cri-o / cri-o-ansible Goto Github PK

It looks like this project is unmaintained, I need this exact playbook/role, but with native packages instead of building from source.
I'm ready to step up as maintainer. My need is around debian/ubuntu, if somebody else could help on the RHEL side of things, it would be good :)
Also I wouldn't maintain the "build from source" part.

And I'd like to transform this into a role and publish it to galaxy.

I think we could discuss things here :)

@community what are your thoughts?

[root@gprfc018-vm3 cri-o]# crioctl pod run --config test/testdata/sandbox_config.json
Creating the pod sandbox failed: rpc error: code = 2 desc = failed to mount container redhat.test.crio-podsandbox1-1-infra in pod sandbox redhat.test.crio-podsandbox1-1(cffded1c853e025be76904ae7312d06dae9fa52da7fa4d67dd7a34f7d28ee873): error creating overlay mount to /var/lib/containers/storage/overlay2/dfd54ee8e6d45cf817321b0fe08af3839f7286725c8a8c4f8af4a4b363f28312/merged: mountfrom re-exec error: exit status 1: output: invalid argument

ansible-playbook -i ../hosts.yml cri-o.yml -u ubuntu

PLAY [all] **********************************************************************************************************************************************************************************

TASK [Gathering Facts] **********************************************************************************************************************************************************************
ok: [10.20.100.31]

TASK [Update all in Ubuntu] *****************************************************************************************************************************************************************

changed: [10.20.100.31]

TASK [update all in RHEL/CentOS] ************************************************************************************************************************************************************
skipping: [10.20.100.31]

TASK [Update all packages on Fedora] ********************************************************************************************************************************************************
skipping: [10.20.100.31]

TASK [Install k8s repository key (Ubuntu)] **************************************************************************************************************************************************
changed: [10.20.100.31]

TASK [Install k8s repository (Ubuntu)] ******************************************************************************************************************************************************
fatal: [10.20.100.31]: FAILED! => {"changed": false, "msg": "E:The repository 'http://apt.kubernetes.io kubernetes-bionic Release' does not have a Release file."}
to retry, use: --limit @/home/ubuntu/cri-o-ansible/cri-o.retry

PLAY RECAP **********************************************************************************************************************************************************************************
10.20.100.31 : ok=3 changed=2 unreachable=0 failed=1

ubuntu@inst:/cri-o-ansible$
ubuntu@inst:/cri-o-ansible$
ubuntu@inst:/cri-o-ansible$
ubuntu@inst:/cri-o-ansible$ ansible-playbook -i ../hosts.yml cri-o.yml -u ubuntu

PLAY [all] **********************************************************************************************************************************************************************************

TASK [Gathering Facts] **********************************************************************************************************************************************************************
ok: [10.20.100.31]

TASK [Update all in Ubuntu] *****************************************************************************************************************************************************************
ok: [10.20.100.31]

TASK [update all in RHEL/CentOS] ************************************************************************************************************************************************************
skipping: [10.20.100.31]

TASK [Update all packages on Fedora] ********************************************************************************************************************************************************
skipping: [10.20.100.31]

TASK [Install k8s repository key (Ubuntu)] **************************************************************************************************************************************************
^C [ERROR]: User interrupted execution

Process WorkerProcess-5:
Traceback (most recent call last):
File "/usr/lib/python3.6/multiprocessing/process.py", line 258, in _bootstrap
self.run()
File "/usr/local/lib/python3.6/dist-packages/ansible/executor/process/worker.py", line 118, in run
self._final_q
File "/usr/local/lib/python3.6/dist-packages/ansible/executor/task_executor.py", line 140, in run
res = self._execute()
File "/usr/local/lib/python3.6/dist-packages/ansible/executor/task_executor.py", line 612, in _execute
result = self._handler.run(task_vars=variables)
File "/usr/local/lib/python3.6/dist-packages/ansible/plugins/action/normal.py", line 46, in run
result = merge_hash(result, self._execute_module(task_vars=task_vars, wrap_async=wrap_async))
File "/usr/local/lib/python3.6/dist-packages/ansible/plugins/action/init.py", line 756, in _execute_module
(module_style, shebang, module_data, module_path) = self._configure_module(module_name=module_name, module_args=module_args, task_vars=task_vars)
File "/usr/local/lib/python3.6/dist-packages/ansible/plugins/action/init.py", line 178, in _configure_module
environment=final_environment)
File "/usr/local/lib/python3.6/dist-packages/ansible/executor/module_common.py", line 973, in modify_module
environment=environment)
File "/usr/local/lib/python3.6/dist-packages/ansible/executor/module_common.py", line 791, in _find_module_utils
recursive_finder(module_name, b_module_data, py_module_names, py_module_cache, zf)
File "/usr/local/lib/python3.6/dist-packages/ansible/executor/module_common.py", line 680, in recursive_finder
recursive_finder(py_module_file, py_module_cache[py_module_file][0], py_module_names, py_module_cache, zf)
File "/usr/local/lib/python3.6/dist-packages/ansible/executor/module_common.py", line 540, in recursive_finder
finder.visit(tree)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 261, in generic_visit
self.visit(item)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 261, in generic_visit
self.visit(item)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 261, in generic_visit
self.visit(item)
File "/usr/lib/python3.6/ast.py", line 252, in visit
visitor = getattr(self, method, self.generic_visit)
KeyboardInterrupt
ubuntu@inst:~/cri-o-ansible$ ansible-playbook -v -i ../hosts.yml cri-o.yml -u ubuntu
No config file found; using defaults
/home/ubuntu/hosts.yml did not meet host_list requirements, check plugin documentation if this is unexpected
/home/ubuntu/hosts.yml did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] **********************************************************************************************************************************************************************************

TASK [Gathering Facts] **********************************************************************************************************************************************************************
ok: [10.20.100.31]

TASK [Update all in Ubuntu] *****************************************************************************************************************************************************************
ok: [10.20.100.31] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nCalculating upgrade...\nThe following package was automatically installed and is no longer required:\n grub-pc-bin\nUse 'sudo apt autoremove' to remove it.\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nCalculating upgrade...\nThe following package was automatically installed and is no longer required:\n grub-pc-bin\nUse 'sudo apt autoremove' to remove it.\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "Calculating upgrade...", "The following package was automatically installed and is no longer required:", " grub-pc-bin", "Use 'sudo apt autoremove' to remove it.", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}

TASK [update all in RHEL/CentOS] ************************************************************************************************************************************************************
skipping: [10.20.100.31] => {"changed": false, "skip_reason": "Conditional result was False"}

TASK [Update all packages on Fedora] ********************************************************************************************************************************************************
skipping: [10.20.100.31] => {"changed": false, "skip_reason": "Conditional result was False"}

TASK [Install k8s repository key (Ubuntu)] **************************************************************************************************************************************************
ok: [10.20.100.31] => {"changed": false}

TASK [Install k8s repository (Ubuntu)] ******************************************************************************************************************************************************
ok: [10.20.100.31] => {"changed": false, "repo": "deb http://apt.kubernetes.io/ kubernetes-bionic main", "state": "present"}

TASK [Update apt (Ubuntu)] ******************************************************************************************************************************************************************
fatal: [10.20.100.31]: FAILED! => {"changed": false, "msg": "Failed to update apt cache: W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., E:The repository 'http://apt.kubernetes.io kubernetes-bionic Release' does not have a Release file."}
to retry, use: --limit @/home/ubuntu/cri-o-ansible/cri-o.retry

PLAY RECAP **********************************************************************************************************************************************************************************
10.20.100.31 : ok=4 changed=0 unreachable=0 failed=1

We probably need to expand this to work with distro packages. Installing of the kubernets packages at the end were causing me issues also.

Here is the diff that I used to make it work on fedora 26

diff --git a/cri-o.yml b/cri-o.yml
index ab681b9..b9e707d 100644
--- a/cri-o.yml
+++ b/cri-o.yml
@@ -33,6 +33,9 @@
         - skopeo-containers
         - tar
         - wget
+        - runc
+        - cri-o
+        - kubernetes
       when: ansible_distribution == 'Fedora'
 
     - name: Make sure we have all required packages on RHEL/CentOS
@@ -125,7 +128,7 @@
               make install
 
     - name: link runc
-      file: src=/usr/local/sbin/runc dest=/usr/bin/runc state=link
+      file: src=/usr/local/sbin/runc dest=/usr/bin/runc state=link force=true
 
     - name: build cri-o
       shell: |
@@ -135,6 +138,7 @@
               make install && \
               make install.systemd && \
               make install.config
+      when: ansible_distribution != 'Fedora'
 
     - name: install policy.json in Ubuntu
       shell: |
diff --git a/install/kubernetes.yml b/install/kubernetes.yml
index e9f886a..cec7e56 100644
--- a/install/kubernetes.yml
+++ b/install/kubernetes.yml
@@ -30,3 +30,4 @@
     - kubeadm
     - kubectl
     - kubernetes-cni
+  when: ansible_distribution != "Fedora"

The go package requires go-md2man, which is not installed by default on CentOS cloud images. Please add golang-github-cpuguy83-go-md2man to the packages. Thanks!

https://github.com/kubernetes/community/blob/master/contributors/devel/container-runtime-interface.md

crioctl pod run --config test/testdata/sandbox_config.json
Creating the pod sandbox failed: rpc error: code = 2 desc = failed to create network for container redhat.test.crio-podsandbox1-1-infra in sandbox e346d8c8dbbee173b796de12a946590ca5bd5bafc29dff44852525a06800e76f: cni config uninitialized

Kernel: 4.11.3-200.fc25.x86_64
Fedora25
disabled selinux

I have Problem while creating the Kubernetes cluster using kubeadm init --pod-network-cidr=10.244.0.0/16 --ignore-preflight-errors=all --cri-socket=/var/run/crio/crio.sock. The process stuck at the

[init] This might take a minute or longer if the control plane images have to be pulled.

it gives error like

[kubelet-check] The HTTP call equal to 'curl -sSL http://localhost:10255/healthz' failed with error: Get http://localhost:10255/healthz: dial tcp 127.0.0.1:10255: getsockopt: connection refused.

Is there any documentation i can follow to configure kubeadm with CRI-O runtime

I just noticed the following task

- name: install policy.json in Ubuntu
      shell: |
              cd /root/src/github.com/kubernetes-incubator/cri-o && \
              cp test/policy.json /etc/containers/policy.json

Should this be run on all distros? (remove in Ubuntu from name)
Or should this be run only in Ubuntu (add when: ansible_distribution == "Ubuntu")

fatal: [<all_ip_cluster>]: FAILED! => {"changed": true, "cmd": "cd /root/src/github.com/kubernetes-incubator/cri-o && make && make install && make install.systemd && make install.config\n", "delta": "0:01:04.153020", "end": "2020-06-07 16:33:29.004316", "msg": "non-zero return code", "rc": 2, "start": "2020-06-07 16:32:24.851296", "stderr": "flag provided but not defined: -mod\nusage: build [-o output] [-i] [build flags] [packages]\n\nBuild compiles the packages named by the import paths,\nalong with their dependencies, but it does not install the results.\n\nIf the arguments to build are a list of .go files, build treats\nthem as a list of source files specifying a single package.\n\nWhen compiling a single main package, build writes\nthe resulting executable to an output file named after\nthe first source file ('go build ed.go rx.go' writes 'ed' or 'ed.exe')\nor the source code directory ('go build unix/sam' writes 'sam' or 'sam.exe').\nThe '.exe' suffix is added when writing a Windows executable.\n\nWhen compiling multiple packages or a single non-main package,\nbuild compiles the packages but discards the resulting object,\nserving only as a check that the packages can be built.\n\nWhen compiling packages, build ignores files that end in '_test.go'.\n\nThe -o flag, only allowed when compiling a single package,\nforces build to write the resulting executable or object\nto the named output file, instead of the default behavior described\nin the last two paragraphs.\n\nThe -i flag installs the packages that are dependencies of the target.\n\nThe build flags are shared by the build, clean, get, install, list, run,\nand test commands:\n\n\t-a\n\t\tforce rebuilding of packages that are already up-to-date.\n\t-n\n\t\tprint the commands but do not run them.\n\t-p n\n\t\tthe number of programs, such as build commands or\n\t\ttest binaries, that can be run in parallel.\n\t\tThe default is the number of CPUs available.\n\t-race\n\t\tenable data race detection.\n\t\tSupported only on linux/amd64, freebsd/amd64, darwin/amd64 and windows/amd64.\n\t-msan\n\t\tenable interoperation with memory sanitizer.\n\t\tSupported only on linux/amd64,\n\t\tand only with Clang/LLVM as the host C compiler.\n\t-v\n\t\tprint the names of packages as they are compiled.\n\t-work\n\t\tprint the name of the temporary work directory and\n\t\tdo not delete it when exiting.\n\t-x\n\t\tprint the commands.\n\n\t-asmflags 'flag list'\n\t\targuments to pass on each go tool asm invocation.\n\t-buildmode mode\n\t\tbuild mode to use. See 'go help buildmode' for more.\n\t-compiler name\n\t\tname of compiler to use, as in runtime.Compiler (gccgo or gc).\n\t-gccgoflags 'arg list'\n\t\targuments to pass on each gccgo compiler/linker invocation.\n\t-gcflags 'arg list'\n\t\targuments to pass on each go tool compile invocation.\n\t-installsuffix suffix\n\t\ta suffix to use in the name of the package installation directory,\n\t\tin order to keep output separate from default builds.\n\t\tIf using the -race flag, the install suffix is automatically set to race\n\t\tor, if set explicitly, has _race appended to it. Likewise for the -msan\n\t\tflag. Using a -buildmode option that requires non-default compile flags\n\t\thas a similar effect.\n\t-ldflags 'flag list'\n\t\targuments to pass on each go tool link invocation.\n\t-linkshared\n\t\tlink against shared libraries previously created with\n\t\t-buildmode=shared.\n\t-pkgdir dir\n\t\tinstall and load all packages from dir instead of the usual locations.\n\t\tFor example, when building with a non-standard configuration,\n\t\tuse -pkgdir to keep generated packages in a separate location.\n\t-tags 'tag list'\n\t\ta list of build tags to consider satisfied during the build.\n\t\tFor more information about build tags, see the description of\n\t\tbuild constraints in the documentation for the go/build package.\n\t-toolexec 'cmd args'\n\t\ta program to use to invoke toolchain programs like vet and asm.\n\t\tFor example, instead of running asm, the go command will run\n\t\t'cmd args /path/to/asm '.\n\nThe list flags accept a space-separated list of strings. To embed spaces\nin an element in the list, surround it with either single or double quotes.\n\nFor more about specifying packages, see 'go help packages'.\nFor more about where packages and binaries are installed,\nrun 'go help gopath'.\nFor more about calling between Go and C/C++, run 'go help c'.\n\nNote: Build adheres to certain conventions such as those described\nby 'go help gopath'. Not all projects can follow these conventions,\nhowever. Installations that have their own conventions or that use\na separate software build system may choose to use lower-level\ninvocations such as 'go tool compile' and 'go tool link' to avoid\nsome of the overheads and design decisions of the build tool.\n\nSee also: go install, go get, go clean.\nmake: *** [bin/crio] Error 2", "stderr_lines": ["flag provided but not defined: -mod", "usage: build [-o output] [-i] [build flags] [packages]", "", "Build compiles the packages named by the import paths,", "along with their dependencies, but it does not install the results.", "", "If the arguments to build are a list of .go files, build treats", "them as a list of source files specifying a single package.", "", "When compiling a single main package, build writes", "the resulting executable to an output file named after", "the first source file ('go build ed.go rx.go' writes 'ed' or 'ed.exe')", "or the source code directory ('go build unix/sam' writes 'sam' or 'sam.exe').", "The '.exe' suffix is added when writing a Windows executable.", "", "When compiling multiple packages or a single non-main package,", "build compiles the packages but discards the resulting object,", "serving only as a check that the packages can be built.", "", "When compiling packages, build ignores files that end in '_test.go'.", "", "The -o flag, only allowed when compiling a single package,", "forces build to write the resulting executable or object", "to the named output file, instead of the default behavior described", "in the last two paragraphs.", "", "The -i flag installs the packages that are dependencies of the target.", "", "The build flags are shared by the build, clean, get, install, list, run,", "and test commands:", "", "\t-a", "\t\tforce rebuilding of packages that are already up-to-date.", "\t-n", "\t\tprint the commands but do not run them.", "\t-p n", "\t\tthe number of programs, such as build commands or", "\t\ttest binaries, that can be run in parallel.", "\t\tThe default is the number of CPUs available.", "\t-race", "\t\tenable data race detection.", "\t\tSupported only on linux/amd64, freebsd/amd64, darwin/amd64 and windows/amd64.", "\t-msan", "\t\tenable interoperation with memory sanitizer.", "\t\tSupported only on linux/amd64,", "\t\tand only with Clang/LLVM as the host C compiler.", "\t-v", "\t\tprint the names of packages as they are compiled.", "\t-work", "\t\tprint the name of the temporary work directory and", "\t\tdo not delete it when exiting.", "\t-x", "\t\tprint the commands.", "", "\t-asmflags 'flag list'", "\t\targuments to pass on each go tool asm invocation.", "\t-buildmode mode", "\t\tbuild mode to use. See 'go help buildmode' for more.", "\t-compiler name", "\t\tname of compiler to use, as in runtime.Compiler (gccgo or gc).", "\t-gccgoflags 'arg list'", "\t\targuments to pass on each gccgo compiler/linker invocation.", "\t-gcflags 'arg list'", "\t\targuments to pass on each go tool compile invocation.", "\t-installsuffix suffix", "\t\ta suffix to use in the name of the package installation directory,", "\t\tin order to keep output separate from default builds.", "\t\tIf using the -race flag, the install suffix is automatically set to race", "\t\tor, if set explicitly, has _race appended to it. Likewise for the -msan", "\t\tflag. Using a -buildmode option that requires non-default compile flags", "\t\thas a similar effect.", "\t-ldflags 'flag list'", "\t\targuments to pass on each go tool link invocation.", "\t-linkshared", "\t\tlink against shared libraries previously created with", "\t\t-buildmode=shared.", "\t-pkgdir dir", "\t\tinstall and load all packages from dir instead of the usual locations.", "\t\tFor example, when building with a non-standard configuration,", "\t\tuse -pkgdir to keep generated packages in a separate location.", "\t-tags 'tag list'", "\t\ta list of build tags to consider satisfied during the build.", "\t\tFor more information about build tags, see the description of", "\t\tbuild constraints in the documentation for the go/build package.", "\t-toolexec 'cmd args'", "\t\ta program to use to invoke toolchain programs like vet and asm.", "\t\tFor example, instead of running asm, the go command will run", "\t\t'cmd args /path/to/asm '.", "", "The list flags accept a space-separated list of strings. To embed spaces", "in an element in the list, surround it with either single or double quotes.", "", "For more about specifying packages, see 'go help packages'.", "For more about where packages and binaries are installed,", "run 'go help gopath'.", "For more about calling between Go and C/C++, run 'go help c'.", "", "Note: Build adheres to certain conventions such as those described", "by 'go help gopath'. Not all projects can follow these conventions,", "however. Installations that have their own conventions or that use", "a separate software build system may choose to use lower-level", "invocations such as 'go tool compile' and 'go tool link' to avoid", "some of the overheads and design decisions of the build tool.", "", "See also: go install, go get, go clean.", "make: *** [bin/crio] Error 2"], "stdout": "mkdir -p "/root/src/github.com/kubernetes-incubator/cri-o/_output/src/github.com/cri-o"\nln -s "/root/src/github.com/kubernetes-incubator/cri-o" "/root/src/github.com/kubernetes-incubator/cri-o/_output/src/github.com/cri-o/cri-o"\ntouch "/root/src/github.com/kubernetes-incubator/cri-o/_output/.gopathok"\nGO111MODULE=on go build --mod=vendor -ldflags '-s -w -X github.com/cri-o/cri-o/internal/pkg/criocli.DefaultsPath="" -X github.com/cri-o/cri-o/internal/version.buildDate=2020-06-07T21:33:27Z -X github.com/cri-o/cri-o/internal/version.gitCommit=5cbf694c34f8d1af19eb873e39057663a4830635 -X github.com/cri-o/cri-o/internal/version.gitTreeState=clean ' -tags "containers_image_ostree_stub seccomp selinux" -o bin/crio github.com/cri-o/cri-o/cmd/crio", "stdout_lines": ["mkdir -p "/root/src/github.com/kubernetes-incubator/cri-o/_output/src/github.com/cri-o"", "ln -s "/root/src/github.com/kubernetes-incubator/cri-o" "/root/src/github.com/kubernetes-incubator/cri-o/_output/src/github.com/cri-o/cri-o"", "touch "/root/src/github.com/kubernetes-incubator/cri-o/_output/.gopathok"", "GO111MODULE=on go build --mod=vendor -ldflags '-s -w -X github.com/cri-o/cri-o/internal/pkg/criocli.DefaultsPath="" -X github.com/cri-o/cri-o/internal/version.buildDate=2020-06-07T21:33:27Z -X github.com/cri-o/cri-o/internal/version.gitCommit=5cbf694c34f8d1af19eb873e39057663a4830635 -X github.com/cri-o/cri-o/internal/version.gitTreeState=clean ' -tags "containers_image_ostree_stub seccomp selinux" -o bin/crio github.com/cri-o/cri-o/cmd/crio"]}

TASK [clone CRI-O] ******************************************************************************************************************************************************
fatal: [34.213.5.110]: FAILED! => {"changed": false, "cmd": "/bin/git checkout --force kube-1.6.x", "failed": true, "msg": "Failed to checkout kube-1.6.x", "rc": 1, "stderr": "error: pathspec 'kube-1.6.x' did not match any file(s) known to git.\n", "stderr_lines": ["error: pathspec 'kube-1.6.x' did not match any file(s) known to git."], "stdout": "", "stdout_lines": []}
fatal: [54.185.125.151]: FAILED! => {"changed": false, "cmd": "/bin/git checkout --force kube-1.6.x", "failed": true, "msg": "Failed to checkout kube-1.6.x", "rc": 1, "stderr": "error: pathspec 'kube-1.6.x' did not match any file(s) known to git.\n", "stderr_lines": ["error: pathspec 'kube-1.6.x' did not match any file(s) known to git."], "stdout": "", "stdout_lines": []}

Is there a particular version I need to set this to?

Sorry for duplicated effort but I had propose another individual implementation for CRI-O with Ansible Role (cri-o/cri-o#3552):

I am now maintenance an Ansible Role for CRI-O installation (https://github.com/alvistack/ansible-role-cri_o), by downloading the static binary release archive and extract it for following OS:

Ubuntu 16.04/18.04/19.10
CentOS/RHEL 7/8
openSUSE 15.1

Could we also introduce this as an alternative installation method, e.g. under https://github.com/cri-o/cri-o#installing-cri-o?

Corresponding simple installation guide also now included in official documentation as alternative install method (see cri-o/cri-o#3628 and https://github.com/cri-o/cri-o/blob/master/tutorials/setup.md#install-with-ansible):

sudo su -
mkdir -p ~/.ansible/roles
git clone https://github.com/alvistack/ansible-role-cri_o.git cri_o
cd ~/.ansible/roles/cri_o
pip3 install --upgrade --ignore-installed --requirement requirements.txt
molecule converge
molecule verify

As long as this repo seems no longer active since 2017, should anyone with Ansible related issue please feel free to let me know at https://github.com/alvistack/ansible-role-cri_o/issues and I will keep response ASAP.