Remove docker

parts/k8s/kubernetesagentcustomdata.yml

@@ -8,14 +8,15 @@ write_files:
   content: !!binary |
     {{WrapAsVariable "provisionSource"}}
 
-{{if not .IsCoreOS}}
+{{if .KubernetesConfig.RequiresDocker}}
+    {{if not .IsCoreOS}}
 - path: "/etc/systemd/system/docker.service.d/clear_mount_propagation_flags.conf"
   permissions: "0644"
   owner: "root"
   content: |
     [Service]
     MountFlags=shared
-{{end}}
+    {{end}}
 - path: "/etc/systemd/system/docker.service.d/exec_start.conf"
   permissions: "0644"
   owner: "root"
@@ -43,6 +44,7 @@ write_files:
         }
       }{{end}}
     }
+{{end}}
 
 - path: "/etc/kubernetes/certs/ca.crt"
   permissions: "0644"
@@ -139,7 +141,10 @@ AGENT_ARTIFACTS_CONFIG_PLACEHOLDER
   content: |
     #!/bin/bash
     /usr/bin/mkdir -p /etc/kubernetes/manifests
+
+    {{if .KubernetesConfig.RequiresDocker}}
     usermod -aG docker {{WrapAsVariable "username"}}
+    {{end}}
 
     systemctl enable rpcbind
     systemctl enable rpc-statd

parts/k8s/kubernetescustomscript.sh

@@ -337,6 +337,7 @@ function installContainerd() {
     retrycmd_get_tarball 60 5 "$CONTAINERD_TGZ_TMP" "$CONTAINERD_DOWNLOAD_URL"
 	tar -xzf "$CONTAINERD_TGZ_TMP" -C /
 	rm -f "$CONTAINERD_TGZ_TMP"
+	sed -i '/\[Service\]/a ExecStartPost=\/sbin\/iptables -P FORWARD ACCEPT' /etc/systemd/system/containerd.service
 
 	echo "Successfully installed cri-containerd..."
 	if [[ "$CONTAINER_RUNTIME" == "clear-containers" ]] || [[ "$CONTAINER_RUNTIME" == "containerd" ]]; then
@@ -511,9 +512,14 @@ if [ -f $CUSTOM_SEARCH_DOMAIN_SCRIPT ]; then
 fi
 
 installDeps
-installDocker
+
+if [[ "$CONTAINER_RUNTIME" == "docker" ]]; then
+    installDocker
+    ensureDocker
+fi
+
 configureK8s
-ensureDocker
+
 configNetworkPlugin
 
 if [[ ! -z "${MASTER_NODE}" ]]; then

parts/k8s/kubernetesmastercustomdata.yml

@@ -14,6 +14,7 @@ write_files:
   content: !!binary |
     {{WrapAsVariable "provisionSource"}}
 
+{{if .OrchestratorProfile.KubernetesConfig.RequiresDocker}}
 {{if not .MasterProfile.IsCoreOS}}
 - path: "/etc/systemd/system/docker.service.d/clear_mount_propagation_flags.conf"
   permissions: "0644"
@@ -46,6 +47,7 @@ write_files:
          "max-file": "5"
       }
     }
+{{end}}
 
 - path: "/etc/kubernetes/certs/ca.crt"
   permissions: "0644"
@@ -376,7 +378,10 @@ MASTER_ARTIFACTS_CONFIG_PLACEHOLDER
     systemctl restart etcd-member
     retrycmd_if_failure 5 5 10 curl --retry 5 --retry-delay 10 --retry-max-time 10 --max-time 60 http://127.0.0.1:2379/v2/machines
     mkdir -p /etc/kubernetes/manifests
+
+    {{if .OrchestratorProfile.KubernetesConfig.RequiresDocker}}
     usermod -aG docker {{WrapAsVariable "username"}}
+    {{end}}
 
     {{if EnableAggregatedAPIs}}
     sudo bash /etc/kubernetes/generate-proxy-certs.sh

pkg/api/types.go

@@ -978,3 +978,9 @@ func (k *KubernetesConfig) PrivateJumpboxProvision() bool {
 	}
 	return false
 }
+
+// RequiresDocker returns if the kubernetes settings require docker to be installed.
+func (k *KubernetesConfig) RequiresDocker() bool {
+	runtime := strings.ToLower(k.ContainerRuntime)
+	return runtime == "docker" || runtime == ""
+}

pkg/api/vlabs/types.go

@@ -633,3 +633,9 @@ func (l *LinuxProfile) HasCustomNodesDNS() bool {
 func (o *OrchestratorProfile) IsSwarmMode() bool {
 	return o.OrchestratorType == SwarmMode
 }
+
+// RequiresDocker returns if the kubernetes settings require docker to be installed.
+func (k *KubernetesConfig) RequiresDocker() bool {
+	runtime := strings.ToLower(k.ContainerRuntime)
+	return runtime == "docker" || runtime == ""
+}