mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-06-09 18:55:20 +00:00
a2216ec05a
If the rendered config-v3.toml does not import the drop-in dir, write the full k3s ContainerdConfigTemplateV3 (with hardcoded import path) so kata-deploy can use drop-in. This allows us to test with K3s/RKE2 before my patch there gets released. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
125 lines
4.2 KiB
Cheetah
125 lines
4.2 KiB
Cheetah
# Copyright (c) K3s contributors
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
|
|
{{- /* */ -}}
|
|
# File generated by {{ .Program }}. DO NOT EDIT. Use config-v3.toml.tmpl instead.
|
|
version = 3
|
|
imports = ["__CONTAINERD_IMPORTS_PATH__"]
|
|
root = {{ printf "%q" .NodeConfig.Containerd.Root }}
|
|
state = {{ printf "%q" .NodeConfig.Containerd.State }}
|
|
|
|
[grpc]
|
|
address = {{ deschemify .NodeConfig.Containerd.Address | printf "%q" }}
|
|
|
|
[plugins.'io.containerd.internal.v1.opt']
|
|
path = {{ printf "%q" .NodeConfig.Containerd.Opt }}
|
|
|
|
[plugins.'io.containerd.grpc.v1.cri']
|
|
stream_server_address = "127.0.0.1"
|
|
stream_server_port = "10010"
|
|
|
|
[plugins.'io.containerd.cri.v1.runtime']
|
|
enable_selinux = {{ .NodeConfig.SELinux }}
|
|
enable_unprivileged_ports = {{ .EnableUnprivileged }}
|
|
enable_unprivileged_icmp = {{ .EnableUnprivileged }}
|
|
device_ownership_from_security_context = {{ .NonrootDevices }}
|
|
|
|
{{ if .DisableCgroup}}
|
|
disable_cgroup = true
|
|
{{ end }}
|
|
|
|
{{ if .IsRunningInUserNS }}
|
|
disable_apparmor = true
|
|
restrict_oom_score_adj = true
|
|
{{ end }}
|
|
|
|
{{ with .NodeConfig.AgentConfig.Snapshotter }}
|
|
[plugins.'io.containerd.cri.v1.images']
|
|
snapshotter = "{{ . }}"
|
|
disable_snapshot_annotations = {{ if eq . "stargz" }}false{{else}}true{{end}}
|
|
use_local_image_pull = true
|
|
{{ end }}
|
|
|
|
{{ with .NodeConfig.AgentConfig.PauseImage }}
|
|
[plugins.'io.containerd.cri.v1.images'.pinned_images]
|
|
sandbox = "{{ . }}"
|
|
{{ end }}
|
|
|
|
{{- if or .NodeConfig.AgentConfig.CNIBinDir .NodeConfig.AgentConfig.CNIConfDir }}
|
|
[plugins.'io.containerd.cri.v1.runtime'.cni]
|
|
{{ with .NodeConfig.AgentConfig.CNIBinDir }}bin_dirs = [{{ printf "%q" . }}]{{ end }}
|
|
{{ with .NodeConfig.AgentConfig.CNIConfDir }}conf_dir = {{ printf "%q" . }}{{ end }}
|
|
{{ end }}
|
|
|
|
{{ if or .NodeConfig.Containerd.BlockIOConfig .NodeConfig.Containerd.RDTConfig }}
|
|
[plugins.'io.containerd.service.v1.tasks-service']
|
|
{{ with .NodeConfig.Containerd.BlockIOConfig }}blockio_config_file = {{ printf "%q" . }}{{ end }}
|
|
{{ with .NodeConfig.Containerd.RDTConfig }}rdt_config_file = {{ printf "%q" . }}{{ end }}
|
|
{{ end }}
|
|
|
|
{{ with .NodeConfig.DefaultRuntime }}
|
|
[plugins.'io.containerd.cri.v1.runtime'.containerd]
|
|
default_runtime_name = "{{ . }}"
|
|
{{ end }}
|
|
|
|
[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
|
|
runtime_type = "io.containerd.runc.v2"
|
|
|
|
[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
|
|
SystemdCgroup = {{ .SystemdCgroup }}
|
|
|
|
[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runhcs-wcow-process]
|
|
runtime_type = "io.containerd.runhcs.v1"
|
|
|
|
{{ range $k, $v := .ExtraRuntimes }}
|
|
[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.'{{ $k }}']
|
|
runtime_type = "{{$v.RuntimeType}}"
|
|
{{ with $v.BinaryName}}
|
|
[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.'{{ $k }}'.options]
|
|
BinaryName = {{ printf "%q" . }}
|
|
SystemdCgroup = {{ $.SystemdCgroup }}
|
|
{{ end }}
|
|
{{ end }}
|
|
|
|
[plugins.'io.containerd.cri.v1.images'.registry]
|
|
config_path = {{ printf "%q" .NodeConfig.Containerd.Registry }}
|
|
|
|
{{ if .PrivateRegistryConfig }}
|
|
{{ range $k, $v := .PrivateRegistryConfig.Configs }}
|
|
{{ with $v.Auth }}
|
|
[plugins.'io.containerd.cri.v1.images'.registry.configs.'{{ $k }}'.auth]
|
|
{{ with .Username }}username = {{ printf "%q" . }}{{ end }}
|
|
{{ with .Password }}password = {{ printf "%q" . }}{{ end }}
|
|
{{ with .Auth }}auth = {{ printf "%q" . }}{{ end }}
|
|
{{ with .IdentityToken }}identitytoken = {{ printf "%q" . }}{{ end }}
|
|
{{ end }}
|
|
{{ end }}
|
|
{{ end }}
|
|
|
|
{{ if eq .NodeConfig.AgentConfig.Snapshotter "stargz" }}
|
|
{{ with .NodeConfig.AgentConfig.ImageServiceSocket }}
|
|
[plugins.'io.containerd.snapshotter.v1.stargz']
|
|
cri_keychain_image_service_path = {{ printf "%q" . }}
|
|
|
|
[plugins.'io.containerd.snapshotter.v1.stargz'.cri_keychain]
|
|
enable_keychain = true
|
|
{{ end }}
|
|
|
|
[plugins.'io.containerd.snapshotter.v1.stargz'.registry]
|
|
config_path = {{ printf "%q" .NodeConfig.Containerd.Registry }}
|
|
|
|
{{ if .PrivateRegistryConfig }}
|
|
{{ range $k, $v := .PrivateRegistryConfig.Configs }}
|
|
{{ with $v.Auth }}
|
|
[plugins.'io.containerd.snapshotter.v1.stargz'.registry.configs.'{{ $k }}'.auth]
|
|
{{ with .Username }}username = {{ printf "%q" . }}{{ end }}
|
|
{{ with .Password }}password = {{ printf "%q" . }}{{ end }}
|
|
{{ with .Auth }}auth = {{ printf "%q" . }}{{ end }}
|
|
{{ with .IdentityToken }}identitytoken = {{ printf "%q" . }}{{ end }}
|
|
{{ end }}
|
|
{{ end }}
|
|
{{ end }}
|
|
{{ end }}
|