diff options
author | Sascha Grunert <sgrunert@suse.com> | 2019-09-21 16:18:42 +0200 |
---|---|---|
committer | zimbatm <zimbatm@zimbatm.com> | 2019-09-21 14:18:42 +0000 |
commit | 2c3dcbb9d09a9757c26a1bc34ba5b8f263a7e554 (patch) | |
tree | 6418459652ab4d3fa3e684bd5a9b6d33609bc1de /nixos/modules/virtualisation | |
parent | a1f6032ea1f6f7a168a5a0713f49ab3ff20333dc (diff) |
Add cri-o service to modules (#68153)
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
Diffstat (limited to 'nixos/modules/virtualisation')
-rw-r--r-- | nixos/modules/virtualisation/cri-o.nix | 106 |
1 files changed, 106 insertions, 0 deletions
diff --git a/nixos/modules/virtualisation/cri-o.nix b/nixos/modules/virtualisation/cri-o.nix new file mode 100644 index 0000000000000..14a435f6c8bb9 --- /dev/null +++ b/nixos/modules/virtualisation/cri-o.nix @@ -0,0 +1,106 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.virtualisation.cri-o; +in +{ + options.virtualisation.cri-o = { + enable = mkEnableOption "Container Runtime Interface for OCI (CRI-O)"; + + storageDriver = mkOption { + type = types.enum ["btrfs" "overlay" "vfs"]; + default = "overlay"; + description = "Storage driver to be used"; + }; + + logLevel = mkOption { + type = types.enum ["trace" "debug" "info" "warn" "error" "fatal"]; + default = "info"; + description = "Log level to be used"; + }; + + pauseImage = mkOption { + type = types.str; + default = "k8s.gcr.io/pause:3.1"; + description = "Pause image for pod sandboxes to be used"; + }; + + pauseCommand = mkOption { + type = types.str; + default = "/pause"; + description = "Pause command to be executed"; + }; + + registries = mkOption { + type = types.listOf types.str; + default = [ "docker.io" "quay.io" ]; + description = "Registries to be configured for unqualified image pull"; + }; + }; + + config = mkIf cfg.enable { + environment.systemPackages = with pkgs; + [ cri-o cri-tools conmon cni-plugins iptables runc utillinux ]; + environment.etc."crictl.yaml".text = '' + runtime-endpoint: unix:///var/run/crio/crio.sock + ''; + environment.etc."crio/crio.conf".text = '' + [crio] + storage_driver = "${cfg.storageDriver}" + + [crio.image] + pause_image = "${cfg.pauseImage}" + pause_command = "${cfg.pauseCommand}" + registries = [ + ${concatMapStringsSep ", " (x: "\"" + x + "\"") cfg.registries} + ] + + [crio.runtime] + conmon = "${pkgs.conmon}/bin/conmon" + log_level = "${cfg.logLevel}" + manage_network_ns_lifecycle = true + ''; + environment.etc."containers/policy.json".text = '' + {"default": [{"type": "insecureAcceptAnything"}]} + ''; + environment.etc."cni/net.d/20-cri-o-bridge.conf".text = '' + { + "cniVersion": "0.3.1", + "name": "crio-bridge", + "type": "bridge", + "bridge": "cni0", + "isGateway": true, + "ipMasq": true, + "ipam": { + "type": "host-local", + "subnet": "10.88.0.0/16", + "routes": [ + { "dst": "0.0.0.0/0" } + ] + } + } + ''; + + systemd.services.crio = { + description = "Container Runtime Interface for OCI (CRI-O)"; + documentation = [ "https://github.com/cri-o/cri-o" ]; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + path = [ pkgs.utillinux pkgs.runc pkgs.iptables ]; + serviceConfig = { + Type = "notify"; + ExecStart = "${pkgs.cri-o}/bin/crio"; + ExecReload = "/bin/kill -s HUP $MAINPID"; + TasksMax = "infinity"; + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; + LimitCORE = "infinity"; + OOMScoreAdjust = "-999"; + TimeoutStartSec = "0"; + Restart = "on-abnormal"; + }; + }; + }; +} |