feat: add openSUSE MicroOS support (#13449)

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

.github/ISSUE_TEMPLATE/bug-report.yaml

@@ -51,6 +51,7 @@ body:
         - 'Debian 11'
         - 'Flatcar Container Linux'
         - 'openSUSE Leap'
+        - 'openSUSE MicroOS'
         - 'openSUSE Tumbleweed'
         - 'Oracle Linux 9'
         - 'Oracle Linux 8'

.github/advanced-issue-labeler.yml

@@ -24,6 +24,8 @@ policy:
             keys: ['Flatcar Container Linux']
           - name: 'openSUSE Leap'
             keys: ['openSUSE Leap']
+          - name: 'openSUSE MicroOS'
+            keys: ['openSUSE MicroOS']
           - name: 'openSUSE Tumbleweed'
             keys: ['openSUSE Tumbleweed']
           - name: 'Oracle Linux 9'

.gitlab-ci/kubevirt.yml

@@ -145,6 +145,7 @@ pr_extended:
           - debian12-calico
           - debian12-docker
           - debian13-calico
+          - opensusemicroos-calico
           - rockylinux9-calico
           - rockylinux10-calico
           - ubuntu22-all-in-one-docker

README.md

@@ -92,7 +92,7 @@ vagrant up
 - **CentOS Stream / RHEL** 9, 10
 - **Fedora** 39, 40, 41, 42
 - **Fedora CoreOS** (see [fcos Note](docs/operating_systems/fcos.md))
-- **openSUSE** Leap 16.x/Tumbleweed
+- **openSUSE** Leap 16.x/Tumbleweed/MicroOS (containerd only; see [openSUSE notes](docs/operating_systems/opensuse.md))
 - **Oracle Linux** 9, 10
 - **Alma Linux** 9, 10
 - **Rocky Linux** 9, 10 (experimental in 10: see [Rocky Linux 10 notes](docs/operating_systems/rhel.md#rocky-linux-10))

docs/developers/ci.md

@@ -15,6 +15,7 @@ fedora44 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: |
 flatcar4081 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
 opensuse |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+opensusemicroos |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
 rockylinux9 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
 ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
@@ -34,6 +35,7 @@ fedora44 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: |
 opensuse |  :x: | :x: | :x: | :x: | :x: | :x: |
+opensusemicroos |  :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux9 |  :x: | :x: | :x: | :x: | :x: | :x: |
 ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
@@ -53,6 +55,7 @@ fedora44 |  :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: |
 opensuse |  :x: | :x: | :x: | :x: | :x: | :x: |
+opensusemicroos |  :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux9 |  :x: | :x: | :x: | :x: | :x: | :x: |
 ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |

docs/operating_systems/opensuse.md

@@ -1,4 +1,4 @@
-# openSUSE Leap 16.0 and Tumbleweed
+# openSUSE Leap 16.0, Tumbleweed, and MicroOS
 
 openSUSE Leap installation Notes:
 
@@ -15,3 +15,22 @@ openSUSE Leap installation Notes:
   ```sudo zypper -n install python-Jinja2 python-netaddr```
 
 Now you can continue with [Preparing your deployment](getting-started.md#starting-custom-deployment)
+
+## openSUSE MicroOS
+
+Kubespray supports openSUSE MicroOS nodes with `containerd`. Docker and CRI-O
+are not supported.
+
+MicroOS uses a read-only root filesystem and transactional package updates.
+Packages installed into a new snapshot become available only after a reboot.
+When the bootstrap package transaction changes the system, Kubespray reboots
+one node at a time and waits for it to become reachable before continuing.
+
+Kubespray does not cordon or drain nodes for this bootstrap reboot. For an
+existing cluster, schedule an appropriate maintenance window if new bootstrap
+packages might be required. Transactional root filesystem snapshots do not
+replace etcd snapshots or persistent volume backups.
+
+Kubespray does not disable or coordinate the MicroOS
+`transactional-update.timer` and `rebootmgr` services. Configure automatic
+reboots according to your cluster maintenance and node-draining policy.

roles/bootstrap_os/tasks/main.yml

@@ -36,6 +36,16 @@
   tags:
   - system-packages
 
+- name: Reboot openSUSE MicroOS after transactional package changes
+  ansible.builtin.reboot: {}
+  throttle: 1
+  when:
+  - ansible_facts['distribution'] == "openSUSE MicroOS"
+  - pkgs_task_result is defined
+  - pkgs_task_result is changed
+  tags:
+  - system-packages
+
 - name: Create remote_tmp for it is used by another module
   file:
     path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"

roles/bootstrap_os/tasks/opensuse-microos.yml

@@ -0,0 +1,3 @@
+---
+- name: Import openSUSE bootstrap
+  import_tasks: opensuse.yml

roles/bootstrap_os/tasks/opensuse.yml

@@ -1,9 +1,9 @@
 ---
 # OpenSUSE ships with Python installed
-- name: Gather host facts to get ansible_distribution_version ansible_distribution_major_version
+- name: Gather host distribution facts
   setup:
     gather_subset: '!all'
-    filter: ansible_distribution_*version
+    filter: ansible_distribution*
 
 - name: Check that /etc/sysconfig/proxy file exists
   stat:

roles/container-engine/containerd/defaults/main.yml

@@ -118,6 +118,7 @@ containerd_supported_distributions:
   - "Flatcar"
   - "Suse"
   - "openSUSE Leap"
+  - "openSUSE MicroOS"
   - "openSUSE Tumbleweed"
   - "Kylin Linux Advanced Server"
   - "UnionTech"

roles/container-engine/runc/tasks/main.yml

@@ -15,6 +15,7 @@
   when:
     - not is_ostree
     - ansible_facts['distribution'] != "Flatcar"
+    - ansible_facts['distribution'] != "openSUSE MicroOS"
   block:
     - name: Runc | Remove package
       package:

roles/kubernetes/preinstall/defaults/main.yml

@@ -89,6 +89,7 @@ supported_os_distributions:
   - 'Flatcar'
   - 'Suse'
   - 'openSUSE Leap'
+  - 'openSUSE MicroOS'
   - 'openSUSE Tumbleweed'
   - 'ClearLinux'
   - 'OracleLinux'

roles/kubernetes/preinstall/tasks/0020-set_facts.yml

@@ -10,6 +10,14 @@
   tags:
     - facts
 
+- name: Normalize ansible_facts for openSUSE MicroOS
+  set_fact:
+    ansible_facts: "{{ ansible_facts | combine({'os_family': 'Suse'}) }}"
+    ansible_os_family: Suse
+  when: ansible_facts['distribution'] == "openSUSE MicroOS"
+  tags:
+    - facts
+
 - name: Check resolvconf
   command: which resolvconf
   register: resolvconf

roles/kubernetes/preinstall/tasks/0040-verify-settings.yml

@@ -24,6 +24,14 @@
     msg: "{{ ansible_facts['distribution'] }} is not a known OS"
   when: not ignore_assert_errors
 
+- name: Stop if the container manager is unsupported on openSUSE MicroOS
+  assert:
+    that: container_manager == "containerd"
+    msg: "openSUSE MicroOS only supports containerd"
+  when:
+    - not ignore_assert_errors
+    - ansible_facts['distribution'] == "openSUSE MicroOS"
+
 - name: Stop if memory is too small for control plane nodes
   assert:
     that: ansible_facts['memtotal_mb'] >= minimal_master_memory_mb

roles/system_packages/tasks/main.yml

@@ -5,6 +5,11 @@
       - distribution
       - pkg_mgr
 
+- name: Normalize openSUSE MicroOS legacy OS family fact
+  set_fact:
+    ansible_os_family: Suse
+  when: ansible_facts['distribution'] == "openSUSE MicroOS"
+
 - name: Update package management cache (zypper) - SUSE
   command: zypper -n --gpg-auto-import-keys ref
   register: make_cache_output

test-infra/image-builder/roles/kubevirt-images/defaults/main.yml

@@ -190,6 +190,13 @@ images:
     converted: true
     tag: "latest"
 
+  opensuse-microos:
+    filename: openSUSE-MicroOS.x86_64-16.0.0-ContainerHost-OpenStack-Cloud-Build99.19.qcow2
+    url: https://download.opensuse.org/repositories/devel:/microos:/images/openSUSE_Tumbleweed/openSUSE-MicroOS.x86_64-16.0.0-ContainerHost-OpenStack-Cloud-Build99.19.qcow2
+    checksum: sha256:7192d8a34ac7821a0d2ea0818eb4dd4dff62e0e07b35c6f582e52fc71fd027cf
+    converted: true
+    tag: "latest"
+
   openeuler-2203:
     filename: openEuler-22.03-LTS-SP4-x86_64.qcow2.xz
     url: https://mirrors.ocf.berkeley.edu/openeuler/openEuler-22.03-LTS-SP4/virtual_machine_img/x86_64/openEuler-22.03-LTS-SP4-x86_64.qcow2.xz

tests/files/opensusemicroos-calico.yml

@@ -0,0 +1,6 @@
+---
+# Instance settings
+cloud_image: opensuse-microos
+
+# Transactional package operations can exceed the default timeout.
+pkg_install_timeout: "{{ 15 * 60 }}"