committed by
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
26 changed files with 481 additions and 56 deletions
Split View
Diff Options
-
3cluster.yml
-
31docs/cri-o.md
-
4inventory/sample/group_vars/all.yml
-
4inventory/sample/group_vars/k8s-cluster.yml
-
2roles/cri-o/defaults/main.yml
-
1roles/cri-o/files/mounts.conf
-
56roles/cri-o/tasks/main.yaml
-
234roles/cri-o/templates/crio.conf.j2
-
7roles/cri-o/vars/redhat.yml
-
33roles/download/defaults/main.yml
-
3roles/download/tasks/download_prep.yml
-
1roles/download/tasks/main.yml
-
28roles/etcd/tasks/install_host.yml
-
3roles/kubernetes/kubeadm/templates/kubeadm-client.conf.v1alpha2.j2
-
16roles/kubernetes/master/tasks/kubeadm-setup.yml
-
24roles/kubernetes/master/tasks/main.yml
-
19roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2
-
3roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2
-
5roles/kubernetes/node/defaults/main.yml
-
22roles/kubernetes/node/tasks/install_host.yml
-
7roles/kubernetes/node/templates/kubelet.kubeadm.env.j2
-
6roles/kubernetes/node/templates/kubelet.standard.env.j2
-
8roles/kubespray-defaults/defaults/main.yaml
-
10roles/reset/tasks/main.yml
-
4scale.yml
-
3upgrade-cluster.yml
@ -0,0 +1,31 @@ |
|||
cri-o |
|||
=============== |
|||
|
|||
cri-o is container developed by kubernetes project. |
|||
Currently, only basic function is supported for cri-o. |
|||
|
|||
* cri-o is supported kubernetes 1.11.1 or later. |
|||
* helm and other feature may not be supported due to docker dependency. |
|||
* scale.yml and upgrade-cluster.yml are not supported. |
|||
|
|||
helm and other feature may not be supported due to docker dependency. |
|||
|
|||
Use cri-o instead of docker, set following variable: |
|||
|
|||
#### all.yml |
|||
|
|||
``` |
|||
kubeadm_enable: true |
|||
... |
|||
download_container: false |
|||
skip_downloads: false |
|||
``` |
|||
|
|||
#### k8s-cluster.yml |
|||
|
|||
``` |
|||
etcd_deployment_type: host |
|||
kubelet_deployment_type: host |
|||
container_manager: crio |
|||
``` |
|||
|
@ -0,0 +1,2 @@ |
|||
--- |
|||
crio_rhel_repo_base_url: 'https://cbs.centos.org/repos/paas7-openshift-origin311-candidate/x86_64/os/' |
@ -0,0 +1 @@ |
|||
/usr/share/rhel/secrets:/run/secrets |
@ -0,0 +1,56 @@ |
|||
--- |
|||
- name: gather os specific variables |
|||
include_vars: "{{ item }}" |
|||
with_first_found: |
|||
- files: |
|||
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_version|lower|replace('/', '_') }}.yml" |
|||
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_release }}.yml" |
|||
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_major_version|lower|replace('/', '_') }}.yml" |
|||
- "{{ ansible_distribution|lower }}.yml" |
|||
- "{{ ansible_os_family|lower }}-{{ ansible_architecture }}.yml" |
|||
- "{{ ansible_os_family|lower }}.yml" |
|||
- defaults.yml |
|||
paths: |
|||
- ../vars |
|||
skip: true |
|||
tags: |
|||
- facts |
|||
|
|||
- name: Add OpenShift Origin repository |
|||
yum_repository: |
|||
name: origin |
|||
description: OpenShift Origin Repo |
|||
baseurl: "{{ crio_rhel_repo_base_url }}" |
|||
gpgcheck: no |
|||
when: ansible_distribution in ["CentOS","RedHat"] and not is_atomic |
|||
|
|||
- name: Install cri-o packages |
|||
package: |
|||
name: "{{ item }}" |
|||
state: present |
|||
with_items: "{{ crio_packages }}" |
|||
|
|||
- name: Install cri-o config |
|||
template: |
|||
src: crio.conf.j2 |
|||
dest: /etc/crio/crio.conf |
|||
|
|||
- name: Copy mounts.conf |
|||
copy: |
|||
src: mounts.conf |
|||
dest: /etc/containers/mounts.conf |
|||
when: |
|||
- ansible_os_family == 'RedHat' |
|||
|
|||
- name: Create directory for oci hooks |
|||
file: |
|||
path: /etc/containers/oci/hooks.d |
|||
state: directory |
|||
owner: root |
|||
mode: 0755 |
|||
|
|||
- name: Install cri-o service |
|||
service: |
|||
name: "{{ crio_service }}" |
|||
enabled: yes |
|||
state: restarted |
@ -0,0 +1,234 @@ |
|||
|
|||
# The "crio" table contains all of the server options. |
|||
[crio] |
|||
|
|||
# CRI-O reads its storage defaults from the containers/storage configuration |
|||
# file, /etc/containers/storage.conf. Modify storage.conf if you want to |
|||
# change default storage for all tools that use containers/storage. If you |
|||
# want to modify just crio, you can change the storage configuration in this |
|||
# file. |
|||
|
|||
# root is a path to the "root directory". CRIO stores all of its data, |
|||
# including container images, in this directory. |
|||
#root = "/var/lib/containers/storage" |
|||
|
|||
# run is a path to the "run directory". CRIO stores all of its state |
|||
# in this directory. |
|||
#runroot = "/var/run/containers/storage" |
|||
|
|||
# storage_driver select which storage driver is used to manage storage |
|||
# of images and containers. |
|||
storage_driver = "overlay2" |
|||
|
|||
# storage_option is used to pass an option to the storage driver. |
|||
#storage_option = [ |
|||
#] |
|||
|
|||
# The "crio.api" table contains settings for the kubelet/gRPC interface. |
|||
[crio.api] |
|||
|
|||
# listen is the path to the AF_LOCAL socket on which crio will listen. |
|||
listen = "/var/run/crio/crio.sock" |
|||
|
|||
# stream_address is the IP address on which the stream server will listen |
|||
stream_address = "" |
|||
|
|||
# stream_port is the port on which the stream server will listen |
|||
stream_port = "10010" |
|||
|
|||
# stream_enable_tls enables encrypted tls transport of the stream server |
|||
stream_enable_tls = false |
|||
|
|||
# stream_tls_cert is the x509 certificate file path used to serve the encrypted stream. |
|||
# This file can change, and CRIO will automatically pick up the changes within 5 minutes. |
|||
stream_tls_cert = "" |
|||
|
|||
# stream_tls_key is the key file path used to serve the encrypted stream. |
|||
# This file can change, and CRIO will automatically pick up the changes within 5 minutes. |
|||
stream_tls_key = "" |
|||
|
|||
# stream_tls_ca is the x509 CA(s) file used to verify and authenticate client |
|||
# communication with the tls encrypted stream. |
|||
# This file can change, and CRIO will automatically pick up the changes within 5 minutes. |
|||
stream_tls_ca = "" |
|||
|
|||
# file_locking is whether file-based locking will be used instead of |
|||
# in-memory locking |
|||
file_locking = true |
|||
|
|||
# The "crio.runtime" table contains settings pertaining to the OCI |
|||
# runtime used and options for how to set up and manage the OCI runtime. |
|||
[crio.runtime] |
|||
|
|||
# runtime is the OCI compatible runtime used for trusted container workloads. |
|||
# This is a mandatory setting as this runtime will be the default one |
|||
# and will also be used for untrusted container workloads if |
|||
# runtime_untrusted_workload is not set. |
|||
runtime = "/usr/bin/runc" |
|||
|
|||
# runtime_untrusted_workload is the OCI compatible runtime used for untrusted |
|||
# container workloads. This is an optional setting, except if |
|||
# default_container_trust is set to "untrusted". |
|||
runtime_untrusted_workload = "" |
|||
|
|||
# default_workload_trust is the default level of trust crio puts in container |
|||
# workloads. It can either be "trusted" or "untrusted", and the default |
|||
# is "trusted". |
|||
# Containers can be run through different container runtimes, depending on |
|||
# the trust hints we receive from kubelet: |
|||
# - If kubelet tags a container workload as untrusted, crio will try first to |
|||
# run it through the untrusted container workload runtime. If it is not set, |
|||
# crio will use the trusted runtime. |
|||
# - If kubelet does not provide any information about the container workload trust |
|||
# level, the selected runtime will depend on the default_container_trust setting. |
|||
# If it is set to "untrusted", then all containers except for the host privileged |
|||
# ones, will be run by the runtime_untrusted_workload runtime. Host privileged |
|||
# containers are by definition trusted and will always use the trusted container |
|||
# runtime. If default_container_trust is set to "trusted", crio will use the trusted |
|||
# container runtime for all containers. |
|||
default_workload_trust = "trusted" |
|||
|
|||
# no_pivot instructs the runtime to not use pivot_root, but instead use MS_MOVE |
|||
no_pivot = false |
|||
|
|||
# conmon is the path to conmon binary, used for managing the runtime. |
|||
conmon = "/usr/libexec/crio/conmon" |
|||
|
|||
# conmon_env is the environment variable list for conmon process, |
|||
# used for passing necessary environment variable to conmon or runtime. |
|||
conmon_env = [ |
|||
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", |
|||
] |
|||
|
|||
# selinux indicates whether or not SELinux will be used for pod |
|||
# separation on the host. If you enable this flag, SELinux must be running |
|||
# on the host. |
|||
selinux = {{ (preinstall_selinux_state == 'enforcing')|lower }} |
|||
|
|||
# seccomp_profile is the seccomp json profile path which is used as the |
|||
# default for the runtime. |
|||
seccomp_profile = "/etc/crio/seccomp.json" |
|||
|
|||
# apparmor_profile is the apparmor profile name which is used as the |
|||
# default for the runtime. |
|||
apparmor_profile = "crio-default" |
|||
|
|||
# cgroup_manager is the cgroup management implementation to be used |
|||
# for the runtime. |
|||
cgroup_manager = "cgroupfs" |
|||
|
|||
# default_capabilities is the list of capabilities to add and can be modified here. |
|||
# If capabilities below is commented out, the default list of capabilities defined in the |
|||
# spec will be added. |
|||
# If capabilities is empty below, only the capabilities defined in the container json |
|||
# file by the user/kube will be added. |
|||
default_capabilities = [ |
|||
"CHOWN", |
|||
"DAC_OVERRIDE", |
|||
"FSETID", |
|||
"FOWNER", |
|||
"NET_RAW", |
|||
"SETGID", |
|||
"SETUID", |
|||
"SETPCAP", |
|||
"NET_BIND_SERVICE", |
|||
"SYS_CHROOT", |
|||
"KILL", |
|||
] |
|||
|
|||
# hooks_dir_path is the oci hooks directory for automatically executed hooks |
|||
hooks_dir_path = "/usr/share/containers/oci/hooks.d" |
|||
|
|||
# default_mounts is the mounts list to be mounted for the container when created |
|||
# deprecated, will be taken out in future versions, add default mounts to either |
|||
# /usr/share/containers/mounts.conf or /etc/containers/mounts.conf |
|||
default_mounts = [ |
|||
] |
|||
|
|||
# CRI-O reads its default mounts from the following two files: |
|||
# 1) /etc/containers/mounts.conf - this is the override file, where users can |
|||
# either add in their own default mounts, or override the default mounts shipped |
|||
# with the package. |
|||
# 2) /usr/share/containers/mounts.conf - this is the default file read for mounts. |
|||
# If you want CRI-O to read from a different, specific mounts file, you can change |
|||
# the default_mounts_file path right below. Note, if this is done, CRI-O will only add |
|||
# mounts it finds in this file. |
|||
|
|||
# default_mounts_file is the file path holding the default mounts to be mounted for the |
|||
# container when created. |
|||
# default_mounts_file = "" |
|||
|
|||
# pids_limit is the number of processes allowed in a container |
|||
pids_limit = 1024 |
|||
|
|||
# log_size_max is the max limit for the container log size in bytes. |
|||
# Negative values indicate that no limit is imposed. |
|||
log_size_max = -1 |
|||
|
|||
# read-only indicates whether all containers will run in read-only mode |
|||
read_only = false |
|||
|
|||
# The "crio.image" table contains settings pertaining to the |
|||
# management of OCI images. |
|||
|
|||
# uid_mappings specifies the UID mappings to have in the user namespace. |
|||
# A range is specified in the form containerUID:HostUID:Size. Multiple |
|||
# ranges are separed by comma. |
|||
uid_mappings = "" |
|||
|
|||
# gid_mappings specifies the GID mappings to have in the user namespace. |
|||
# A range is specified in the form containerGID:HostGID:Size. Multiple |
|||
# ranges are separed by comma. |
|||
gid_mappings = "" |
|||
|
|||
[crio.image] |
|||
|
|||
# default_transport is the prefix we try prepending to an image name if the |
|||
# image name as we receive it can't be parsed as a valid source reference |
|||
default_transport = "docker://" |
|||
|
|||
# pause_image is the image which we use to instantiate infra containers. |
|||
pause_image = "docker://k8s.gcr.io/pause:3.1" |
|||
|
|||
# pause_command is the command to run in a pause_image to have a container just |
|||
# sit there. If the image contains the necessary information, this value need |
|||
# not be specified. |
|||
pause_command = "/pause" |
|||
|
|||
# signature_policy is the name of the file which decides what sort of policy we |
|||
# use when deciding whether or not to trust an image that we've pulled. |
|||
# Outside of testing situations, it is strongly advised that this be left |
|||
# unspecified so that the default system-wide policy will be used. |
|||
signature_policy = "" |
|||
|
|||
# image_volumes controls how image volumes are handled. |
|||
# The valid values are mkdir and ignore. |
|||
image_volumes = "mkdir" |
|||
|
|||
# CRI-O reads its configured registries defaults from the containers/image configuration |
|||
# file, /etc/containers/registries.conf. Modify registries.conf if you want to |
|||
# change default registries for all tools that use containers/image. If you |
|||
# want to modify just crio, you can change the registies configuration in this |
|||
# file. |
|||
|
|||
# insecure_registries is used to skip TLS verification when pulling images. |
|||
insecure_registries = [ |
|||
"{{ kube_service_addresses }}" |
|||
] |
|||
|
|||
# registries is used to specify a comma separated list of registries to be used |
|||
# when pulling an unqualified image (e.g. fedora:rawhide). |
|||
registries = [ |
|||
"docker.io" |
|||
] |
|||
|
|||
# The "crio.network" table contains settings pertaining to the |
|||
# management of CNI plugins. |
|||
[crio.network] |
|||
|
|||
# network_dir is is where CNI network configuration |
|||
# files are stored. |
|||
network_dir = "/etc/cni/net.d/" |
|||
|
|||
# plugin_dir is is where CNI plugin binaries are stored. |
|||
plugin_dir = "/opt/cni/bin/" |
@ -0,0 +1,7 @@ |
|||
--- |
|||
crio_packages: |
|||
- cri-o |
|||
- cri-tools |
|||
- oci-systemd-hook |
|||
|
|||
crio_service: crio |
@ -1,13 +1,21 @@ |
|||
--- |
|||
- name: Install | Copy etcdctl and etcd binary from docker container |
|||
command: sh -c "{{ docker_bin_dir }}/docker rm -f etcdctl-binarycopy; |
|||
{{ docker_bin_dir }}/docker create --name etcdctl-binarycopy {{ etcd_image_repo }}:{{ etcd_image_tag }} && |
|||
{{ docker_bin_dir }}/docker cp etcdctl-binarycopy:/usr/local/bin/etcdctl {{ bin_dir }}/etcdctl && |
|||
{{ docker_bin_dir }}/docker cp etcdctl-binarycopy:/usr/local/bin/etcd {{ bin_dir }}/etcd && |
|||
{{ docker_bin_dir }}/docker rm -f etcdctl-binarycopy" |
|||
register: etcd_task_result |
|||
until: etcd_task_result.rc == 0 |
|||
retries: 4 |
|||
delay: "{{ retry_stagger | random + 3 }}" |
|||
- name: install | Copy etcd binary from download dir |
|||
shell: | |
|||
rsync -piu "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-amd64/etcd" "{{ bin_dir }}/etcd" |
|||
rsync -piu "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-amd64/etcdctl" "{{ bin_dir }}/etcdctl" |
|||
changed_when: false |
|||
when: etcd_cluster_setup |
|||
|
|||
- name: install | Set etcd binary permissions |
|||
file: |
|||
path: "{{ bin_dir }}/etcd" |
|||
mode: "0755" |
|||
state: file |
|||
when: etcd_cluster_setup |
|||
|
|||
- name: install | Set etcdctl binary permissions |
|||
file: |
|||
path: "{{ bin_dir }}/etcdctl" |
|||
mode: "0755" |
|||
state: file |
|||
when: etcd_cluster_setup |
Write
Preview
Loading…
Cancel
Save