update multus to 3.4 and add crio support (#5701)

Signed-off-by: Chris Randles <randles.chris@gmail.com>

roles/network_plugin/multus/defaults/main.yml

@@ -1,7 +1,10 @@
 ---
 multus_conf_file: "auto"
 multus_cni_conf_dir_host: "/etc/cni/net.d"
-multus_cni_bin_dir_host: "/opt/cni/bin"
+multus_cni_bin_dir_host: "{{ '/usr/libexec/cni' if container_manager == 'crio' else '/opt/cni/bin' }}"
+multus_cni_run_dir_host: "/run"
 multus_cni_conf_dir: "{{ ('/host',  multus_cni_conf_dir_host) | join }}"
 multus_cni_bin_dir: "{{ ('/host', multus_cni_bin_dir_host) | join }}"
+multus_cni_run_dir: "{{ ('/host', multus_cni_run_dir_host) | join }}"
+multus_cni_version: "0.3.1"
 multus_kubeconfig_file_host: "{{ (multus_cni_conf_dir_host, '/multus.d/multus.kubeconfig') | join }}"

roles/network_plugin/multus/files/multus-clusterrole.yml

@@ -4,13 +4,16 @@ apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: multus
 rules:
-- apiGroups:
-  - '*'
+- apiGroups: ["k8s.cni.cncf.io"]
   resources:
   - '*'
   verbs:
   - '*'
-- nonResourceURLs:
-  - '*'
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/status
   verbs:
-  - '*'
+  - get
+  - update

roles/network_plugin/multus/files/multus-crd.yml

@@ -1,11 +1,10 @@
 ---
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
-apiVersion: apiextensions.k8s.io/v1beta1
 metadata:
   name: network-attachment-definitions.k8s.cni.cncf.io
 spec:
   group: k8s.cni.cncf.io
-  version: v1
   scope: Namespaced
   names:
     plural: network-attachment-definitions
@@ -13,10 +12,16 @@ spec:
     kind: NetworkAttachmentDefinition
     shortNames:
     - net-attach-def
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
-          properties:
-            config:
-              type: string
+  versions:
+  - name: v1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+        properties:
+          spec:
+            type: object
+            properties:
+              config:
+                type: string

roles/network_plugin/multus/templates/multus-daemonset.yml.j2

@@ -36,6 +36,10 @@ spec:
         - "--cni-bin-dir={{ multus_cni_bin_dir }}"
         - "--multus-conf-file={{ multus_conf_file }}"
         - "--multus-kubeconfig-file-host={{ multus_kubeconfig_file_host }}"
+        - "--cni-version={{ multus_cni_version }}"
+{% if container_manager == 'crio' %}
+        - "--restart-crio=true"
+{% endif %}
         resources:
           requests:
             cpu: "100m"
@@ -45,12 +49,25 @@ spec:
             memory: "50Mi"
         securityContext:
           privileged: true
+{% if container_manager == 'crio' %}
+          capabilities:
+            add: ["SYS_ADMIN"]
+{% endif %}
         volumeMounts:
+{% if container_manager == 'crio' %}
+        - name: run
+          mountPath: {{ multus_cni_run_dir }}
+{% endif %}
         - name: cni
           mountPath: {{  multus_cni_conf_dir }}
         - name: cnibin
           mountPath: {{ multus_cni_bin_dir }}
       volumes:
+{% if container_manager == 'crio' %}
+      - name: run
+        hostPath:
+          path: {{ multus_cni_run_dir_host }}
+{% endif %}
       - name: cni
         hostPath:
           path: {{ multus_cni_conf_dir_host }}