containerd support (#4664)

* Add limited containerd support

Containerd support for Ubuntu + Calico

* Added CRI-O support for ubuntu

* containerd support.

* Reset  containerd support.

* fix lint.

* implemented feedback

* Change task name cri xx instead of cri-o in reset task and timeout condition.

* set crictl to fixed version

* Use docker-ce's container.io package for containerd.

* Add check containerd is installable or not.

* Avoid stop docker when use containerd and optimize retry for reset.

* Add config.toml.

* Fixed containerd for kubelet.env.

* Merge PR #4629

* Remove unused ubuntu variable for containerd

* Polish code for containerd and cri-o

* Refactoring cri socket configuration.

* Configurable conmon.

* Remove unused crictl/runc download

* Now crictl and runc is downloaded by common crictl.yml.

* fixed yamllint error

* Fixed brokenfiles by conflict.

* Remove commented line in config.toml

* Remove readded v1.12.x version

* Fixed broken set_docker_image_facts

* Fix yamllint errors.

* Remove unused apt source

* Fix crictl could not be installed

* Add containerd config from skolekonov's PR #4601

roles/download/tasks/download_container.yml

@@ -1,129 +1,137 @@
 ---
+- name: container_download | Make download decision if pull is required by tag or sha256
+  include_tasks: set_docker_image_facts.yml
+  when:
+    - download.enabled
+    - download.container
+  tags:
+    - facts
+
 - block:
-  - name: download_container | Set a few facts
-    import_tasks: set_container_facts.yml
-    run_once: "{{ download_run_once }}"
-    tags:
-    - facts
+    - name: download_container | Set a few facts
+      import_tasks: set_container_facts.yml
+      run_once: "{{ download_run_once }}"
+      tags:
+        - facts
 
-  - name: download_container | Determine if image is in cache
-    stat:
-      path: "{{ image_path_cached }}"
-    delegate_to: localhost
-    delegate_facts: no
-    register: cache_image
-    changed_when: false
-    become: false
-    when:
-    - download_force_cache
+    - name: download_container | Determine if image is in cache
+      stat:
+        path: "{{ image_path_cached }}"
+      delegate_to: localhost
+      delegate_facts: no
+      register: cache_image
+      changed_when: false
+      become: false
+      when:
+        - download_force_cache
 
-  - name: download_container | Set fact indicating if image is in cache
-    set_fact:
-      image_is_cached: "{{ cache_image.stat.exists | default(false) }}"
-    tags:
-    - facts
-    when:
-    - download_force_cache
+    - name: download_container | Set fact indicating if image is in cache
+      set_fact:
+        image_is_cached: "{{ cache_image.stat.exists | default(false) }}"
+      tags:
+        - facts
+      when:
+        - download_force_cache
 
-  - name: download_container | Upload image to node if it is cached
-    synchronize:
-      src: "{{ image_path_cached }}"
-      dest: "{{ image_path_final }}"
-      use_ssh_args: "{{ has_bastion | default(false) }}"
-      mode: push
-    delegate_facts: no
-    register: upload_image
-    failed_when: not upload_image
-    run_once: "{{ download_run_once }}"
-    until: upload_image is succeeded
-    retries: 4
-    delay: "{{ retry_stagger | random + 3 }}"
-    when:
-    - download_force_cache
-    - image_is_cached
-    - not download_localhost
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - name: download_container | Upload image to node if it is cached
+      synchronize:
+        src: "{{ image_path_cached }}"
+        dest: "{{ image_path_final }}"
+        use_ssh_args: "{{ has_bastion | default(false) }}"
+        mode: push
+      delegate_facts: no
+      register: upload_image
+      failed_when: not upload_image
+      run_once: "{{ download_run_once }}"
+      until: upload_image is succeeded
+      retries: 4
+      delay: "{{ retry_stagger | random + 3 }}"
+      when:
+        - download_force_cache
+        - image_is_cached
+        - not download_localhost
+        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
 
-  - name: download_container | Load image into docker
-    shell: "{{ docker_bin_dir }}/docker load < {{ image_path_cached if download_localhost else image_path_final }}"
-    delegate_to: "{{ download_delegate if download_run_once or inventory_hostname }}"
-    run_once: "{{ download_run_once }}"
-    register: container_load_status
-    failed_when: container_load_status | failed
-    become: "{{ user_can_become_root | default(false) or not (download_run_once and download_localhost) }}"
-    when:
-    - download_force_cache
-    - image_is_cached
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - name: download_container | Load image into docker
+      shell: "{{ docker_bin_dir }}/docker load < {{ image_path_cached if download_localhost else image_path_final }}"
+      delegate_to: "{{ download_delegate if download_run_once or inventory_hostname }}"
+      run_once: "{{ download_run_once }}"
+      register: container_load_status
+      failed_when: container_load_status | failed
+      become: "{{ user_can_become_root | default(false) or not (download_run_once and download_localhost) }}"
+      when:
+        - download_force_cache
+        - image_is_cached
+        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
 
-  - name: download_container | Prepare container download
-    import_tasks: check_pull_required.yml
-    run_once: "{{ download_run_once }}"
-    when:
-    - not download_always_pull
+    - name: download_container | Prepare container download
+      import_tasks: check_pull_required.yml
+      run_once: "{{ download_run_once }}"
+      when:
+        - not download_always_pull
 
-  - debug:
-      msg: "XXX Pull required is: {{ pull_required }}"
+    - debug:
+        msg: "XXX Pull required is: {{ pull_required }}"
 
-  # NOTE: Pre-loading docker images will not prevent 'docker pull' from re-downloading the layers in that image
-  # if a pull is forced. This is a known issue with docker. See https://github.com/moby/moby/issues/23684
-  - name: download_container | Download image if required
-    command: "{{ docker_bin_dir }}/docker pull {{ image_reponame }}"
-    delegate_to: "{{ download_delegate if download_run_once or inventory_hostname }}"
-    delegate_facts: yes
-    run_once: "{{ download_run_once }}"
-    register: pull_task_result
-    until: pull_task_result is succeeded
-    delay: "{{ retry_stagger | random + 3 }}"
-    retries: 4
-    become: "{{ user_can_become_root | default(false) or not download_localhost }}"
-    when:
-    - pull_required | default(download_always_pull)
+    # NOTE: Pre-loading docker images will not prevent 'docker pull' from re-downloading the layers in that image
+    # if a pull is forced. This is a known issue with docker. See https://github.com/moby/moby/issues/23684
+    - name: download_container | Download image if required
+      command: "{{ image_pull_command }} {{ image_reponame }}"
+      delegate_to: "{{ download_delegate if download_run_once or inventory_hostname }}"
+      delegate_facts: yes
+      run_once: "{{ download_run_once }}"
+      register: pull_task_result
+      until: pull_task_result is succeeded
+      delay: "{{ retry_stagger | random + 3 }}"
+      retries: 4
+      become: "{{ user_can_become_root | default(false) or not download_localhost }}"
+      when:
+        - pull_required | default(download_always_pull)
 
-  # NOTE: image_changed is only valid if a pull is was needed or forced.
-  - name: download_container | Check if image changed
-    set_fact:
-      image_changed: "{{ true if pull_task_result.stdout is defined and not 'up to date' in pull_task_result.stdout else false }}"
-    run_once: true
-    when:
-    - download_force_cache
-    tags:
-    - facts
+    # NOTE: image_changed is only valid if a pull is was needed or forced.
+    - name: download_container | Check if image changed
+      set_fact:
+        image_changed: "{{ true if pull_task_result.stdout is defined and not 'up to date' in pull_task_result.stdout else false }}"
+      run_once: true
+      when:
+        - download_force_cache
+      tags:
+        - facts
 
-  - name: download_container | Save and compress image
-    shell: "{{ docker_bin_dir }}/docker save {{ image_reponame }} | gzip -{{ download_compress }} > {{ image_path_cached if download_localhost else image_path_final }}"
-    delegate_to: "{{ download_delegate if download_run_once or inventory_hostname }}"
-    delegate_facts: no
-    register: container_save_status
-    failed_when: container_save_status.stderr
-    run_once: true
-    become: "{{ user_can_become_root | default(false) or not download_localhost }}"
-    when:
-    - download_force_cache
-    - not image_is_cached or (image_changed | default(true))
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - name: download_container | Save and compress image
+      shell: "{{ docker_bin_dir }}/docker save {{ image_reponame }} | gzip -{{ download_compress }} > {{ image_path_cached if download_localhost else image_path_final }}"
+      delegate_to: "{{ download_delegate if download_run_once or inventory_hostname }}"
+      delegate_facts: no
+      register: container_save_status
+      failed_when: container_save_status.stderr
+      run_once: true
+      become: "{{ user_can_become_root | default(false) or not download_localhost }}"
+      when:
+        - download_force_cache
+        - not image_is_cached or (image_changed | default(true))
+        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
 
-  - name: download_container | Copy image to ansible host cache
-    synchronize:
-      src: "{{ image_path_final }}"
-      dest: "{{ image_path_cached }}"
-      use_ssh_args: "{{ has_bastion | default(false) }}"
-      mode: pull
-    delegate_facts: no
-    run_once: true
-    when:
-    - download_force_cache
-    - not download_localhost
-    - not image_is_cached or (image_changed | default(true))
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - name: download_container | Copy image to ansible host cache
+      synchronize:
+        src: "{{ image_path_final }}"
+        dest: "{{ image_path_cached }}"
+        use_ssh_args: "{{ has_bastion | default(false) }}"
+        mode: pull
+      delegate_facts: no
+      run_once: true
+      when:
+        - download_force_cache
+        - not download_localhost
+        - not image_is_cached or (image_changed | default(true))
+        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
 
-  - name: download_container | Remove container image from cache
-    file:
-      state: absent
-      path: "{{ image_path_final }}"
-    when:
-    - not download_keep_remote_cache
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - name: download_container | Remove container image from cache
+      file:
+        state: absent
+        path: "{{ image_path_final }}"
+      when:
+        - not download_keep_remote_cache
+        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
 
   tags:
-  - download
+    - download

roles/download/tasks/download_prep.yml

@@ -0,0 +1,42 @@
+---
+# Use the same format for Containerd images as for Docker images
+# ctr doesn't have inspect command
+
+- name: Set image info command for containerd
+  set_fact:
+    image_info_command: "{{ containerd_bin_dir }}/ctr images ls | tail -n +2 | awk -F '[ :]+' '{print $1\":\"$2\",\"$1\":\"$4\"@\"$5}' | tr '\n' ','"
+  when: container_manager == 'containerd'
+
+- name: Register docker images info
+  shell: "{{ image_info_command }}"
+  no_log: true
+  register: docker_images
+  failed_when: false
+  changed_when: false
+  check_mode: no
+  when: download_container
+
+- name: container_download | Create dest directory for saved/loaded container images
+  file:
+    path: "{{ local_release_dir }}/containers"
+    state: directory
+    recurse: yes
+    mode: 0755
+    owner: "{{ ansible_ssh_user|default(ansible_user_id) }}"
+  when: download_container
+
+- name: container_download | create local directory for saved/loaded container images
+  file:
+    path: "{{ local_release_dir }}/containers"
+    state: directory
+    recurse: yes
+  delegate_to: localhost
+  delegate_facts: false
+  become: false
+  run_once: true
+  when:
+    - download_run_once
+    - download_delegate == 'localhost'
+    - download_container
+  tags:
+    - localhost

roles/download/tasks/main.yml

@@ -7,6 +7,25 @@
     - download
     - upload
 
+- name: Use cri-o for cri connection
+  set_fact:
+    cri_socket: /var/run/crio/crio.sock
+  when: container_manager == 'crio'
+
+- name: Use containerd for cri connetion
+  set_fact:
+    cri_socket: /var/run/containerd/containerd.sock
+  when: container_manager == 'containerd'
+
+- name: Use docker for cri connetion
+  set_fact:
+    cri_socket: /var/run/dockershim.sock
+  when: container_manager == 'docker'
+
+- include_tasks: ../../container-engine/containerd/tasks/crictl.yml
+  when:
+    - container_manager in ['containerd', 'crio']
+
 - name: download | Get kubeadm binary and list of required images
   import_tasks: prep_kubeadm_images.yml
   when:

roles/download/tasks/set_docker_image_facts.yml

@@ -0,0 +1,54 @@
+---
+- name: Set if containers should be pulled by digest
+  set_fact:
+    pull_by_digest: >-
+      {%- if download.sha256 is defined and download.sha256 -%}true{%- else -%}false{%- endif -%}
+
+- name: Set pull_args
+  set_fact:
+    pull_args: >-
+      {%- if pull_by_digest %}{{ download.repo }}@sha256:{{ download.sha256 }}{%- else -%}{{ download.repo }}:{{ download.tag }}{%- endif -%}
+
+- name: Set image pull command for containerd
+  set_fact:
+    image_pull_command: "{{ bin_dir }}/crictl pull"
+  when: container_manager in ['crio' ,'containerd']
+
+- name: Register docker images info
+  shell: "{{ image_info_command }}"
+  no_log: true
+  register: docker_images
+  failed_when: false
+  changed_when: false
+  check_mode: no
+  when:
+    - not download_always_pull
+    - group_names | intersect(download.groups) | length
+
+- name: Set if pull is required per container
+  set_fact:
+    pull_required: >-
+      {%- if pull_args in docker_images.stdout.split(',') %}false{%- else -%}true{%- endif -%}
+  when:
+    - not download_always_pull
+    - group_names | intersect(download.groups) | length
+
+- name: Does any host require container pull?
+  vars:
+    hosts_pull_required: "{{ hostvars.values() | map(attribute='pull_required') | select('defined') | list }}"
+  set_fact:
+    any_pull_required: "{{ True in hosts_pull_required }}"
+  run_once: true
+  changed_when: false
+  when: not download_always_pull
+
+- name: Check the local digest sha256 corresponds to the given image tag
+  assert:
+    that: "{{ download.repo }}:{{ download.tag }} in docker_images.stdout.split(',')"
+  when:
+    - group_names | intersect(download.groups) | length
+    - not download_always_pull
+    - not pull_required
+    - pull_by_digest
+  tags:
+    - asserts