10_container_runtimes.yml

---
- name: Install container runtime
  hosts: k8s_nodes
  become: true
  vars_files:
    - vars/k8s_cluster.yml
  tasks:
    - name: Upgrade all packages
      ansible.builtin.package:
        name: "*"
        state: latest # noqa package-latest

    - name: Install pip
      ansible.builtin.package:
        name: python3-pip
        state: present

    - name: Ensuring cryptography module is present
      ansible.builtin.pip:
        name: cryptography
      become: true

    - name: Ensure prerequisites are met.
      block:
        - name: Add modules to autostart
          ansible.builtin.blockinfile:
            path: /etc/modules-load.d/k8s.conf
            block: |
              overlay
              br_netfilter
            create: true
            mode: "0755"

        - name: Enable br_netfilter
          community.general.modprobe:
            name: "{{ item }}"
            state: present
          loop:
            - br_netfilter
            - overlay

        - name: Enable sysctl values
          ansible.posix.sysctl:
            name: "{{ item.key }}"
            value: "{{ item.value }}"
            state: present
            reload: true
            sysctl_set: true
          loop:
            - key: net.ipv4.ip_forward
              value: 1
            - key: net.bridge.bridge-nf-call-ip6tables
              value: 1
            - key: net.bridge.bridge-nf-call-iptables
              value: 1

        - name: Fix dead traffic on Systemd 245+ for cilium
          when:
            - k8s.cluster_os == "Ubuntu"
            - k8s.network.cni_plugin == "cilium"
          block:
            - name: Setup sysctl
              ansible.builtin.copy:
                dest: /etc/sysctl.d/99-restore-cilium-traffic.conf
                content: "net.ipv4.conf.lxc*.rp_filter = 0"
                mode: "0755"

            - name: Ensure sysctl is restarted
              ansible.builtin.service:
                name: systemd-sysctl
                state: restarted

    - name: Install cri-o
      when: k8s.container_runtime == 'crio'
      block:
        - name: Ensure required packages for cri-o are installed
          ansible.builtin.apt:
            name:
              - apt-transport-https
              - curl
            state: present
          when: k8s.cluster_os == 'Ubuntu'

        - name: Add crio-repo key
          ansible.builtin.apt_key:
            url: "{{ crio.ubuntu.crio_key }}"
            keyring: "{{ crio.ubuntu.crio_keyring }}"
            state: present
          when: k8s.cluster_os == 'Ubuntu'

        - name: Ensure the presence of apt-repo for cri-o packages
          ansible.builtin.apt_repository:
            repo: "{{ crio.ubuntu.crio_repo }}"
            filename: "{{ crio.ubuntu.crio_repofile }}"
            state: present
          when: k8s.cluster_os == 'Ubuntu'

        - name: Temporary fix for memory swap slices on 20.04
          ansible.builtin.lineinfile:
            path: /etc/default/grub
            regexp: "^GRUB_CMDLINE_LINUX"
            line: 'GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"'
          when: k8s.cluster_os == 'Ubuntu'

        - name: Add cri-o repository
          ansible.builtin.yum_repository:
            name: cri-o
            description: cri-o repo
            baseurl: "{{ crio.centos.crio_repo }}"
            gpgcheck: true
            repo_gpgcheck: true
            gpgkey: "{{ crio.centos.crio_key }}"
            exclude: crio
          when: k8s.cluster_os == 'CentOS'

        - name: Ensure cri-o is installed - CentOS
          ansible.builtin.yum:
            name: cri-o
            state: present
          when: k8s.cluster_os == 'CentOS'

        - name: Ensure cri-o is installed - Ubuntu
          ansible.builtin.apt:
            name:
              - cri-o
              - crun
            state: present
          when:
            - k8s.cluster_os == 'Ubuntu'

        - name: Fire crio-conf template
          ansible.builtin.template:
            src: templates/crio.conf.j2
            dest: /etc/crio/crio.conf
            mode: "0755"

        - name: Fire crio-conf template
          ansible.builtin.template:
            src: templates/crio.conf.crun.j2
            dest: /etc/crio/crio.conf.d/01-crio-runc.conf
            mode: "0755"
          when:
            - k8s.cluster_os == 'Ubuntu'

        - name: Remove example CNI configs
          ansible.builtin.file:
            path: "/etc/cni/net.d/{{ item }}"
            state: absent
          loop:
            - 100-crio-bridge.conf
            - 200-loopback.conf

        - name: Force systemd to reread configs
          ansible.builtin.systemd:
            daemon_reload: true

        - name: Ensure cri-o is enabled and started
          ansible.builtin.systemd:
            name: crio
            state: started
            enabled: true

    - name: Ensure containerd is configured and installed on CentOS machine
      when:
        - k8s.container_runtime == 'containerd'
        - k8s.cluster_os == 'CentOS'
      block:
        - name: Ensure required packages are present
          ansible.builtin.yum:
            name:
              - yum-utils
              - device-mapper-persistent-data
              - lvm2
            state: present

        - name: Add containerd repository
          ansible.builtin.get_url:
            url: "{{ containerd.centos.containerd_repo }}"
            dest: "/etc/yum.repos.d/docker-ce.repo"
            mode: "0755"

        - name: Ensure containerd is installed
          ansible.builtin.yum:
            name: containerd.io
            state: present

    - name: Setup containerd on Ubuntu
      when:
        - k8s.container_runtime == 'containerd'
        - k8s.cluster_os == 'Ubuntu'
      block:
        - name: Add containerd repo key
          ansible.builtin.apt_key:
            url: "{{ item.key }}"
            keyring: "{{ item.keyring }}"
            state: present
          loop:
            - key: "{{ containerd.ubuntu.containerd_repo_key }}"
              keyring: "{{ containerd.ubuntu.containerd_repo_key_file }}"

        - name: Ensure the presence of apt-repo for containerd
          ansible.builtin.apt_repository:
            repo: "{{ item.repo }}"
            filename: "{{ item.file }}"
            state: present
          loop:
            - repo: "{{ containerd.ubuntu.containerd_repo }}"
              file: /etc/apt/sources.list.d/docker.list

        - name: Ensure containerd is configured and installed on Ubuntu machine
          ansible.builtin.apt:
            name: containerd.io
            state: latest # noqa package-latest
            update_cache: true

    - name: Ensure containerd service is configured
      when: k8s.container_runtime == 'containerd'
      block:
        - name: Create /etc/containers
          ansible.builtin.file:
            state: directory
            path: /etc/containerd
            mode: "0755"

        - name: Initialize config # noqa no-changed-when
          ansible.builtin.shell: containerd config default > /etc/containerd/config.toml

        - name: Configure containerd to work with systemd
          ansible.builtin.replace:
            path: /etc/containerd/config.toml
            regexp: "SystemdCgroup = false"
            replace: "SystemdCgroup = true"

        - name: Force systemd to reread configs
          ansible.builtin.systemd:
            daemon_reload: true

        - name: Ensure containerd is enabled and started
          ansible.builtin.service:
            name: containerd
            state: restarted
            enabled: true

    - name: Reboot nodes before proceeding
      ansible.builtin.reboot: