI-O container runtime. Signed-off-by: Victor Morales <v.morales@samsung.com> * Set appropiate conmon_cgroup when crio_cgroup_manager is 'cgroupfs' * Set manage_ns_lifecycle=true when KataContainers is enabed * Add preinstall check for katacontainers Signed-off-by: Victor Morales <v.morales@samsung.com> Co-authored-by: Pasquale Toscano <pasqualetoscano90@gmail.com>
52 lines
1.7 KiB
YAML
52 lines
1.7 KiB
YAML
---
|
|
|
|
crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}"
|
|
crio_conmon: "/usr/bin/conmon"
|
|
crio_enable_metrics: false
|
|
crio_log_level: "info"
|
|
crio_metrics_port: "9090"
|
|
crio_pause_image: "{{ pod_infra_image_repo }}:{{ pod_infra_version }}"
|
|
|
|
# Trusted registries to pull unqualified images (e.g. alpine:latest) from
|
|
# By default unqualified images are not allowed for security reasons
|
|
crio_registries: []
|
|
|
|
crio_seccomp_profile: ""
|
|
crio_selinux: "{{ (preinstall_selinux_state == 'enforcing')|lower }}"
|
|
crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
|
|
|
|
# Override system default for storage driver
|
|
# crio_storage_driver: "overlay"
|
|
|
|
crio_stream_port: "10010"
|
|
|
|
crio_required_version: "{{ kube_version | regex_replace('^v(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
|
|
|
|
crio_kubernetes_version_matrix:
|
|
"1.19": "1.19"
|
|
"1.18": "1.18"
|
|
"1.17": "1.17"
|
|
|
|
crio_version: "{{ crio_kubernetes_version_matrix[crio_required_version] | default('1.19') }}"
|
|
|
|
# The crio_runtimes variable defines a list of OCI compatible runtimes.
|
|
crio_runtimes:
|
|
- name: runc
|
|
path: /usr/bin/runc
|
|
type: oci
|
|
root: /run/runc
|
|
|
|
# Kata Containers is an OCI runtime, where containers are run inside lightweight
|
|
# VMs. Kata provides additional isolation towards the host, minimizing the host attack
|
|
# surface and mitigating the consequences of containers breakout.
|
|
kata_runtimes:
|
|
# Kata Containers with the default configured VMM
|
|
- name: kata-runtime
|
|
path: /opt/kata/bin/kata-runtime
|
|
type: oci
|
|
root: /run/kata-containers
|
|
# Kata Containers with the QEMU VMM
|
|
- name: kata-qemu
|
|
path: /opt/kata/bin/kata-qemu
|
|
type: oci
|
|
root: /run/kata-containers
|