10_container_runtimes.yml

---
- name: Install container runtime
  hosts: k8s_nodes
  become: true
  vars_files:
    - vars/k8s_cluster.yml
  tasks:

    - name: Upgrade all packages
      yum:
        name: '*'
        state: latest
      when: k8s.cluster_os == 'CentOS'

    - name: Upgrade all packages
      apt:
        name: '*'
        state: latest
      when: k8s.cluster_os == 'Ubuntu'

    - name: Ensure prerequisites are met.
      block:
        - name: Add modules to autostart
          blockinfile:
            path: /etc/modules-load.d/k8s.conf
            block: |
              overlay
              br_netfilter
            create: true

        - name: Enable br_netfilter
          modprobe:
            name: "{{ item }}"
            state: present
          loop:
            - br_netfilter
            - overlay

        - name: Enable iptables inspection on bridge ifaces
          blockinfile:
            path: /etc/sysctl.d/k8s.conf
            block: |
              net.ipv4.ip_forward = 1
              net.bridge.bridge-nf-call-ip6tables = 1
              net.bridge.bridge-nf-call-iptables = 1
            create: true

        - name: Reload sysctl
          shell: sysctl --system

    - name: Configure docker on a Ubuntu machine
      block: 
        - name: Ensure required packages are present
          apt:
            name:
              - apt-transport-https
              - ca-certificates 
              - gnupg2
              - curl 
              - software-properties-common 
            state: latest

        - name: Add docker repo key
          apt_key:
            url: "{{ docker.ubuntu.docker_repo_key }}"
            keyring: "{{ docker.ubuntu.docker_repo_key_file }}"

            state: present

        - name: Ensure the presence of apt-repo for docker
          apt_repository:
            repo: "{{ docker.ubuntu.docker_repo }}"
#            update_cache_retries: 25
            state: present
            
        - name: Ensure docker packages are installed
          apt:
            name: "{{ docker.ubuntu.docker_packages }}"
            state: present

      when: 
        - k8s.container_runtime == 'docker'
        - k8s.cluster_os == 'Ubuntu'

    - name: Configure docker on a CentOS machine
      block: 
        - name: Ensure required packages are present
          yum:
            name:
              - yum-utils 
              - device-mapper-persistent-data 
              - lvm2
            state: latest

        - name: Add docker repository
          get_url:
            url: "{{ docker.centos.docker_repo }}"
            dest: "/etc/yum.repos.d/docker-ce.repo"

        - name: Ensure docker is installed
          yum:
            name: "{{ docker.centos.docker_packages }}"
            state: latest

      when: 
        - k8s.container_runtime == 'docker' 
        - k8s.cluster_os == 'CentOS'

    - name: Ensure docker service is configured
      block:
      - name: Create /etc/docker
        file:
          state: directory
          path: /etc/docker
      
      - name: Copy docker configuration in /etc/docker
        copy:
          src: files/daemon.json
          dest: /etc/docker/

      - name: Create systemd folder for Docker service
        file:
          path: /etc/systemd/system/docker.service.d
          state: directory

      - name: Force systemd to reread configs
        systemd:
          daemon_reload: yes

      - name: Ensure docker is enabled and started
        systemd: 
          name: docker
          state: restarted
          enabled: true
      when: k8s.container_runtime == 'docker'

    - name: Install cri-o
      block:
        - name: Add crio repo key
          apt_key:
            url: "{{ item.key }}"
            keyring: "{{ item.keyring }}"
            state: present
          loop:
            - key: "{{ crio.ubuntu.libcontainers_key }}"
              keyring: "{{ crio.ubuntu.libcontainers_keyring }}"
            - key: "{{ crio.ubuntu.crio_key }}"
              keyring: "{{ crio.ubuntu.crio_keyring }}"
          when: k8s.cluster_os == 'Ubuntu'

        - name: Ensure the presence of apt-repo for cri-o
          apt_repository:
            repo: "{{ item.repo }}"
            filename: "{{ item.file }}"
#            update_cache_retries: 25
            state: present
          loop: 
            - repo: "{{ crio.ubuntu.libcontainers_repo }}"
              file: /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
            - repo: "{{ crio.ubuntu.crio_repo }}"
              file: /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:1.19.list
          when: k8s.cluster_os == 'Ubuntu'

        - name: Add kubic CentOS repository
          get_url:
            url: "{{ item.url }}"
            dest: "{{ item.file }}"
            validate_certs: false
          loop:
            - file: "/etc/yum.repos.d/devel:kubic:libcontainers:stable.repo"
              url: "{{ crio.centos.libcontainers_repo }}"
            - file: "/etc/yum.repos.d/devel:kubic:libcontainers:stable:cri-o.repo"
              url: "{{ crio.centos.crio_repo }}"
          when: k8s.cluster_os == 'CentOS'

        - name: Ensure cri-o is installed - CentOS
          yum:
            name: cri-o
            state: latest
          when: k8s.cluster_os == 'CentOS'

        - name: Ensure cri-o is installed - Ubuntu
          apt:
            name: 
              - cri-o
              - cri-o-runc
            state: latest
          when: k8s.cluster_os == 'Ubuntu'

        - name: Fire crio-conf template 
          template: 
            src: templates/crio.conf.j2
            dest: /etc/crio/crio.conf

#        - name: Ensure systemd as default cgroup_manager
#          replace:
#            path: /etc/crio/crio.conf
#            regexp: '^cgroup_manager.*'
#            replace: 'cgroup_manager = "systemd"'

#        - name: Ensure systemd as default cgroup_manager
#          replace:
#            path: /etc/crio/crio.conf
#            regexp: '^conmon_cgroup.*'
#            replace: 'conmon_cgroup = "pod"'

#        - name: Add capabilities due to particular capabilities required by Rancher
#          block: 
#            - name: Ensure MKNOD is enabled if installing Rancher
#              lineinfile:
#                path: /etc/crio/crio.conf
#                line: '"MKNOD",'
#                insertafter: 'default_capabilities'
#          when: rancher.install_rancher
           
#        - name: Ensure to use all possible plugins dir
#          replace:
#            path: /etc/crio/crio.conf
#            regexp: '"/usr/libexec/cni",'
#            replace: '"/usr/libexec/cni", "/opt/cni/bin/",'

#        - name: Add docker.io to registries due to bad usage of unqualified images from many dev teams
#          lineinfile:
#            path: /etc/crio/crio.conf
#            regexp: '^#registries'
#            line: 'registries = [ "docker.io", "quay.io" ]'

        - name: Remove example CNI configs
          file:
            path: "/etc/cni/net.d/{{ item }}"
            state: absent
          loop:
            - 100-crio-bridge.conf
            - 200-loopback.conf

        - name: Force systemd to reread configs
          systemd:
            daemon_reload: yes

        - name: Ensure cri-o is enabled and started
          systemd:
            name: crio
            state: started
            enabled: true
      when: k8s.container_runtime == 'crio'

    - name: Ensure containerd is configured and installed on CentOS machine
      block:
        - name: Ensure required packages are present
          yum:
            name:
              - yum-utils
              - device-mapper-persistent-data
              - lvm2
            state: latest

        - name: Add containerd repository
          get_url:
            url: "{{ containerd.containerd_repo }}"
            dest: "/etc/yum.repos.d/docker-ce.repo"

        - name: Ensure containerd is installed
          yum:
            name: containerd.io
            state: latest
      when: 
        - k8s.container_runtime == 'containerd'
        - k8s.cluster_os == 'CentOS'

    - name: Ensure containerd is configured and installed on Ubuntu machine
      apt:
        name: containerd
        state: latest
      when: 
        - k8s.container_runtime == 'containerd'
        - k8s.cluster_os == 'Ubuntu'

    - name: Ensure containerd service is configured
      block:
        - name: Create /etc/containers
          file:
            state: directory
            path: /etc/containerd

        - name: Initialize config
          shell: containerd config default > /etc/containerd/config.toml

        - name: Force systemd to reread configs
          systemd:
            daemon_reload: yes

        - name: Ensure containerd is enabled and started
          systemd:
            name: containerd
            state: restarted
            enabled: true
      when: k8s.container_runtime == 'containerd'