FEAUTRE: replace docker to nerdctl

main.tf

@@ -42,9 +42,9 @@ data "ignition_systemd_unit" "etcd_service" {
 }
 
 data "ignition_file" "etcd_metrics_proxy_wrapper_sh" {
-  overwrite   = true
-  path       = "/opt/etcd/bin/etcd-metrics-proxy-wrapper"
-  mode       = 500
+  overwrite = true
+  path      = "/opt/etcd/bin/etcd-metrics-proxy-wrapper"
+  mode      = 500
 
   content {
     content = file("${path.module}/scripts/etcd-metrics-proxy-wrapper.sh")

nertctl.tf

@@ -0,0 +1,27 @@
+
+data "ignition_file" "init_nerdctl" {
+  overwrite = true
+  path      = "/opt/bin/init-nerdctl"
+  mode      = 500
+
+  content {
+    content = file("${path.module}/scripts/init-nerdctl.sh")
+  }
+}
+
+data "ignition_systemd_unit" "init_nerdctl" {
+  name    = "init-nerdctl.service"
+  enabled = true
+  content = templatefile("${path.module}/templates/init-nerdctl.service.tpl", {})
+}
+
+data "ignition_file" "nerdctl" {
+  path      = "/opt/bin/nerdctl.tar.gz"
+  mode      = 500
+  overwrite = true
+
+  source {
+    source       = local.binaries["nerdctl"].source
+    verification = local.binaries["nerdctl"].checksum
+  }
+}

outputs.tf

@@ -2,6 +2,7 @@ output "systemd_units" {
   value = concat([
     data.ignition_systemd_unit.etcd_service.rendered,
     data.ignition_systemd_unit.etcd_data_mount.rendered,
+    data.ignition_systemd_unit.init_nerdctl.rendered,
     ],
     var.enable_metrics_proxy ? [
       data.ignition_systemd_unit.etcd_metrics_proxy_service.rendered
@@ -19,7 +20,9 @@ output "files" {
     data.ignition_file.etcd_server_cert.rendered,
     data.ignition_file.etcd_server_key.rendered,
     data.ignition_file.etcd_peer_cert.rendered,
-    data.ignition_file.etcd_peer_key.rendered
+    data.ignition_file.etcd_peer_key.rendered,
+    data.ignition_file.init_nerdctl.rendered,
+    data.ignition_file.nerdctl.rendered,
     ],
     var.enable_metrics_proxy ? [
       data.ignition_file.etcd_metrics_proxy_wrapper_sh.rendered

scripts/etcd-metrics-proxy-wrapper.sh

@@ -32,9 +32,9 @@ fi
 
 DOCKER_RUN_ARGS="${DOCKER_RUN_ARGS} ${DOCKER_OPTS}"
 
-DOCKER="${DOCKER:-/usr/bin/docker}"
+NERDCTL="${NERDCTL:-/opt/bin/nerdctl}"
 set -x
-exec ${DOCKER} run \
+exec ${NERDCTL} run \
   -v ${ETCD_CERT_PATH}:${ETCD_CERT_PATH}:ro \
   --env-file=/etc/etcd/config.env \
   --net=host \

scripts/etcd-wrapper.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wrapper for launching etcd via docker.
+# Wrapper for launching etcd via nerdctl.
 
 set -e
 
@@ -60,9 +60,9 @@ fi
 
 DOCKER_RUN_ARGS="${DOCKER_RUN_ARGS} ${DOCKER_OPTS}"
 
-DOCKER="${DOCKER:-/usr/bin/docker}"
+NERDCTL="${NERDCTL:-/opt/bin/nerdctl}"
 set -x
-exec ${DOCKER} run \
+exec ${NERDCTL} run \
   -v ${ETCD_DATA_DIR}:${ETCD_DATA_DIR}:rw \
   -v /etc/ssl/certs:/etc/ssl/certs:ro \
   -v ${ETCD_CERT_PATH}:${ETCD_CERT_PATH}:rw \

scripts/init-nerdctl.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Wrapper script for initing nerdctl.
+
+set -eu
+
+NERDCTL_BIN_PATH=${NERDCTL_BIN_PATH:="/opt/bin"}
+mkdir -p ${NERDCTL_BIN_PATH}
+sudo tar -xvf /opt/bin/nerdctl.tar.gz -C ${NERDCTL_BIN_PATH}

templates/etcd-metrics-proxy.service.tpl

@@ -1,13 +1,14 @@
 [Unit]
 Description=etcd-metrics-proxy service
+After=init-nerdctl.service
 Requires=network-online.target
 
 [Service]
 Environment="PATH=/opt/bin:/opt/etcd/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
 EnvironmentFile=/etc/etcd/config.env
-ExecStartPre=-/usr/bin/docker rm -f etcd-metrics-proxy
+ExecStartPre=-/opt/bin/nerdctl rm -f etcd-metrics-proxy
 ExecStart=/opt/etcd/bin/etcd-metrics-proxy-wrapper
-ExecStop=-/usr/bin/docker stop etcd-metrics-proxy
+ExecStop=-/opt/bin/nerdctl stop etcd-metrics-proxy
 
 Restart=always
 RestartSec=10

templates/etcd.service.tpl

@@ -1,13 +1,14 @@
 [Unit]
 Description=etcd service
+After=init-nerdctl.service
 Requires=network-online.target
 
 [Service]
 Environment="PATH=/opt/bin:/opt/etcd/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
 EnvironmentFile=/etc/etcd/config.env
-ExecStartPre=-/usr/bin/docker rm -f etcd
+ExecStartPre=-/opt/bin/nerdctl rm -f etcd
 ExecStart=/opt/etcd/bin/etcd-wrapper
-ExecStop=-/usr/bin/docker stop etcd
+ExecStop=-/opt/bin/nerdctl stop etcd
 
 Restart=always
 RestartSec=10

templates/init-nerdctl.service.tpl

@@ -0,0 +1,18 @@
+[Unit]
+Description=init nerdctl service
+ConditionPathExists = !/opt/bin/init-configs.done
+Requires=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+
+User=root
+Group=root
+
+Environment="PATH=/opt/bin:/opt/etcd/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
+ExecStart=/opt/bin/init-nerdctl
+ExecStartPost=/bin/touch /opt/bin/init-configs.done
+
+[Install]
+WantedBy=multi-user.target

variables.tf

@@ -12,6 +12,15 @@ variable "containers" {
   default = {}
 }
 
+variable "binaries" {
+  description = "Desired addon binaries url and checksum."
+  type = map(object({
+    source   = string
+    checksum = string
+  }))
+  default = {}
+}
+
 variable "cloud_provider" {
   description = "The name of public cloud."
   type        = string

variables_defaults.tf

@@ -13,4 +13,13 @@ locals {
   extra_flags = merge({
     "log-level" = var.log_level
   }, var.extra_flags)
+
+  binaries = merge(
+    {
+      nerdctl = {
+        source   = "https://github.com/containerd/nerdctl/releases/download/v1.6.0/nerdctl-1.6.0-linux-amd64.tar.gz"
+        checksum = "sha512-89dcba32badfd1481d88cd5f4179ff99348578af5004a7e96daa05101e99ba7448685596692ada3186f718ffd1166768ac6a22e041c5887e416e6dc7fda97f24"
+      }
+  }, var.binaries)
+
 }