Enable CRI runtime in devstack

Depends-On: https://review.opendev.org/#/c/709328/
Implements: blueprint add-support-cri-runtime
Change-Id: Id907628e8629d2bb8447f62e96e0018f3232e08f

.zuul.yaml

@@ -24,6 +24,7 @@
         ZUN_DRIVER: docker
         ZUN_DB_TYPE: sql
         USE_PYTHON3: true
+        ENABLE_CONTAINERD_CRI: true
       devstack_local_conf:
         test-config:
           $TEMPEST_CONFIG:
@@ -62,6 +63,7 @@
           KURYR_PROCESS_EXTERNAL_CONNECTIVITY: false
           KURYR_CONFIG_DIR: /etc/kuryr-libnetwork
           USE_PYTHON3: true
+          ENABLE_CONTAINERD_CRI: true
 
 - job:
     name: zun-tempest-py3-docker-sql

devstack/lib/zun

@@ -47,6 +47,8 @@ ZUN_CONF_DIR=/etc/zun
 ZUN_CONF=$ZUN_CONF_DIR/zun.conf
 ZUN_API_PASTE=$ZUN_CONF_DIR/api-paste.ini
 
+CNI_BIN_DIR=/opt/cni/bin
+
 if is_ssl_enabled_service "zun" || is_service_enabled tls-proxy; then
     ZUN_SERVICE_PROTOCOL="https"
 fi
@@ -75,6 +77,7 @@ ZUN_UWSGI_CONF=$ZUN_CONF_DIR/zun-api-uwsgi.ini
 
 DOCKER_REMOTE_API_PORT=2375
 ZUN_DRIVER=${ZUN_DRIVER:-docker}
+ZUN_CAPSULE_DRIVER=${ZUN_CAPSULE_DRIVER:-cri}
 ZUN_DB_TYPE=${ZUN_DB_TYPE:-sql}
 
 ZUN_ETCD_VERSION=${ZUN_ETCD_VERSION:-v3.0.13}
@@ -176,6 +179,9 @@ function create_zun_conf {
     if [[ ${ZUN_DRIVER} == "docker" ]]; then
         iniset $ZUN_CONF DEFAULT container_driver docker
     fi
+    if [[ ${ZUN_CAPSULE_DRIVER} == "cri" ]]; then
+        iniset $ZUN_CONF DEFAULT capsule_driver cri
+    fi
     iniset $ZUN_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
     if [[ $SERVICE_IP_VERSION == 6 ]]; then
         iniset $ZUN_CONF DEFAULT my_ip "$HOST_IPV6"
@@ -292,6 +298,16 @@ function install_zun {
 
     git_clone $ZUN_TEMPEST_PLUGIN_REPO $ZUN_TEMPEST_PLUGIN_DIR $ZUN_TEMPEST_PLUGIN_BRANCH
     setup_develop $ZUN_TEMPEST_PLUGIN_DIR
+
+    if [[ ${ZUN_CAPSULE_DRIVER} == "cri" ]]; then
+        install_zun_cni
+    fi
+}
+
+function install_zun_cni {
+    local zun_cni_bin=$(which zun-cni)
+    sudo install -o "$STACK_USER" -m 0555 -D \
+        "$zun_cni_bin" "${CNI_BIN_DIR}/zun-cni"
 }
 
 # start_zun_api() - Start the API process ahead of other things

devstack/local.conf.sample

@@ -8,9 +8,11 @@ ADMIN_PASSWORD=password
 enable_plugin zun https://opendev.org/openstack/zun $TARGET_BRANCH
 enable_plugin zun-tempest-plugin https://opendev.org/openstack/zun-tempest-plugin
 
-#This below plugin enables installation of container engine on Devstack.
-#The default container engine is Docker
+# This below plugin enables installation of container engine on Devstack.
+# The default container engine is Docker
 enable_plugin devstack-plugin-container https://opendev.org/openstack/devstack-plugin-container $TARGET_BRANCH
+# This enables CRI plugin for containerd
+ENABLE_CONTAINERD_CRI=True
 
 # In Kuryr, KURYR_CAPABILITY_SCOPE is `local` by default,
 # but we must change it to `global` in the multinode scenario.

devstack/local.conf.subnode.sample

@@ -5,6 +5,8 @@ RABBIT_PASSWORD=password
 SERVICE_TOKEN=password
 SERVICE_PASSWORD=password
 ADMIN_PASSWORD=password
+
+ENABLE_CONTAINERD_CRI=True
 enable_plugin devstack-plugin-container https://opendev.org/openstack/devstack-plugin-container $TARGET_BRANCH
 enable_plugin zun https://opendev.org/openstack/zun $TARGET_BRANCH
 

devstack/settings

@@ -17,6 +17,10 @@
 # Configure Docker cluster store
 DOCKER_CLUSTER_STORE=${DOCKER_CLUSTER_STORE:-etcd://$SERVICE_HOST:$ETCD_PORT}
 
+# Configure CNI plugins
+CNI_PLUGINS_INSTALL_PLUGINS=loopback,zun-cni
+CNI_PLUGINS_CONF_SOURCE_DIR=$DEST/zun/etc/cni/net.d
+
 # Enable Zun services
 if [[ ${HOST_IP} == ${SERVICE_HOST} ]] || [[ "[${HOST_IPV6}]" == "${SERVICE_HOST}" ]]; then
     enable_service zun-api

playbooks/zun-tempest-base/post.yaml

@@ -1,3 +1,4 @@
 - hosts: all
   roles:
     - fetch_docker_log
+    - fetch_containerd_log

roles/fetch_containerd_log/tasks/main.yaml

@@ -0,0 +1,11 @@
+- name: Ensure {{ ansible_user_dir }}/logs exists
+  become: True
+  file:
+    path: "{{ ansible_user_dir }}/logs"
+    state: directory
+    owner: "{{ ansible_user }}"
+- name: Copy over containerd systemd unit journals
+  shell:
+    cmd: |
+      sudo journalctl -o short-precise --unit containerd | sudo tee {{ ansible_user_dir }}/logs/containerd.txt > /dev/null
+    executable: /bin/bash