actualized for kubespray version 2.28.0

2025-06-15 20:25:45 +03:00
parent c819d4f51f
commit c2df2abc78
366 changed files with 9939 additions and 40388 deletions
--- a/kubespray/project/roles/container-engine/cri-o/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/cri-o/defaults/main.yml
@@ -2,6 +2,8 @@

 crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}"
 crio_conmon: "{{ bin_dir }}/conmon"
+crio_default_runtime: "crun"
+crio_libexec_dir: "/usr/libexec/crio"
 crio_enable_metrics: false
 crio_log_level: "info"
 crio_metrics_port: "9090"
@@ -35,14 +37,16 @@ crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/def

 crio_stream_port: "10010"

-crio_required_version: "{{ kube_version | regex_replace('^v(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
+crio_required_version: "{{ kube_version | regex_replace('^(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
+
+crio_root: "/var/lib/containers/storage"

 # The crio_runtimes variable defines a list of OCI compatible runtimes.
 crio_runtimes:
-  - name: runc
-    path: "{{ bin_dir }}/runc"
+  - name: crun
+    path: "{{ crio_runtime_bin_dir }}/crun"
    type: oci
-    root: /run/runc
+    root: /run/crun

 # Kata Containers is an OCI runtime, where containers are run inside lightweight
 # VMs. Kata provides additional isolation towards the host, minimizing the host attack
@@ -55,10 +59,16 @@ kata_runtimes:
    root: /run/kata-containers
    privileged_without_host_devices: true

+runc_runtime:
+  name: runc
+  path: "{{ crio_runtime_bin_dir }}/runc"
+  type: oci
+  root: /run/runc
+
 # crun is a fast and low-memory footprint OCI Container Runtime fully written in C.
 crun_runtime:
  name: crun
-  path: "{{ bin_dir }}/crun"
+  path: "{{ crio_runtime_bin_dir }}/crun"
  type: oci
  root: /run/crun

@@ -89,3 +99,15 @@ crio_man_files:

 # If set to true, it will enable the CRIU support in cri-o
 crio_criu_support_enabled: false
+
+# Configure default_capabilities in crio.conf
+crio_default_capabilities:
+  - CHOWN
+  - DAC_OVERRIDE
+  - FSETID
+  - FOWNER
+  - SETGID
+  - SETUID
+  - SETPCAP
+  - NET_BIND_SERVICE
+  - KILL
--- a/kubespray/project/roles/container-engine/cri-o/meta/main.yml
+++ b/kubespray/project/roles/container-engine/cri-o/meta/main.yml
@@ -1,5 +1,5 @@
 ---
 dependencies:
-  - role: container-engine/runc
+  - role: container-engine/crun
  - role: container-engine/crictl
  - role: container-engine/skopeo
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml
@@ -5,5 +5,5 @@
  vars:
    container_manager: crio
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: container-engine/cri-o
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml
@@ -1,50 +1,38 @@
 ---
 role_name_check: 1
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
  - name: ubuntu20
-    box: generic/ubuntu2004
-    cpus: 2
-    memory: 1024
-    groups:
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
-    cpus: 2
-    memory: 1024
-    groups:
+  - name: almalinux9
+    cloud_image: almalinux-9
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
  - name: fedora
-    box: fedora/38-cloud-base
-    cpus: 2
-    memory: 2048
-    groups:
+    cloud_image: fedora-39
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
-  - name: debian10
-    box: generic/debian10
-    cpus: 2
-    memory: 1024
-    groups:
+  - name: debian12
+    cloud_image: debian-12
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
 provisioner:
  name: ansible
  env:
@@ -53,5 +41,7 @@ provisioner:
    defaults:
      callbacks_enabled: profile_tasks
      timeout: 120
+  playbooks:
+    create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
  name: testinfra
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml
@@ -6,8 +6,9 @@
  vars:
    ignore_assert_errors: true
  roles:
-    - role: kubespray-defaults
-    - role: bootstrap-os
+    - role: kubespray_defaults
+    - role: bootstrap_os
+    - role: network_facts
    - role: kubernetes/preinstall
    - role: adduser
      user: "{{ addusers.kube }}"
@@ -25,7 +26,7 @@
    ignore_assert_errors: true
    kube_network_plugin: cni
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: network_plugin/cni
  tasks:
    - name: Copy test container files
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py
@@ -21,7 +21,7 @@ def test_run(host):
    assert "RuntimeName:  cri-o" in cmd.stdout

 def test_run_pod(host):
-    runtime = "runc"
+    runtime = "crun"

    run_command = "/usr/local/bin/crictl run --with-pull --runtime {} /tmp/container.json /tmp/sandbox.json".format(runtime)
    with host.sudo():
--- a/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml
@@ -1,8 +1,8 @@
 ---
- name: Cri-o | include vars/v1.28.yml
-  include_vars: v1.28.yml
-  when: crio_version is version("v1.29.0", operator="<")
-
 - name: Cri-o | include vars/v1.29.yml
  include_vars: v1.29.yml
-  when: crio_version is version("v1.29.0", operator=">=")
+  when: crio_version is version("1.29.0", operator=">=")
+
+- name: Cri-o | include vars/v1.31.yml
+  include_vars: v1.31.yml
+  when: crio_version is version("1.31.0", operator=">=")
--- a/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml
@@ -36,11 +36,18 @@
  when:
    - kata_containers_enabled

- name: Cri-o | build a list of crio runtimes with crun runtime
+## After CRI-O v1.31, crun is default runtime.
+# - name: Cri-o | build a list of crio runtimes with crun runtime
+#   set_fact:
+#     crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}"
+#   when:
+#     - crun_enabled
+
+- name: Cri-o | build a list of crio runtimes with runc runtime
  set_fact:
-    crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}"
+    crio_runtimes: "{{ crio_runtimes + [runc_runtime] }}"
  when:
-    - crun_enabled
+    - runc_enabled

 - name: Cri-o | build a list of crio runtimes with youki runtime
  set_fact:
@@ -82,6 +89,23 @@
    - "{{ crio_bin_files }}"
  notify: Restart crio

+- name: Cri-o | create directory for libexec
+  file:
+    path: "{{ crio_libexec_dir }}"
+    state: directory
+    owner: root
+    mode: "0755"
+
+- name: Cri-o | copy libexec
+  copy:
+    src: "{{ local_release_dir }}/cri-o/bin/{{ item }}"
+    dest: "{{ crio_libexec_dir }}/{{ item }}"
+    mode: "0755"
+    remote_src: true
+  with_items:
+    - "{{ crio_libexec_files }}"
+  notify: Restart crio
+
 - name: Cri-o | copy service file
  copy:
    src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
@@ -156,7 +180,7 @@
    dest: /etc/containers/storage.conf
    section: storage.options.overlay
    option: mountopt
-    value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
+    value: '{{ ''"nodev"'' if ansible_kernel is version(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
    mode: "0644"

 - name: Cri-o | create directory registries configs
--- a/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml
@@ -19,7 +19,7 @@

 - name: CRI-O | Remove cri-o apt repo
  apt_repository:
-    repo: "deb {{ crio_download_crio }}{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /"
+    repo: "deb {{ crio_download_crio }}v{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /"
    state: absent
    filename: devel-kubic-libcontainers-stable-cri-o
  when: crio_kubic_debian_repo_name is defined
@@ -36,7 +36,7 @@

 - name: CRI-O | Remove CRI-O kubic yum repo
  yum_repository:
-    name: "devel_kubic_libcontainers_stable_cri-o_{{ crio_version }}"
+    name: "devel_kubic_libcontainers_stable_cri-o_v{{ crio_version }}"
    state: absent
  when:
    - ansible_os_family == "RedHat"
@@ -88,3 +88,11 @@
  with_items: "{{ crio_bin_files }}"
  tags:
    - reset_crio
+
+- name: CRI-O | Remove CRI-O libexec
+  file:
+    name: "{{ item }}"
+    state: absent
+  with_items: "{{ crio_libexec_files }}"
+  tags:
+    - reset_crio
--- a/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2
+++ b/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2
@@ -17,7 +17,7 @@

 # Path to the "root directory". CRI-O stores all of its data, including
 # containers images, in this directory.
-root = "/var/lib/containers/storage"
+root = "{{ crio_root }}"

 # Path to the "run directory". CRI-O stores all of its state in this directory.
 # Read from /etc/containers/storage.conf first so unnecessary here
@@ -97,7 +97,7 @@ grpc_max_recv_msg_size = 16777216

 # default_runtime is the _name_ of the OCI runtime to be used as the default.
 # The name is matched against the runtimes map below.
-default_runtime = "runc"
+default_runtime = "{{ crio_default_runtime }}"

 # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
 no_pivot = false
@@ -155,17 +155,9 @@ cgroup_manager = "{{ crio_cgroup_manager }}"
 # only the capabilities defined in the containers json file by the user/kube
 # will be added.
 default_capabilities = [
-	"CHOWN",
-	"DAC_OVERRIDE",
-	"FSETID",
-	"FOWNER",
-	"NET_RAW",
-	"SETGID",
-	"SETUID",
-	"SETPCAP",
-	"NET_BIND_SERVICE",
-	"SYS_CHROOT",
-	"KILL",
+{%- for item in crio_default_capabilities %}
+        "{{ item }}",
+{%- endfor %}
 ]

 # List of default sysctls. If it is empty or commented out, only the sysctls
@@ -382,7 +374,7 @@ enable_metrics = {{ crio_enable_metrics | bool | lower }}
 # The port on which the metrics server will listen.
 metrics_port = {{ crio_metrics_port }}

-{% if nri_enabled and crio_version is version('v1.26.0', operator='>=') %}
+{% if nri_enabled and crio_version is version('1.26.0', operator='>=') %}
 [crio.nri]

 enable_nri=true
--- a/kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml
+++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml
@@ -1,9 +0,0 @@
---
-# cri-o binary files
-crio_bin_files:
-  - conmon
-  - crio
-  - crio-status
-  - pinns
-
-crio_status_command: crio-status
--- a/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml
+++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml
@@ -1,5 +1,6 @@
 ---
 crio_conmon: "{{ bin_dir }}/crio-conmon"
+crio_runtime_bin_dir: "{{ bin_dir }}"

 # cri-o binary files
 crio_bin_files:
--- a/kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml
+++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml
@@ -0,0 +1,16 @@
+---
+crio_conmon: "{{ crio_libexec_dir }}/conmon"
+crio_runtime_bin_dir: "{{ crio_libexec_dir }}"
+
+# cri-o binary files
+crio_bin_files:
+  - crio
+  - pinns
+
+crio_libexec_files:
+  - conmon
+  - conmonrs
+  - crun
+  - runc
+
+crio_status_command: crio status