summaryrefslogtreecommitdiffstats
path: root/roles/container_runtime
diff options
context:
space:
mode:
Diffstat (limited to 'roles/container_runtime')
-rw-r--r--roles/container_runtime/README.md4
-rw-r--r--roles/container_runtime/defaults/main.yml20
-rw-r--r--roles/container_runtime/meta/main.yml2
-rw-r--r--roles/container_runtime/tasks/common/post.yml4
-rw-r--r--roles/container_runtime/tasks/common/syscontainer_packages.yml6
-rw-r--r--roles/container_runtime/tasks/docker_storage_setup_overlay.yml10
-rw-r--r--roles/container_runtime/tasks/docker_upgrade_check.yml29
-rw-r--r--roles/container_runtime/tasks/main.yml2
-rw-r--r--roles/container_runtime/tasks/package_docker.yml8
-rw-r--r--roles/container_runtime/tasks/registry_auth.yml2
-rw-r--r--roles/container_runtime/tasks/systemcontainer_crio.yml15
-rw-r--r--roles/container_runtime/tasks/systemcontainer_docker.yml8
-rw-r--r--roles/container_runtime/templates/crio-network.j29
-rw-r--r--roles/container_runtime/templates/docker_storage_setup.j212
14 files changed, 100 insertions, 31 deletions
diff --git a/roles/container_runtime/README.md b/roles/container_runtime/README.md
index 51f469aaf..665b1b012 100644
--- a/roles/container_runtime/README.md
+++ b/roles/container_runtime/README.md
@@ -5,7 +5,7 @@ Ensures docker package or system container is installed, and optionally raises t
container-daemon.json items may be found at https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file
-This role is designed to be used with include_role and tasks_from.
+This role is designed to be used with import_role and tasks_from.
Entry points
------------
@@ -30,7 +30,7 @@ Example Playbook
- hosts: servers
tasks:
- - include_role: container_runtime
+ - import_role: container_runtime
tasks_from: package_docker.yml
License
diff --git a/roles/container_runtime/defaults/main.yml b/roles/container_runtime/defaults/main.yml
index dd185cb38..d0e37e2f4 100644
--- a/roles/container_runtime/defaults/main.yml
+++ b/roles/container_runtime/defaults/main.yml
@@ -2,8 +2,6 @@
docker_cli_auth_config_path: '/root/.docker'
openshift_docker_signature_verification: False
-repoquery_cmd: "{{ 'dnf repoquery --latest-limit 1 -d 0' if ansible_pkg_mgr == 'dnf' else 'repoquery --plugins' }}"
-
openshift_docker_alternative_creds: False
# oreg_url is defined by user input.
@@ -13,7 +11,7 @@ oreg_auth_credentials_replace: False
openshift_docker_use_system_container: False
openshift_docker_disable_push_dockerhub: False # bool
openshift_docker_selinux_enabled: True
-openshift_docker_service_name: "{{ 'container-engine' if (openshift_docker_use_system_container | default(False)) else 'docker' }}"
+openshift_docker_service_name: "{{ 'container-engine' if (openshift_docker_use_system_container | default(False) | bool) else 'docker' }}"
openshift_docker_hosted_registry_insecure: False # bool
@@ -55,11 +53,25 @@ openshift_docker_is_node_or_master: "{{ True if inventory_hostname in (groups['o
docker_alt_storage_path: /var/lib/containers/docker
docker_default_storage_path: /var/lib/docker
+docker_storage_path: "{{ docker_default_storage_path }}"
+docker_storage_size: 40G
+docker_storage_setup_options:
+ vg: docker_vg
+ data_size: 99%VG
+ storage_driver: overlay2
+ root_lv_name: docker-root-lv
+ root_lv_size: 100%FREE
+ root_lv_mount_path: "{{ docker_storage_path }}"
+docker_storage_extra_options:
+- "--storage-opt overlay2.override_kernel_check=true"
+- "--storage-opt overlay2.size={{ docker_storage_size }}"
+- "--graph={{ docker_storage_path}}"
+
# Set local versions of facts that must be in json format for container-daemon.json
# NOTE: When jinja2.9+ is used the container-daemon.json file can move to using tojson
l_docker_log_options: "{{ l2_docker_log_options | to_json }}"
-l_docker_log_options_dict: "{{ l2_docker_log_options | oo_list_to_dict | to_json }}"
+l_docker_log_options_dict: "{{ l2_docker_log_options | lib_utils_oo_list_to_dict | to_json }}"
l_docker_additional_registries: "{{ l2_docker_additional_registries | to_json }}"
l_docker_blocked_registries: "{{ l2_docker_blocked_registries | to_json }}"
l_docker_insecure_registries: "{{ l2_docker_insecure_registries | to_json }}"
diff --git a/roles/container_runtime/meta/main.yml b/roles/container_runtime/meta/main.yml
index 02fceb745..3bc2607fb 100644
--- a/roles/container_runtime/meta/main.yml
+++ b/roles/container_runtime/meta/main.yml
@@ -11,5 +11,5 @@ galaxy_info:
- 7
dependencies:
- role: lib_openshift
-- role: lib_os_firewall
- role: lib_utils
+- role: openshift_facts
diff --git a/roles/container_runtime/tasks/common/post.yml b/roles/container_runtime/tasks/common/post.yml
index d790eb2c0..23fd8528a 100644
--- a/roles/container_runtime/tasks/common/post.yml
+++ b/roles/container_runtime/tasks/common/post.yml
@@ -11,7 +11,7 @@
- meta: flush_handlers
# This needs to run after docker is restarted to account for proxy settings.
-# registry_auth is called directly with include_role in some places, so we
+# registry_auth is called directly with import_role in some places, so we
# have to put it in the root of the tasks/ directory.
- include_tasks: ../registry_auth.yml
@@ -22,5 +22,5 @@
- include_tasks: setup_docker_symlink.yml
when:
- - openshift_use_crio
+ - openshift_use_crio | bool
- dockerstat.stat.islnk is defined and not (dockerstat.stat.islnk | bool)
diff --git a/roles/container_runtime/tasks/common/syscontainer_packages.yml b/roles/container_runtime/tasks/common/syscontainer_packages.yml
index b41122880..d429047e6 100644
--- a/roles/container_runtime/tasks/common/syscontainer_packages.yml
+++ b/roles/container_runtime/tasks/common/syscontainer_packages.yml
@@ -4,7 +4,7 @@
package:
name: container-selinux
state: present
- when: not openshift.common.is_atomic | bool
+ when: not openshift_is_atomic | bool
register: result
until: result is succeeded
@@ -13,7 +13,7 @@
package:
name: atomic
state: present
- when: not openshift.common.is_atomic | bool
+ when: not openshift_is_atomic | bool
register: result
until: result is succeeded
@@ -23,6 +23,6 @@
package:
name: runc
state: present
- when: not openshift.common.is_atomic | bool
+ when: not openshift_is_atomic | bool
register: result
until: result is succeeded
diff --git a/roles/container_runtime/tasks/docker_storage_setup_overlay.yml b/roles/container_runtime/tasks/docker_storage_setup_overlay.yml
new file mode 100644
index 000000000..782c002e3
--- /dev/null
+++ b/roles/container_runtime/tasks/docker_storage_setup_overlay.yml
@@ -0,0 +1,10 @@
+---
+- name: Setup the docker-storage for overlay
+ template:
+ src: docker_storage_setup.j2
+ dest: /etc/sysconfig/docker-storage-setup
+ owner: root
+ group: root
+ mode: 0664
+ when:
+ - container_runtime_docker_storage_type == 'overlay2'
diff --git a/roles/container_runtime/tasks/docker_upgrade_check.yml b/roles/container_runtime/tasks/docker_upgrade_check.yml
index 6731963dd..8dd916e79 100644
--- a/roles/container_runtime/tasks/docker_upgrade_check.yml
+++ b/roles/container_runtime/tasks/docker_upgrade_check.yml
@@ -21,6 +21,7 @@
retries: 4
until: curr_docker_version is succeeded
changed_when: false
+ when: not openshift_is_atomic | bool
- name: Get latest available version of Docker
command: >
@@ -29,7 +30,9 @@
retries: 4
until: avail_docker_version is succeeded
# Don't expect docker rpm to be available on hosts that don't already have it installed:
- when: pkg_check.rc == 0
+ when:
+ - not openshift_is_atomic | bool
+ - pkg_check.rc == 0
failed_when: false
changed_when: false
@@ -37,9 +40,10 @@
msg: This playbook requires access to Docker 1.12 or later
# Disable the 1.12 requirement if the user set a specific Docker version
when:
- - docker_version is not defined
- - docker_upgrade is not defined or docker_upgrade | bool == True
- - (pkg_check.rc == 0 and (avail_docker_version.stdout == "" or avail_docker_version.stdout is version_compare('1.12','<')))
+ - not openshift_is_atomic | bool
+ - docker_version is not defined
+ - docker_upgrade is not defined or docker_upgrade | bool == True
+ - (pkg_check.rc == 0 and (avail_docker_version.stdout == "" or avail_docker_version.stdout is version_compare('1.12','<')))
# Default l_docker_upgrade to False, we'll set to True if an upgrade is required:
- set_fact:
@@ -48,27 +52,30 @@
# Make sure a docker_version is set if none was requested:
- set_fact:
docker_version: "{{ avail_docker_version.stdout }}"
- when: pkg_check.rc == 0 and docker_version is not defined
+ when:
+ - not openshift_is_atomic | bool
+ - pkg_check.rc == 0 and docker_version is not defined
- name: Flag for Docker upgrade if necessary
set_fact:
l_docker_upgrade: True
when:
- - pkg_check.rc == 0
- - curr_docker_version.stdout is version_compare(docker_version,'<')
+ - not openshift_is_atomic | bool
+ - pkg_check.rc == 0
+ - curr_docker_version.stdout is version_compare(docker_version,'<')
# Additional checks for Atomic hosts:
- name: Determine available Docker
shell: "rpm -q --queryformat '---\ncurr_version: %{VERSION}\navail_version: \n' docker"
register: g_atomic_docker_version_result
- when: openshift.common.is_atomic | bool
+ when: openshift_is_atomic | bool
- set_fact:
l_docker_version: "{{ g_atomic_docker_version_result.stdout | from_yaml }}"
- when: openshift.common.is_atomic | bool
+ when: openshift_is_atomic | bool
- fail:
msg: This playbook requires access to Docker 1.12 or later
when:
- - openshift.common.is_atomic | bool
- - l_docker_version.avail_version | default(l_docker_version.curr_version, true) is version_compare('1.12','<')
+ - openshift_is_atomic | bool
+ - l_docker_version.avail_version | default(l_docker_version.curr_version, true) is version_compare('1.12','<')
diff --git a/roles/container_runtime/tasks/main.yml b/roles/container_runtime/tasks/main.yml
index 96d8606c6..07da831c4 100644
--- a/roles/container_runtime/tasks/main.yml
+++ b/roles/container_runtime/tasks/main.yml
@@ -1,2 +1,2 @@
---
-# This role is meant to be used with include_role and tasks_from.
+# This role is meant to be used with import_role and tasks_from.
diff --git a/roles/container_runtime/tasks/package_docker.yml b/roles/container_runtime/tasks/package_docker.yml
index d9d4037dd..d6e7e7fed 100644
--- a/roles/container_runtime/tasks/package_docker.yml
+++ b/roles/container_runtime/tasks/package_docker.yml
@@ -3,7 +3,7 @@
- name: Get current installed Docker version
command: "{{ repoquery_installed }} --qf '%{version}' docker"
- when: not openshift.common.is_atomic | bool
+ when: not openshift_is_atomic | bool
register: curr_docker_version
retries: 4
until: curr_docker_version is succeeded
@@ -20,7 +20,7 @@
name: "docker{{ '-' + docker_version if docker_version is defined else '' }}"
state: present
when:
- - not (openshift.common.is_atomic | bool)
+ - not (openshift_is_atomic | bool)
- not (curr_docker_version is skipped)
- not (curr_docker_version.stdout != '')
register: result
@@ -48,7 +48,7 @@
lineinfile:
dest: /etc/sysconfig/docker
regexp: '^{{ item.reg_conf_var }}=.*$'
- line: "{{ item.reg_conf_var }}='{{ item.reg_fact_val | oo_prepend_strings_in_list(item.reg_flag ~ ' ') | join(' ') }}'"
+ line: "{{ item.reg_conf_var }}='{{ item.reg_fact_val | lib_utils_oo_prepend_strings_in_list(item.reg_flag ~ ' ') | join(' ') }}'"
when:
- item.reg_fact_val != []
- docker_check.stat.isreg is defined
@@ -101,7 +101,7 @@
line: "OPTIONS='\
{% if ansible_selinux.status | default(None) == 'enabled' and openshift_docker_selinux_enabled | default(true) | bool %} --selinux-enabled {% endif %} \
{% if openshift_docker_log_driver | bool %} --log-driver {{ openshift_docker_log_driver }}{% endif %} \
- {% if l2_docker_log_options != [] %} {{ l2_docker_log_options | oo_split() | oo_prepend_strings_in_list('--log-opt ') | join(' ')}}{% endif %} \
+ {% if l2_docker_log_options != [] %} {{ l2_docker_log_options | lib_utils_oo_split() | lib_utils_oo_prepend_strings_in_list('--log-opt ') | join(' ')}}{% endif %} \
{% if openshift_docker_hosted_registry_insecure and (openshift_docker_hosted_registry_network | bool) %} --insecure-registry={{ openshift_docker_hosted_registry_network }} {% endif %} \
{% if docker_options is defined %} {{ docker_options }}{% endif %} \
{% if openshift_docker_options %} {{ openshift_docker_options }}{% endif %} \
diff --git a/roles/container_runtime/tasks/registry_auth.yml b/roles/container_runtime/tasks/registry_auth.yml
index 2c7bc5711..4f1abd59a 100644
--- a/roles/container_runtime/tasks/registry_auth.yml
+++ b/roles/container_runtime/tasks/registry_auth.yml
@@ -15,6 +15,7 @@
- not openshift_docker_alternative_creds | bool
- oreg_auth_user is defined
- (not docker_cli_auth_credentials_stat.stat.exists or oreg_auth_credentials_replace) | bool
+ no_log: True
# docker_creds is a custom module from lib_utils
# 'docker login' requires a docker.service running on the local host, this is an
@@ -30,3 +31,4 @@
- openshift_docker_alternative_creds | bool
- oreg_auth_user is defined
- (not docker_cli_auth_credentials_stat.stat.exists or oreg_auth_credentials_replace) | bool
+ no_log: True
diff --git a/roles/container_runtime/tasks/systemcontainer_crio.yml b/roles/container_runtime/tasks/systemcontainer_crio.yml
index 61f122f3c..d588f2618 100644
--- a/roles/container_runtime/tasks/systemcontainer_crio.yml
+++ b/roles/container_runtime/tasks/systemcontainer_crio.yml
@@ -3,7 +3,7 @@
- name: Check we are not using node as a Docker container with CRI-O
fail: msg='Cannot use CRI-O with node configured as a Docker container'
when:
- - openshift.common.is_containerized | bool
+ - openshift_is_containerized | bool
- not l_is_node_system_container | bool
- include_tasks: common/pre.yml
@@ -81,6 +81,17 @@
dest: /etc/cni/net.d/openshift-sdn.conf
src: 80-openshift-sdn.conf.j2
+- name: Create /etc/sysconfig/crio-storage
+ copy:
+ content: ""
+ dest: /etc/sysconfig/crio-storage
+ force: no
+
+- name: Create /etc/sysconfig/crio-network
+ template:
+ dest: /etc/sysconfig/crio-network
+ src: crio-network.j2
+
- name: Start the CRI-O service
systemd:
name: "cri-o"
@@ -93,4 +104,4 @@
# 'docker login'
- include_tasks: common/post.yml
vars:
- openshift_docker_alternative_creds: "{{ openshift_use_crio_only }}"
+ openshift_docker_alternative_creds: "{{ openshift_use_crio_only | bool }}"
diff --git a/roles/container_runtime/tasks/systemcontainer_docker.yml b/roles/container_runtime/tasks/systemcontainer_docker.yml
index 639585367..5f715cd21 100644
--- a/roles/container_runtime/tasks/systemcontainer_docker.yml
+++ b/roles/container_runtime/tasks/systemcontainer_docker.yml
@@ -18,7 +18,7 @@
# Make sure Docker is installed so we are able to use the client
- name: Install Docker so we can use the client
package: name=docker{{ '-' + docker_version if docker_version is defined else '' }} state=present
- when: not openshift.common.is_atomic | bool
+ when: not openshift_is_atomic | bool
register: result
until: result is succeeded
@@ -42,6 +42,12 @@
- debug:
var: l_docker_image
+# Do the authentication before pulling the container engine system container
+# as the pull might be from an authenticated registry.
+- include_tasks: registry_auth.yml
+ vars:
+ openshift_docker_alternative_creds: True
+
# NOTE: no_proxy added as a workaround until https://github.com/projectatomic/atomic/pull/999 is released
- name: Pre-pull Container Engine System Container image
command: "atomic pull --storage ostree {{ l_docker_image }}"
diff --git a/roles/container_runtime/templates/crio-network.j2 b/roles/container_runtime/templates/crio-network.j2
new file mode 100644
index 000000000..763be97d7
--- /dev/null
+++ b/roles/container_runtime/templates/crio-network.j2
@@ -0,0 +1,9 @@
+{% if 'http_proxy' in openshift.common %}
+HTTP_PROXY={{ openshift.common.http_proxy }}
+{% endif %}
+{% if 'https_proxy' in openshift.common %}
+HTTPS_PROXY={{ openshift.common.https_proxy }}
+{% endif %}
+{% if 'no_proxy' in openshift.common %}
+NO_PROXY={{ openshift.common.no_proxy }}
+{% endif %}
diff --git a/roles/container_runtime/templates/docker_storage_setup.j2 b/roles/container_runtime/templates/docker_storage_setup.j2
new file mode 100644
index 000000000..b056087e0
--- /dev/null
+++ b/roles/container_runtime/templates/docker_storage_setup.j2
@@ -0,0 +1,12 @@
+# Edit this file to override any configuration options specified in
+# /usr/lib/docker-storage-setup/docker-storage-setup.
+#
+# For more details refer to "man docker-storage-setup"
+DEVS={{ container_runtime_docker_storage_setup_device }}
+VG={{ docker_storage_setup_options.vg }}
+DATA_SIZE={{ docker_storage_setup_options.data_size }}
+STORAGE_DRIVER="{{ docker_storage_setup_options.storage_driver }}"
+CONTAINER_ROOT_LV_NAME="{{ docker_storage_setup_options.root_lv_name }}"
+CONTAINER_ROOT_LV_SIZE="{{ docker_storage_setup_options.root_lv_size }}"
+CONTAINER_ROOT_LV_MOUNT_PATH="{{ docker_storage_setup_options.root_lv_mount_path }}"
+EXTRA_STORAGE_OPTIONS="{{ docker_storage_extra_options | join(' ') }}"
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-17 23:44:20 +0000