openstack/openstack-ansible-os_zun
Code Issues Proposed changes
openstack-ansible-os_zun/tasks/zun_compute.yml
Dmitriy Rabotyagov 51e347dcb9 Install kata containers from source 
At the moment there are no repositories exists for Ubuntu/Debian
to install kata from. The only options are snap or source installation.

To avoid using snap, we're fetching kata release from github and
proceeding with source installation.

With that we also update docker version to existing in the repos,
as otherwise it get's 23.0.0 installed, which fails to startup
due to removal of standalone mode support.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/883194
Change-Id: I3ee976062d9288536270f9b1d80750749174af22
2023-05-19 09:01:00 +00:00

322 lines
8.8 KiB
YAML
Raw Blame History

---
# Copyright 2018, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Run apt install block
block:
- name: Run the apt package pinning role
include_role:
name: apt_package_pinning
vars:
apt_package_pinning_file_name: "docker.pref"
apt_package_pinning_priority: 999
apt_pinned_packages:
- package: "docker-ce"
version: "{{ zun_docker_package_version }}"
priority: 1000
- package: "docker-ce-cli"
version: "{{ zun_docker_package_version }}"
priority: 1000
- package: "containerd.io"
version: "{{ zun_containerd_package_version }}"
priority: 1000
- name: Get apt gpg key
get_url:
url: "{{ item.gpg_uri }}"
dest: "/tmp/{{ item.name }}"
mode: 0440
with_items: "{{ zun_docker_repo }}"
- name: Add Apt signing key on remote server to keyring
apt_key:
file: "/tmp/{{ item.name }}"
state: present
with_items: "{{ zun_docker_repo }}"
- name: Add apt repository
apt_repository:
repo: "{{ item.repo }}"
state: present
filename: "{{ item.name }}"
update_cache: no
with_items: "{{ zun_docker_repo }}"
register: add_nv_repos
- name: Update Apt cache
apt:
update_cache: yes
when: add_nv_repos is changed
register: update_apt_cache
until: update_apt_cache is success
retries: 5
delay: 2
when:
- "ansible_facts['pkg_mgr'] == 'apt'"
- name: Add docker repo
yum_repository:
name: "{{ item.name }}"
description: "{{ item.description }}"
baseurl: "{{ item.repo }}"
gpgkey: "{{ item.gpgkey | default(omit) }}"
gpgcheck: yes
enabled: yes
priority: 25
register: add_docker_repos
until: add_docker_repos is success
retries: 5
delay: 2
with_items: "{{ zun_docker_repo }}"
when:
- ansible_facts['pkg_mgr'] == 'dnf'
- name: Enable module_hotfixes
lineinfile:
dest: "/etc/yum.repos.d/{{ item.name }}.repo"
line: "module_hotfixes=1"
regexp: "^module_hotfixes"
insertafter: "^enabled"
with_items: "{{ zun_docker_repo }}"
when:
- ansible_facts['os_family'] | lower == 'redhat'
- name: Install compute distro packages
package:
name: "{{ zun_distro_compute_packages }}"
state: "{{ zun_package_state }}"
update_cache: "{{ (ansible_facts['pkg_mgr'] == 'apt') | ternary('yes', omit) }}"
cache_valid_time: "{{ (ansible_facts['pkg_mgr'] == 'apt') | ternary(cache_timeout, omit) }}"
enablerepo: "{{ (ansible_facts['pkg_mgr'] == 'dnf') | ternary('extras', omit) }}"
- name: Install and configure katacontainers
when: zun_kata_enabled | bool
block:
- name: Download kata package
get_url:
url: "{{ zun_kata_package_source }}"
dest: "/opt/{{ zun_kata_package_source | basename }}"
mode: '0440'
checksum: "{{ zun_kata_package_checksum }}"
register: _kata_downloaded
- name: Unpack package
unarchive:
src: "/opt/{{ zun_kata_package_source | basename }}"
dest: /opt/
remote_src: True
owner: root
group: root
extra_opts:
- --strip-components=2
when: _kata_downloaded is changed
notify:
- Restart containerd
- name: Symlink kata binaries to PATH
file:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
state: link
with_items:
- src: /opt/kata/bin/containerd-shim-kata-v2
dest: /usr/local/bin/containerd-shim-kata-v2
- src: /opt/kata/bin/kata-collect-data.sh
dest: /usr/local/bin/kata-collect-data.sh
- src: /opt/kata/bin/kata-runtime
dest: /usr/local/bin/kata-runtime
- name: Ensure the containerd config directory exists
file:
path: "/etc/containerd"
state: "directory"
owner: "root"
group: "root"
mode: "0755"
- name: Configure containerd
template:
src: "config.toml.j2"
dest: "/etc/containerd/config.toml"
mode: "0644"
owner: "root"
group: "root"
notify:
- Restart containerd
- name: Ensure the Docker config directory exists
file:
path: "/etc/docker"
state: "directory"
owner: "root"
group: "root"
mode: "0755"
- name: Generate kuryr config
openstack.config_template.config_template:
content: |
{
"live-restore": true,
"default-ipc-mode": "shareable"
}
dest: "/etc/docker/daemon.json"
owner: "root"
group: "root"
mode: "0644"
config_overrides: "{{ zun_docker_config_overrides }}"
config_type: "json"
notify:
- Restart docker
- name: Create the kuryr system group
group:
name: "{{ zun_kuryr_system_group_name }}"
gid: "{{ zun_kuryr_system_group_gid | default(omit) }}"
state: "present"
system: "yes"
tags:
- zun-kuryr-group
- name: Remove old kuryr key file(s) if found
file:
path: "{{ item }}"
state: "absent"
with_items:
- "{{ zun_kuryr_system_home_folder }}/.ssh/authorized_keys"
- "{{ zun_kuryr_system_home_folder }}/.ssh/id_rsa"
- "{{ zun_kuryr_system_home_folder }}/.ssh/id_rsa.pub"
when:
- zun_recreate_keys | bool
tags:
- zun-kuryr-key
- zun-kuryr-key-create
- name: Create the kuryr system user
user:
name: "{{ zun_kuryr_system_user_name }}"
uid: "{{ zun_kuryr_system_user_uid | default(omit) }}"
group: "{{ zun_kuryr_system_group_name }}"
comment: "{{ zun_kuryr_system_comment }}"
shell: "{{ zun_kuryr_system_shell }}"
system: "yes"
createhome: "yes"
home: "{{ zun_kuryr_system_home_folder }}"
generate_ssh_key: "yes"
when: zun_kuryr_system_user_name != 'root'
tags:
- zun-kuryr-user
- zun-kuryr-key
- zun-kuryr-key-create
- name: Create kuryr dir
file:
path: "{{ item.path }}"
state: directory
owner: "{{ item.owner | default('root') }}"
group: "{{ item.group | default('root') }}"
mode: "{{ item.mode | default('0755') }}"
with_items:
- path: "/etc/kuryr"
mode: "0750"
owner: "{{ zun_kuryr_system_user_name }}"
group: "{{ zun_kuryr_system_group_name }}"
- path: "/etc/docker/plugins"
tags:
- zun-kuryr-dirs
- name: Generate kuryr config
openstack.config_template.config_template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: "{{ zun_kuryr_system_user_name }}"
group: "{{ zun_system_group_name }}"
mode: "0640"
config_overrides: "{{ item.config_overrides }}"
config_type: "{{ item.config_type }}"
with_items:
- src: "kuryr-libnetwork.conf.j2"
dest: "/etc/kuryr/kuryr.conf"
config_overrides: "{{ zun_kuryr_conf_overrides }}"
config_type: "ini"
notify:
- Restart docker
tags:
- zun-config
- zun-post-install
- name: Generate kuryr docker plugin config
openstack.config_template.config_template:
content: |
{
"Name": "kuryr",
"Addr": "http://127.0.0.1:23750"
}
dest: "/etc/docker/plugins/kuryr.json"
owner: "root"
group: "root"
mode: "0644"
config_overrides: "{{ zun_kuryr_config_overrides }}"
config_type: "json"
notify:
- Restart docker
- name: Ensure docker users are added to the docker group
user:
name: "{{ item }}"
groups: "{{ zun_docker_groupname }}"
append: yes
with_items: "{{ zun_docker_users }}"
- name: Drop sudoers file
template:
src: "sudoers.j2"
dest: "/etc/sudoers.d/{{ zun_system_user_name }}_sudoers"
mode: "0440"
owner: "root"
group: "root"
tags:
- sudoers
- zun-sudoers
- name: Configure multipathd (RedHat only)
command:
cmd: "/sbin/mpathconf --enable"
creates: "/etc/multipath.conf"
when: ansible_facts['os_family'] == "RedHat"
- name: Enable multipathd service
systemd:
name: multipathd
state: started
enabled: yes
- name: Create script to clean up old Docker data
template:
src: "zun-docker-cleanup.j2"
dest: "{{ zun_bin }}/zun-docker-cleanup"
owner: "root"
group: "root"
mode: "0755"
- name: Set state for timed data cleanup
file:
path: "/var/tmp/zun-docker-cleanup.disabled"
state: "{{ zun_docker_prune_images | ternary('absent', 'touch') }}"
- name: Remove legacy systemd docker override
file:
path: "/etc/systemd/system/docker.service.d/zun-docker.conf"
state: absent
View Git Blame Copy Permalink