d315f73080
* Ensure libseccomp is installed before starting containerd on CentOS 8 * Simplify libseccomp install on CentOS 8 - Uses `package` module - Replaces complex version check with 'state: latest'. The version must be > 2.3 when using with cri-o. - Removes unnecessary `not is_ostree` condition as CentOS 8 does not use ostree
142 lines
4.4 KiB
YAML
142 lines
4.4 KiB
YAML
---
|
|
- name: check if fedora coreos
|
|
stat:
|
|
path: /run/ostree-booted
|
|
register: ostree
|
|
|
|
- name: set is_ostree
|
|
set_fact:
|
|
is_ostree: "{{ ostree.stat.exists }}"
|
|
|
|
|
|
- name: Fail containerd setup if distribution is not supported
|
|
fail:
|
|
msg: "{{ ansible_distribution }} is not supported by containerd."
|
|
when:
|
|
- not ansible_distribution in ["CentOS","RedHat", "Ubuntu", "Debian", "Fedora"]
|
|
|
|
- name: gather os specific variables
|
|
include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- files:
|
|
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_version|lower|replace('/', '_') }}.yml"
|
|
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}-{{ host_architecture }}.yml"
|
|
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}.yml"
|
|
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_major_version|lower|replace('/', '_') }}.yml"
|
|
- "{{ ansible_distribution|lower }}-{{ host_architecture }}.yml"
|
|
- "{{ ansible_distribution|lower }}.yml"
|
|
- "{{ ansible_os_family|lower }}-{{ host_architecture }}.yml"
|
|
- "{{ ansible_os_family|lower }}.yml"
|
|
- defaults.yml
|
|
paths:
|
|
- ../vars
|
|
skip: true
|
|
tags:
|
|
- facts
|
|
|
|
- name: disable unified_cgroup_hierarchy in Fedora 31+
|
|
command: grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=0"
|
|
when:
|
|
- ansible_distribution == "Fedora"
|
|
- (ansible_distribution_major_version | int) >= 31
|
|
- ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] is not defined or ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] != '0'
|
|
|
|
- name: reboot in Fedora 31+
|
|
reboot:
|
|
when:
|
|
- ansible_distribution == "Fedora"
|
|
- (ansible_distribution_major_version | int) >= 31
|
|
- ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] is not defined or ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] != '0'
|
|
|
|
- include_tasks: containerd_repo.yml
|
|
when: not is_ostree
|
|
|
|
- name: Create containerd service systemd directory if it doesn't exist
|
|
file:
|
|
path: /etc/systemd/system/containerd.service.d
|
|
state: directory
|
|
|
|
- name: Write containerd proxy drop-in
|
|
template:
|
|
src: http-proxy.conf.j2
|
|
dest: /etc/systemd/system/containerd.service.d/http-proxy.conf
|
|
notify: restart containerd
|
|
when: http_proxy is defined or https_proxy is defined
|
|
|
|
- name: ensure containerd config directory
|
|
file:
|
|
dest: "{{ containerd_cfg_dir }}"
|
|
state: directory
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Copy containerd config file
|
|
template:
|
|
src: config.toml.j2
|
|
dest: "{{ containerd_cfg_dir }}/config.toml"
|
|
owner: "root"
|
|
mode: 0644
|
|
notify: restart containerd
|
|
|
|
# This is required to ensure any apt upgrade will not break kubernetes
|
|
- name: Set containerd pin priority to apt_preferences on Debian family
|
|
template:
|
|
src: "apt_preferences.d/debian_containerd.j2"
|
|
dest: "/etc/apt/preferences.d/containerd"
|
|
owner: "root"
|
|
mode: 0644
|
|
when:
|
|
- ansible_os_family in ['Ubuntu', 'Debian']
|
|
- not is_ostree
|
|
|
|
- name: ensure containerd packages are installed
|
|
action: "{{ containerd_package_info.pkg_mgr }}"
|
|
args:
|
|
pkg: "{{ item.name }}"
|
|
force: "{{ item.force | default(omit) }}"
|
|
conf_file: "{{ item.yum_conf | default(omit) }}"
|
|
state: present
|
|
update_cache: "{{ omit if ansible_distribution == 'Fedora' else True }}"
|
|
register: containerd_task_result
|
|
until: containerd_task_result is succeeded
|
|
retries: 4
|
|
delay: "{{ retry_stagger | d(3) }}"
|
|
with_items: "{{ containerd_package_info.pkgs }}"
|
|
notify: restart containerd
|
|
when:
|
|
- not is_ostree
|
|
- containerd_package_info.pkgs|length > 0
|
|
ignore_errors: true
|
|
|
|
- name: Check if runc is installed
|
|
stat:
|
|
path: "{{ runc_binary }}"
|
|
register: runc_stat
|
|
|
|
- name: Install runc package if necessary
|
|
action: "{{ containerd_package_info.pkg_mgr }}"
|
|
args:
|
|
pkg: runc
|
|
state: present
|
|
update_cache: "{{ omit if ansible_distribution == 'Fedora' else True }}"
|
|
register: runc_task_result
|
|
until: runc_task_result is succeeded
|
|
retries: 4
|
|
delay: "{{ retry_stagger | d(3) }}"
|
|
notify: restart containerd
|
|
when:
|
|
- not is_ostree
|
|
- not runc_stat.stat.exists
|
|
|
|
- name: Ensure latest version of libseccomp installed # noqa 403
|
|
package:
|
|
name: libseccomp
|
|
state: latest
|
|
when:
|
|
- ansible_distribution == "CentOS"
|
|
- ansible_distribution_major_version == "8"
|
|
notify: restart containerd
|
|
|
|
- include_tasks: crictl.yml
|