[candi] migrate to containerd 1.6

candi/bashible/bundles/centos/node-group/031_install_containerd.sh.tpl

@@ -1,4 +1,4 @@
-# Copyright 2021 Flant JSC
+# Copyright 2022 Flant JSC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -84,19 +84,4 @@ if [[ "$should_install_containerd" == true ]]; then
 
   bb-rp-install "containerd-io:${containerd_tag}" "crictl:${crictl_tag}"
 fi
-
-# Upgrade containerd-flant-edition if needed
-containerd_fe_tag="{{ index .images.registrypackages "containerdFe1511" | toString }}"
-if ! bb-rp-is-installed? "containerd-flant-edition" "${containerd_fe_tag}" ; then
-  systemctl stop containerd.service
-  bb-rp-install "containerd-flant-edition:${containerd_fe_tag}"
-
-  mkdir -p /etc/systemd/system/containerd.service.d
-  bb-sync-file /etc/systemd/system/containerd.service.d/override.conf - << EOF
-[Service]
-ExecStart=
-ExecStart=-/usr/local/bin/containerd
-EOF
-fi
-
 {{- end }}

candi/bashible/bundles/debian/all/001_install_mandatory_packages.sh.tpl

@@ -1,4 +1,4 @@
-# Copyright 2021 Flant JSC
+# Copyright 2022 Flant JSC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -11,8 +11,8 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
-SYSTEM_PACKAGES="curl wget inotify-tools bash-completion lvm2 parted apt-transport-https sudo nfs-common vim"
+# libseccomp - containerd.io dependencies
+SYSTEM_PACKAGES="curl wget inotify-tools bash-completion lvm2 parted apt-transport-https sudo nfs-common vim libseccomp2"
 KUBERNETES_DEPENDENCIES="iptables iproute2 socat util-linux mount ebtables ethtool"
 
 if bb-is-debian-version? 9 || bb-is-debian-version? 10 || bb-is-debian-version? 11; then
@@ -25,3 +25,9 @@ fi
 bb-apt-install ${SYSTEM_PACKAGES} ${KUBERNETES_DEPENDENCIES}
 
 bb-rp-install "jq:{{ .images.registrypackages.jq16 }}" "curl:{{ .images.registrypackages.d8Curl7800 }}"
+
+# containerd 1.6.7 requires libseccomp version >= 2.5.0
+libseccomp_version="$(dpkg-query --show --showformat '${Version}' libseccomp2)"
+if dpkg --compare-versions ${libseccomp_version} lt 2.5; then
+  bb-apt-install --force libseccomp2
+fi

candi/bashible/bundles/debian/node-group/031_install_containerd.sh.tpl

@@ -1,4 +1,4 @@
-# Copyright 2021 Flant JSC
+# Copyright 2022 Flant JSC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -91,19 +91,4 @@ containerd_tag="{{- index $.images.registrypackages (printf "containerdDebian%sB
 
   bb-rp-install "containerd-io:${containerd_tag}" "crictl:${crictl_tag}"
 fi
-
-# Upgrade containerd-flant-edition if needed
-containerd_fe_tag="{{ index .images.registrypackages "containerdFe1511" | toString }}"
-if ! bb-rp-is-installed? "containerd-flant-edition" "${containerd_fe_tag}" ; then
-  systemctl stop containerd.service
-  bb-rp-install "containerd-flant-edition:${containerd_fe_tag}"
-
-  mkdir -p /etc/systemd/system/containerd.service.d
-  bb-sync-file /etc/systemd/system/containerd.service.d/override.conf - << EOF
-[Service]
-ExecStart=
-ExecStart=-/usr/local/bin/containerd
-EOF
-fi
-
 {{- end }}

candi/bashible/bundles/ubuntu-lts/all/001_install_mandatory_packages.sh.tpl

@@ -11,10 +11,16 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
-SYSTEM_PACKAGES="curl wget virt-what inotify-tools bash-completion lvm2 parted apt-transport-https sudo nfs-common"
+# libseccomp - containerd.io dependencies
+SYSTEM_PACKAGES="curl wget virt-what inotify-tools bash-completion lvm2 parted apt-transport-https sudo nfs-common libseccomp2"
 KUBERNETES_DEPENDENCIES="iptables iproute2 socat util-linux mount ebtables ethtool conntrack"
 
 bb-apt-install ${SYSTEM_PACKAGES} ${KUBERNETES_DEPENDENCIES}
 
 bb-rp-install "jq:{{ .images.registrypackages.jq16 }}" "curl:{{ .images.registrypackages.d8Curl7800 }}"
+
+# containerd 1.6.7 requires libseccomp version >= 2.5.0
+libseccomp_version="$(dpkg-query --show --showformat '${Version}' libseccomp2)"
+if dpkg --compare-versions ${libseccomp_version} lt 2.5; then
+  bb-apt-install --force libseccomp2
+fi

candi/bashible/bundles/ubuntu-lts/node-group/031_install_containerd.sh.tpl

@@ -1,4 +1,4 @@
-# Copyright 2021 Flant JSC
+# Copyright 2022 Flant JSC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -85,19 +85,4 @@ if [[ "$should_install_containerd" == true ]]; then
 
   bb-rp-install "containerd-io:${containerd_tag}" "crictl:${crictl_tag}"
 fi
-
-# Upgrade containerd-flant-edition if needed
-containerd_fe_tag="{{ index .images.registrypackages "containerdFe1511" | toString }}"
-if ! bb-rp-is-installed? "containerd-flant-edition" "${containerd_fe_tag}" ; then
-  systemctl stop containerd.service
-  bb-rp-install "containerd-flant-edition:${containerd_fe_tag}"
-
-  mkdir -p /etc/systemd/system/containerd.service.d
-  bb-sync-file /etc/systemd/system/containerd.service.d/override.conf - << EOF
-[Service]
-ExecStart=
-ExecStart=-/usr/local/bin/containerd
-EOF
-fi
-
 {{- end }}

modules/007-registrypackages/images/containerd-fe/scripts/install → candi/bashible/common-steps/node-group/032_remove_containerd_fe.sh.tpl

@@ -1,4 +1,3 @@
-#!/bin/bash
 # Copyright 2021 Flant JSC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,5 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-set -Eeo pipefail
-cp containerd /usr/local/bin
+# TODO remove on next release !!!
+
+{{- if eq .cri "Containerd" }}
+if [[ -f /etc/systemd/system/containerd.service.d/override.conf ]]; then
+  rm -rf /usr/local/bin/containerd ${BB_RP_INSTALLED_PACKAGES_STORE}/containerd-fe ${BB_RP_INSTALLED_PACKAGES_STORE}/containerd-flant-edition /etc/systemd/system/containerd.service.d
+  systemctl daemon-reload
+  systemctl restart containerd.service
+fi
+{{- end }}

candi/version_map.yml

@@ -22,8 +22,8 @@ bashible: &bashible
           desiredVersion: "containerd.io=1.4.6-1"
           allowedPattern: "containerd.io=1.[234]"
       containerd:
-        desiredVersion: "containerd.io=1.5.11-1"
-        allowedPattern: "containerd.io=1.[56]"
+        desiredVersion: "containerd.io=1.6.7-1"
+        allowedPattern: "containerd.io=1.[6]"
       kernel:
         generic:
           desiredVersion: "5.3.0-51-generic"
@@ -45,8 +45,8 @@ bashible: &bashible
           desiredVersion: "containerd.io=1.4.6-1"
           allowedPattern: "containerd.io=1.[234]"
       containerd:
-        desiredVersion: "containerd.io=1.5.11-1"
-        allowedPattern: "containerd.io=1.[56]"
+        desiredVersion: "containerd.io=1.6.7-1"
+        allowedPattern: "containerd.io=1.[6]"
       kernel:
         generic:
           desiredVersion: "5.4.0-54-generic"
@@ -65,11 +65,11 @@ bashible: &bashible
         desiredVersion: "docker-ce=5:20.10.14~3-0~ubuntu-jammy"
         allowedPattern: ""
         containerd:
-          desiredVersion: "containerd.io=1.5.11-1"
+          desiredVersion: "containerd.io=1.6.7-1"
           allowedPattern: "containerd.io=1.[56]"
       containerd:
-        desiredVersion: "containerd.io=1.5.11-1"
-        allowedPattern: "containerd.io=1.[56]"
+        desiredVersion: "containerd.io=1.6.7-1"
+        allowedPattern: "containerd.io=1.[6]"
       kernel:
         generic:
           desiredVersion: "5.15.0-27-generic"
@@ -106,8 +106,8 @@ bashible: &bashible
           desiredVersion: "containerd.io=1.4.6-1"
           allowedPattern: "containerd.io=1.[234]"
       containerd:
-        desiredVersion: "containerd.io=1.5.11-1"
-        allowedPattern: "containerd.io=1.[56]"
+        desiredVersion: "containerd.io=1.6.7-1"
+        allowedPattern: "containerd.io=1.[6]"
       kernel:
         generic:
           desiredVersion: "4.19.0-18-amd64"
@@ -120,8 +120,8 @@ bashible: &bashible
           desiredVersion: "containerd.io=1.4.6-1"
           allowedPattern: "containerd.io=1.[234]"
       containerd:
-        desiredVersion: "containerd.io=1.5.11-1"
-        allowedPattern: "containerd.io=1.[56]"
+        desiredVersion: "containerd.io=1.6.7-1"
+        allowedPattern: "containerd.io=1.[6]"
       kernel:
         generic:
           desiredVersion: "5.10.0-10-amd64"
@@ -135,8 +135,8 @@ bashible: &bashible
           desiredVersion: "containerd.io-1.4.6-3.1.el7.x86_64"
           allowedPattern: "containerd.io-1.[1234]"
       containerd:
-        desiredVersion: "containerd.io-1.5.11-3.1.el7.x86_64"
-        allowedPattern: "containerd.io-1.[56]"
+        desiredVersion: "containerd.io-1.6.7-3.1.el7.x86_64"
+        allowedPattern: "containerd.io-1.[6]"
       kernel:
         generic:
           desiredVersion: "3.10.0-1127.el7.x86_64"
@@ -149,8 +149,8 @@ bashible: &bashible
           desiredVersion: "containerd.io-1.4.6-3.1.el8.x86_64"
           allowedPattern: "containerd.io-1.[1234]"
       containerd:
-        desiredVersion: "containerd.io-1.5.11-3.1.el8.x86_64"
-        allowedPattern: "containerd.io-1.[56]"
+        desiredVersion: "containerd.io-1.6.7-3.1.el8.x86_64"
+        allowedPattern: "containerd.io-1.[6]"
       kernel:
         generic:
           desiredVersion: "4.18.0-305.3.1.el8.x86_64"
@@ -172,8 +172,8 @@ k8s:
               desiredVersion: "containerd.io=1.4.6-1"
               allowedPattern: "containerd.io=1.[234]"
           containerd:
-            desiredVersion: "containerd.io=1.5.11-1"
-            allowedPattern: "containerd.io=1.[56]"
+            desiredVersion: "containerd.io=1.6.7-1"
+            allowedPattern: "containerd.io=1.[6]"
           kernel:
             generic:
               desiredVersion: "5.3.0-51-generic"