300 lines
11 KiB
Django/Jinja
300 lines
11 KiB
Django/Jinja
|
||
# The CRI-O configuration file specifies all of the available configuration
|
||
# options and command-line flags for the crio(8) OCI Kubernetes Container Runtime
|
||
# daemon, but in a TOML format that can be more easily modified and versioned.
|
||
#
|
||
# Please refer to crio.conf(5) for details of all configuration options.
|
||
|
||
# CRI-O reads its storage defaults from the containers-storage.conf(5) file
|
||
# located at /etc/containers/storage.conf. Modify this storage configuration if
|
||
# you want to change the system's defaults. If you want to modify storage just
|
||
# for CRI-O, you can change the storage configuration options here.
|
||
[crio]
|
||
|
||
# Path to the "root directory". CRI-O stores all of its data, including
|
||
# containers images, in this directory.
|
||
#root = "/var/lib/containers/storage"
|
||
|
||
# Path to the "run directory". CRI-O stores all of its state in this directory.
|
||
#runroot = "/var/run/containers/storage"
|
||
|
||
# Storage driver used to manage the storage of images and containers. Please
|
||
# refer to containers-storage.conf(5) to see all available storage drivers.
|
||
storage_driver = "overlay2"
|
||
|
||
# List to pass options to the storage driver. Please refer to
|
||
# containers-storage.conf(5) to see all available storage options.
|
||
#storage_option = [
|
||
#]
|
||
|
||
# If set to false, in-memory locking will be used instead of file-based locking.
|
||
file_locking = true
|
||
|
||
# Path to the lock file.
|
||
file_locking_path = "/run/crio.lock"
|
||
|
||
|
||
# The crio.api table contains settings for the kubelet/gRPC interface.
|
||
[crio.api]
|
||
|
||
# Path to AF_LOCAL socket on which CRI-O will listen.
|
||
listen = "/var/run/crio/crio.sock"
|
||
|
||
# IP address on which the stream server will listen.
|
||
stream_address = ""
|
||
|
||
# The port on which the stream server will listen.
|
||
stream_port = "10010"
|
||
|
||
# Enable encrypted TLS transport of the stream server.
|
||
stream_enable_tls = false
|
||
|
||
# Path to the x509 certificate file used to serve the encrypted stream. This
|
||
# file can change, and CRI-O will automatically pick up the changes within 5
|
||
# minutes.
|
||
stream_tls_cert = ""
|
||
|
||
# Path to the key file used to serve the encrypted stream. This file can
|
||
# change, and CRI-O will automatically pick up the changes within 5 minutes.
|
||
stream_tls_key = ""
|
||
|
||
# Path to the x509 CA(s) file used to verify and authenticate client
|
||
# communication with the encrypted stream. This file can change, and CRI-O will
|
||
# automatically pick up the changes within 5 minutes.
|
||
stream_tls_ca = ""
|
||
|
||
# Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 16 * 1024 * 1024.
|
||
grpc_max_send_msg_size = 16777216
|
||
|
||
# Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 16 * 1024 * 1024.
|
||
grpc_max_recv_msg_size = 16777216
|
||
|
||
# The crio.runtime table contains settings pertaining to the OCI runtime used
|
||
# and options for how to set up and manage the OCI runtime.
|
||
[crio.runtime]
|
||
|
||
# A list of ulimits to be set in containers by default, specified as
|
||
# "<ulimit name>=<soft limit>:<hard limit>", for example:
|
||
# "nofile=1024:2048"
|
||
# If nothing is set here, settings will be inherited from the CRI-O daemon
|
||
#default_ulimits = [
|
||
# "nofile=65536:65536",
|
||
#]
|
||
|
||
# default_runtime is the _name_ of the OCI runtime to be used as the default.
|
||
# The name is matched against the runtimes map below.
|
||
default_runtime = "runc"
|
||
|
||
# If true, the runtime will not use pivot_root, but instead use MS_MOVE.
|
||
no_pivot = false
|
||
|
||
# Path to the conmon binary, used for monitoring the OCI runtime.
|
||
conmon = "{{ crio_conmon }}"
|
||
|
||
# Environment variable list for the conmon process, used for passing necessary
|
||
# environment variables to conmon or the runtime.
|
||
conmon_env = [
|
||
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||
]
|
||
|
||
# If true, SELinux will be used for pod separation on the host.
|
||
selinux = {{ (preinstall_selinux_state == 'enforcing')|lower }}
|
||
|
||
# Path to the seccomp.json profile which is used as the default seccomp profile
|
||
# for the runtime.
|
||
{% if ansible_os_family == "ClearLinux" %}
|
||
seccomp_profile = "/usr/share/defaults/crio/seccomp.json"
|
||
{% elif ansible_distribution == "Ubuntu" %}
|
||
seccomp_profile = ""
|
||
{% else %}
|
||
seccomp_profile = "/etc/crio/seccomp.json"
|
||
{% endif %}
|
||
|
||
# Used to change the name of the default AppArmor profile of CRI-O. The default
|
||
# profile name is "crio-default-" followed by the version string of CRI-O.
|
||
apparmor_profile = "crio-default"
|
||
|
||
# Cgroup management implementation used for the runtime.
|
||
cgroup_manager = "cgroupfs"
|
||
|
||
# List of default capabilities for containers. If it is empty or commented out,
|
||
# only the capabilities defined in the containers json file by the user/kube
|
||
# will be added.
|
||
default_capabilities = [
|
||
"CHOWN",
|
||
"DAC_OVERRIDE",
|
||
"FSETID",
|
||
"FOWNER",
|
||
"NET_RAW",
|
||
"SETGID",
|
||
"SETUID",
|
||
"SETPCAP",
|
||
"NET_BIND_SERVICE",
|
||
"SYS_CHROOT",
|
||
"KILL",
|
||
]
|
||
|
||
# List of default sysctls. If it is empty or commented out, only the sysctls
|
||
# defined in the container json file by the user/kube will be added.
|
||
default_sysctls = [
|
||
]
|
||
|
||
# List of additional devices. specified as
|
||
# "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
|
||
#If it is empty or commented out, only the devices
|
||
# defined in the container json file by the user/kube will be added.
|
||
additional_devices = [
|
||
]
|
||
|
||
# Path to OCI hooks directories for automatically executed hooks.
|
||
hooks_dir = [
|
||
]
|
||
|
||
# List of default mounts for each container. **Deprecated:** this option will
|
||
# be removed in future versions in favor of default_mounts_file.
|
||
default_mounts = [
|
||
{% if ansible_os_family == "RedHat" %}
|
||
"/usr/share/rhel/secrets:/run/secrets",
|
||
{% endif %}
|
||
]
|
||
|
||
# Path to the file specifying the defaults mounts for each container. The
|
||
# format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads
|
||
# its default mounts from the following two files:
|
||
#
|
||
# 1) /etc/containers/mounts.conf (i.e., default_mounts_file): This is the
|
||
# override file, where users can either add in their own default mounts, or
|
||
# override the default mounts shipped with the package.
|
||
#
|
||
# 2) /usr/share/containers/mounts.conf: This is the default file read for
|
||
# mounts. If you want CRI-O to read from a different, specific mounts file,
|
||
# you can change the default_mounts_file. Note, if this is done, CRI-O will
|
||
# only add mounts it finds in this file.
|
||
#
|
||
#default_mounts_file = ""
|
||
|
||
# Maximum number of processes allowed in a container.
|
||
pids_limit = 1024
|
||
|
||
# Maximum sized allowed for the container log file. Negative numbers indicate
|
||
# that no size limit is imposed. If it is positive, it must be >= 8192 to
|
||
# match/exceed conmon's read buffer. The file is truncated and re-opened so the
|
||
# limit is never exceeded.
|
||
log_size_max = -1
|
||
|
||
# Whether container output should be logged to journald in addition to the kuberentes log file
|
||
log_to_journald = false
|
||
|
||
# Path to directory in which container exit files are written to by conmon.
|
||
container_exits_dir = "/var/run/crio/exits"
|
||
|
||
# Path to directory for container attach sockets.
|
||
container_attach_socket_dir = "/var/run/crio"
|
||
|
||
# If set to true, all containers will run in read-only mode.
|
||
read_only = false
|
||
|
||
# Changes the verbosity of the logs based on the level it is set to. Options
|
||
# are fatal, panic, error, warn, info, and debug.
|
||
log_level = "error"
|
||
|
||
# The UID mappings for the user namespace of each container. A range is
|
||
# specified in the form containerUID:HostUID:Size. Multiple ranges must be
|
||
# separated by comma.
|
||
uid_mappings = ""
|
||
|
||
# The GID mappings for the user namespace of each container. A range is
|
||
# specified in the form containerGID:HostGID:Size. Multiple ranges must be
|
||
# separated by comma.
|
||
gid_mappings = ""
|
||
|
||
# The minimal amount of time in seconds to wait before issuing a timeout
|
||
# regarding the proper termination of the container.
|
||
ctr_stop_timeout = 0
|
||
|
||
# The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.
|
||
# The runtime to use is picked based on the runtime_handler provided by the CRI.
|
||
# If no runtime_handler is provided, the runtime will be picked based on the level
|
||
# of trust of the workload.
|
||
|
||
[crio.runtime.runtimes.runc]
|
||
{% if ansible_os_family == "ClearLinux" or ansible_os_family == "RedHat" %}
|
||
runtime_path = "/usr/bin/runc"
|
||
{% elif ansible_distribution == "Ubuntu" %}
|
||
runtime_path = "/usr/lib/cri-o-runc/sbin/runc"
|
||
{% else %}
|
||
runtime_path = "/usr/sbin/runc"
|
||
{% endif %}
|
||
runtime_type = "oci"
|
||
|
||
|
||
|
||
# The crio.image table contains settings pertaining to the management of OCI images.
|
||
#
|
||
# CRI-O reads its configured registries defaults from the system wide
|
||
# containers-registries.conf(5) located in /etc/containers/registries.conf. If
|
||
# you want to modify just CRI-O, you can change the registries configuration in
|
||
# this file. Otherwise, leave insecure_registries and registries commented out to
|
||
# use the system's defaults from /etc/containers/registries.conf.
|
||
[crio.image]
|
||
|
||
# Default transport for pulling images from a remote container storage.
|
||
default_transport = "docker://"
|
||
|
||
# The image used to instantiate infra containers.
|
||
pause_image = "docker://k8s.gcr.io/pause:3.1"
|
||
|
||
# If not empty, the path to a docker/config.json-like file containing credentials
|
||
# necessary for pulling the image specified by pause_image above.
|
||
pause_image_auth_file = ""
|
||
|
||
# The command to run to have a container stay in the paused state.
|
||
pause_command = "/pause"
|
||
|
||
# Path to the file which decides what sort of policy we use when deciding
|
||
# whether or not to trust an image that we've pulled. It is not recommended that
|
||
# this option be used, as the default behavior of using the system-wide default
|
||
# policy (i.e., /etc/containers/policy.json) is most often preferred. Please
|
||
# refer to containers-policy.json(5) for more details.
|
||
{% if ansible_os_family == "ClearLinux" %}
|
||
signature_policy = "/usr/share/defaults/crio/policy.json"
|
||
{% else %}
|
||
signature_policy = ""
|
||
{% endif %}
|
||
|
||
# Controls how image volumes are handled. The valid values are mkdir, bind and
|
||
# ignore; the latter will ignore volumes entirely.
|
||
image_volumes = "mkdir"
|
||
|
||
# List of registries to be used when pulling an unqualified image (e.g.,
|
||
# "alpine:latest"). By default, registries is set to "docker.io" for
|
||
# compatibility reasons. Depending on your workload and usecase you may add more
|
||
# registries (e.g., "quay.io", "registry.fedoraproject.org",
|
||
# "registry.opensuse.org", etc.).
|
||
registries = [
|
||
"docker.io"
|
||
]
|
||
# "registry.fedoraproject.org",
|
||
# "quay.io",
|
||
# "registry.centos.org",
|
||
#]
|
||
|
||
insecure_registries = [
|
||
"{{ kube_service_addresses }}"
|
||
]
|
||
|
||
# The crio.network table containers settings pertaining to the management of
|
||
# CNI plugins.
|
||
[crio.network]
|
||
|
||
# Path to the directory where CNI configuration files are located.
|
||
network_dir = "/etc/cni/net.d/"
|
||
|
||
# Paths to directories where CNI plugin binaries are located.
|
||
plugin_dirs = [
|
||
"/usr/libexec/cni",
|
||
{% if ansible_os_family == "ClearLinux" %}
|
||
"/opt/cni/bin/",
|
||
{% endif %}
|
||
]
|