Compare commits

...

14 Commits

Author SHA1 Message Date
e9e83d2f8d feat: add option to add custom unit override options (#5)
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #5
2023-06-05 22:55:25 +02:00
0f881e669b
fix: allow to overwrite ansible deps
All checks were successful
continuous-integration/drone/push Build is passing
2023-02-19 21:45:48 +01:00
0994ace222
fix package name in molecule test
All checks were successful
continuous-integration/drone/push Build is passing
2023-02-18 16:15:17 +01:00
95d2ed8da6
remove whitespace 2023-02-18 16:04:02 +01:00
bd53dd525c
fix: deploy environment file 2023-02-18 16:01:45 +01:00
8c7732b555 refactor: migrate to docker ce (#4)
Some checks failed
continuous-integration/drone/push Build is failing
2023-02-18 15:14:39 +01:00
53be9e013a
[skip ci] fix drone-matrix template 2023-02-08 21:15:52 +01:00
b33d10e747
ci: switch to molecule v4
All checks were successful
continuous-integration/drone/push Build is passing
2022-12-21 09:13:45 +01:00
5135783a4d
ci: update python images to 3.10
All checks were successful
continuous-integration/drone/push Build is passing
2022-07-02 21:53:01 +02:00
591c17d8e5
chore: switch to main as default branch
All checks were successful
continuous-integration/drone/push Build is passing
2022-06-20 22:20:00 +02:00
14f1f3df72
chore: add auto-generated _docs folder to gitignore file
All checks were successful
continuous-integration/drone/push Build is passing
2022-03-03 21:15:29 +01:00
a793449afa
fix: fix loop control
All checks were successful
continuous-integration/drone/push Build is passing
2022-01-28 11:49:18 +01:00
2793a02ba3
feat: add task to handle registry logins
All checks were successful
continuous-integration/drone/push Build is passing
2022-01-28 11:31:12 +01:00
0b106d51c7
chore: end of the year maintenance [skip ci] 2021-12-21 10:45:08 +01:00
20 changed files with 168 additions and 147 deletions

View File

@ -15,18 +15,18 @@ local PipelineLinting = {
}, },
{ {
name: 'python-format', name: 'python-format',
image: 'python:3.9', image: 'python:3.11',
environment: { environment: {
PY_COLORS: 1, PY_COLORS: 1,
}, },
commands: [ commands: [
'pip install -qq yapf', 'pip install -qq yapf',
'[ -z "$(find . -type f -name *.py)" ] || (yapf -rd ./)', '[ -z "$(find . -type f -name *.py)" ] || (yapf -rd ./)',
], ],
}, },
{ {
name: 'python-flake8', name: 'python-flake8',
image: 'python:3.9', image: 'python:3.11',
environment: { environment: {
PY_COLORS: 1, PY_COLORS: 1,
}, },
@ -37,11 +37,11 @@ local PipelineLinting = {
}, },
], ],
trigger: { trigger: {
ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'], ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
}, },
}; };
local PipelineDeployment(scenario='centos7') = { local PipelineDeployment(scenario='rocky9') = {
kind: 'pipeline', kind: 'pipeline',
name: 'testing-' + scenario, name: 'testing-' + scenario,
platform: { platform: {
@ -58,7 +58,7 @@ local PipelineDeployment(scenario='centos7') = {
steps: [ steps: [
{ {
name: 'ansible-molecule', name: 'ansible-molecule',
image: 'thegeeklab/molecule:3', image: 'thegeeklab/molecule:4',
environment: { environment: {
HCLOUD_TOKEN: { from_secret: 'hcloud_token' }, HCLOUD_TOKEN: { from_secret: 'hcloud_token' },
}, },
@ -71,7 +71,7 @@ local PipelineDeployment(scenario='centos7') = {
'linting', 'linting',
], ],
trigger: { trigger: {
ref: ['refs/heads/master', 'refs/tags/**'], ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
}, },
}; };
@ -107,15 +107,15 @@ local PipelineDocumentation = {
target_branch: 'docs', target_branch: 'docs',
}, },
when: { when: {
ref: ['refs/heads/master'], ref: ['refs/heads/main'],
}, },
}, },
], ],
trigger: { trigger: {
ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'], ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
}, },
depends_on: [ depends_on: [
'testing-centos7', 'testing-rocky9',
], ],
}; };
@ -136,7 +136,7 @@ local PipelineNotification = {
settings: { settings: {
homeserver: { from_secret: 'matrix_homeserver' }, homeserver: { from_secret: 'matrix_homeserver' },
roomid: { from_secret: 'matrix_roomid' }, roomid: { from_secret: 'matrix_roomid' },
template: 'Status: **{{ build.Status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.Link }}){{#if build.Branch}} ({{ build.Branch }}){{/if}} by {{ commit.Author }}<br/> Message: {{ commit.Message.Title }}', template: 'Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}',
username: { from_secret: 'matrix_username' }, username: { from_secret: 'matrix_username' },
password: { from_secret: 'matrix_password' }, password: { from_secret: 'matrix_password' },
}, },
@ -147,13 +147,13 @@ local PipelineNotification = {
], ],
trigger: { trigger: {
status: ['success', 'failure'], status: ['success', 'failure'],
ref: ['refs/heads/master', 'refs/tags/**'], ref: ['refs/heads/main', 'refs/tags/**'],
}, },
}; };
[ [
PipelineLinting, PipelineLinting,
PipelineDeployment(scenario='centos7'), PipelineDeployment(scenario='rocky9'),
PipelineDocumentation, PipelineDocumentation,
PipelineNotification, PipelineNotification,
] ]

View File

@ -13,15 +13,15 @@ steps:
- ansible-later - ansible-later
- name: python-format - name: python-format
image: python:3.9 image: python:3.11
commands: commands:
- pip install -qq yapf - pip install -qq yapf
- "[ -z \"$(find . -type f -name *.py)\" ] || (yapf -rd ./)" - "[ -z \"$(find . -type f -name *.py)\" ] || (yapf -rd ./)"
environment: environment:
PY_COLORS: 1 PY_COLORS: 1
- name: python-flake8 - name: python-flake8
image: python:3.9 image: python:3.11
commands: commands:
- pip install -qq flake8 - pip install -qq flake8
- flake8 - flake8
@ -30,13 +30,13 @@ steps:
trigger: trigger:
ref: ref:
- refs/heads/master - refs/heads/main
- refs/tags/** - refs/tags/**
- refs/pull/** - refs/pull/**
--- ---
kind: pipeline kind: pipeline
name: testing-centos7 name: testing-rocky9
platform: platform:
os: linux os: linux
@ -51,17 +51,18 @@ workspace:
steps: steps:
- name: ansible-molecule - name: ansible-molecule
image: thegeeklab/molecule:3 image: thegeeklab/molecule:4
commands: commands:
- molecule test -s centos7 - molecule test -s rocky9
environment: environment:
HCLOUD_TOKEN: HCLOUD_TOKEN:
from_secret: hcloud_token from_secret: hcloud_token
trigger: trigger:
ref: ref:
- refs/heads/master - refs/heads/main
- refs/tags/** - refs/tags/**
- refs/pull/**
depends_on: depends_on:
- linting - linting
@ -98,16 +99,16 @@ steps:
from_secret: gitea_username from_secret: gitea_username
when: when:
ref: ref:
- refs/heads/master - refs/heads/main
trigger: trigger:
ref: ref:
- refs/heads/master - refs/heads/main
- refs/tags/** - refs/tags/**
- refs/pull/** - refs/pull/**
depends_on: depends_on:
- testing-centos7 - testing-rocky9
--- ---
kind: pipeline kind: pipeline
@ -130,13 +131,13 @@ steps:
from_secret: matrix_password from_secret: matrix_password
roomid: roomid:
from_secret: matrix_roomid from_secret: matrix_roomid
template: "Status: **{{ build.Status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.Link }}){{#if build.Branch}} ({{ build.Branch }}){{/if}} by {{ commit.Author }}<br/> Message: {{ commit.Message.Title }}" template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
username: username:
from_secret: matrix_username from_secret: matrix_username
trigger: trigger:
ref: ref:
- refs/heads/master - refs/heads/main
- refs/tags/** - refs/tags/**
status: status:
- success - success
@ -147,6 +148,6 @@ depends_on:
--- ---
kind: signature kind: signature
hmac: 7223650263350e2d70725d822ec216f71e262c1319c60a9d490a07e1b7f5d345 hmac: 5ecb808a24d61708adad225a6fd1ffde1b8de1a477f513e21c5e2b14c3790e0d
... ...

2
.gitignore vendored
View File

@ -9,3 +9,5 @@ __pycache__/
*.py[cod] *.py[cod]
*$py.class *$py.class
# ---> Docs
/_docs

View File

@ -1,6 +1,6 @@
MIT License MIT License
Copyright (c) 2021 Robert Kaussow <mail@thegeeklab.de> Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
Permission is hereby granted, free of charge, to any person obtaining a copy Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal of this software and associated documentation files (the "Software"), to deal

View File

@ -1,6 +1,10 @@
--- ---
dockerengine_packages: dockerengine_packages:
- docker - docker-ce
- docker-ce-cli
- containerd.io
- docker-buildx-plugin
- docker-compose-plugin
# @var dockerengine_packages_extra:description: > # @var dockerengine_packages_extra:description: >
# The role requires epel repository and pip to work. You can use # The role requires epel repository and pip to work. You can use
@ -8,35 +12,55 @@ dockerengine_packages:
# @end # @end
dockerengine_packages_extra: [] dockerengine_packages_extra: []
dockerengine_ansible_deps:
- cryptography
- docker-compose
- docker
dockerengine_service: docker dockerengine_service: docker
# @var dockerengine_service_override_unit:description: >
# Multiline string of options to add to the `systemd` service override unit section.
# @end
# @var dockerengine_service_override_unit: $ "_unset_"
# @var dockerengine_service_override_unit:example: >
# dockerengine_service_override_unit: |
# After=time-sync.target
# Requires=time-sync.target
# @end
dockerengine_docker_group_enabled: False dockerengine_docker_group_enabled: False
dockerengine_secure_registries: []
dockerengine_insecure_registries: [] # @var dockerengine_registries:description: List of docker registries to auto login
dockerengine_block_registries: [] # @var dockerengine_registries:example: >
# dockerengine_registries:
# - registry: myregistry.example.com (optional)
# username: docker
# password: secure
# reauthorize: False
# state: present
# @end
dockerengine_registries: []
# @var dockerengine_http_proxy: $ "_unset_" # @var dockerengine_http_proxy: $ "_unset_"
# @var dockerengine_https_proxy: $ "_unset" # @var dockerengine_https_proxy: $ "_unset"
# @var dockerengine_no_proxy: $ "_unset_" # @var dockerengine_no_proxy: $ "_unset_"
# @var dockerengine_storage_pvs: $ "_unset_"
# @var dockerengine_storage_pvs:example: $ "/dev/sda"
dockerengine_storage_vg: vg_docker
dockerengine_storage_lv: lv_docker
dockerengine_storage_size: 100G
dockerengine_base_dir: /var/lib/docker
dockerengine_cli_options:
- selinux-enabled
- log-driver=journald
- log-level=info
- signature-verification=false
dockerengine_usernamespace_enabled: False dockerengine_usernamespace_enabled: False
dockerengine_nsremap_user: dockremap dockerengine_nsremap_user: dockremap
dockerengine_nsremap_range_start: 231072 dockerengine_nsremap_range_start: 231072
dockerengine_nsremap_range_length: 65536 dockerengine_nsremap_range_length: 65536
dockerengine_daemon_config:
- selinux-enabled: False
- log-driver: journald
- log-level: info
- live-restore: True
dockerengine_daemon_config_extra: []
# dockerengine_daemon_config_extra:
# - userns-remap: "{{ dockerengine_nsremap_user +':' + dockerengine_nsremap_user }}"
# @var dockerengine_networks:description: List of additional docker networks to create. # @var dockerengine_networks:description: List of additional docker networks to create.
# @var dockerengine_networks:example: > # @var dockerengine_networks:example: >
# dockerengine_networks: # dockerengine_networks:

View File

@ -8,7 +8,7 @@ galaxy_info:
# @meta description: > # @meta description: >
# [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.docker_engine) # [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.docker_engine)
# [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.docker_engine?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.docker_engine) # [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.docker_engine?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.docker_engine)
# [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/ansible/xoxys.docker_engine/src/branch/master/LICENSE) # [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/ansible/xoxys.docker_engine/src/branch/main/LICENSE)
# #
# Setup docker engine. # Setup docker engine.
# @end # @end

View File

@ -1,11 +0,0 @@
---
- name: Converge
hosts: all
vars:
dockerengine_packages_extra:
- epel-release
- python-pip
- python-virtualenv
roles:
- role: xoxys.docker_engine

View File

@ -0,0 +1,14 @@
---
- name: Converge
hosts: all
vars:
dockerengine_packages_extra:
- epel-release
- python3-pip
- python3-virtualenv
pre_tasks:
- name: Enable CodeReadyBuilder repository
command: dnf config-manager --set-enabled "crb"
changed_when: False
roles:
- role: xoxys.docker_engine

View File

@ -9,8 +9,8 @@ dependency:
driver: driver:
name: delegated name: delegated
platforms: platforms:
- name: centos7-docker-engine - name: rocky9-docker-engine
image: centos-7 image: rocky-9
server_type: cx11 server_type: cx11
lint: | lint: |
/usr/local/bin/flake8 /usr/local/bin/flake8

View File

@ -8,7 +8,7 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
def test_docker_is_installed(host): def test_docker_is_installed(host):
docker = host.package("docker") docker = host.package("docker-ce")
assert docker.is_installed assert docker.is_installed

View File

@ -7,21 +7,6 @@
notify: __docker_restart notify: __docker_restart
when: dockerengine_docker_group_enabled | bool when: dockerengine_docker_group_enabled | bool
- name: Deploy config files to setup environment
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: root
group: root
mode: 0644
loop:
- { src: 'etc/sysconfig/docker.j2', dest: '/etc/sysconfig/{{ dockerengine_service }}' }
- { src: 'etc/sysconfig/docker-storage-setup.j2', dest: '/etc/sysconfig/{{ dockerengine_service }}-storage-setup' }
- { src: 'etc/containers/registries.conf.j2', dest: '/etc/containers/registries.conf' }
loop_control:
label: "{{ item.dest }}"
notify: __docker_restart
- name: Add namespace group - name: Add namespace group
group: group:
name: "{{ dockerengine_nsremap_user }}" name: "{{ dockerengine_nsremap_user }}"
@ -51,12 +36,57 @@
- /etc/subuid - /etc/subuid
- /etc/subgid - /etc/subgid
- name: Create required directories
loop:
- name: /etc/systemd/system/docker.service.d
mode: "0755"
- name: /etc/docker
mode: "0755"
loop_control:
label: "{{ item.name }}"
file:
path: "{{ item.name }}"
state: directory
mode: "{{ item.mode }}"
- name: Write environment file
template:
src: etc/sysconfig/docker.j2
dest: /etc/sysconfig/docker
mode: 0600
notify: __docker_restart
- name: Write service override.conf
template:
src: etc/systemd/system/docker.service.d/override.conf.j2
dest: /etc/systemd/system/docker.service.d/override.conf
mode: 0644
notify: __docker_restart
- name: Deploy daemon config
copy:
content: "{{ (dockerengine_daemon_config | combine(dockerengine_daemon_config_extra)) | to_nice_json }}"
dest: /etc/docker/daemon.json
mode: 0600
notify: __docker_restart
- name: Ensure docker engine is up and running - name: Ensure docker engine is up and running
service: service:
name: "{{ dockerengine_service }}" name: "{{ dockerengine_service }}"
enabled: True enabled: True
state: started state: started
- name: Handle registry logins
docker_login:
registry: "{{ item.url | default(omit) }}"
username: "{{ item.username }}"
password: "{{ item.password }}"
reauthorize: "{{ item.reauthorize | default(False) }}"
state: '{{ item.state | default("present") }}'
loop: "{{ dockerengine_registries }}"
loop_control:
label: "{{ item.url | default('DockerHub') }}"
- name: Create docker networks - name: Create docker networks
docker_network: docker_network:
name: "{{ item.name }}" name: "{{ item.name }}"

View File

@ -1,5 +1,15 @@
--- ---
- block: - block:
- name: Add Docker CE repository
yum_repository:
name: "docker-ce"
file: "Docker-CE"
description: "Docker CE Stable"
baseurl: "https://download.docker.com/linux/centos/{{ ansible_distribution_major_version }}/{{ ansible_architecture }}/stable"
gpgcheck: yes
enabled: yes
gpgkey: "https://download.docker.com/linux/rhel/gpg"
- name: Install dependencies - name: Install dependencies
package: package:
name: "{{ item }}" name: "{{ item }}"
@ -10,7 +20,7 @@
pip: pip:
name: "{{ item }}" name: "{{ item }}"
virtualenv: /opt/python2/ansible-deps virtualenv: /opt/python2/ansible-deps
loop: "{{ __docker_ansible_deps }}" loop: "{{ dockerengine_ansible_deps }}"
- name: Add docker-compose wrapper - name: Add docker-compose wrapper
template: template:
@ -20,6 +30,14 @@
group: root group: root
mode: 0755 mode: 0755
- name: Ensure to remove old docker packages
package:
name:
- docker
- docker-common
- docker-engine
state: absent
- name: Install packages - name: Install packages
package: package:
name: "{{ item }}" name: "{{ item }}"

View File

@ -1,27 +0,0 @@
{{ ansible_managed | comment }}
# This is a system-wide configuration file used to
# keep track of registries for various container backends.
# It adheres to TOML format and does not support recursive
# lists of registries.
# The default location for this configuration file is /etc/containers/registries.conf.
# The only valid categories are: 'registries.search', 'registries.insecure',
# and 'registries.block'.
[registries.search]
#registries = ['registry.access.redhat.com']
registries = [{{ dockerengine_secure_registries | xoxys.general.wrap | join(',') }}]
# If you need to access insecure registries, add the registry's fully-qualified name.
# An insecure registry is one that does not have a valid SSL certificate or only does HTTP.
[registries.insecure]
registries = [{{ dockerengine_insecure_registries | xoxys.general.wrap | join(',') }}]
# If you need to block pull access from a registry, uncomment the section below
# and add the registries fully-qualified name.
#
# Docker only
[registries.block]
registries = [{{ dockerengine_block_registries | xoxys.general.wrap | join(',') }}]

View File

@ -1,10 +0,0 @@
#jinja2: lstrip_blocks: True
{{ ansible_managed | comment }}
STORAGE_DRIVER=overlay2
{% if dockerengine_storage_pvs is defined %}
DEVS={{ dockerengine_storage_pvs }}
CONTAINER_ROOT_LV_NAME={{ dockerengine_storage_lv }}
CONTAINER_ROOT_LV_SIZE={{ dockerengine_storage_size }}
CONTAINER_ROOT_LV_MOUNT_PATH={{ dockerengine_base_dir }}
VG={{ dockerengine_storage_vg }}
{% endif %}

View File

@ -1,33 +1,6 @@
#jinja2: lstrip_blocks: True
{{ ansible_managed | comment }} {{ ansible_managed | comment }}
# Modify these options if you want to change the way the docker daemon runs OPTIONS='{{'--userns-remap=' + dockerengine_nsremap_user + ':' + dockerengine_nsremap_user if dockerengine_usernamespace_enabled | bool else '' }}'
OPTIONS='{{ dockerengine_cli_options | xoxys.general.prefix | join(' ') }}{{ ' --userns-remap='+dockerengine_nsremap_user+':'+dockerengine_nsremap_user if dockerengine_usernamespace_enabled | bool else '' }}'
if [ -z "${DOCKER_CERT_PATH}" ]; then
DOCKER_CERT_PATH=/etc/docker
fi
# Do not add registries in this file anymore. Use /etc/containers/registries.conf
# from the atomic-registries package.
#
# On an SELinux system, if you remove the --selinux-enabled option, you
# also need to turn on the docker_transition_unconfined boolean.
# setsebool -P docker_transition_unconfined 1
# Location used for temporary files, such as those created by
# docker load and build operations. Default is /var/lib/docker/tmp
# Can be overriden by setting the following environment variable.
# DOCKER_TMPDIR=/var/tmp
# Controls the /etc/cron.daily/docker-logrotate cron job status.
# To disable, uncomment the line below.
# LOGROTATE=false
# docker-latest daemon can be used by starting the docker-latest unitfile.
# To use docker-latest client, uncomment below lines
#DOCKERBINARY=/usr/bin/docker-latest
#DOCKERDBINARY=/usr/bin/dockerd-latest
#DOCKER_CONTAINERD_BINARY=/usr/bin/docker-containerd-latest
#DOCKER_CONTAINERD_SHIM_BINARY=/usr/bin/docker-containerd-shim-latest
# Proxy settings # Proxy settings
{% if dockerengine_http_proxy is defined %} {% if dockerengine_http_proxy is defined %}

View File

@ -0,0 +1,12 @@
#jinja2: lstrip_blocks: True
{{ ansible_managed | comment }}
{% if dockerengine_service_override_unit is defined %}
[Unit]
{{ dockerengine_service_override_unit }}
{% endif %}
[Service]
EnvironmentFile=-/etc/sysconfig/docker
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// \
--containerd=/run/containerd/containerd.sock \
$OPTIONS

View File

@ -1,5 +0,0 @@
---
__docker_ansible_deps:
- cryptography~=2.0
- docker-compose~=1.24.0
- docker