kubespray/roles/container-engine/containerd/tasks/main.yml

---
- name: check if fedora coreos
  stat:
    path: /run/ostree-booted
  register: ostree

- name: set is_ostree
  set_fact:
    is_ostree: "{{ ostree.stat.exists }}"


- name: Fail containerd setup if distribution is not supported
  fail:
    msg: "{{ ansible_distribution }} is not supported by containerd."
  when:
    - not ansible_distribution in ["CentOS","RedHat", "Ubuntu", "Debian", "Fedora"]

- name: gather os specific variables
  include_vars: "{{ item }}"
  with_first_found:
    - files:
        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_version|lower|replace('/', '_') }}.yml"
        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}-{{ host_architecture }}.yml"
        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}.yml"
        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_major_version|lower|replace('/', '_') }}.yml"
        - "{{ ansible_distribution|lower }}-{{ host_architecture }}.yml"
        - "{{ ansible_distribution|lower }}.yml"
        - "{{ ansible_os_family|lower }}-{{ host_architecture }}.yml"
        - "{{ ansible_os_family|lower }}.yml"
        - defaults.yml
      paths:
        - ../vars
      skip: true
  tags:
    - facts

- name: disable unified_cgroup_hierarchy in Fedora 31+
  command: grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=0"
  when:
    - ansible_distribution == "Fedora"
    - (ansible_distribution_major_version | int) >= 31
    - ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] is not defined or ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] != '0'

- name: reboot in Fedora 31+
  reboot:
  when:
    - ansible_distribution == "Fedora"
    - (ansible_distribution_major_version | int) >= 31
    - ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] is not defined or ansible_proc_cmdline['systemd.unified_cgroup_hierarchy'] != '0'

- include_tasks: containerd_repo.yml
  when: not is_ostree

- name: Create containerd service systemd directory if it doesn't exist
  file:
    path: /etc/systemd/system/containerd.service.d
    state: directory

- name: Write containerd proxy drop-in
  template:
    src: http-proxy.conf.j2
    dest: /etc/systemd/system/containerd.service.d/http-proxy.conf
  notify: restart containerd
  when: http_proxy is defined or https_proxy is defined

- name: ensure containerd config directory
  file:
    dest: "{{ containerd_cfg_dir }}"
    state: directory
    mode: 0755
    owner: root
    group: root

- name: Copy containerd config file
  template:
    src: config.toml.j2
    dest: "{{ containerd_cfg_dir }}/config.toml"
    owner: "root"
    mode: 0644
  notify: restart containerd

# This is required to ensure any apt upgrade will not break kubernetes
- name: Set containerd pin priority to apt_preferences on Debian family
  template:
    src: "apt_preferences.d/debian_containerd.j2"
    dest: "/etc/apt/preferences.d/containerd"
    owner: "root"
    mode: 0644
  when:
    - ansible_os_family in ['Ubuntu', 'Debian']
    - not is_ostree

- name: ensure containerd packages are installed
  action: "{{ containerd_package_info.pkg_mgr }}"
  args:
    pkg: "{{ item.name }}"
    force: "{{ item.force | default(omit) }}"
    conf_file: "{{ item.yum_conf | default(omit) }}"
    state: present
    update_cache: "{{ omit if ansible_distribution == 'Fedora' else True }}"
  register: containerd_task_result
  until: containerd_task_result is succeeded
  retries: 4
  delay: "{{ retry_stagger | d(3) }}"
  with_items: "{{ containerd_package_info.pkgs }}"
  notify: restart containerd
  when:
    - not is_ostree
    - containerd_package_info.pkgs|length > 0
  ignore_errors: true

- name: Check if runc is installed
  stat:
    path: "{{ runc_binary }}"
  register: runc_stat

- name: Install runc package if necessary
  action: "{{ containerd_package_info.pkg_mgr }}"
  args:
    pkg: runc
    state: present
    update_cache: "{{ omit if ansible_distribution == 'Fedora' else True }}"
  register: runc_task_result
  until: runc_task_result is succeeded
  retries: 4
  delay: "{{ retry_stagger | d(3) }}"
  notify: restart containerd
  when:
    - not is_ostree
    - not runc_stat.stat.exists

- name: Ensure latest version of libseccomp installed  # noqa 403
  package:
    name: libseccomp
    state: latest
  when:
    - ansible_distribution == "CentOS"
    - ansible_distribution_major_version == "8"
  notify: restart containerd

- include_tasks: crictl.yml