Added support for private apis
This commit is contained in:
@@ -0,0 +1,241 @@
|
||||
- name: Check if required vars are set
|
||||
ansible.builtin.fail:
|
||||
msg: "Required variables are not set for Podman setup. Please check your playbook variables.)"
|
||||
when:
|
||||
- podman_user is not defined
|
||||
- podman_group is not defined
|
||||
- podman_user_home is not defined
|
||||
|
||||
- name: Set fact podman_binary (Debian family)
|
||||
when: ansible_os_family == 'Debian'
|
||||
ansible.builtin.set_fact:
|
||||
podman_binary: /usr/bin/podman
|
||||
|
||||
- name: Set fact podman_binary (Red Hat family)
|
||||
when: ansible_os_family == 'RedHat'
|
||||
ansible.builtin.set_fact:
|
||||
podman_binary: /usr/sbin/podman
|
||||
|
||||
- name: Install Podman and its dependencies
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- podman
|
||||
- acl
|
||||
state: present
|
||||
|
||||
- name: Create group and user for AI workloads
|
||||
become: true
|
||||
ansible.builtin.group:
|
||||
name: "{{ podman_group }}"
|
||||
system: true
|
||||
|
||||
- name: Create user and group for AI containers
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ podman_user }}"
|
||||
groups: "{{ podman_group }}"
|
||||
shell: /bin/bash
|
||||
home: "{{ podman_user_home }}"
|
||||
group: "{{ podman_group }}"
|
||||
|
||||
- name: Disable password login for AI user
|
||||
ansible.builtin.command: passwd -d "{{ podman_user }}"
|
||||
become: true
|
||||
changed_when: false
|
||||
|
||||
- name: SELinux tasks (RedHat only)
|
||||
when: ansible_os_family == 'RedHat'
|
||||
become: true
|
||||
block:
|
||||
- name: Persistently set SELinux context for home directories on AI home
|
||||
community.general.sefcontext:
|
||||
target: "{{ podman_user_home }}(/.*)?"
|
||||
setype: user_home_dir_t
|
||||
state: present
|
||||
|
||||
- name: Apply SELinux context changes to AI home directories
|
||||
ansible.builtin.command: restorecon -Rv {{ podman_user_home }}
|
||||
changed_when: false
|
||||
|
||||
- name: Create user home
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ podman_user_home }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_group }}"
|
||||
mode: "0750"
|
||||
|
||||
- name: Create build folders
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ podman_user_home }}/build"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_group }}"
|
||||
mode: "0750"
|
||||
|
||||
- name: Create folders
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ podman_user_home }}/{{ item.name }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_group }}"
|
||||
mode: "0750"
|
||||
loop: "{{ pods }}"
|
||||
|
||||
- name: Enable sudo access to podman user (temporary)
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
|
||||
create: true
|
||||
mode: "0440"
|
||||
line: "{{ ansible_user_id }} ALL=({{ podman_user }}) NOPASSWD: ALL"
|
||||
validate: "visudo -cf %s"
|
||||
|
||||
- name: Enable lingering for podman user
|
||||
become: true
|
||||
ansible.builtin.command: loginctl enable-linger {{ podman_user }}
|
||||
register: linger_status
|
||||
changed_when: >-
|
||||
"'created' in linger_status.stdout or
|
||||
(linger_status.rc == 0 and not
|
||||
('linger file already exists' in linger_status.stderr or
|
||||
'linger file does not exist' in linger_status.stderr))"
|
||||
failed_when:
|
||||
- linger_status.rc != 0 and not
|
||||
('linger file already exists' in linger_status.stderr)
|
||||
|
||||
- name: Get current user's UID
|
||||
ansible.builtin.command: id -u {{ podman_user }}
|
||||
changed_when: false
|
||||
register: uid
|
||||
|
||||
- name: Get current user's GID
|
||||
ansible.builtin.command: id -g {{ podman_user }}
|
||||
changed_when: false
|
||||
register: gid
|
||||
|
||||
- name: Ensure rootless Podman works with overlay driver on Debian-family systems
|
||||
become: true
|
||||
vars:
|
||||
subuid_range: "100000:65536"
|
||||
block:
|
||||
- name: Install required packages for rootless Podman overlay support
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- uidmap
|
||||
- fuse-overlayfs
|
||||
- libslirp0
|
||||
- slirp4netns
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Ensure subuid entry exists for the user
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/subuid
|
||||
line: "{{ podman_user }}:{{ subuid_range }}"
|
||||
create: true
|
||||
state: present
|
||||
regexp: "^{{ podman_user }}:"
|
||||
mode: "0644"
|
||||
|
||||
- name: Ensure subgid entry exists for the user
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/subgid
|
||||
line: "{{ podman_user }}:{{ subuid_range }}"
|
||||
create: true
|
||||
state: present
|
||||
regexp: "^{{ podman_user }}:"
|
||||
mode: "0644"
|
||||
|
||||
- name: Ensure overlay module is loaded # noqa no-ignore-errors
|
||||
community.general.modprobe:
|
||||
name: overlay
|
||||
state: present
|
||||
|
||||
- name: Ensure overlay module loads on boot
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modules
|
||||
line: overlay
|
||||
create: true
|
||||
state: present
|
||||
mode: "0644"
|
||||
|
||||
- name: Run tasks as podman user
|
||||
become: true
|
||||
become_user: "{{ podman_user }}"
|
||||
block:
|
||||
- name: Create a custom Podman network
|
||||
when: podman_network_name is defined and podman_network_name != 'none'
|
||||
containers.podman.podman_network:
|
||||
name: "{{ podman_network_name }}"
|
||||
state: present
|
||||
|
||||
- name: Build containers images
|
||||
containers.podman.podman_image:
|
||||
name: "{{ podman_user }}/{{ item.name }}"
|
||||
path: "{{ podman_user_home }}/build"
|
||||
build:
|
||||
cache: false
|
||||
force_rm: true
|
||||
container_file: "{{ item.build.dockerfile }}"
|
||||
extra_args: "--build-arg UID={{ uid.stdout }} --build-arg GID={{ gid.stdout }} --security-opt=label=disable {{ item.build.args | default('') }}"
|
||||
tag: "latest"
|
||||
state: present
|
||||
loop: "{{ pods }}"
|
||||
when: item.build is defined
|
||||
|
||||
- name: Pull the requested images
|
||||
containers.podman.podman_image:
|
||||
name: "{{ item.repo.image }}"
|
||||
tag: "{{ item.repo.tag | default('latest') }}"
|
||||
state: present
|
||||
loop: "{{ pods }}"
|
||||
when: item.repo is defined
|
||||
|
||||
- name: Create pods
|
||||
containers.podman.podman_container:
|
||||
name: "{{ item.name }}"
|
||||
image: "{{ item.repo.image | default(podman_user + '/' + item.name) }}"
|
||||
state: started
|
||||
device: "{{ item.device | default(omit) }}"
|
||||
env: "{{ item.env | default(omit) }}"
|
||||
network: "{{ podman_network_name | default(omit) }}"
|
||||
ports: "{{ item.ports | default(omit) }}"
|
||||
volumes: "{{ item.volumes | default(omit) }}"
|
||||
cmd_args:
|
||||
- "--userns=keep-id"
|
||||
- "--security-opt=label=disable"
|
||||
loop: "{{ pods }}"
|
||||
|
||||
- name: Create systemd service file for pods
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: podman.service.j2
|
||||
dest: "/etc/systemd/system/podman-{{ item.name }}.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
loop: "{{ pods }}"
|
||||
|
||||
- name: Reload systemd daemon
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable containers at boot
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: "podman-{{ item.name }}"
|
||||
enabled: true
|
||||
state: started
|
||||
loop: "{{ pods }}"
|
||||
|
||||
- name: Remove temporary sudo access
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
|
||||
state: absent
|
||||
Reference in New Issue
Block a user