From fd882160aa2ac03b6f3dc84647b227c65db50635 Mon Sep 17 00:00:00 2001
From: Kenny Woodson <kwoodson@redhat.com>
Date: Fri, 15 Dec 2017 14:56:50 -0500
Subject: Adding no_log to registry_auth.

---
 roles/container_runtime/tasks/registry_auth.yml | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/tasks/registry_auth.yml b/roles/container_runtime/tasks/registry_auth.yml
index 2c7bc5711..4f1abd59a 100644
--- a/roles/container_runtime/tasks/registry_auth.yml
+++ b/roles/container_runtime/tasks/registry_auth.yml
@@ -15,6 +15,7 @@
   - not openshift_docker_alternative_creds | bool
   - oreg_auth_user is defined
   - (not docker_cli_auth_credentials_stat.stat.exists or oreg_auth_credentials_replace) | bool
+  no_log: True
 
 # docker_creds is a custom module from lib_utils
 # 'docker login' requires a docker.service running on the local host, this is an
@@ -30,3 +31,4 @@
   - openshift_docker_alternative_creds | bool
   - oreg_auth_user is defined
   - (not docker_cli_auth_credentials_stat.stat.exists or oreg_auth_credentials_replace) | bool
+  no_log: True
-- 
cgit v1.2.3


From 801779eeb6f6308f81ae7c48409de7686c04a0aa Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Wed, 13 Dec 2017 12:42:32 -0500
Subject: Relocate filter plugins to lib_utils

This commit relocates filter_plugings to lib_utils,
changes the namespacing to prevent unintended use of
older versions that may be present in filter_plugins/
directory on existing installs.

Add lib_utils to meta depends for roles

Also consolidate some plugins into lib_utils from
various other areas.

Update rpm spec, obsolete plugin rpms.
---
 roles/container_runtime/defaults/main.yml        | 2 +-
 roles/container_runtime/meta/main.yml            | 1 -
 roles/container_runtime/tasks/package_docker.yml | 4 ++--
 3 files changed, 3 insertions(+), 4 deletions(-)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/defaults/main.yml b/roles/container_runtime/defaults/main.yml
index dd185cb38..6ab0456bc 100644
--- a/roles/container_runtime/defaults/main.yml
+++ b/roles/container_runtime/defaults/main.yml
@@ -59,7 +59,7 @@ docker_default_storage_path: /var/lib/docker
 # Set local versions of facts that must be in json format for container-daemon.json
 # NOTE: When jinja2.9+ is used the container-daemon.json file can move to using tojson
 l_docker_log_options: "{{ l2_docker_log_options | to_json }}"
-l_docker_log_options_dict: "{{ l2_docker_log_options | oo_list_to_dict | to_json }}"
+l_docker_log_options_dict: "{{ l2_docker_log_options | lib_utils_oo_list_to_dict | to_json }}"
 l_docker_additional_registries: "{{ l2_docker_additional_registries | to_json }}"
 l_docker_blocked_registries: "{{ l2_docker_blocked_registries | to_json }}"
 l_docker_insecure_registries: "{{ l2_docker_insecure_registries | to_json }}"
diff --git a/roles/container_runtime/meta/main.yml b/roles/container_runtime/meta/main.yml
index 02fceb745..5c4c569de 100644
--- a/roles/container_runtime/meta/main.yml
+++ b/roles/container_runtime/meta/main.yml
@@ -11,5 +11,4 @@ galaxy_info:
     - 7
 dependencies:
 - role: lib_openshift
-- role: lib_os_firewall
 - role: lib_utils
diff --git a/roles/container_runtime/tasks/package_docker.yml b/roles/container_runtime/tasks/package_docker.yml
index d9d4037dd..6604e6ad5 100644
--- a/roles/container_runtime/tasks/package_docker.yml
+++ b/roles/container_runtime/tasks/package_docker.yml
@@ -48,7 +48,7 @@
   lineinfile:
     dest: /etc/sysconfig/docker
     regexp: '^{{ item.reg_conf_var }}=.*$'
-    line: "{{ item.reg_conf_var }}='{{ item.reg_fact_val | oo_prepend_strings_in_list(item.reg_flag ~ ' ') | join(' ') }}'"
+    line: "{{ item.reg_conf_var }}='{{ item.reg_fact_val | lib_utils_oo_prepend_strings_in_list(item.reg_flag ~ ' ') | join(' ') }}'"
   when:
   - item.reg_fact_val != []
   - docker_check.stat.isreg is defined
@@ -101,7 +101,7 @@
     line: "OPTIONS='\
       {% if ansible_selinux.status | default(None) == 'enabled' and openshift_docker_selinux_enabled | default(true) | bool %} --selinux-enabled {% endif %} \
       {% if openshift_docker_log_driver | bool %} --log-driver {{ openshift_docker_log_driver }}{% endif %} \
-      {% if l2_docker_log_options != [] %} {{ l2_docker_log_options |  oo_split() | oo_prepend_strings_in_list('--log-opt ') | join(' ')}}{% endif %} \
+      {% if l2_docker_log_options != [] %} {{ l2_docker_log_options |  lib_utils_oo_split() | lib_utils_oo_prepend_strings_in_list('--log-opt ') | join(' ')}}{% endif %} \
       {% if openshift_docker_hosted_registry_insecure and (openshift_docker_hosted_registry_network | bool) %} --insecure-registry={{ openshift_docker_hosted_registry_network }} {% endif %} \
       {% if docker_options is defined %} {{ docker_options }}{% endif %} \
       {% if openshift_docker_options %} {{ openshift_docker_options }}{% endif %} \
-- 
cgit v1.2.3


From 5c6af565bfae851b493c8b4670d56f69016de3bb Mon Sep 17 00:00:00 2001
From: Kenny Woodson <kwoodson@redhat.com>
Date: Tue, 19 Dec 2017 11:02:28 -0500
Subject: Adding support for docker-storage-setup on overlay

---
 roles/container_runtime/defaults/main.yml                  | 14 ++++++++++++++
 .../tasks/docker_storage_setup_overlay.yml                 | 10 ++++++++++
 roles/container_runtime/templates/docker_storage_setup.j2  | 12 ++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 roles/container_runtime/tasks/docker_storage_setup_overlay.yml
 create mode 100644 roles/container_runtime/templates/docker_storage_setup.j2

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/defaults/main.yml b/roles/container_runtime/defaults/main.yml
index dd185cb38..561edcaca 100644
--- a/roles/container_runtime/defaults/main.yml
+++ b/roles/container_runtime/defaults/main.yml
@@ -55,6 +55,20 @@ openshift_docker_is_node_or_master: "{{ True if inventory_hostname in (groups['o
 
 docker_alt_storage_path: /var/lib/containers/docker
 docker_default_storage_path: /var/lib/docker
+docker_storage_path: "{{ docker_default_storage_path }}"
+docker_storage_size: 40G
+docker_storage_setup_options:
+  vg: docker_vg
+  data_size: 99%VG
+  storage_driver: overlay2
+  root_lv_name: docker-root-lv
+  root_lv_size: 100%FREE
+  root_lv_mount_path: "{{ docker_storage_path }}"
+docker_storage_extra_options:
+- "--storage-opt overlay2.override_kernel_check=true"
+- "--storage-opt overlay2.size={{ docker_storage_size }}"
+- "--graph={{ docker_storage_path}}"
+
 
 # Set local versions of facts that must be in json format for container-daemon.json
 # NOTE: When jinja2.9+ is used the container-daemon.json file can move to using tojson
diff --git a/roles/container_runtime/tasks/docker_storage_setup_overlay.yml b/roles/container_runtime/tasks/docker_storage_setup_overlay.yml
new file mode 100644
index 000000000..782c002e3
--- /dev/null
+++ b/roles/container_runtime/tasks/docker_storage_setup_overlay.yml
@@ -0,0 +1,10 @@
+---
+- name: Setup the docker-storage for overlay
+  template:
+    src: docker_storage_setup.j2
+    dest: /etc/sysconfig/docker-storage-setup
+    owner: root
+    group: root
+    mode: 0664
+  when:
+  - container_runtime_docker_storage_type == 'overlay2'
diff --git a/roles/container_runtime/templates/docker_storage_setup.j2 b/roles/container_runtime/templates/docker_storage_setup.j2
new file mode 100644
index 000000000..b056087e0
--- /dev/null
+++ b/roles/container_runtime/templates/docker_storage_setup.j2
@@ -0,0 +1,12 @@
+# Edit this file to override any configuration options specified in
+# /usr/lib/docker-storage-setup/docker-storage-setup.
+#
+# For more details refer to "man docker-storage-setup"
+DEVS={{ container_runtime_docker_storage_setup_device }}
+VG={{ docker_storage_setup_options.vg }}
+DATA_SIZE={{ docker_storage_setup_options.data_size }}
+STORAGE_DRIVER="{{ docker_storage_setup_options.storage_driver }}"
+CONTAINER_ROOT_LV_NAME="{{ docker_storage_setup_options.root_lv_name }}"
+CONTAINER_ROOT_LV_SIZE="{{ docker_storage_setup_options.root_lv_size }}"
+CONTAINER_ROOT_LV_MOUNT_PATH="{{ docker_storage_setup_options.root_lv_mount_path }}"
+EXTRA_STORAGE_OPTIONS="{{ docker_storage_extra_options | join(' ') }}"
-- 
cgit v1.2.3


From e6c159afb4ba39a7266c750d43d6a5e911cc8f21 Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Mon, 18 Dec 2017 16:13:36 -0500
Subject: Remove openshift.common.{is_atomic|is_containerized}

We set these variables using facts in init, no need
to duplicate the logic all around the codebase.
---
 roles/container_runtime/tasks/common/syscontainer_packages.yml | 6 +++---
 roles/container_runtime/tasks/docker_upgrade_check.yml         | 6 +++---
 roles/container_runtime/tasks/package_docker.yml               | 4 ++--
 roles/container_runtime/tasks/systemcontainer_crio.yml         | 2 +-
 roles/container_runtime/tasks/systemcontainer_docker.yml       | 2 +-
 5 files changed, 10 insertions(+), 10 deletions(-)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/tasks/common/syscontainer_packages.yml b/roles/container_runtime/tasks/common/syscontainer_packages.yml
index b41122880..d429047e6 100644
--- a/roles/container_runtime/tasks/common/syscontainer_packages.yml
+++ b/roles/container_runtime/tasks/common/syscontainer_packages.yml
@@ -4,7 +4,7 @@
   package:
     name: container-selinux
     state: present
-  when: not openshift.common.is_atomic | bool
+  when: not openshift_is_atomic | bool
   register: result
   until: result is succeeded
 
@@ -13,7 +13,7 @@
   package:
     name: atomic
     state: present
-  when: not openshift.common.is_atomic | bool
+  when: not openshift_is_atomic | bool
   register: result
   until: result is succeeded
 
@@ -23,6 +23,6 @@
   package:
     name: runc
     state: present
-  when: not openshift.common.is_atomic | bool
+  when: not openshift_is_atomic | bool
   register: result
   until: result is succeeded
diff --git a/roles/container_runtime/tasks/docker_upgrade_check.yml b/roles/container_runtime/tasks/docker_upgrade_check.yml
index 6731963dd..7831f4c7d 100644
--- a/roles/container_runtime/tasks/docker_upgrade_check.yml
+++ b/roles/container_runtime/tasks/docker_upgrade_check.yml
@@ -61,14 +61,14 @@
 - name: Determine available Docker
   shell: "rpm -q --queryformat '---\ncurr_version: %{VERSION}\navail_version: \n' docker"
   register: g_atomic_docker_version_result
-  when: openshift.common.is_atomic | bool
+  when: openshift_is_atomic | bool
 
 - set_fact:
     l_docker_version: "{{ g_atomic_docker_version_result.stdout | from_yaml }}"
-  when: openshift.common.is_atomic | bool
+  when: openshift_is_atomic | bool
 
 - fail:
     msg: This playbook requires access to Docker 1.12 or later
   when:
-  - openshift.common.is_atomic | bool
+  - openshift_is_atomic | bool
   - l_docker_version.avail_version | default(l_docker_version.curr_version, true) is version_compare('1.12','<')
diff --git a/roles/container_runtime/tasks/package_docker.yml b/roles/container_runtime/tasks/package_docker.yml
index 6604e6ad5..d6e7e7fed 100644
--- a/roles/container_runtime/tasks/package_docker.yml
+++ b/roles/container_runtime/tasks/package_docker.yml
@@ -3,7 +3,7 @@
 
 - name: Get current installed Docker version
   command: "{{ repoquery_installed }} --qf '%{version}' docker"
-  when: not openshift.common.is_atomic | bool
+  when: not openshift_is_atomic | bool
   register: curr_docker_version
   retries: 4
   until: curr_docker_version is succeeded
@@ -20,7 +20,7 @@
     name: "docker{{ '-' + docker_version if docker_version is defined else '' }}"
     state: present
   when:
-  - not (openshift.common.is_atomic | bool)
+  - not (openshift_is_atomic | bool)
   - not (curr_docker_version is skipped)
   - not (curr_docker_version.stdout != '')
   register: result
diff --git a/roles/container_runtime/tasks/systemcontainer_crio.yml b/roles/container_runtime/tasks/systemcontainer_crio.yml
index 61f122f3c..6a195a938 100644
--- a/roles/container_runtime/tasks/systemcontainer_crio.yml
+++ b/roles/container_runtime/tasks/systemcontainer_crio.yml
@@ -3,7 +3,7 @@
 - name: Check we are not using node as a Docker container with CRI-O
   fail: msg='Cannot use CRI-O with node configured as a Docker container'
   when:
-    - openshift.common.is_containerized | bool
+    - openshift_is_containerized | bool
     - not l_is_node_system_container | bool
 
 - include_tasks: common/pre.yml
diff --git a/roles/container_runtime/tasks/systemcontainer_docker.yml b/roles/container_runtime/tasks/systemcontainer_docker.yml
index 639585367..dc0452553 100644
--- a/roles/container_runtime/tasks/systemcontainer_docker.yml
+++ b/roles/container_runtime/tasks/systemcontainer_docker.yml
@@ -18,7 +18,7 @@
 # Make sure Docker is installed so we are able to use the client
 - name: Install Docker so we can use the client
   package: name=docker{{ '-' + docker_version if docker_version is defined else '' }} state=present
-  when: not openshift.common.is_atomic | bool
+  when: not openshift_is_atomic | bool
   register: result
   until: result is succeeded
 
-- 
cgit v1.2.3


From edde00af6a5b811468fe2a0e9bff45346103be92 Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Tue, 19 Dec 2017 15:36:57 -0500
Subject: Move validate_hosts to prerequisites.yml

Move more checks outside of init/main.yml for
speeding up upgrades and other operational plays that
need to run.
---
 roles/container_runtime/defaults/main.yml | 2 --
 1 file changed, 2 deletions(-)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/defaults/main.yml b/roles/container_runtime/defaults/main.yml
index 3e4b0c2b8..f4e249792 100644
--- a/roles/container_runtime/defaults/main.yml
+++ b/roles/container_runtime/defaults/main.yml
@@ -2,8 +2,6 @@
 docker_cli_auth_config_path: '/root/.docker'
 openshift_docker_signature_verification: False
 
-repoquery_cmd: "{{ 'dnf repoquery --latest-limit 1 -d 0' if ansible_pkg_mgr == 'dnf' else 'repoquery --plugins' }}"
-
 openshift_docker_alternative_creds: False
 
 # oreg_url is defined by user input.
-- 
cgit v1.2.3


From e3cf9edff6d0186b09b1a112592f283fab6857d0 Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Tue, 19 Dec 2017 16:36:47 -0500
Subject: Remove references to deployment_type

Move openshift_deployment_type check into sanity_check
action plugin.  Remove compatibility for deployment_type.

deployment_type has been deprecated for some time now.
---
 roles/container_runtime/meta/main.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/meta/main.yml b/roles/container_runtime/meta/main.yml
index 5c4c569de..3bc2607fb 100644
--- a/roles/container_runtime/meta/main.yml
+++ b/roles/container_runtime/meta/main.yml
@@ -12,3 +12,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: lib_utils
+- role: openshift_facts
-- 
cgit v1.2.3


From 1a99f2ee9fac6dfe02e56e227874371b40a0b4fe Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Tue, 2 Jan 2018 14:21:36 -0500
Subject: Cast openshift_docker_use_system_container to bool

openshift_docker_use_system_container might be passed
in via ini inventory as 'openshift_docker_use_system_container=false'

This condition will be interpreted as a string type, instead of
boolean.

Casting openshift_docker_use_system_container as bool
will achieve the users desired intent.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1528943
---
 roles/container_runtime/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/defaults/main.yml b/roles/container_runtime/defaults/main.yml
index f4e249792..d0e37e2f4 100644
--- a/roles/container_runtime/defaults/main.yml
+++ b/roles/container_runtime/defaults/main.yml
@@ -11,7 +11,7 @@ oreg_auth_credentials_replace: False
 openshift_docker_use_system_container: False
 openshift_docker_disable_push_dockerhub: False  # bool
 openshift_docker_selinux_enabled: True
-openshift_docker_service_name: "{{ 'container-engine' if (openshift_docker_use_system_container | default(False)) else 'docker' }}"
+openshift_docker_service_name: "{{ 'container-engine' if (openshift_docker_use_system_container | default(False) | bool) else 'docker' }}"
 
 openshift_docker_hosted_registry_insecure: False  # bool
 
-- 
cgit v1.2.3


From 98eef4c6f0ff07c4812c7d15b5cf678c356f48c4 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Fri, 5 Jan 2018 10:07:35 +0100
Subject: crio: configure proxy variables

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1529478

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
 roles/container_runtime/tasks/systemcontainer_crio.yml | 5 +++++
 roles/container_runtime/templates/crio-network.j2      | 9 +++++++++
 2 files changed, 14 insertions(+)
 create mode 100644 roles/container_runtime/templates/crio-network.j2

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/tasks/systemcontainer_crio.yml b/roles/container_runtime/tasks/systemcontainer_crio.yml
index 6a195a938..30d233f5c 100644
--- a/roles/container_runtime/tasks/systemcontainer_crio.yml
+++ b/roles/container_runtime/tasks/systemcontainer_crio.yml
@@ -81,6 +81,11 @@
     dest: /etc/cni/net.d/openshift-sdn.conf
     src: 80-openshift-sdn.conf.j2
 
+- name: Create /etc/sysconfig/crio-network
+  template:
+    dest: /etc/sysconfig/crio-network
+    src: crio-network.j2
+
 - name: Start the CRI-O service
   systemd:
     name: "cri-o"
diff --git a/roles/container_runtime/templates/crio-network.j2 b/roles/container_runtime/templates/crio-network.j2
new file mode 100644
index 000000000..763be97d7
--- /dev/null
+++ b/roles/container_runtime/templates/crio-network.j2
@@ -0,0 +1,9 @@
+{% if 'http_proxy' in openshift.common %}
+HTTP_PROXY={{ openshift.common.http_proxy }}
+{% endif %}
+{% if 'https_proxy' in openshift.common %}
+HTTPS_PROXY={{ openshift.common.https_proxy }}
+{% endif %}
+{% if 'no_proxy' in openshift.common %}
+NO_PROXY={{ openshift.common.no_proxy }}
+{% endif %}
-- 
cgit v1.2.3


From 3e5a8a1b3c545c3050924fc70f105b3c23e7dce7 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Fri, 5 Jan 2018 10:07:54 +0100
Subject: crio: create /etc/sysconfig/crio-storage

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
 roles/container_runtime/tasks/systemcontainer_crio.yml | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/tasks/systemcontainer_crio.yml b/roles/container_runtime/tasks/systemcontainer_crio.yml
index 30d233f5c..eedb18604 100644
--- a/roles/container_runtime/tasks/systemcontainer_crio.yml
+++ b/roles/container_runtime/tasks/systemcontainer_crio.yml
@@ -81,6 +81,12 @@
     dest: /etc/cni/net.d/openshift-sdn.conf
     src: 80-openshift-sdn.conf.j2
 
+- name: Create /etc/sysconfig/crio-storage
+  copy:
+    content: ""
+    dest: /etc/sysconfig/crio-storage
+    force: no
+
 - name: Create /etc/sysconfig/crio-network
   template:
     dest: /etc/sysconfig/crio-network
-- 
cgit v1.2.3


From 3fcbdcfd7e3d1898ba3e1394e77f985efd11485f Mon Sep 17 00:00:00 2001
From: Vadim Rutkovsky <vrutkovs@redhat.com>
Date: Fri, 5 Jan 2018 16:16:34 +0100
Subject: docker_upgrade_check: skip repoquery calls on containerized setups

Fedora/CentOS Atomic hosts don't have repoquery installed - also there
is no need to check available Docker rpms in the repos for Atomic
---
 .../tasks/docker_upgrade_check.yml                 | 25 ++++++++++++++--------
 1 file changed, 16 insertions(+), 9 deletions(-)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/tasks/docker_upgrade_check.yml b/roles/container_runtime/tasks/docker_upgrade_check.yml
index 7831f4c7d..8dd916e79 100644
--- a/roles/container_runtime/tasks/docker_upgrade_check.yml
+++ b/roles/container_runtime/tasks/docker_upgrade_check.yml
@@ -21,6 +21,7 @@
   retries: 4
   until: curr_docker_version is succeeded
   changed_when: false
+  when: not openshift_is_atomic | bool
 
 - name: Get latest available version of Docker
   command: >
@@ -29,7 +30,9 @@
   retries: 4
   until: avail_docker_version is succeeded
   # Don't expect docker rpm to be available on hosts that don't already have it installed:
-  when: pkg_check.rc == 0
+  when:
+    - not openshift_is_atomic | bool
+    - pkg_check.rc == 0
   failed_when: false
   changed_when: false
 
@@ -37,9 +40,10 @@
     msg: This playbook requires access to Docker 1.12 or later
   # Disable the 1.12 requirement if the user set a specific Docker version
   when:
-  - docker_version is not defined
-  - docker_upgrade is not defined or docker_upgrade | bool == True
-  - (pkg_check.rc == 0 and (avail_docker_version.stdout == "" or avail_docker_version.stdout is version_compare('1.12','<')))
+    - not openshift_is_atomic | bool
+    - docker_version is not defined
+    - docker_upgrade is not defined or docker_upgrade | bool == True
+    - (pkg_check.rc == 0 and (avail_docker_version.stdout == "" or avail_docker_version.stdout is version_compare('1.12','<')))
 
 # Default l_docker_upgrade to False, we'll set to True if an upgrade is required:
 - set_fact:
@@ -48,14 +52,17 @@
 # Make sure a docker_version is set if none was requested:
 - set_fact:
     docker_version: "{{ avail_docker_version.stdout }}"
-  when: pkg_check.rc == 0 and docker_version is not defined
+  when:
+    - not openshift_is_atomic | bool
+    - pkg_check.rc == 0 and docker_version is not defined
 
 - name: Flag for Docker upgrade if necessary
   set_fact:
     l_docker_upgrade: True
   when:
-  - pkg_check.rc == 0
-  - curr_docker_version.stdout is version_compare(docker_version,'<')
+    - not openshift_is_atomic | bool
+    - pkg_check.rc == 0
+    - curr_docker_version.stdout is version_compare(docker_version,'<')
 
 # Additional checks for Atomic hosts:
 - name: Determine available Docker
@@ -70,5 +77,5 @@
 - fail:
     msg: This playbook requires access to Docker 1.12 or later
   when:
-  - openshift_is_atomic | bool
-  - l_docker_version.avail_version | default(l_docker_version.curr_version, true) is version_compare('1.12','<')
+    - openshift_is_atomic | bool
+    - l_docker_version.avail_version | default(l_docker_version.curr_version, true) is version_compare('1.12','<')
-- 
cgit v1.2.3


From eacc12897ca86a255f89b8a4537ce2b7004cf319 Mon Sep 17 00:00:00 2001
From: Scott Dodson <sdodson@redhat.com>
Date: Fri, 5 Jan 2018 12:44:56 -0500
Subject: Migrate to import_role for static role inclusion

In Ansible 2.2, the include_role directive came into existence as
a Tech Preview. It is still a Tech Preview through Ansible 2.4
(and in current devel branch), but with a noteable change. The
default behavior switched from static: true to static: false
because that functionality moved to the newly introduced
import_role directive (in order to stay consistent with include*
being dynamic in nature and `import* being static in nature).

The dynamic include is considerably more memory intensive as it will
dynamically create a role import for every host in the inventory
list to be used. (Also worth noting, there is at the time of this
writing an object allocation inefficiency in the dynamic include
that can in certain situations amplify this effect considerably)

This change is meant to mitigate the pressure on memory for the
Ansible control host.

We need to evaluate where it makes sense to dynamically include roles
and revert back to dynamic inclusion if and where it makes sense to do
so.
---
 roles/container_runtime/README.md             | 4 ++--
 roles/container_runtime/tasks/common/post.yml | 2 +-
 roles/container_runtime/tasks/main.yml        | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/README.md b/roles/container_runtime/README.md
index 51f469aaf..665b1b012 100644
--- a/roles/container_runtime/README.md
+++ b/roles/container_runtime/README.md
@@ -5,7 +5,7 @@ Ensures docker package or system container is installed, and optionally raises t
 
 container-daemon.json items may be found at https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file
 
-This role is designed to be used with include_role and tasks_from.
+This role is designed to be used with import_role and tasks_from.
 
 Entry points
 ------------
@@ -30,7 +30,7 @@ Example Playbook
 
     - hosts: servers
       tasks:
-      - include_role: container_runtime
+      - import_role: container_runtime
         tasks_from: package_docker.yml
 
 License
diff --git a/roles/container_runtime/tasks/common/post.yml b/roles/container_runtime/tasks/common/post.yml
index d790eb2c0..b90190ebf 100644
--- a/roles/container_runtime/tasks/common/post.yml
+++ b/roles/container_runtime/tasks/common/post.yml
@@ -11,7 +11,7 @@
 - meta: flush_handlers
 
 # This needs to run after docker is restarted to account for proxy settings.
-# registry_auth is called directly with include_role in some places, so we
+# registry_auth is called directly with import_role in some places, so we
 # have to put it in the root of the tasks/ directory.
 - include_tasks: ../registry_auth.yml
 
diff --git a/roles/container_runtime/tasks/main.yml b/roles/container_runtime/tasks/main.yml
index 96d8606c6..07da831c4 100644
--- a/roles/container_runtime/tasks/main.yml
+++ b/roles/container_runtime/tasks/main.yml
@@ -1,2 +1,2 @@
 ---
-# This role is meant to be used with include_role and tasks_from.
+# This role is meant to be used with import_role and tasks_from.
-- 
cgit v1.2.3


From 065584c1d0b653012d0a32a3410211c3fc362ec7 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Mon, 8 Jan 2018 11:39:33 +0100
Subject: container-engine: move registry_auth.yml before pull

so that the atomic pull takes into account the credentials if
required.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
 roles/container_runtime/tasks/systemcontainer_docker.yml | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/tasks/systemcontainer_docker.yml b/roles/container_runtime/tasks/systemcontainer_docker.yml
index dc0452553..5f715cd21 100644
--- a/roles/container_runtime/tasks/systemcontainer_docker.yml
+++ b/roles/container_runtime/tasks/systemcontainer_docker.yml
@@ -42,6 +42,12 @@
 - debug:
     var: l_docker_image
 
+# Do the authentication before pulling the container engine system container
+# as the pull might be from an authenticated registry.
+- include_tasks: registry_auth.yml
+  vars:
+    openshift_docker_alternative_creds: True
+
 # NOTE: no_proxy added as a workaround until https://github.com/projectatomic/atomic/pull/999 is released
 - name: Pre-pull Container Engine System Container image
   command: "atomic pull --storage ostree {{ l_docker_image }}"
-- 
cgit v1.2.3


From 7819056aa716356416f421b3916954c040f2824f Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Mon, 8 Jan 2018 14:12:52 -0500
Subject: Properly cast crio boolean variables to bool

Variables that are specifically booleans should be
cast to bool.  This is because users may sometimes
pass them as string values.  This is particularly
prevalent when using ini-style inventories.

Affected-by: https://github.com/ansible/ansible/issues/34591

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1531592
---
 roles/container_runtime/tasks/common/post.yml          | 2 +-
 roles/container_runtime/tasks/systemcontainer_crio.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'roles/container_runtime')

diff --git a/roles/container_runtime/tasks/common/post.yml b/roles/container_runtime/tasks/common/post.yml
index b90190ebf..23fd8528a 100644
--- a/roles/container_runtime/tasks/common/post.yml
+++ b/roles/container_runtime/tasks/common/post.yml
@@ -22,5 +22,5 @@
 
 - include_tasks: setup_docker_symlink.yml
   when:
-    - openshift_use_crio
+    - openshift_use_crio | bool
     - dockerstat.stat.islnk is defined and not (dockerstat.stat.islnk | bool)
diff --git a/roles/container_runtime/tasks/systemcontainer_crio.yml b/roles/container_runtime/tasks/systemcontainer_crio.yml
index eedb18604..d588f2618 100644
--- a/roles/container_runtime/tasks/systemcontainer_crio.yml
+++ b/roles/container_runtime/tasks/systemcontainer_crio.yml
@@ -104,4 +104,4 @@
 # 'docker login'
 - include_tasks: common/post.yml
   vars:
-    openshift_docker_alternative_creds: "{{ openshift_use_crio_only }}"
+    openshift_docker_alternative_creds: "{{ openshift_use_crio_only | bool }}"
-- 
cgit v1.2.3