feat(containerd): Support containerd 2.0

images/capi/ansible/roles/containerd/tasks/main.yml

@@ -30,6 +30,19 @@
     dest: /tmp/containerd.tar.gz
     mode: "0600"
 
+- name: Download containerd.service
+  ansible.builtin.get_url:
+    url: "{{ containerd_service_url }}"
+    dest: /tmp/containerd.service
+    mode: "0600"
+
+- name: Download runc
+  ansible.builtin.get_url:
+    url: "{{ runc_url }}"
+    checksum: sha256:{{ runc_sha256 }}
+    dest: /tmp/runc
+    mode: "0600"
+
 - name: Download containerd-wasm-shims
   vars:
     sha256sums: "{{ containerd_wasm_shims_sha256 | from_json }}"
@@ -54,11 +67,26 @@
   ansible.builtin.unarchive:
     remote_src: true
     src: /tmp/containerd.tar.gz
-    dest: "{{ containerd_prefix | default('/') }}"
+    dest: "{{ containerd_prefix | default('/usr/local') }}"
     extra_opts:
       - --no-overwrite-dir
   when: ansible_os_family != "Flatcar"
 
+- name: Copy containerd.service to /etc/systemd/system
+  ansible.builtin.copy:
+    remote_src: true
+    src: /tmp/containerd.service
+    dest: /etc/systemd/system/containerd.service
+    mode: "0600"
+
+- name: Copy runc to /usr/local/sbin
+  ansible.builtin.copy:
+    remote_src: true
+    src: /tmp/runc
+    dest: /usr/local/sbin/runc
+    mode: "0755"
+  when: ansible_os_family != "Flatcar"
+
 # Install containerd Wasm shims specified in a comma-separated string. Known runtimes are 'lunatic', 'slight', 'spin', and 'wws'.
 - name: Unpack containerd-wasm-shims
   ansible.builtin.unarchive:
@@ -74,15 +102,15 @@
   ansible.builtin.unarchive:
     remote_src: true
     src: /tmp/containerd.tar.gz
-    dest: "{{ containerd_prefix | default('/') }}"
-    extra_opts:
-      - --absolute-names
-      - --transform
-      - s@usr@opt@
-      - --transform
-      - s@sbin@bin@
-      - --transform
-      - s@opt/local@opt@
+    dest: "{{ containerd_prefix | default('/opt') }}"
+  when: ansible_os_family == "Flatcar"
+
+- name: Copy runc to /opt/bin
+  ansible.builtin.copy:
+    remote_src: true
+    src: /tmp/runc
+    dest: /opt/bin/runc
+    mode: "0755"
   when: ansible_os_family == "Flatcar"
 
 # Install containerd Wasm shims specified in a comma-separated string. Known runtimes are 'lunatic', 'slight', 'spin', and 'wws'.
@@ -96,18 +124,6 @@
   when: ansible_os_family == "Flatcar" and (containerd_wasm_shims_runtimes | length > 0)
   loop: "{{ containerd_wasm_shims_runtimes | split(',') }}"
 
-# Remove /opt/cni directory, as we will install cni later
-- name: Delete /opt/cni directory
-  ansible.builtin.file:
-    path: /opt/cni
-    state: absent
-
-# Remove /etc/cni directory, as we will configure cni later
-- name: Delete /etc/cni directory
-  ansible.builtin.file:
-    path: /etc/cni
-    state: absent
-
 - name: Create unit file directory
   ansible.builtin.file:
     path: /etc/systemd/system/containerd.service.d
@@ -181,6 +197,16 @@
     path: /tmp/containerd.tar.gz
     state: absent
 
+- name: Delete runc bin
+  ansible.builtin.file:
+    path: /tmp/runc
+    state: absent
+
+- name: Delete containerd.service
+  ansible.builtin.file:
+    path: /tmp/containerd.service
+    state: absent
+
 - name: Delete containerd-wasm-shims tarballs
   ansible.builtin.file:
     path: /tmp/{{ item }}_wasm_shims.tar.gz

images/capi/ansible/roles/kubernetes/tasks/main.yml

@@ -24,6 +24,13 @@
 - ansible.builtin.import_tasks: photon.yml
   when: kubernetes_source_type == "pkg" and ansible_os_family == "VMware Photon OS"
 
+- ansible.builtin.import_tasks: url.yml
+  when: kubernetes_source_type == "http" and kubernetes_cni_source_type == "http"
+
+# must include crictl-url.yml after installing containerd,
+# as the cri-containerd tarball also includes crictl.
+- ansible.builtin.import_tasks: crictl-url.yml
+
 - name: Symlink cri-tools
   ansible.builtin.file:
     src: /usr/local/bin/{{ item }}
@@ -37,14 +44,6 @@
     - critest
   when: ansible_os_family != "Flatcar"
 
-- ansible.builtin.import_tasks: url.yml
-  when: kubernetes_source_type == "http" and kubernetes_cni_source_type == "http"
-
-# must include crictl-url.yml after installing containerd,
-# as the cri-containerd tarball also includes crictl.
-- ansible.builtin.import_tasks: crictl-url.yml
-  when: crictl_source_type == "http"
-
 - name: Create kubelet default config file
   ansible.builtin.template:
     src: etc/sysconfig/kubelet

images/capi/packer/ami/packer.json

@@ -160,8 +160,9 @@
     "builder_instance_type": "t3.small",
     "containerd_gvisor_runtime": "false",
     "containerd_gvisor_version": "latest",
+    "containerd_service_url": "https://raw.githubusercontent.com/containerd/containerd/main/containerd.service",
     "containerd_sha256": null,
-    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/cri-containerd-cni-{{user `containerd_version`}}-linux-amd64.tar.gz",
+    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/containerd-{{user `containerd_version`}}-linux-amd64.tar.gz",
     "containerd_version": null,
     "crictl_url": "https://github.com/kubernetes-sigs/cri-tools/releases/download/v{{user `crictl_version`}}/crictl-v{{user `crictl_version`}}-linux-amd64.tar.gz",
     "crictl_version": null,
@@ -192,6 +193,9 @@
     "kubernetes_source_type": null,
     "manifest_output": "manifest.json",
     "python_path": "",
+    "runc_sha256": null,
+    "runc_url": "https://github.com/opencontainers/runc/releases/download/v{{user `runc_version`}}/runc.amd64",
+    "runc_version": null,
     "skip_create_ami": "false",
     "skip_profile_validation": "false",
     "snapshot_groups": "all",

images/capi/packer/azure/packer.json

@@ -219,8 +219,9 @@
     "community_gallery_image_id": "",
     "containerd_gvisor_runtime": "false",
     "containerd_gvisor_version": "latest",
+    "containerd_service_url": "https://raw.githubusercontent.com/containerd/containerd/main/containerd.service",
     "containerd_sha256": null,
-    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/cri-containerd-cni-{{user `containerd_version`}}-linux-amd64.tar.gz",
+    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/containerd-{{user `containerd_version`}}-linux-amd64.tar.gz",
     "containerd_version": null,
     "containerd_wasm_shims_runtimes": null,
     "crictl_url": "https://github.com/kubernetes-sigs/cri-tools/releases/download/v{{user `crictl_version`}}/crictl-v{{user `crictl_version`}}-linux-amd64.tar.gz",
@@ -264,6 +265,9 @@
     "plan_image_sku": "",
     "private_virtual_network_with_public_ip": "",
     "provisioner_remote_folder": "/tmp",
+    "runc_sha256": null,
+    "runc_url": "https://github.com/opencontainers/runc/releases/download/v{{user `runc_version`}}/runc.amd64",
+    "runc_version": null,
     "source_sig_image_name": "",
     "source_sig_image_version": "",
     "source_sig_name": "",

images/capi/packer/config/ansible-args.json

@@ -1,5 +1,5 @@
 {
   "ansible_common_ssh_args": "-o IdentitiesOnly=yes",
-  "ansible_common_vars": "containerd_url={{user `containerd_url`}} containerd_sha256={{user `containerd_sha256`}} pause_image={{user `pause_image`}} containerd_additional_settings={{user `containerd_additional_settings`}} containerd_cri_socket={{user `containerd_cri_socket`}} containerd_version={{user `containerd_version`}} containerd_wasm_shims_url={{user `containerd_wasm_shims_url`}} containerd_wasm_shims_version={{user `containerd_wasm_shims_version`}} containerd_wasm_shims_sha256={{user `containerd_wasm_shims_sha256`}} containerd_wasm_shims_runtimes=\"{{user `containerd_wasm_shims_runtimes`}}\" containerd_wasm_shims_runtime_versions=\"{{user `containerd_wasm_shims_runtime_versions`}}\" crictl_url={{user `crictl_url`}} crictl_sha256={{user `crictl_sha256`}} crictl_source_type={{user `crictl_source_type`}} custom_role_names=\"{{user `custom_role_names`}}\" firstboot_custom_roles_pre=\"{{user `firstboot_custom_roles_pre`}}\" firstboot_custom_roles_post=\"{{user `firstboot_custom_roles_post`}}\" node_custom_roles_pre=\"{{user `node_custom_roles_pre`}}\" node_custom_roles_post=\"{{user `node_custom_roles_post`}}\" disable_public_repos={{user `disable_public_repos`}} extra_debs=\"{{user `extra_debs`}}\" extra_repos=\"{{user `extra_repos`}}\" extra_rpms=\"{{user `extra_rpms`}}\" http_proxy={{user `http_proxy`}} https_proxy={{user `https_proxy`}} kubeadm_template={{user `kubeadm_template`}} kubernetes_apiserver_port={{user `kubernetes_apiserver_port`}} kubernetes_cni_http_source={{user `kubernetes_cni_http_source`}} kubernetes_cni_http_checksum={{user `kubernetes_cni_http_checksum`}} kubernetes_goarch={{user `kubernetes_goarch`}} kubernetes_http_source={{user `kubernetes_http_source`}} kubernetes_container_registry={{user `kubernetes_container_registry`}} kubernetes_rpm_repo={{user `kubernetes_rpm_repo`}} kubernetes_rpm_gpg_key={{user `kubernetes_rpm_gpg_key`}} kubernetes_rpm_gpg_check={{user `kubernetes_rpm_gpg_check`}} kubernetes_deb_repo={{user `kubernetes_deb_repo`}} kubernetes_deb_gpg_key={{user `kubernetes_deb_gpg_key`}} kubernetes_cni_deb_version={{user `kubernetes_cni_deb_version`}} kubernetes_cni_rpm_version={{user `kubernetes_cni_rpm_version`}} kubernetes_cni_semver={{user `kubernetes_cni_semver`}} kubernetes_cni_source_type={{user `kubernetes_cni_source_type`}} kubernetes_semver={{user `kubernetes_semver`}} kubernetes_source_type={{user `kubernetes_source_type`}} kubernetes_load_additional_imgs={{user `kubernetes_load_additional_imgs`}} kubernetes_deb_version={{user `kubernetes_deb_version`}} kubernetes_rpm_version={{user `kubernetes_rpm_version`}} no_proxy={{user `no_proxy`}} pip_conf_file={{user `pip_conf_file`}} python_path={{user `python_path`}} redhat_epel_rpm={{user `redhat_epel_rpm`}} epel_rpm_gpg_key={{user `epel_rpm_gpg_key`}} reenable_public_repos={{user `reenable_public_repos`}} remove_extra_repos={{user `remove_extra_repos`}} systemd_prefix={{user `systemd_prefix`}} sysusr_prefix={{user `sysusr_prefix`}} sysusrlocal_prefix={{user `sysusrlocal_prefix`}} load_additional_components={{ user `load_additional_components`}} additional_registry_images={{ user `additional_registry_images`}} additional_registry_images_list={{ user `additional_registry_images_list`}} ecr_credential_provider={{ user `ecr_credential_provider` }} additional_url_images={{ user `additional_url_images`}} additional_url_images_list={{ user `additional_url_images_list`}} additional_executables={{ user `additional_executables`}} additional_executables_list={{ user `additional_executables_list`}} additional_executables_destination_path={{ user `additional_executables_destination_path`}} additional_s3={{ user `additional_s3`}} build_target={{ user `build_target`}} amazon_ssm_agent_rpm={{ user `amazon_ssm_agent_rpm` }} enable_containerd_audit={{ user `enable_containerd_audit` }} kubernetes_enable_automatic_resource_sizing={{ user `kubernetes_enable_automatic_resource_sizing` }} debug_tools={{user `debug_tools`}} ubuntu_repo={{user `ubuntu_repo`}} ubuntu_security_repo={{user `ubuntu_security_repo`}} gpu_block_nouveau_loading={{user `block_nouveau_loading`}}",
+  "ansible_common_vars": "containerd_url={{user `containerd_url`}} containerd_sha256={{user `containerd_sha256`}} pause_image={{user `pause_image`}} containerd_additional_settings={{user `containerd_additional_settings`}} containerd_cri_socket={{user `containerd_cri_socket`}} containerd_version={{user `containerd_version`}} containerd_wasm_shims_url={{user `containerd_wasm_shims_url`}} containerd_wasm_shims_version={{user `containerd_wasm_shims_version`}} containerd_wasm_shims_sha256={{user `containerd_wasm_shims_sha256`}} containerd_wasm_shims_runtimes=\"{{user `containerd_wasm_shims_runtimes`}}\" containerd_wasm_shims_runtime_versions=\"{{user `containerd_wasm_shims_runtime_versions`}}\" crictl_url={{user `crictl_url`}} crictl_sha256={{user `crictl_sha256`}} crictl_source_type={{user `crictl_source_type`}} custom_role_names=\"{{user `custom_role_names`}}\" firstboot_custom_roles_pre=\"{{user `firstboot_custom_roles_pre`}}\" firstboot_custom_roles_post=\"{{user `firstboot_custom_roles_post`}}\" node_custom_roles_pre=\"{{user `node_custom_roles_pre`}}\" node_custom_roles_post=\"{{user `node_custom_roles_post`}}\" disable_public_repos={{user `disable_public_repos`}} extra_debs=\"{{user `extra_debs`}}\" extra_repos=\"{{user `extra_repos`}}\" extra_rpms=\"{{user `extra_rpms`}}\" http_proxy={{user `http_proxy`}} https_proxy={{user `https_proxy`}} kubeadm_template={{user `kubeadm_template`}} kubernetes_apiserver_port={{user `kubernetes_apiserver_port`}} kubernetes_cni_http_source={{user `kubernetes_cni_http_source`}} kubernetes_cni_http_checksum={{user `kubernetes_cni_http_checksum`}} kubernetes_goarch={{user `kubernetes_goarch`}} kubernetes_http_source={{user `kubernetes_http_source`}} kubernetes_container_registry={{user `kubernetes_container_registry`}} kubernetes_rpm_repo={{user `kubernetes_rpm_repo`}} kubernetes_rpm_gpg_key={{user `kubernetes_rpm_gpg_key`}} kubernetes_rpm_gpg_check={{user `kubernetes_rpm_gpg_check`}} kubernetes_deb_repo={{user `kubernetes_deb_repo`}} kubernetes_deb_gpg_key={{user `kubernetes_deb_gpg_key`}} kubernetes_cni_deb_version={{user `kubernetes_cni_deb_version`}} kubernetes_cni_rpm_version={{user `kubernetes_cni_rpm_version`}} kubernetes_cni_semver={{user `kubernetes_cni_semver`}} kubernetes_cni_source_type={{user `kubernetes_cni_source_type`}} kubernetes_semver={{user `kubernetes_semver`}} kubernetes_source_type={{user `kubernetes_source_type`}} kubernetes_load_additional_imgs={{user `kubernetes_load_additional_imgs`}} kubernetes_deb_version={{user `kubernetes_deb_version`}} kubernetes_rpm_version={{user `kubernetes_rpm_version`}} no_proxy={{user `no_proxy`}} pip_conf_file={{user `pip_conf_file`}} python_path={{user `python_path`}} redhat_epel_rpm={{user `redhat_epel_rpm`}} epel_rpm_gpg_key={{user `epel_rpm_gpg_key`}} reenable_public_repos={{user `reenable_public_repos`}} remove_extra_repos={{user `remove_extra_repos`}} systemd_prefix={{user `systemd_prefix`}} sysusr_prefix={{user `sysusr_prefix`}} sysusrlocal_prefix={{user `sysusrlocal_prefix`}} load_additional_components={{ user `load_additional_components`}} additional_registry_images={{ user `additional_registry_images`}} additional_registry_images_list={{ user `additional_registry_images_list`}} ecr_credential_provider={{ user `ecr_credential_provider` }} additional_url_images={{ user `additional_url_images`}} additional_url_images_list={{ user `additional_url_images_list`}} additional_executables={{ user `additional_executables`}} additional_executables_list={{ user `additional_executables_list`}} additional_executables_destination_path={{ user `additional_executables_destination_path`}} additional_s3={{ user `additional_s3`}} build_target={{ user `build_target`}} amazon_ssm_agent_rpm={{ user `amazon_ssm_agent_rpm` }} enable_containerd_audit={{ user `enable_containerd_audit` }} kubernetes_enable_automatic_resource_sizing={{ user `kubernetes_enable_automatic_resource_sizing` }} debug_tools={{user `debug_tools`}} ubuntu_repo={{user `ubuntu_repo`}} ubuntu_security_repo={{user `ubuntu_security_repo`}} gpu_block_nouveau_loading={{user `block_nouveau_loading`}} runc_sha256={{user `runc_sha256`}} runc_url={{user `runc_url`}} runc_version={{user `runc_version`}} containerd_service_url={{user `containerd_service_url`}}",
   "ansible_scp_extra_args": "{{env `ANSIBLE_SCP_EXTRA_ARGS`}}"
 }

images/capi/packer/config/containerd.json

@@ -3,7 +3,9 @@
   "containerd_cri_socket": "/var/run/containerd/containerd.sock",
   "containerd_gvisor_runtime": "false",
   "containerd_gvisor_version": "latest",
-  "containerd_sha256": "041fa3cfd4e6689d37516e4c7752741df0974e7985d97258c1009b20f25f33c7",
+  "containerd_sha256": "e09410787b6f392748959177a84e024424f75d7aff33ea1c5b783f2260edce67",
   "containerd_sha256_windows": "a51c9a7d625b393023e587fd76cec01d9025af23677c734bfca04506d06b0ac3",
-  "containerd_version": "1.7.20"
+  "containerd_version": "1.7.20",
+  "runc_sha256": "e6e8c8049b1910fce58fa68c057aaa5f42cee2a73834df5e59e5da7612d2739d",
+  "runc_version": "1.2.3"
 }

images/capi/packer/digitalocean/packer.json

@@ -56,8 +56,9 @@
     "build_timestamp": "{{timestamp}}",
     "containerd_gvisor_runtime": "false",
     "containerd_gvisor_version": "latest",
+    "containerd_service_url": "https://raw.githubusercontent.com/containerd/containerd/main/containerd.service",
     "containerd_sha256": null,
-    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/cri-containerd-cni-{{user `containerd_version`}}-linux-amd64.tar.gz",
+    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/containerd-{{user `containerd_version`}}-linux-amd64.tar.gz",
     "containerd_version": null,
     "crictl_url": "https://github.com/kubernetes-sigs/cri-tools/releases/download/v{{user `crictl_version`}}/crictl-v{{user `crictl_version`}}-linux-amd64.tar.gz",
     "crictl_version": null,
@@ -81,6 +82,9 @@
     "kubernetes_series": null,
     "kubernetes_source_type": null,
     "region": "nyc1",
+    "runc_sha256": null,
+    "runc_url": "https://github.com/opencontainers/runc/releases/download/v{{user `runc_version`}}/runc.amd64",
+    "runc_version": null,
     "size": "s-1vcpu-1gb"
   }
 }

images/capi/packer/gce/packer.json

@@ -84,8 +84,9 @@
     "build_timestamp": "{{timestamp}}",
     "containerd_gvisor_runtime": "false",
     "containerd_gvisor_version": "latest",
+    "containerd_service_url": "https://raw.githubusercontent.com/containerd/containerd/main/containerd.service",
     "containerd_sha256": null,
-    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/cri-containerd-cni-{{user `containerd_version`}}-linux-amd64.tar.gz",
+    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/containerd-{{user `containerd_version`}}-linux-amd64.tar.gz",
     "containerd_version": null,
     "crictl_url": "https://github.com/kubernetes-sigs/cri-tools/releases/download/v{{user `crictl_version`}}/crictl-v{{user `crictl_version`}}-linux-amd64.tar.gz",
     "crictl_version": null,
@@ -116,6 +117,9 @@
     "kubernetes_source_type": null,
     "machine_type": "n1-standard-1",
     "project_id": "{{env `GCP_PROJECT_ID`}}",
+    "runc_sha256": null,
+    "runc_url": "https://github.com/opencontainers/runc/releases/download/v{{user `runc_version`}}/runc.amd64",
+    "runc_version": null,
     "service_account_email": "",
     "source_image_family": "{{user `source_image_family`}}",
     "use_internal_ip": "false",

images/capi/packer/hcloud/packer.json

@@ -125,8 +125,9 @@
     "build_timestamp": "{{timestamp}}",
     "containerd_gvisor_runtime": "false",
     "containerd_gvisor_version": "latest",
+    "containerd_service_url": "https://raw.githubusercontent.com/containerd/containerd/main/containerd.service",
     "containerd_sha256": null,
-    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/cri-containerd-cni-{{user `containerd_version`}}-linux-amd64.tar.gz",
+    "containerd_url": "https://github.com/containerd/containerd/releases/download/v{{user `containerd_version`}}/containerd-{{user `containerd_version`}}-linux-amd64.tar.gz",
     "containerd_version": null,
     "containerd_wasm_shims_runtimes": null,
     "crictl_url": "https://github.com/kubernetes-sigs/cri-tools/releases/download/v{{user `crictl_version`}}/crictl-v{{user `crictl_version`}}-linux-amd64.tar.gz",
@@ -156,6 +157,9 @@
     "kubernetes_semver": null,
     "kubernetes_series": null,
     "kubernetes_source_type": null,
-    "manifest_output": "manifest.json"
+    "manifest_output": "manifest.json",
+    "runc_sha256": null,
+    "runc_url": "https://github.com/opencontainers/runc/releases/download/v{{user `runc_version`}}/runc.amd64",
+    "runc_version": null
   }
 }