ansible-role-containerd

Ansible role to install containerd. containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.

Changelog

Change history:

See full CHANGELOG

Recent changes:

0.18.0+2.3.0

• UPDATE

  • update containerd to v2.3.0

• MOLECULE

  • use own githubixx Vagrant boxes

0.17.0+2.2.1

• BREAKING

  • CNI bin_dir in CRI runtime config is deprecated (plugins.'io.containerd.cri.v1.runtime'.cni.bin_dir) and will be removed in containerd v2.3. It was replaced with bin_dirs in the same section which supports a list of directories. So, plugins.'io.containerd.cri.v1.runtime'.cni.bin_dir = '/opt/cni/bin' was changed to plugins.'io.containerd.cri.v1.runtime'.cni.bin_dirs = ['/opt/cni/bin'] in containerd_config variable.

• UPDATE

  • update containerd to v2.2.1

• FEATURE

  • support conf.d include in the default config

• MOLECULE

  • add test for conf.d include feature

0.16.0+2.1.4

• Breaking

  • meta/main.yml: Change min_ansible_version to 2.15. Ansible 2.9 is end-of-life (EOL).

• UPDATE

  • update containerd to v2.1.4
  • update .gitignore
  • update .yamllint
  • fix ansible-lint issues

Installation

• Directly download from Github (change into Ansible role directory before cloning): git clone https://github.com/githubixx/ansible-role-containerd.git githubixx.containerd

• Via ansible-galaxy command and download directly from Ansible Galaxy: ansible-galaxy install role githubixx.containerd

• Create a requirements.yml file with the following content (this will download the role from Github) and install with ansible-galaxy role install -r requirements.yml:

---
roles:
  - name: githubixx.containerd
    src: https://github.com/githubixx/ansible-role-containerd.git
    version: 0.18.0+2.3.0

Role Variables

# Only value "base" is currently supported
containerd_flavor: "base"

# containerd version to install
containerd_version: "2.3.0"

# Directory where to store "containerd" binaries
containerd_binary_directory: "/usr/local/bin"

# Location of containerd configuration file
containerd_config_directory: "/etc/containerd"

# Directory to store the archive
containerd_tmp_directory: "{{ lookup('env', 'TMPDIR') | default('/tmp', true) }}"

# Owner/group of "containerd" binaries. If the variables are not set
# the resulting binary will be owned by the current user.
containerd_owner: "root"
containerd_group: "root"

# Specifies the permissions of the "containerd" binaries
containerd_binary_mode: "0755"

# Operating system
# Possible options: "linux", "windows"
containerd_os: "linux"

# Processor architecture "containerd" should run on.
# Other possible values: "arm64","arm"
containerd_arch: "amd64"

# Name of the archive file name
containerd_archive_base: "containerd-{{ containerd_version }}-{{ containerd_os }}-{{ containerd_arch }}.tar.gz"

# The containerd download URL (normally no need to change it)
containerd_url: "https://github.com/containerd/containerd/releases/download/v{{ containerd_version }}/{{ containerd_archive_base }}"

# containerd systemd service settings
containerd_service_settings:
  "ExecStartPre": "{{ modprobe_location }} overlay"
  "ExecStart": "{{ containerd_binary_directory }}/containerd"
  "Restart": "always"
  "RestartSec": "5"
  "Type": "notify"
  "Delegate": "yes"
  "KillMode": "process"
  "OOMScoreAdjust": "-999"
  "LimitNOFILE": "1048576"
  "LimitNPROC": "infinity"
  "LimitCORE": "infinity"

# Content of configuration file of "containerd". The settings below are the
# settings that are either different to the default "containerd" settings or
# stated explicitly to make important settings more visible even if they're
# default. So these settings will override the default settings.
#
# The default "containerd" configuration can be generated with this command:
#
# containerd config default
#
# A full configuration example with all possible options is also available here:
# https://github.com/containerd/containerd/blob/main/docs/cri/config.md#full-configuration
#
# Also if you want to adjust settings please consult the CRI Plugin Config Guide:
# https://github.com/containerd/containerd/blob/main/docs/cri/config.md
#
# Difference to default configuration:
#
# - In 'plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options' the
#   setting "SystemdCgroup" is set to "true" instead of "false". This is relevant for
#   Kubernetes e.g. Also see:
#   https://kubernetes.io/docs/setup/production-environment/container-runtimes/#containerd-systemd)
#
containerd_config: |
  version = 3
  [plugins]
    [plugins.'io.containerd.cri.v1.runtime']
      [plugins.'io.containerd.cri.v1.runtime'.containerd]
        default_runtime_name = 'runc'
        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes]
          [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
            runtime_type = 'io.containerd.runc.v2'
            [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
              BinaryName = '/usr/local/sbin/runc'
              SystemdCgroup = true
      [plugins.'io.containerd.cri.v1.runtime'.cni]
        bin_dirs = ['/opt/cni/bin']
        conf_dir = '/etc/cni/net.d'

# Optional: containerd config drop-ins via `imports` (containerd >= v2.2.0)
#
# If you set `containerd_config_imports`, the role will:
# - add `imports = [ ... ]` to the generated `config.toml` (unless your
#   `containerd_config` already contains an `imports = ...` line)
# - optionally create the referenced directories and manage `.toml` drop-in files
#   defined under `configs`.
#
# Example 1: Enable imports and manage a few drop-in files in `/etc/containerd/conf.d`
#
# containerd_config_imports:
#   - glob: "/etc/containerd/conf.d/*.toml"
#     configs:
#       10-nvidia.toml: |
#         # Example override (use dotted keys to avoid table re-definition issues)
#         disabled_plugins = []
#
#       20-cni.toml: |
#         plugins.'io.containerd.cri.v1.runtime'.cni.bin_dirs = ['/opt/cni/bin']
#         plugins.'io.containerd.cri.v1.runtime'.cni.conf_dir = '/etc/cni/net.d'
#
# Example 2: Import additional directories but manage files elsewhere
#
# containerd_config_imports:
#   - glob: "/etc/containerd/conf.d/*.toml"
#   - glob: "/etc/containerd/conf2.d/*.toml"
#
# Example 3: Override an existing default setting via a drop-in
# (here: switch SystemdCgroup to false)
#
# containerd_config_imports:
#   - glob: "/etc/containerd/conf.d/*.toml"
#     configs:
#       10-runc-options.toml: |
#         plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options.SystemdCgroup = false
#
# Variable definition (default: disabled)
containerd_config_imports: []

# Validate the combined config (main config + imported drop-ins).
# Uses: `containerd --config <path> config dump`. If invalid, the play fails.
containerd_validate_config: false

Dependencies

Optional dependencies (e.g. needed for Kubernetes):

• runc
• CNI

You can use every other runc and CNI role of course.

Example Playbook

- hosts: your-host
  roles:
    - githubixx.containerd

More examples are available in the Molecule tests.

Testing

This role has a small test setup that is created using Molecule, libvirt (vagrant-libvirt) and QEMU/KVM. Please see my blog post Testing Ansible roles with Molecule, libvirt (vagrant-libvirt) and QEMU/KVM how to setup. The test configuration is in molecule/kvm.

Afterwards molecule can be executed:

molecule converge

This will setup a few virtual machines (VM) with different supported Linux operating systems and installs containerd, runc and the CNI plugins (which are needed by Kubernetes e.g.).

A small verification step is also included. It pulls a nginx container and runs it to make sure that containerd is setup correctly and is able to run container images:

molecule verify

To clean up run

molecule destroy

License

GNU GENERAL PUBLIC LICENSE Version 3

Author Information

http://www.tauceti.blog