From 81bf4f93047f3d05c592a10bb0e95543f8099fac Mon Sep 17 00:00:00 2001
From: kranthi guttikonda <kranthi.guttikonda9@hotmail.com>
Date: Wed, 1 Sep 2021 13:20:59 -0400
Subject: [PATCH] cri-o registry auth support (#7837)
* cri-o registry auth support
* yaml lint for comments
* crio_registry_auth from registry_auth
* crio_registry_auth as defaults
---
inventory/sample/group_vars/all/cri-o.yml | 6 ++++++
roles/container-engine/cri-o/defaults/main.yml | 6 ++++++
roles/container-engine/cri-o/tasks/main.yaml | 7 +++++++
.../cri-o/templates/config.json.j2 | 17 +++++++++++++++++
.../cri-o/templates/crio.conf.j2 | 2 +-
5 files changed, 37 insertions(+), 1 deletion(-)
create mode 100644 inventory/sample/group_vars/all/cri-o.yml
create mode 100644 roles/container-engine/cri-o/templates/config.json.j2
diff --git a/inventory/sample/group_vars/all/cri-o.yml b/inventory/sample/group_vars/all/cri-o.yml
new file mode 100644
index 000000000..3e6e4eebb
--- /dev/null
+++ b/inventory/sample/group_vars/all/cri-o.yml
@@ -0,0 +1,6 @@
+# crio_insecure_registries:
+# - 10.0.0.2:5000
+# crio_registry_auth:
+# - registry: 10.0.0.2:5000
+# username: user
+# password: pass
diff --git a/roles/container-engine/cri-o/defaults/main.yml b/roles/container-engine/cri-o/defaults/main.yml
index bc9092fd7..5f53aa6f9 100644
--- a/roles/container-engine/cri-o/defaults/main.yml
+++ b/roles/container-engine/cri-o/defaults/main.yml
@@ -14,6 +14,12 @@ crio_registries: []
# Configure insecure registries.
crio_insecure_registries: []
+# Configure registry auth (if applicable to secure/insecure registries)
+crio_registry_auth: []
+# - registry: 10.0.0.2:5000
+# username: user
+# password: pass
+
# Define registiries mirror
crio_registries_mirrors: []
diff --git a/roles/container-engine/cri-o/tasks/main.yaml b/roles/container-engine/cri-o/tasks/main.yaml
index d22d1dc32..55db2690f 100644
--- a/roles/container-engine/cri-o/tasks/main.yaml
+++ b/roles/container-engine/cri-o/tasks/main.yaml
@@ -80,6 +80,12 @@
mode: 0644
register: config_install
+- name: Install config.json
+ template:
+ src: config.json.j2
+ dest: /etc/crio/config.json
+ register: reg_auth_install
+
- name: Add skopeo pkg to install
set_fact:
crio_packages: "{{ crio_packages + skopeo_packages }}"
@@ -198,6 +204,7 @@
state: restarted
when:
- config_install.changed
+ - reg_auth_install.changed
- not package_install.changed
- not service_start.changed
diff --git a/roles/container-engine/cri-o/templates/config.json.j2 b/roles/container-engine/cri-o/templates/config.json.j2
new file mode 100644
index 000000000..522ade7a4
--- /dev/null
+++ b/roles/container-engine/cri-o/templates/config.json.j2
@@ -0,0 +1,17 @@
+{% if crio_registry_auth is defined and crio_registry_auth|length %}
+{
+{% for reg in crio_registry_auth %}
+ "auths": {
+ "{{ reg.registry }}": {
+ "auth": "{{ (reg.username + ':' + reg.password) | string | b64encode }}"
+ }
+{% if not loop.last %}
+ },
+{% else %}
+ }
+{% endif %}
+{% endfor %}
+}
+{% else %}
+{}
+{% endif %}
diff --git a/roles/container-engine/cri-o/templates/crio.conf.j2 b/roles/container-engine/cri-o/templates/crio.conf.j2
index cdc7363ac..b6f5357dd 100644
--- a/roles/container-engine/cri-o/templates/crio.conf.j2
+++ b/roles/container-engine/cri-o/templates/crio.conf.j2
@@ -313,7 +313,7 @@ default_transport = "docker://"
# The path to a file containing credentials necessary for pulling images from
# secure registries. The file is similar to that of /var/lib/kubelet/config.json
-global_auth_file = ""
+global_auth_file = "/etc/crio/config.json"
# The image used to instantiate infra containers.
# This option supports live configuration reload.
--
GitLab