update

kubespray/roles/container-engine/docker/tasks/docker_plugin.yml

@@ -0,0 +1,8 @@
+---
+- name: Install Docker plugin
+  command: docker plugin install --grant-all-permissions {{ docker_plugin | quote }}
+  when: docker_plugin is defined
+  register: docker_plugin_status
+  failed_when:
+    - docker_plugin_status.failed
+    - '"already exists" not in docker_plugin_status.stderr'

kubespray/roles/container-engine/docker/tasks/main.yml

@@ -0,0 +1,177 @@
+---
+- name: check if fedora coreos
+  stat:
+    path: /run/ostree-booted
+    get_attributes: no
+    get_checksum: no
+    get_mime: no
+  register: ostree
+
+- name: set is_ostree
+  set_fact:
+    is_ostree: "{{ ostree.stat.exists }}"
+
+- name: set docker_version for openEuler
+  set_fact:
+    docker_version: '19.03'
+  when: ansible_distribution == "openEuler"
+  tags:
+    - facts
+
+- name: gather os specific variables
+  include_vars: "{{ item }}"
+  with_first_found:
+    - files:
+        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_version|lower|replace('/', '_') }}.yml"
+        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}.yml"
+        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_major_version|lower|replace('/', '_') }}.yml"
+        - "{{ ansible_distribution|lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_distribution|lower }}.yml"
+        - "{{ ansible_distribution.split(' ')[0]|lower }}.yml"
+        - "{{ ansible_os_family|lower }}-{{ ansible_distribution_major_version|lower|replace('/', '_') }}.yml"
+        - "{{ ansible_os_family|lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_os_family|lower }}.yml"
+        - defaults.yml
+      paths:
+        - ../vars
+      skip: true
+  tags:
+    - facts
+
+- name: Warn about Docker version on SUSE
+  debug:
+    msg: "SUSE distributions always install Docker from the distro repos"
+  when: ansible_pkg_mgr == 'zypper'
+
+- include_tasks: set_facts_dns.yml
+  when: dns_mode != 'none' and resolvconf_mode == 'docker_dns'
+  tags:
+    - facts
+
+- import_tasks: pre-upgrade.yml
+
+- name: ensure docker-ce repository public key is installed
+  apt_key:
+    id: "{{ item }}"
+    url: "{{ docker_repo_key_info.url }}"
+    state: present
+  register: keyserver_task_result
+  until: keyserver_task_result is succeeded
+  retries: 4
+  delay: "{{ retry_stagger | d(3) }}"
+  with_items: "{{ docker_repo_key_info.repo_keys }}"
+  environment: "{{ proxy_env }}"
+  when: ansible_pkg_mgr == 'apt'
+
+- name: ensure docker-ce repository is enabled
+  apt_repository:
+    repo: "{{ item }}"
+    state: present
+  with_items: "{{ docker_repo_info.repos }}"
+  when: ansible_pkg_mgr == 'apt'
+
+- name: Configure docker repository on Fedora
+  template:
+    src: "fedora_docker.repo.j2"
+    dest: "{{ yum_repo_dir }}/docker.repo"
+    mode: 0644
+  when: ansible_distribution == "Fedora" and not is_ostree
+
+- name: Configure docker repository on RedHat/CentOS/OracleLinux/AlmaLinux/KylinLinux
+  template:
+    src: "rh_docker.repo.j2"
+    dest: "{{ yum_repo_dir }}/docker-ce.repo"
+    mode: 0644
+  when:
+    - ansible_os_family == "RedHat"
+    - ansible_distribution != "Fedora"
+    - not is_ostree
+
+- name: Remove dpkg hold
+  dpkg_selections:
+    name: "{{ item }}"
+    selection: install
+  when: ansible_pkg_mgr == 'apt'
+  changed_when: false
+  with_items:
+    - "{{ containerd_package }}"
+    - docker-ce
+    - docker-ce-cli
+
+- name: ensure docker packages are installed
+  package:
+    name: "{{ docker_package_info.pkgs }}"
+    state: "{{ docker_package_info.state | default('present') }}"
+  module_defaults:
+    apt:
+      update_cache: true
+    dnf:
+      enablerepo: "{{ docker_package_info.enablerepo | default(omit) }}"
+      disablerepo: "{{ docker_package_info.disablerepo | default(omit) }}"
+    yum:
+      enablerepo: "{{ docker_package_info.enablerepo | default(omit) }}"
+    zypper:
+      update_cache: true
+  register: docker_task_result
+  until: docker_task_result is succeeded
+  retries: 4
+  delay: "{{ retry_stagger | d(3) }}"
+  notify: restart docker
+  when:
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not is_ostree
+    - docker_package_info.pkgs|length > 0
+
+# This is required to ensure any apt upgrade will not break kubernetes
+- name: Tell Debian hosts not to change the docker version with apt upgrade
+  dpkg_selections:
+    name: "{{ item }}"
+    selection: hold
+  when: ansible_pkg_mgr == 'apt'
+  changed_when: false
+  with_items:
+    - "{{ containerd_package }}"
+    - docker-ce
+    - docker-ce-cli
+
+- name: ensure docker started, remove our config if docker start failed and try again
+  block:
+    - name: ensure service is started if docker packages are already present
+      service:
+        name: docker
+        state: started
+      when: docker_task_result is not changed
+  rescue:
+    - debug:  # noqa unnamed-task
+        msg: "Docker start failed. Try to remove our config"
+    - name: remove kubespray generated config
+      file:
+        path: "{{ item }}"
+        state: absent
+      with_items:
+        - /etc/systemd/system/docker.service.d/http-proxy.conf
+        - /etc/systemd/system/docker.service.d/docker-options.conf
+        - /etc/systemd/system/docker.service.d/docker-dns.conf
+        - /etc/systemd/system/docker.service.d/docker-orphan-cleanup.conf
+      notify: restart docker
+
+- name: flush handlers so we can wait for docker to come up
+  meta: flush_handlers
+
+# Install each plugin using a looped include to make error handling in the included task simpler.
+- include_tasks: docker_plugin.yml
+  loop: "{{ docker_plugins }}"
+  loop_control:
+    loop_var: docker_plugin
+
+- name: Set docker systemd config
+  import_tasks: systemd.yml
+
+- name: ensure docker service is started and enabled
+  service:
+    name: "{{ item }}"
+    enabled: yes
+    state: started
+  with_items:
+    - docker

kubespray/roles/container-engine/docker/tasks/pre-upgrade.yml

@@ -0,0 +1,36 @@
+---
+- name: Remove legacy docker repo file
+  file:
+    path: "{{ yum_repo_dir }}/docker.repo"
+    state: absent
+  when:
+    - ansible_os_family == 'RedHat'
+    - not is_ostree
+
+- name: Ensure old versions of Docker are not installed. | Debian
+  apt:
+    name: '{{ docker_remove_packages_apt }}'
+    state: absent
+  when:
+    - ansible_os_family == 'Debian'
+    - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
+
+
+- name: Ensure podman not installed. | RedHat
+  package:
+    name: '{{ podman_remove_packages_yum }}'
+    state: absent
+  when:
+    - ansible_os_family == 'RedHat'
+    - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
+    - not is_ostree
+
+
+- name: Ensure old versions of Docker are not installed. | RedHat
+  package:
+    name: '{{ docker_remove_packages_yum }}'
+    state: absent
+  when:
+    - ansible_os_family == 'RedHat'
+    - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
+    - not is_ostree

kubespray/roles/container-engine/docker/tasks/reset.yml

@@ -0,0 +1,106 @@
+---
+
+- name: Docker | Get package facts
+  package_facts:
+    manager: auto
+
+- name: Docker | Find docker packages
+  set_fact:
+    docker_packages_list: "{{ ansible_facts.packages.keys() | select('search', '^docker*') }}"
+    containerd_package: "{{ ansible_facts.packages.keys() | select('search', '^containerd*') }}"
+
+- name: Docker | Stop all running container
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -q | xargs -r {{ docker_bin_dir }}/docker kill"
+  args:
+    executable: /bin/bash
+  register: stop_all_containers
+  retries: 5
+  until: stop_all_containers.rc == 0
+  changed_when: true
+  delay: 5
+  ignore_errors: true  # noqa ignore-errors
+  when: docker_packages_list|length>0
+
+- name: reset | remove all containers
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -aq | xargs -r docker rm -fv"
+  args:
+    executable: /bin/bash
+  register: remove_all_containers
+  retries: 4
+  until: remove_all_containers.rc == 0
+  delay: 5
+  when: docker_packages_list|length>0
+
+- name: Docker | Stop docker service
+  service:
+    name: "{{ item }}"
+    enabled: false
+    state: stopped
+  loop:
+    - docker
+    - docker.socket
+    - containerd
+  when: docker_packages_list|length>0
+
+- name: Docker | Remove dpkg hold
+  dpkg_selections:
+    name: "{{ item }}"
+    selection: install
+  when: ansible_pkg_mgr == 'apt'
+  changed_when: false
+  with_items:
+    - "{{ docker_packages_list }}"
+    - "{{ containerd_package }}"
+
+- name: Docker | Remove docker package
+  package:
+    name: "{{ item }}"
+    state: absent
+  changed_when: false
+  with_items:
+    - "{{ docker_packages_list }}"
+    - "{{ containerd_package }}"
+  when:
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not is_ostree
+    - docker_packages_list|length > 0
+
+- name: Docker | ensure docker-ce repository is removed
+  apt_repository:
+    repo: "{{ item }}"
+    state: absent
+  with_items: "{{ docker_repo_info.repos }}"
+  when: ansible_pkg_mgr == 'apt'
+
+- name: Docker | Remove docker repository on Fedora
+  file:
+    name: "{{ yum_repo_dir }}/docker.repo"
+    state: absent
+  when: ansible_distribution == "Fedora" and not is_ostree
+
+- name: Docker | Remove docker repository on RedHat/CentOS/Oracle/AlmaLinux Linux
+  file:
+    name: "{{ yum_repo_dir }}/docker-ce.repo"
+    state: absent
+  when:
+    - ansible_os_family == "RedHat"
+    - ansible_distribution != "Fedora"
+    - not is_ostree
+
+- name: Docker | Remove docker configuration files
+  file:
+    name: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/systemd/system/docker.service.d/
+    - /etc/systemd/system/docker.socket
+    - /etc/systemd/system/docker.service
+    - /etc/systemd/system/containerd.service
+    - /etc/systemd/system/containerd.service.d
+    - /var/lib/docker
+    - /etc/docker
+  ignore_errors: true  # noqa ignore-errors
+
+- name: Docker | systemctl daemon-reload  # noqa 503
+  systemd:
+    daemon_reload: true

kubespray/roles/container-engine/docker/tasks/set_facts_dns.yml

@@ -0,0 +1,66 @@
+---
+
+- name: set dns server for docker
+  set_fact:
+    docker_dns_servers: "{{ dns_servers }}"
+
+- name: show docker_dns_servers
+  debug:
+    msg: "{{ docker_dns_servers }}"
+
+- name: add upstream dns servers
+  set_fact:
+    docker_dns_servers: "{{ docker_dns_servers + upstream_dns_servers|default([]) }}"
+  when: dns_mode in ['coredns', 'coredns_dual']
+
+- name: add global searchdomains
+  set_fact:
+    docker_dns_search_domains: "{{ docker_dns_search_domains + searchdomains|default([]) }}"
+
+- name: check system nameservers
+  shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/'
+  args:
+    executable: /bin/bash
+  changed_when: False
+  register: system_nameservers
+  check_mode: no
+
+- name: check system search domains
+  # noqa 306 - if resolf.conf has no search domain, grep will exit 1 which would force us to add failed_when: false
+  # Therefore -o pipefail is not applicable in this specific instance
+  shell: grep "^search" /etc/resolv.conf | sed -r 's/^search\s*([^#]+)\s*(#.*)?/\1/'
+  args:
+    executable: /bin/bash
+  changed_when: False
+  register: system_search_domains
+  check_mode: no
+
+- name: add system nameservers to docker options
+  set_fact:
+    docker_dns_servers: "{{ docker_dns_servers | union(system_nameservers.stdout_lines) | unique }}"
+  when: system_nameservers.stdout
+
+- name: add system search domains to docker options
+  set_fact:
+    docker_dns_search_domains: "{{ docker_dns_search_domains | union(system_search_domains.stdout.split()|default([])) | unique }}"
+  when: system_search_domains.stdout
+
+- name: check number of nameservers
+  fail:
+    msg: "Too many nameservers. You can relax this check by set docker_dns_servers_strict=false in docker.yml and we will only use the first 3."
+  when: docker_dns_servers|length > 3 and docker_dns_servers_strict|bool
+
+- name: rtrim number of nameservers to 3
+  set_fact:
+    docker_dns_servers: "{{ docker_dns_servers[0:3] }}"
+  when: docker_dns_servers|length > 3 and not docker_dns_servers_strict|bool
+
+- name: check number of search domains
+  fail:
+    msg: "Too many search domains"
+  when: docker_dns_search_domains|length > 6
+
+- name: check length of search domains
+  fail:
+    msg: "Search domains exceeded limit of 256 characters"
+  when: docker_dns_search_domains|join(' ')|length > 256

kubespray/roles/container-engine/docker/tasks/systemd.yml

@@ -0,0 +1,68 @@
+---
+- name: Create docker service systemd directory if it doesn't exist
+  file:
+    path: /etc/systemd/system/docker.service.d
+    state: directory
+    mode: 0755
+
+- name: Write docker proxy drop-in
+  template:
+    src: http-proxy.conf.j2
+    dest: /etc/systemd/system/docker.service.d/http-proxy.conf
+    mode: 0644
+  notify: restart docker
+  when: http_proxy is defined or https_proxy is defined
+
+- name: get systemd version
+  # noqa 303 - systemctl is called intentionally here
+  shell: set -o pipefail && systemctl --version | head -n 1 | cut -d " " -f 2
+  args:
+    executable: /bin/bash
+  register: systemd_version
+  when: not is_ostree
+  changed_when: false
+  check_mode: false
+
+- name: Write docker.service systemd file
+  template:
+    src: docker.service.j2
+    dest: /etc/systemd/system/docker.service
+    mode: 0644
+  register: docker_service_file
+  notify: restart docker
+  when:
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not is_fedora_coreos
+
+- name: Write docker options systemd drop-in
+  template:
+    src: docker-options.conf.j2
+    dest: "/etc/systemd/system/docker.service.d/docker-options.conf"
+    mode: 0644
+  notify: restart docker
+
+- name: Write docker dns systemd drop-in
+  template:
+    src: docker-dns.conf.j2
+    dest: "/etc/systemd/system/docker.service.d/docker-dns.conf"
+    mode: 0644
+  notify: restart docker
+  when: dns_mode != 'none' and resolvconf_mode == 'docker_dns'
+
+- name: Copy docker orphan clean up script to the node
+  copy:
+    src: cleanup-docker-orphans.sh
+    dest: "{{ bin_dir }}/cleanup-docker-orphans.sh"
+    mode: 0755
+  when: docker_orphan_clean_up | bool
+
+- name: Write docker orphan clean up systemd drop-in
+  template:
+    src: docker-orphan-cleanup.conf.j2
+    dest: "/etc/systemd/system/docker.service.d/docker-orphan-cleanup.conf"
+    mode: 0644
+  notify: restart docker
+  when: docker_orphan_clean_up | bool
+
+- name: Flush handlers
+  meta: flush_handlers