Centos, debian and fedora CRI-O repo (#6008)

* replace removed repo with kubic repository for centos 7

* add crio configuration for centos8

* add crio configurations for debian

* use correct crio version for fedora

* simplify calulation of required crio version
- gives possibility to overwrite

* change default path for runc

* change default for seccomp path

* change default for conmon

roles/container-engine/cri-o/tasks/crictl.yml

@@ -23,7 +23,6 @@
 
 - name: Get crictl completion
   shell: "{{ bin_dir }}/crictl completion"
-  when: ansible_distribution in ["CentOS","RedHat", "Ubuntu", "Debian"]
   changed_when: False
   register: cri_completion
 
@@ -32,4 +31,3 @@
     dest: /etc/bash_completion.d/crictl
     content: "{{ cri_completion.stdout }}"
   become: True
-  when: cri_completion is defined

roles/container-engine/cri-o/tasks/crio_repo.yml

@@ -1,34 +1,60 @@
 ---
 
+- name: CRI-O kubic repo name for debian os family
+  set_fact:
+    crio_kubic_debian_repo_name: "{{ ((ansible_distribution == 'Ubuntu') | ternary('x','')) ~ ansible_distribution ~ '_' ~ ansible_distribution_version }}"
+  when: ansible_os_family == "Debian"
+
 - name: Add CRI-O kubic repo key
   apt_key:
-    url: "https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/x{{ ansible_distribution }}_{{ ansible_distribution_version }}/Release.key"
+    url: "https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/{{ crio_kubic_debian_repo_name }}/Release.key"
     state: present
-  when: ansible_distribution in ["Ubuntu"]
+  when: crio_kubic_debian_repo_name is defined
 
 - name: Add CRI-O kubic repo
   apt_repository:
-    repo: "deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/x{{ ansible_distribution }}_{{ ansible_distribution_version }}/ /"
+    repo: "deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/{{ crio_kubic_debian_repo_name }}/ /"
     state: present
     filename: devel:kubic:libcontainers:stable
-  when: ansible_distribution in ["Ubuntu"]
+  when: crio_kubic_debian_repo_name is defined
 
-- name: Add CRI-O OpenShift Origin repository
+- name: Add CRI-O kubic repo
   yum_repository:
-    name: origin
-    description: OpenShift Origin Repo
-    baseurl: "{{ crio_rhel_repo_base_url }}"
-    gpgcheck: no
-  when: ansible_distribution in ["CentOS","RedHat","OracleLinux"] and not is_ostree
+    name: devel_kubic_libcontainers_stable
+    description: Stable Releases of Upstream github.com/containers packages (CentOS_$releasever)
+    baseurl: http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/
+    gpgcheck: yes
+    gpgkey: http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/repodata/repomd.xml.key
+  when: ansible_distribution in ["CentOS"]
 
-- name: Enable modular repos for crio
+- name: Add CRI-O kubic repo
+  yum_repository:
+    name: "devel_kubic_libcontainers_stable_cri-o_{{ crio_version }}"
+    description: 1.17 (CentOS_$releasever)
+    baseurl: "http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/{{ crio_version }}/CentOS_$releasever/"
+    gpgcheck: yes
+    gpgkey: "http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/{{ crio_version }}/CentOS_$releasever/repodata/repomd.xml.key"
+  when: ansible_distribution in ["CentOS"]
+
+- name: Enable modular repos for CRI-O
   ini_file:
     path: "/etc/yum.repos.d/{{ item }}.repo"
     section: "{{ item }}"
     option: enabled
     value: 1
   become: true
-  when: ansible_distribution in ["Fedora"]
+  when: is_ostree
   loop:
     - "fedora-updates-modular"
     - "fedora-modular"
+
+- name: Enable CRI-O module
+  command: "dnf -y module enable cri-o:{{ crio_version }}"
+  args:
+    warn: False
+  register: crio_dnf_result
+  changed_when: "'Enabling' in crio_dnf_result.stdout"
+  become: true
+  when:
+    - ansible_distribution in ["Fedora"]
+    - not is_ostree

roles/container-engine/cri-o/tasks/main.yaml

@@ -48,6 +48,21 @@
   with_items: "{{ crio_packages }}"
   notify: restart crio
 
+- name: Gather the rpm package facts
+  package_facts:
+    manager: auto
+  when:
+    - ansible_distribution == "CentOS"
+    - ansible_distribution_major_version == "8"
+
+- name: Ensure latest version of libseccom installed
+  command: "yum update -y libseccomp"
+  when:
+    - ansible_distribution == "CentOS"
+    - ansible_distribution_major_version == "8"
+    - ansible_facts.packages['libseccomp'] | map(attribute='version') | map('regex_replace','^(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') | list | first == '2.3'
+  notify: restart crio
+
 - name: Check if already installed
   stat:
     path: "/bin/crio"
@@ -96,9 +111,20 @@
     owner: root
     mode: 0755
 
+- name: Remove metacopy mount options for older kernels
+  ini_file:
+    dest: /etc/containers/storage.conf
+    section: storage.options.overlay
+    option: mountopt
+    value: "\"nodev\""
+  when:
+    - ansible_distribution == "CentOS"
+    - ansible_distribution_major_version == "7"
+
+
 - name: Write cri-o proxy drop-in
   template:
     src: http-proxy.conf.j2
     dest: /etc/systemd/system/crio.service.d/http-proxy.conf
   notify: restart crio
-  when: http_proxy is defined or https_proxy is defined
+  when: http_proxy is defined or https_proxy is defined