cri-o.yml

---
- hosts: all
  become: true
  tasks:
    - include: install/os_updates.yml
    - include: install/kubernetes.yml
    - include: install/golang.yml
    - include: install/clearcontainers.yml
      when: runtime == "cc-oci-runtime"

    - name: Make sure we have all required packages on Fedora
      dnf:
        name: "{{ item }}"
        state: latest
      with_items:
        - btrfs-progs-devel
        - container-selinux
        - device-mapper-devel
        - gcc
        - git
        - glib2-devel
        - glibc-devel
        - glibc-static
        - go-md2man
        - golang
        - gpgme-devel
        - iptables
        - libassuan-devel
        - libgpg-error-devel
        - libseccomp-devel
        - make
        - pkgconfig
        - skopeo-containers
        - tar
        - wget
      when: ansible_distribution == 'Fedora'

    - name: Make sure we have all required packages on RHEL/CentOS
      yum:
        name: "{{ item }}"
        state: latest
      with_items:
        - btrfs-progs-devel
        - container-selinux
        - device-mapper-devel
        - gcc
        - git
        - glib2-devel
        - glibc-devel
        - glibc-static
        - go-md2man
        - golang
        - gpgme-devel
        - json-glib-devel
        - libassuan-devel
        - libgpg-error-devel
        - libseccomp-devel
        - make
        - pkgconfig
        - skopeo-containers
        - tar
        - wget
      when: ansible_distribution in ['RedHat', 'CentOS']

    - name: Make sure we have all required packages on Ubuntu
      package:
        name: "{{ item }}"
        state: latest
      with_items:
        - apt-transport-https
        - aptitude
        - btrfs-tools
        - build-essential
        - curl
        - gawk
        - iptables
        - libaio-dev
        - libapparmor-dev
        - libcap-dev
        - libdevmapper-dev
        - libdevmapper1.02.1
        - libglib2.0-dev
        - libgpgme11-dev
        - libjson-glib-dev
        - libprotobuf-dev
        - libseccomp-dev
        - libseccomp2
        - pkg-config
        - protobuf-compiler
        - python-minimal
      when: ansible_distribution == 'Ubuntu'

    - name: Make directories
      file:
        path: "{{ item }}"
        state: directory
      with_items:
           - /usr/local/go
           - /etc/systemd/system/kubelet.service.d/
           - /var/lib/etcd
           - /etc/cni/net.d
           - /etc/containers

    - name: clone runc
      git:
        repo: https://github.com/opencontainers/runc
        dest: /root/src/github.com/opencontainers/runc

    - name: clone CRI-O
      git:
        repo: https://github.com/kubernetes-incubator/cri-o
        dest: /root/src/github.com/kubernetes-incubator/cri-o
        version: kube-1.6.x

    - name: clone CNI
      git:
        repo: https://github.com/containernetworking/plugins
        dest: /root/src/github.com/containernetworking/plugins

    - name: build runc
      shell: |
              cd /root/src/github.com/opencontainers/runc && \
              export GOPATH=/root && \
              make BUILDTAGS="seccomp selinux" && \
              make install

    - name: link runc
      file: src=/usr/local/sbin/runc dest=/usr/bin/runc state=link force=yes

    - name: build cri-o
      shell: |
              cd /root/src/github.com/kubernetes-incubator/cri-o && \
              make install.tools && \
              make && \
              make install && \
              make install.systemd && \
              make install.config

    - name: install policy.json in Ubuntu
      shell: |
              cd /root/src/github.com/kubernetes-incubator/cri-o && \
              cp test/policy.json /etc/containers/policy.json
      when: ansible_distribution == 'Ubuntu'

    - name: build CNI stuff
      shell: |
              cd /root/src/github.com/containernetworking/plugins && \
              ./build.sh && \
              mkdir -p /opt/cni/bin && \
              cp bin/* /opt/cni/bin/

    - name: run CRI-O with systemd cgroup manager
      replace:
        regexp: 'cgroupfs'
        replace: 'systemd'
        name: /etc/crio/crio.conf
        backup: yes
      when: ansible_distribution in ['Fedora', 'RedHat', 'CentOS']

    - name: run with overlay2
      replace:
        regexp: 'storage_driver = ""'
        replace: 'storage_driver = "overlay2"'
        name: /etc/crio/crio.conf
        backup: yes

    - name: add overlay2 storage opts on RHEL/CentOS
      lineinfile:
        dest: /etc/crio/crio.conf
        line: '"overlay2.override_kernel_check=1"'
        insertafter: 'storage_option = \['
        regexp: 'overlay2\.override_kernel_check=1'
        state: present
      when: ansible_distribution in ['RedHat', 'CentOS']

    - block:
      - name: Use Clear Containers for Untrusted Workloads
        ini_file:
          backup: yes
          section: crio.runtime
          option: runtime_untrusted_workload
          value: '"/usr/bin/cc-oci-runtime.sh"'
          path: /etc/crio/crio.conf
      - name: Set default workload trust
        ini_file:
          backup: yes
          section: crio.runtime
          option: default_workload_trust
          value: '"untrusted"'
          path: /etc/crio/crio.conf
      when: runtime == "cc-oci-runtime"

    - name: enable and start CRI-O
      systemd:
        name: crio
        state: started
        enabled: yes
        daemon_reload: yes

    - name: modprobe br_netfilter
      command: "modprobe br_netfilter"
      ignore_errors: true

    - name: tune sysctl
      lineinfile:
        line: "net/bridge/bridge-nf-call-iptables = 1"
        dest: /etc/sysctl.conf
        insertafter: 'EOF'
        regexp: '\/net\/bridge\/bridge-nf-call-iptables = 1'
        state: present
      ignore_errors: true

    - name: reload sysctl
      command: "sysctl -p"
      ignore_errors: true

    - name: systemd dropin for kubeadm
      shell: |
              sh -c 'echo "[Service]
              Environment=\"KUBELET_EXTRA_ARGS=--enable-cri=true --container-runtime=remote --runtime-request-timeout=15m --image-service-endpoint /var/run/crio.sock --container-runtime-endpoint /var/run/crio.sock\"" > /etc/systemd/system/kubelet.service.d/0-crio.conf'

    - name: flush iptables
      command: "iptables -F"

    - name: Permanently disable selinux
      lineinfile:
        dest: /etc/selinux/config
        line: 'SELINUX=permissive'
        regexp: '^SELINUX='
      when: ansible_distribution in ['Fedora', 'RedHat', 'CentOS']

    - name: disable selinux
      command: "setenforce 0"
      when: ansible_distribution in ['Fedora', 'RedHat', 'CentOS']