8 changed files with 1445 additions and 1 deletions
@ -0,0 +1,41 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
ask() |
||||||
|
{ |
||||||
|
argument=$* |
||||||
|
USER_ANSWER="?"; |
||||||
|
while [ "${USER_ANSWER}" != "n" ] && [ "${USER_ANSWER}" != "y" ] && [ "${USER_ANSWER}" != "q" ] |
||||||
|
do |
||||||
|
echo -ne "\E[31;40m\033[1mExecute $* ?\033[0m [y/n/q]" |
||||||
|
read -r -n 1 USER_ANSWER |
||||||
|
echo ""; |
||||||
|
done |
||||||
|
if [ "$USER_ANSWER" == "y" ] |
||||||
|
then |
||||||
|
eval "${argument}" |
||||||
|
elif [ "$USER_ANSWER" == "n" ] |
||||||
|
then |
||||||
|
echo "disabled" |
||||||
|
elif [ "$USER_ANSWER" == "q" ] |
||||||
|
then |
||||||
|
exit 0 |
||||||
|
else |
||||||
|
echo "Response error" |
||||||
|
exit 1 |
||||||
|
fi |
||||||
|
} |
||||||
|
|
||||||
|
# shellcheck source=/dev/null |
||||||
|
source ./env.sh |
||||||
|
|
||||||
|
ask systemctl --user status podman.service |
||||||
|
ask podman ps |
||||||
|
ask podman ps -a |
||||||
|
ask podman images |
||||||
|
ask podman network ls |
||||||
|
ask kind get clusters |
||||||
|
ask kubectl cluster-info --context kind-kubosm |
||||||
|
ask kubectl get namespaces |
||||||
|
ask kubectl get nodes |
||||||
|
ask kubectl get deployments |
||||||
|
ask kubectl get services |
||||||
@ -0,0 +1,937 @@ |
|||||||
|
# The containers configuration file specifies all of the available configuration |
||||||
|
# command-line options/flags for container engine tools like Podman & Buildah, |
||||||
|
# but in a TOML format that can be easily modified and versioned. |
||||||
|
|
||||||
|
# Please refer to containers.conf(5) for details of all configuration options. |
||||||
|
# Not all container engines implement all of the options. |
||||||
|
# All of the options have hard coded defaults and these options will override |
||||||
|
# the built in defaults. Users can then override these options via the command |
||||||
|
# line. Container engines will read containers.conf files in up to three |
||||||
|
# locations in the following order: |
||||||
|
# 1. /usr/share/containers/containers.conf |
||||||
|
# 2. /etc/containers/containers.conf |
||||||
|
# 3. $XDG_CONFIG_HOME/containers/containers.conf or |
||||||
|
# $HOME/.config/containers/containers.conf if $XDG_CONFIG_HOME is not set |
||||||
|
# Items specified in the latter containers.conf, if they exist, override the |
||||||
|
# previous containers.conf settings, or the default settings. |
||||||
|
|
||||||
|
[containers] |
||||||
|
|
||||||
|
# List of annotation. Specified as |
||||||
|
# "key = value" |
||||||
|
# If it is empty or commented out, no annotations will be added |
||||||
|
# |
||||||
|
#annotations = [] |
||||||
|
|
||||||
|
# Used to change the name of the default AppArmor profile of container engine. |
||||||
|
# |
||||||
|
#apparmor_profile = "container-default" |
||||||
|
|
||||||
|
# Base file to create the `/etc/hosts` file inside the container. This must either |
||||||
|
# be an absolute path to a file on the host system, or one of the following |
||||||
|
# special flags: |
||||||
|
# "" Use the host's `/etc/hosts` file (the default) |
||||||
|
# `none` Do not use a base file (i.e. start with an empty file) |
||||||
|
# `image` Use the container image's `/etc/hosts` file as base file |
||||||
|
# |
||||||
|
#base_hosts_file = "" |
||||||
|
|
||||||
|
# List of cgroup_conf entries specifying a list of cgroup files to write to and |
||||||
|
# their values. For example `memory.high=1073741824` sets the |
||||||
|
# memory.high limit to 1GB. |
||||||
|
# |
||||||
|
# cgroup_conf = [] |
||||||
|
|
||||||
|
# Default way to to create a cgroup namespace for the container |
||||||
|
# Options are: |
||||||
|
# `private` Create private Cgroup Namespace for the container. |
||||||
|
# `host` Share host Cgroup Namespace with the container. |
||||||
|
# |
||||||
|
#cgroupns = "private" |
||||||
|
|
||||||
|
# Control container cgroup configuration |
||||||
|
# Determines whether the container will create CGroups. |
||||||
|
# Options are: |
||||||
|
# `enabled` Enable cgroup support within container |
||||||
|
# `disabled` Disable cgroup support, will inherit cgroups from parent |
||||||
|
# `no-conmon` Do not create a cgroup dedicated to conmon. |
||||||
|
# |
||||||
|
#cgroups = "enabled" |
||||||
|
|
||||||
|
# When no hostname is set for a container, use the container's name, with |
||||||
|
# characters not valid for a hostname removed, as the hostname instead of |
||||||
|
# the first 12 characters of the container's ID. Containers not running |
||||||
|
# in a private UTS namespace will have their hostname set to the host's |
||||||
|
# hostname regardless of this setting. |
||||||
|
# |
||||||
|
#container_name_as_hostname = false |
||||||
|
|
||||||
|
# List of default capabilities for containers. If it is empty or commented out, |
||||||
|
# the default capabilities defined in the container engine will be added. |
||||||
|
# |
||||||
|
#default_capabilities = [ |
||||||
|
# "CHOWN", |
||||||
|
# "DAC_OVERRIDE", |
||||||
|
# "FOWNER", |
||||||
|
# "FSETID", |
||||||
|
# "KILL", |
||||||
|
# "NET_BIND_SERVICE", |
||||||
|
# "SETFCAP", |
||||||
|
# "SETGID", |
||||||
|
# "SETPCAP", |
||||||
|
# "SETUID", |
||||||
|
# "SYS_CHROOT", |
||||||
|
#] |
||||||
|
|
||||||
|
# A list of sysctls to be set in containers by default, |
||||||
|
# specified as "name=value", |
||||||
|
# for example:"net.ipv4.ping_group_range=0 0". |
||||||
|
# |
||||||
|
default_sysctls = [ |
||||||
|
"net.ipv4.ping_group_range=0 0", |
||||||
|
] |
||||||
|
|
||||||
|
# A list of ulimits to be set in containers by default, specified as |
||||||
|
# "<ulimit name>=<soft limit>:<hard limit>", for example: |
||||||
|
# "nofile=1024:2048" |
||||||
|
# See setrlimit(2) for a list of resource names. |
||||||
|
# Any limit not specified here will be inherited from the process launching the |
||||||
|
# container engine. |
||||||
|
# Ulimits has limits for non privileged container engines. |
||||||
|
# |
||||||
|
#default_ulimits = [ |
||||||
|
# "nofile=1280:2560", |
||||||
|
#] |
||||||
|
|
||||||
|
# List of devices. Specified as |
||||||
|
# "<device-on-host>:<device-on-container>:<permissions>", for example: |
||||||
|
# "/dev/sdc:/dev/xvdc:rwm". |
||||||
|
# If it is empty or commented out, only the default devices will be used |
||||||
|
# |
||||||
|
#devices = [] |
||||||
|
|
||||||
|
# List of default DNS options to be added to /etc/resolv.conf inside of the container. |
||||||
|
# |
||||||
|
#dns_options = [] |
||||||
|
|
||||||
|
# List of default DNS search domains to be added to /etc/resolv.conf inside of the container. |
||||||
|
# |
||||||
|
#dns_searches = [] |
||||||
|
|
||||||
|
# Set default DNS servers. |
||||||
|
# This option can be used to override the DNS configuration passed to the |
||||||
|
# container. The special value "none" can be specified to disable creation of |
||||||
|
# /etc/resolv.conf in the container. |
||||||
|
# The /etc/resolv.conf file in the image will be used without changes. |
||||||
|
# |
||||||
|
#dns_servers = [] |
||||||
|
|
||||||
|
# Environment variable list for the conmon process; used for passing necessary |
||||||
|
# environment variables to conmon or the runtime. |
||||||
|
# |
||||||
|
#env = [ |
||||||
|
# "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", |
||||||
|
#] |
||||||
|
|
||||||
|
# Pass all host environment variables into the container. |
||||||
|
# |
||||||
|
#env_host = false |
||||||
|
|
||||||
|
# Set the IP address the container should expect to connect to the host. The IP |
||||||
|
# address is used by Podman to automatically add the `host.containers.internal` |
||||||
|
# and `host.docker.internal` hostnames to the container's `/etc/hosts` file. It |
||||||
|
# is also used for the *host-gateway* flag of Podman's `--add-host` CLI option. |
||||||
|
# If no IP address is configured (the default), Podman will try to determine it |
||||||
|
# automatically, but might fail to do so depending on the container's network |
||||||
|
# setup. Adding these internal hostnames to `/etc/hosts` is silently skipped then. |
||||||
|
# Set this config to `none` to never add the internal hostnames to `/etc/hosts`. |
||||||
|
# |
||||||
|
# Note: If Podman is running in a virtual machine using `podman machine` (this |
||||||
|
# includes Mac and Windows hosts), Podman will silently skip adding the internal |
||||||
|
# hostnames to `/etc/hosts`, unless an IP address was configured manually. The |
||||||
|
# internal hostnames are resolved by the gvproxy DNS resolver instead. This config |
||||||
|
# has no effect on gvproxy. However, since `/etc/hosts` bypasses the DNS resolver, |
||||||
|
# a manually configured IP address still takes precedence. |
||||||
|
# |
||||||
|
# Note: This config doesn't affect the actual network setup, it just tells Podman |
||||||
|
# the IP address it should expect. Configuring an IP address here doesn't ensure |
||||||
|
# that the container can actually reach the host using this IP address. |
||||||
|
# |
||||||
|
#host_containers_internal_ip = "" |
||||||
|
|
||||||
|
# Default proxy environment variables passed into the container. |
||||||
|
# The environment variables passed in include: |
||||||
|
# http_proxy, https_proxy, ftp_proxy, no_proxy, and the upper case versions of |
||||||
|
# these. This option is needed when host system uses a proxy but container |
||||||
|
# should not use proxy. Proxy environment variables specified for the container |
||||||
|
# in any other way will override the values passed from the host. |
||||||
|
# |
||||||
|
#http_proxy = true |
||||||
|
|
||||||
|
# Run an init inside the container that forwards signals and reaps processes. |
||||||
|
# |
||||||
|
#init = false |
||||||
|
|
||||||
|
# Container init binary, if init=true, this is the init binary to be used for containers. |
||||||
|
# If this option is not set catatonit is searched in the directories listed under |
||||||
|
# the helper_binaries_dir option. It is recommended to just install catatonit |
||||||
|
# there instead of configuring this option here. |
||||||
|
# |
||||||
|
#init_path = "/usr/libexec/podman/catatonit" |
||||||
|
|
||||||
|
# Default way to to create an IPC namespace (POSIX SysV IPC) for the container |
||||||
|
# Options are: |
||||||
|
# "host" Share host IPC Namespace with the container. |
||||||
|
# "none" Create shareable IPC Namespace for the container without a private /dev/shm. |
||||||
|
# "private" Create private IPC Namespace for the container, other containers are not allowed to share it. |
||||||
|
# "shareable" Create shareable IPC Namespace for the container. |
||||||
|
# |
||||||
|
#ipcns = "shareable" |
||||||
|
|
||||||
|
# Default way to set an interface name inside container. Defaults to legacy |
||||||
|
# pattern of ethX, where X is a integer, when left undefined. |
||||||
|
# Options are: |
||||||
|
# "device" Uses the network_interface name from the network config as interface name. |
||||||
|
# Falls back to the ethX pattern if the network_interface is not set. |
||||||
|
#interface_name = "" |
||||||
|
|
||||||
|
# keyring tells the container engine whether to create |
||||||
|
# a kernel keyring for use within the container. |
||||||
|
# |
||||||
|
#keyring = true |
||||||
|
|
||||||
|
# label tells the container engine whether to use container separation using |
||||||
|
# MAC(SELinux) labeling or not. |
||||||
|
# The label flag is ignored on label disabled systems. |
||||||
|
# |
||||||
|
#label = true |
||||||
|
|
||||||
|
# label_users indicates whether to enforce confined users in containers on |
||||||
|
# SELinux systems. This option causes containers to maintain the current user |
||||||
|
# and role field of the calling process. By default SELinux containers run with |
||||||
|
# the user system_u, and the role system_r. |
||||||
|
#label_users = false |
||||||
|
|
||||||
|
# Logging driver for the container. Available options: k8s-file and journald. |
||||||
|
# |
||||||
|
#log_driver = "k8s-file" |
||||||
|
|
||||||
|
# Maximum size allowed for the container log file. Negative numbers indicate |
||||||
|
# that no size limit is imposed. If positive, it must be >= 8192 to match or |
||||||
|
# exceed conmon's read buffer. The file is truncated and re-opened so the |
||||||
|
# limit is never exceeded. |
||||||
|
# |
||||||
|
#log_size_max = -1 |
||||||
|
|
||||||
|
# Specifies default format tag for container log messages. |
||||||
|
# This is useful for creating a specific tag for container log messages. |
||||||
|
# Containers logs default to truncated container ID as a tag. |
||||||
|
# |
||||||
|
#log_tag = "" |
||||||
|
|
||||||
|
# List of mounts. Specified as |
||||||
|
# "type=TYPE,source=<directory-on-host>,destination=<directory-in-container>,<options>", for example: |
||||||
|
# "type=bind,source=/var/lib/foobar,destination=/var/lib/foobar,ro". |
||||||
|
# If it is empty or commented out, no mounts will be added |
||||||
|
# |
||||||
|
#mounts = [] |
||||||
|
|
||||||
|
# Default way to to create a Network namespace for the container |
||||||
|
# Options are: |
||||||
|
# `private` Create private Network Namespace for the container. |
||||||
|
# `host` Share host Network Namespace with the container. |
||||||
|
# `none` Containers do not use the network |
||||||
|
# |
||||||
|
#netns = "private" |
||||||
|
|
||||||
|
# Do not modify the `/etc/hosts` file in the container. Podman assumes control |
||||||
|
# over the container's `/etc/hosts` file by default; refer to the `--add-host` |
||||||
|
# CLI option for details. To disable this, either set this config to `true`, or |
||||||
|
# use the functionally identical `--no-hosts` CLI option. |
||||||
|
# |
||||||
|
#no_hosts = false |
||||||
|
|
||||||
|
# Tune the host's OOM preferences for containers |
||||||
|
# (accepts values from -1000 to 1000). |
||||||
|
#oom_score_adj = 0 |
||||||
|
|
||||||
|
# Default way to to create a PID namespace for the container |
||||||
|
# Options are: |
||||||
|
# `private` Create private PID Namespace for the container. |
||||||
|
# `host` Share host PID Namespace with the container. |
||||||
|
# |
||||||
|
#pidns = "private" |
||||||
|
|
||||||
|
# Maximum number of processes allowed in a container. |
||||||
|
# |
||||||
|
#pids_limit = 2048 |
||||||
|
pids_limit = 65536 |
||||||
|
|
||||||
|
# Copy the content from the underlying image into the newly created volume |
||||||
|
# when the container is created instead of when it is started. If false, |
||||||
|
# the container engine will not copy the content until the container is started. |
||||||
|
# Setting it to true may have negative performance implications. |
||||||
|
# |
||||||
|
#prepare_volume_on_create = false |
||||||
|
|
||||||
|
# Give extended privileges to all containers. A privileged container turns off |
||||||
|
# the security features that isolate the container from the host. Dropped |
||||||
|
# Capabilities, limited devices, read-only mount points, Apparmor/SELinux |
||||||
|
# separation, and Seccomp filters are all disabled. Due to the disabled |
||||||
|
# security features the privileged field should almost never be set as |
||||||
|
# containers can easily break out of confinment. |
||||||
|
# |
||||||
|
# Containers running in a user namespace (e.g., rootless containers) cannot |
||||||
|
# have more privileges than the user that launched them. |
||||||
|
# |
||||||
|
#privileged = false |
||||||
|
|
||||||
|
# Run all containers with root file system mounted read-only |
||||||
|
# |
||||||
|
# read_only = false |
||||||
|
|
||||||
|
# Path to the seccomp.json profile which is used as the default seccomp profile |
||||||
|
# for the runtime. |
||||||
|
# |
||||||
|
#seccomp_profile = "/usr/share/containers/seccomp.json" |
||||||
|
|
||||||
|
# Size of /dev/shm. Specified as <number><unit>. |
||||||
|
# Unit is optional, values: |
||||||
|
# b (bytes), k (kilobytes), m (megabytes), or g (gigabytes). |
||||||
|
# If the unit is omitted, the system uses bytes. |
||||||
|
# |
||||||
|
#shm_size = "65536k" |
||||||
|
|
||||||
|
# Set timezone in container. Takes IANA timezones as well as "local", |
||||||
|
# which sets the timezone in the container to match the host machine. |
||||||
|
# |
||||||
|
#tz = "" |
||||||
|
|
||||||
|
# Set umask inside the container |
||||||
|
# |
||||||
|
#umask = "0022" |
||||||
|
|
||||||
|
# Default way to to create a User namespace for the container |
||||||
|
# Options are: |
||||||
|
# `auto` Create unique User Namespace for the container. |
||||||
|
# `host` Share host User Namespace with the container. |
||||||
|
# |
||||||
|
#userns = "host" |
||||||
|
|
||||||
|
# Default way to to create a UTS namespace for the container |
||||||
|
# Options are: |
||||||
|
# `private` Create private UTS Namespace for the container. |
||||||
|
# `host` Share host UTS Namespace with the container. |
||||||
|
# |
||||||
|
#utsns = "private" |
||||||
|
|
||||||
|
# List of volumes. Specified as |
||||||
|
# "<directory-on-host>:<directory-in-container>:<options>", for example: |
||||||
|
# "/db:/var/lib/db:ro". |
||||||
|
# If it is empty or commented out, no volumes will be added |
||||||
|
# |
||||||
|
#volumes = [] |
||||||
|
|
||||||
|
#[engine.platform_to_oci_runtime] |
||||||
|
#"wasi/wasm" = ["crun-wasm"] |
||||||
|
#"wasi/wasm32" = ["crun-wasm"] |
||||||
|
#"wasi/wasm64" = ["crun-wasm"] |
||||||
|
|
||||||
|
[secrets] |
||||||
|
#driver = "file" |
||||||
|
|
||||||
|
[secrets.opts] |
||||||
|
#root = "/example/directory" |
||||||
|
|
||||||
|
[network] |
||||||
|
|
||||||
|
# Network backend determines what network driver will be used to set up and tear down container networks. |
||||||
|
# Valid values are "cni" and "netavark". |
||||||
|
# The default value is empty which means that it will automatically choose CNI or netavark. If there are |
||||||
|
# already containers/images or CNI networks preset it will choose CNI. |
||||||
|
# |
||||||
|
# Before changing this value all containers must be stopped otherwise it is likely that |
||||||
|
# iptables rules and network interfaces might leak on the host. A reboot will fix this. |
||||||
|
# |
||||||
|
#network_backend = "" |
||||||
|
|
||||||
|
# Path to directory where CNI plugin binaries are located. |
||||||
|
# |
||||||
|
#cni_plugin_dirs = [ |
||||||
|
# "/usr/local/libexec/cni", |
||||||
|
# "/usr/libexec/cni", |
||||||
|
# "/usr/local/lib/cni", |
||||||
|
# "/usr/lib/cni", |
||||||
|
# "/opt/cni/bin", |
||||||
|
#] |
||||||
|
|
||||||
|
# List of directories that will be searched for netavark plugins. |
||||||
|
# |
||||||
|
#netavark_plugin_dirs = [ |
||||||
|
# "/usr/local/libexec/netavark", |
||||||
|
# "/usr/libexec/netavark", |
||||||
|
# "/usr/local/lib/netavark", |
||||||
|
# "/usr/lib/netavark", |
||||||
|
#] |
||||||
|
|
||||||
|
# The firewall driver to be used by netavark. |
||||||
|
# The default is empty which means netavark will pick one accordingly. Current supported |
||||||
|
# drivers are "iptables", "nftables", "none" (no firewall rules will be created) and "firewalld" (firewalld is |
||||||
|
# experimental at the moment and not recommend outside of testing). |
||||||
|
# |
||||||
|
#firewall_driver = "" |
||||||
|
|
||||||
|
|
||||||
|
# The network name of the default network to attach pods to. |
||||||
|
# |
||||||
|
#default_network = "podman" |
||||||
|
|
||||||
|
# The default subnet for the default network given in default_network. |
||||||
|
# If a network with that name does not exist, a new network using that name and |
||||||
|
# this subnet will be created. |
||||||
|
# Must be a valid IPv4 CIDR prefix. |
||||||
|
# |
||||||
|
#default_subnet = "10.88.0.0/16" |
||||||
|
|
||||||
|
# DefaultSubnetPools is a list of subnets and size which are used to |
||||||
|
# allocate subnets automatically for podman network create. |
||||||
|
# It will iterate through the list and will pick the first free subnet |
||||||
|
# with the given size. This is only used for ipv4 subnets, ipv6 subnets |
||||||
|
# are always assigned randomly. |
||||||
|
# |
||||||
|
#default_subnet_pools = [ |
||||||
|
# {"base" = "10.89.0.0/16", "size" = 24}, |
||||||
|
# {"base" = "10.90.0.0/15", "size" = 24}, |
||||||
|
# {"base" = "10.92.0.0/14", "size" = 24}, |
||||||
|
# {"base" = "10.96.0.0/11", "size" = 24}, |
||||||
|
# {"base" = "10.128.0.0/9", "size" = 24}, |
||||||
|
#] |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Configure which rootless network program to use by default. Valid options are |
||||||
|
# `slirp4netns` and `pasta` (default). |
||||||
|
# |
||||||
|
#default_rootless_network_cmd = "pasta" |
||||||
|
|
||||||
|
# Path to the directory where network configuration files are located. |
||||||
|
# For the CNI backend the default is "/etc/cni/net.d" as root |
||||||
|
# and "$HOME/.config/cni/net.d" as rootless. |
||||||
|
# For the netavark backend "/etc/containers/networks" is used as root |
||||||
|
# and "$graphroot/networks" as rootless. |
||||||
|
# |
||||||
|
#network_config_dir = "/etc/cni/net.d/" |
||||||
|
|
||||||
|
# Port to use for dns forwarding daemon with netavark in rootful bridge |
||||||
|
# mode and dns enabled. |
||||||
|
# Using an alternate port might be useful if other dns services should |
||||||
|
# run on the machine. |
||||||
|
# |
||||||
|
#dns_bind_port = 53 |
||||||
|
|
||||||
|
# A list of default pasta options that should be used running pasta. |
||||||
|
# It accepts the pasta cli options, see pasta(1) for the full list of options. |
||||||
|
# |
||||||
|
#pasta_options = [] |
||||||
|
|
||||||
|
[engine] |
||||||
|
# Index to the active service |
||||||
|
# |
||||||
|
#active_service = "production" |
||||||
|
|
||||||
|
#List of compression algorithms. If set makes sure that requested compression variant |
||||||
|
#for each platform is added to the manifest list keeping original instance intact in |
||||||
|
#the same manifest list on every `manifest push`. Supported values are (`gzip`, `zstd` and `zstd:chunked`). |
||||||
|
#`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning |
||||||
|
#in that case. |
||||||
|
# |
||||||
|
#add_compression = ["gzip", "zstd", "zstd:chunked"] |
||||||
|
|
||||||
|
# Enforces using docker.io for completing short names in Podman's compatibility |
||||||
|
# REST API. Note that this will ignore unqualified-search-registries and |
||||||
|
# short-name aliases defined in containers-registries.conf(5). |
||||||
|
#compat_api_enforce_docker_hub = true |
||||||
|
|
||||||
|
# Specify one or more external providers for the compose command. The first |
||||||
|
# found provider is used for execution. Can be an absolute and relative path |
||||||
|
# or a (file) name. |
||||||
|
#compose_providers=[] |
||||||
|
|
||||||
|
# Emit logs on each invocation of the compose command indicating that an |
||||||
|
# external compose provider is being executed. |
||||||
|
#compose_warning_logs = true |
||||||
|
|
||||||
|
# The compression format to use when pushing an image. |
||||||
|
# Valid options are: `gzip`, `zstd` and `zstd:chunked`. |
||||||
|
# This field is ignored when pushing images to the docker-daemon and |
||||||
|
# docker-archive formats. It is also ignored when the manifest format is set |
||||||
|
# to v2s2. |
||||||
|
# `zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning |
||||||
|
# in that case. |
||||||
|
# |
||||||
|
#compression_format = "gzip" |
||||||
|
|
||||||
|
# The compression level to use when pushing an image. |
||||||
|
# Valid options depend on the compression format used. |
||||||
|
# For gzip, valid options are 1-9, with a default of 5. |
||||||
|
# For zstd, valid options are 1-20, with a default of 3. |
||||||
|
# |
||||||
|
#compression_level = 5 |
||||||
|
|
||||||
|
# Cgroup management implementation used for the runtime. |
||||||
|
# Valid options "systemd" or "cgroupfs" |
||||||
|
# |
||||||
|
#cgroup_manager = "systemd" |
||||||
|
|
||||||
|
# Environment variables to pass into conmon |
||||||
|
# |
||||||
|
#conmon_env_vars = [ |
||||||
|
# "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" |
||||||
|
#] |
||||||
|
|
||||||
|
# Paths to look for the conmon container manager binary |
||||||
|
# |
||||||
|
#conmon_path = [ |
||||||
|
# "/usr/libexec/podman/conmon", |
||||||
|
# "/usr/local/libexec/podman/conmon", |
||||||
|
# "/usr/local/lib/podman/conmon", |
||||||
|
# "/usr/bin/conmon", |
||||||
|
# "/usr/sbin/conmon", |
||||||
|
# "/usr/local/bin/conmon", |
||||||
|
# "/usr/local/sbin/conmon" |
||||||
|
#] |
||||||
|
|
||||||
|
# Enforces using docker.io for completing short names in Podman's compatibility |
||||||
|
# REST API. Note that this will ignore unqualified-search-registries and |
||||||
|
# short-name aliases defined in containers-registries.conf(5). |
||||||
|
#compat_api_enforce_docker_hub = true |
||||||
|
|
||||||
|
# The database backend of Podman. Supported values are "" (default), "boltdb" |
||||||
|
# and "sqlite". An empty value means it will check whenever a boltdb already |
||||||
|
# exists and use it when it does, otherwise it will use sqlite as default |
||||||
|
# (e.g. new installs). This allows for backwards compatibility with older versions. |
||||||
|
# Please run `podman-system-reset` prior to changing the database |
||||||
|
# backend of an existing deployment, to make sure Podman can operate correctly. |
||||||
|
# |
||||||
|
#database_backend = "" |
||||||
|
|
||||||
|
# Specify the keys sequence used to detach a container. |
||||||
|
# Format is a single character [a-Z] or a comma separated sequence of |
||||||
|
# `ctrl-<value>`, where `<value>` is one of: |
||||||
|
# `a-z`, `@`, `^`, `[`, `\`, `]`, `^` or `_` |
||||||
|
# Specifying "" disables this feature. |
||||||
|
#detach_keys = "ctrl-p,ctrl-q" |
||||||
|
|
||||||
|
# Determines whether engine will reserve ports on the host when they are |
||||||
|
# forwarded to containers. When enabled, when ports are forwarded to containers, |
||||||
|
# ports are held open by as long as the container is running, ensuring that |
||||||
|
# they cannot be reused by other programs on the host. However, this can cause |
||||||
|
# significant memory usage if a container has many ports forwarded to it. |
||||||
|
# Disabling this can save memory. |
||||||
|
# |
||||||
|
#enable_port_reservation = true |
||||||
|
|
||||||
|
# Environment variables to be used when running the container engine (e.g., Podman, Buildah). |
||||||
|
# For example "http_proxy=internal.proxy.company.com". |
||||||
|
# Note these environment variables will not be used within the container. |
||||||
|
# Set the env section under [containers] table, if you want to set environment variables for the container. |
||||||
|
# |
||||||
|
#env = [] |
||||||
|
|
||||||
|
# Define where event logs will be stored, when events_logger is "file". |
||||||
|
#events_logfile_path="" |
||||||
|
|
||||||
|
# Sets the maximum size for events_logfile_path. |
||||||
|
# The size can be b (bytes), k (kilobytes), m (megabytes), or g (gigabytes). |
||||||
|
# The format for the size is `<number><unit>`, e.g., `1b` or `3g`. |
||||||
|
# If no unit is included then the size will be read in bytes. |
||||||
|
# When the limit is exceeded, the logfile will be rotated and the old one will be deleted. |
||||||
|
# If the maximum size is set to 0, then no limit will be applied, |
||||||
|
# and the logfile will not be rotated. |
||||||
|
#events_logfile_max_size = "1m" |
||||||
|
|
||||||
|
# Selects which logging mechanism to use for container engine events. |
||||||
|
# Valid values are `journald`, `file` and `none`. |
||||||
|
# |
||||||
|
#events_logger = "journald" |
||||||
|
|
||||||
|
# Creates a more verbose container-create event which includes a JSON payload |
||||||
|
# with detailed information about the container. |
||||||
|
#events_container_create_inspect_data = false |
||||||
|
|
||||||
|
# Whenever Podman should log healthcheck events. |
||||||
|
# With many running healthcheck on short interval Podman will spam the event |
||||||
|
# log a lot as it generates a event for each single healthcheck run. Because |
||||||
|
# this event is optional and only useful to external consumers that may want |
||||||
|
# to know when a healthcheck is run or failed allow users to turn it off by |
||||||
|
# setting it to false. The default is true. |
||||||
|
# |
||||||
|
#healthcheck_events = true |
||||||
|
|
||||||
|
# A is a list of directories which are used to search for helper binaries. |
||||||
|
# |
||||||
|
#helper_binaries_dir = [ |
||||||
|
# "/usr/local/libexec/podman", |
||||||
|
# "/usr/local/lib/podman", |
||||||
|
# "/usr/libexec/podman", |
||||||
|
# "/usr/lib/podman", |
||||||
|
#] |
||||||
|
|
||||||
|
# Path to OCI hooks directories for automatically executed hooks. |
||||||
|
# |
||||||
|
#hooks_dir = [ |
||||||
|
# "/usr/share/containers/oci/hooks.d", |
||||||
|
#] |
||||||
|
|
||||||
|
# Directories to scan for CDI Spec files. |
||||||
|
# |
||||||
|
#cdi_spec_dirs = [ |
||||||
|
# "/etc/cdi", |
||||||
|
#] |
||||||
|
|
||||||
|
# Manifest Type (oci, v2s2, or v2s1) to use when pulling, pushing, building |
||||||
|
# container images. By default image pulled and pushed match the format of the |
||||||
|
# source image. Building/committing defaults to OCI. |
||||||
|
# |
||||||
|
#image_default_format = "" |
||||||
|
|
||||||
|
# Default transport method for pulling and pushing for images |
||||||
|
# |
||||||
|
#image_default_transport = "docker://" |
||||||
|
|
||||||
|
# Maximum number of image layers to be copied (pulled/pushed) simultaneously. |
||||||
|
# Not setting this field, or setting it to zero, will fall back to containers/image defaults. |
||||||
|
# |
||||||
|
#image_parallel_copies = 0 |
||||||
|
|
||||||
|
# Tells container engines how to handle the built-in image volumes. |
||||||
|
# * anonymous: An anonymous named volume will be created and mounted |
||||||
|
# into the container. |
||||||
|
# * tmpfs: The volume is mounted onto the container as a tmpfs, |
||||||
|
# which allows users to create content that disappears when |
||||||
|
# the container is stopped. |
||||||
|
# * ignore: All volumes are just ignored and no action is taken. |
||||||
|
# |
||||||
|
#image_volume_mode = "" |
||||||
|
|
||||||
|
# Default command to run the infra container |
||||||
|
# |
||||||
|
#infra_command = "/pause" |
||||||
|
|
||||||
|
# Infra (pause) container image name for pod infra containers. When running a |
||||||
|
# pod, we start a `pause` process in a container to hold open the namespaces |
||||||
|
# associated with the pod. This container does nothing other than sleep, |
||||||
|
# reserving the pod's resources for the lifetime of the pod. By default container |
||||||
|
# engines run a built-in container using the pause executable. If you want override |
||||||
|
# specify an image to pull. |
||||||
|
# |
||||||
|
#infra_image = "" |
||||||
|
|
||||||
|
# Default Kubernetes kind/specification of the kubernetes yaml generated with the `podman kube generate` command. |
||||||
|
# The possible options are `pod` and `deployment`. |
||||||
|
#kube_generate_type = "pod" |
||||||
|
|
||||||
|
# Specify the locking mechanism to use; valid values are "shm" and "file". |
||||||
|
# Change the default only if you are sure of what you are doing, in general |
||||||
|
# "file" is useful only on platforms where cgo is not available for using the |
||||||
|
# faster "shm" lock type. You may need to run "podman system renumber" after |
||||||
|
# you change the lock type. |
||||||
|
# |
||||||
|
#lock_type = "shm" |
||||||
|
|
||||||
|
# MultiImageArchive - if true, the container engine allows for storing archives |
||||||
|
# (e.g., of the docker-archive transport) with multiple images. By default, |
||||||
|
# Podman creates single-image archives. |
||||||
|
# |
||||||
|
#multi_image_archive = false |
||||||
|
|
||||||
|
# Default engine namespace |
||||||
|
# If engine is joined to a namespace, it will see only containers and pods |
||||||
|
# that were created in the same namespace, and will create new containers and |
||||||
|
# pods in that namespace. |
||||||
|
# The default namespace is "", which corresponds to no namespace. When no |
||||||
|
# namespace is set, all containers and pods are visible. |
||||||
|
# |
||||||
|
#namespace = "" |
||||||
|
|
||||||
|
# Path to the slirp4netns binary |
||||||
|
# |
||||||
|
#network_cmd_path = "" |
||||||
|
|
||||||
|
# Default options to pass to the slirp4netns binary. |
||||||
|
# Valid options values are: |
||||||
|
# |
||||||
|
# - allow_host_loopback=true|false: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). |
||||||
|
# Default is false. |
||||||
|
# - mtu=MTU: Specify the MTU to use for this network. (Default is `65520`). |
||||||
|
# - cidr=CIDR: Specify ip range to use for this network. (Default is `10.0.2.0/24`). |
||||||
|
# - enable_ipv6=true|false: Enable IPv6. Default is true. (Required for `outbound_addr6`). |
||||||
|
# - outbound_addr=INTERFACE: Specify the outbound interface slirp should bind to (ipv4 traffic only). |
||||||
|
# - outbound_addr=IPv4: Specify the outbound ipv4 address slirp should bind to. |
||||||
|
# - outbound_addr6=INTERFACE: Specify the outbound interface slirp should bind to (ipv6 traffic only). |
||||||
|
# - outbound_addr6=IPv6: Specify the outbound ipv6 address slirp should bind to. |
||||||
|
# - port_handler=rootlesskit: Use rootlesskit for port forwarding. Default. |
||||||
|
# Note: Rootlesskit changes the source IP address of incoming packets to a IP address in the container |
||||||
|
# network namespace, usually `10.0.2.100`. If your application requires the real source IP address, |
||||||
|
# e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for |
||||||
|
# rootless containers when connected to user-defined networks. |
||||||
|
# - port_handler=slirp4netns: Use the slirp4netns port forwarding, it is slower than rootlesskit but |
||||||
|
# preserves the correct source IP address. This port handler cannot be used for user-defined networks. |
||||||
|
# |
||||||
|
#network_cmd_options = [] |
||||||
|
|
||||||
|
# Whether to use chroot instead of pivot_root in the runtime |
||||||
|
# |
||||||
|
#no_pivot_root = false |
||||||
|
|
||||||
|
# Number of locks available for containers, pods, and volumes. Each container, |
||||||
|
# pod, and volume consumes 1 lock for as long as it exists. |
||||||
|
# If this is changed, a lock renumber must be performed (e.g. with the |
||||||
|
# 'podman system renumber' command). |
||||||
|
# |
||||||
|
#num_locks = 2048 |
||||||
|
|
||||||
|
# Set the exit policy of the pod when the last container exits. |
||||||
|
#pod_exit_policy = "continue" |
||||||
|
|
||||||
|
# Whether to pull new image before running a container |
||||||
|
# |
||||||
|
#pull_policy = "missing" |
||||||
|
|
||||||
|
# Indicates whether the application should be running in remote mode. This flag modifies the |
||||||
|
# --remote option on container engines. Setting the flag to true will default |
||||||
|
# `podman --remote=true` for access to the remote Podman service. |
||||||
|
# |
||||||
|
#remote = false |
||||||
|
|
||||||
|
# Number of times to retry pulling/pushing images in case of failure |
||||||
|
# |
||||||
|
#retry = 3 |
||||||
|
|
||||||
|
# Delay between retries in case pulling/pushing image fails. |
||||||
|
# If set, container engines will retry at the set interval, |
||||||
|
# otherwise they delay 2 seconds and then exponentially back off. |
||||||
|
# |
||||||
|
#retry_delay = "2s" |
||||||
|
|
||||||
|
# Default OCI runtime |
||||||
|
# |
||||||
|
#runtime = "crun" |
||||||
|
|
||||||
|
# List of the OCI runtimes that support --format=json. When json is supported |
||||||
|
# engine will use it for reporting nicer errors. |
||||||
|
# |
||||||
|
#runtime_supports_json = ["crun", "runc", "kata", "runsc", "youki", "krun"] |
||||||
|
|
||||||
|
# List of the OCI runtimes that supports running containers with KVM Separation. |
||||||
|
# |
||||||
|
#runtime_supports_kvm = ["kata", "krun"] |
||||||
|
|
||||||
|
# List of the OCI runtimes that supports running containers without cgroups. |
||||||
|
# |
||||||
|
#runtime_supports_nocgroups = ["crun", "krun"] |
||||||
|
|
||||||
|
# Default location for storing temporary container image content. Can be overridden with the TMPDIR environment |
||||||
|
# variable. If you specify "storage", then the location of the |
||||||
|
# container/storage tmp directory will be used. |
||||||
|
# image_copy_tmp_dir="/var/tmp" |
||||||
|
|
||||||
|
# Number of seconds to wait without a connection |
||||||
|
# before the `podman system service` times out and exits |
||||||
|
# |
||||||
|
#service_timeout = 5 |
||||||
|
|
||||||
|
# Directory for persistent engine files (database, etc) |
||||||
|
# By default, this will be configured relative to where the containers/storage |
||||||
|
# stores containers |
||||||
|
# Uncomment to change location from this default |
||||||
|
# |
||||||
|
#static_dir = "/var/lib/containers/storage/libpod" |
||||||
|
|
||||||
|
# Number of seconds to wait for container to exit before sending kill signal. |
||||||
|
# |
||||||
|
#stop_timeout = 10 |
||||||
|
|
||||||
|
# Number of seconds to wait before exit command in API process is given to. |
||||||
|
# This mimics Docker's exec cleanup behaviour, where the default is 5 minutes (value is in seconds). |
||||||
|
# |
||||||
|
#exit_command_delay = 300 |
||||||
|
|
||||||
|
# map of service destinations |
||||||
|
# |
||||||
|
# [engine.service_destinations] |
||||||
|
# [engine.service_destinations.production] |
||||||
|
# URI to access the Podman service |
||||||
|
# Examples: |
||||||
|
# rootless "unix:///run/user/$UID/podman/podman.sock" (Default) |
||||||
|
# rootful "unix:///run/podman/podman.sock (Default) |
||||||
|
# remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock |
||||||
|
# remote rootful ssh://root@10.10.1.136:22/run/podman/podman.sock |
||||||
|
# |
||||||
|
# uri = "ssh://user@production.example.com/run/user/1001/podman/podman.sock" |
||||||
|
# Path to file containing ssh identity key |
||||||
|
# identity = "~/.ssh/id_rsa" |
||||||
|
|
||||||
|
# Directory for temporary files. Must be tmpfs (wiped after reboot) |
||||||
|
# |
||||||
|
#tmp_dir = "/run/libpod" |
||||||
|
|
||||||
|
# Directory for libpod named volumes. |
||||||
|
# By default, this will be configured relative to where containers/storage |
||||||
|
# stores containers. |
||||||
|
# Uncomment to change location from this default. |
||||||
|
# |
||||||
|
volume_path = "/datas/kubernetes/kubosm/storage/volumes" |
||||||
|
|
||||||
|
# Default timeout (in seconds) for volume plugin operations. |
||||||
|
# Plugins are external programs accessed via a REST API; this sets a timeout |
||||||
|
# for requests to that API. |
||||||
|
# A value of 0 is treated as no timeout. |
||||||
|
#volume_plugin_timeout = 5 |
||||||
|
|
||||||
|
# Paths to look for a valid OCI runtime (crun, runc, kata, runsc, krun, etc) |
||||||
|
[engine.runtimes] |
||||||
|
#crun = [ |
||||||
|
# "/usr/bin/crun", |
||||||
|
# "/usr/sbin/crun", |
||||||
|
# "/usr/local/bin/crun", |
||||||
|
# "/usr/local/sbin/crun", |
||||||
|
# "/sbin/crun", |
||||||
|
# "/bin/crun", |
||||||
|
# "/run/current-system/sw/bin/crun", |
||||||
|
#] |
||||||
|
|
||||||
|
#crun-vm = [ |
||||||
|
# "/usr/bin/crun-vm", |
||||||
|
# "/usr/local/bin/crun-vm", |
||||||
|
# "/usr/local/sbin/crun-vm", |
||||||
|
# "/sbin/crun-vm", |
||||||
|
# "/bin/crun-vm", |
||||||
|
# "/run/current-system/sw/bin/crun-vm", |
||||||
|
#] |
||||||
|
|
||||||
|
#kata = [ |
||||||
|
# "/usr/bin/kata-runtime", |
||||||
|
# "/usr/sbin/kata-runtime", |
||||||
|
# "/usr/local/bin/kata-runtime", |
||||||
|
# "/usr/local/sbin/kata-runtime", |
||||||
|
# "/sbin/kata-runtime", |
||||||
|
# "/bin/kata-runtime", |
||||||
|
# "/usr/bin/kata-qemu", |
||||||
|
# "/usr/bin/kata-fc", |
||||||
|
#] |
||||||
|
|
||||||
|
#runc = [ |
||||||
|
# "/usr/bin/runc", |
||||||
|
# "/usr/sbin/runc", |
||||||
|
# "/usr/local/bin/runc", |
||||||
|
# "/usr/local/sbin/runc", |
||||||
|
# "/sbin/runc", |
||||||
|
# "/bin/runc", |
||||||
|
# "/usr/lib/cri-o-runc/sbin/runc", |
||||||
|
#] |
||||||
|
|
||||||
|
#runsc = [ |
||||||
|
# "/usr/bin/runsc", |
||||||
|
# "/usr/sbin/runsc", |
||||||
|
# "/usr/local/bin/runsc", |
||||||
|
# "/usr/local/sbin/runsc", |
||||||
|
# "/bin/runsc", |
||||||
|
# "/sbin/runsc", |
||||||
|
# "/run/current-system/sw/bin/runsc", |
||||||
|
#] |
||||||
|
|
||||||
|
#youki = [ |
||||||
|
# "/usr/local/bin/youki", |
||||||
|
# "/usr/bin/youki", |
||||||
|
# "/bin/youki", |
||||||
|
# "/run/current-system/sw/bin/youki", |
||||||
|
#] |
||||||
|
|
||||||
|
#krun = [ |
||||||
|
# "/usr/bin/krun", |
||||||
|
# "/usr/local/bin/krun", |
||||||
|
#] |
||||||
|
|
||||||
|
[engine.volume_plugins] |
||||||
|
#testplugin = "/run/podman/plugins/test.sock" |
||||||
|
|
||||||
|
[machine] |
||||||
|
# Number of CPU's a machine is created with. |
||||||
|
# |
||||||
|
#cpus=1 |
||||||
|
|
||||||
|
# The size of the disk in GB created when init-ing a podman-machine VM. |
||||||
|
# |
||||||
|
#disk_size=10 |
||||||
|
|
||||||
|
# Default Image used when creating a new VM using `podman machine init`. |
||||||
|
# Can be specified as registry with a bootable OCI artifact, download URL, or a local path. |
||||||
|
# Registry target must be in the form of `docker://registry/repo/image:version`. |
||||||
|
# Container engines translate URIs $OS and $ARCH to the native OS and ARCH. |
||||||
|
# URI "https://example.com/$OS/$ARCH/foobar.ami" would become |
||||||
|
# "https://example.com/linux/amd64/foobar.ami" on a Linux AMD machine. |
||||||
|
# If unspecified, the default Podman machine image will be used. |
||||||
|
# |
||||||
|
#image = "" |
||||||
|
|
||||||
|
# Memory in MB a machine is created with. |
||||||
|
# |
||||||
|
#memory=2048 |
||||||
|
|
||||||
|
# The username to use and create on the podman machine OS for rootless |
||||||
|
# container access. |
||||||
|
# |
||||||
|
#user = "core" |
||||||
|
|
||||||
|
# Host directories to be mounted as volumes into the VM by default. |
||||||
|
# Environment variables like $HOME as well as complete paths are supported for |
||||||
|
# the source and destination. An optional third field `:ro` can be used to |
||||||
|
# tell the container engines to mount the volume readonly. |
||||||
|
# |
||||||
|
#volumes = [ |
||||||
|
# "$HOME:$HOME", |
||||||
|
#] |
||||||
|
|
||||||
|
# Virtualization provider used to run Podman machine. |
||||||
|
# If it is empty or commented out, the default provider will be used. |
||||||
|
# Linux: |
||||||
|
# qemu - Open source machine emulator and virtualizer. (Default) |
||||||
|
# Windows: there are currently two options: |
||||||
|
# wsl - Windows Subsystem for Linux (Default) |
||||||
|
# hyperv - Windows Server Virtualization |
||||||
|
# Mac: there are currently two options: |
||||||
|
# applehv - Default Apple Hypervisor (Default) |
||||||
|
# libkrun - Launch virtual machines using the libkrun platform, optimized |
||||||
|
# for sharing GPU with the machine. |
||||||
|
#provider = "" |
||||||
|
|
||||||
|
# Rosetta supports running x86_64 Linux binaries on a Podman machine on Apple silicon. |
||||||
|
# The default value is `true`. Supported on AppleHV(arm64) machines only. |
||||||
|
# |
||||||
|
#rosetta=true |
||||||
|
|
||||||
|
# The [machine] table MUST be the last entry in this file. |
||||||
|
# (Unless another table is added) |
||||||
|
# TOML does not provide a way to end a table other than a further table being |
||||||
|
# defined, so every key hereafter will be part of [machine] and not the |
||||||
|
# main config. |
||||||
|
|
||||||
|
[farms] |
||||||
|
# |
||||||
|
# the default farm to use when farming out builds |
||||||
|
# default = "" |
||||||
|
# |
||||||
|
# map of existing farms |
||||||
|
#[farms.list] |
||||||
|
|
||||||
|
[podmansh] |
||||||
|
# Shell to spawn in container. Default: /bin/sh. |
||||||
|
#shell = "/bin/sh" |
||||||
|
# |
||||||
|
# Name of the container the podmansh user should join. |
||||||
|
#container = "podmansh" |
||||||
|
# |
||||||
|
# Default timeout in seconds for podmansh logins. |
||||||
|
# Favored over the deprecated "podmansh_timeout" field. |
||||||
|
#timeout = 30 |
||||||
@ -0,0 +1,56 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
# shellcheck source=/dev/null |
||||||
|
source ./env.sh |
||||||
|
|
||||||
|
logfile=/tmp/kind-get-clusters |
||||||
|
|
||||||
|
kind get clusters | tee "${logfile}" |
||||||
|
|
||||||
|
if grep "${CLUSTERNAME}" ${logfile} |
||||||
|
then |
||||||
|
echo "--- kind delete cluster --name \"${CLUSTERNAME}\"" |
||||||
|
kind delete cluster --name "${CLUSTERNAME}" |
||||||
|
sleep 30 |
||||||
|
fi |
||||||
|
|
||||||
|
echo "--- podman inspect -f '{{.State.Running}}' \"${REGISTRY_NAME}\"" |
||||||
|
podman inspect -f '{{.State.Running}}' "${REGISTRY_NAME}" |
||||||
|
if [ "$(podman inspect -f '{{.State.Running}}' "${REGISTRY_NAME}" 2>/dev/null || true)" != 'true' ]; then |
||||||
|
podman run \ |
||||||
|
-d --restart=always -p "127.0.0.1:${REGISTRY_PORT}:5000" --network bridge --name "${REGISTRY_NAME}" \ |
||||||
|
registry:3 |
||||||
|
fi |
||||||
|
|
||||||
|
systemd-run --scope -p "Delegate=yes" --user kind create cluster --config=kind-config.yaml |
||||||
|
|
||||||
|
for node in $(kind get nodes); do |
||||||
|
podman exec "${node}" mkdir -p "${REGISTRY_DIR}" |
||||||
|
cat <<EOF | podman exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml" |
||||||
|
[host."http://${REGISTRY_NAME}:5000"] |
||||||
|
EOF |
||||||
|
done |
||||||
|
|
||||||
|
echo "--- podman inspect -f='{{json .NetworkSettings.Networks.kind}}' \"${REGISTRY_NAME}\"" |
||||||
|
podman inspect -f='{{json .NetworkSettings.Networks.kind}}' "${REGISTRY_NAME}" |
||||||
|
if [ "$(podman inspect -f='{{json .NetworkSettings.Networks.kind}}' "${REGISTRY_NAME}")" = 'null' ] |
||||||
|
then |
||||||
|
echo "--- podman network connect \"kind\" \"${REGISTRY_NAME}\"" |
||||||
|
podman network connect "kind" "${REGISTRY_NAME}" |
||||||
|
fi |
||||||
|
|
||||||
|
cat <<EOF | kubectl apply -f - |
||||||
|
apiVersion: v1 |
||||||
|
kind: ConfigMap |
||||||
|
metadata: |
||||||
|
name: local-registry-hosting |
||||||
|
namespace: kube-public |
||||||
|
data: |
||||||
|
localRegistryHosting.v1: | |
||||||
|
host: "localhost:${REGISTRY_PORT}" |
||||||
|
help: "https://kind.sigs.k8s.io/docs/user/local-registry/" |
||||||
|
EOF |
||||||
|
|
||||||
|
# podman save docker.io/library/registry:3 | xz > /datas/kubernetes/backups/registry.tar.xz |
||||||
|
# podman save docker.io/kindest/node@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f | xz > /datas/kubernetes/backups/kindest.tar.xz |
||||||
|
# podman pull docker.io/debian:sid |
||||||
@ -0,0 +1,21 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
export CLUSTERNAME=kubosm |
||||||
|
export KUBOSM=/git/kubosm |
||||||
|
export KIND_EXPERIMENTAL_PROVIDER=podman |
||||||
|
export CONTAINERS_CONF=$KUBOSM/containers.conf |
||||||
|
export CONTAINERS_REGISTRIES_CONF=$KUBOSM/registries.conf |
||||||
|
export CONTAINER_STORAGE_CONF=$KUBOSM/storage.conf |
||||||
|
export TMPDIR=/datas/kubernetes/tmpstorage |
||||||
|
export XDG_CONFIG_HOME=/datas/git/kubosm |
||||||
|
export XDG_DATA_HOME=/datas/kubernetes/kubosm/ |
||||||
|
# export XDG_RUNTIME_DIR=/run/user/1000 |
||||||
|
# export XDG_RUNTIME_DIR=/datas/kubernetes/containers |
||||||
|
export KUBECONFIG=$XDG_DATA_HOME/kube/config |
||||||
|
export KUBE_CONFIG_PATH=$XDG_DATA_HOME/kube/config |
||||||
|
export KUBE_CTX=kind-kubosm |
||||||
|
export KUBE_CTX_CLUSTER=kind-kubosm |
||||||
|
export KUBE_HOST=http://127.0.0.1:6443/ |
||||||
|
export REGISTRY_NAME="kind-registry" |
||||||
|
export REGISTRY_PORT="5001" |
||||||
|
export REGISTRY_DIR="/etc/containerd/certs.d/localhost:${REGISTRY_PORT}" |
||||||
@ -0,0 +1,23 @@ |
|||||||
|
kind: Cluster |
||||||
|
apiVersion: kind.x-k8s.io/v1alpha4 |
||||||
|
name: kubosm |
||||||
|
networking: |
||||||
|
# WARNING: It is _strongly_ recommended that you keep this the default |
||||||
|
# (127.0.0.1) for security reasons. However it is possible to change this. |
||||||
|
apiServerAddress: "127.0.0.1" |
||||||
|
# By default the API server listens on a random open port. |
||||||
|
# You may choose a specific port but probably don't need to in most cases. |
||||||
|
# Using a random port makes it easier to spin up multiple clusters. |
||||||
|
apiServerPort: 6443 |
||||||
|
nodes: |
||||||
|
- role: control-plane |
||||||
|
# port forward 8080 on the host to 8080 on this node |
||||||
|
extraPortMappings: |
||||||
|
- containerPort: 8080 |
||||||
|
hostPort: 8080 |
||||||
|
# optional: set the bind address on the host |
||||||
|
# 0.0.0.0 is the current default |
||||||
|
listenAddress: "127.0.0.1" |
||||||
|
# optional: set the protocol to one of TCP, UDP, SCTP. |
||||||
|
# TCP is the default |
||||||
|
protocol: TCP |
||||||
@ -0,0 +1,7 @@ |
|||||||
|
# /etc/containers/registries.conf |
||||||
|
|
||||||
|
# Define a registry that uses HTTP instead of HTTPS |
||||||
|
|
||||||
|
[[registry]] |
||||||
|
location = "my-registry.local:5000" |
||||||
|
insecure = true |
||||||
@ -0,0 +1,178 @@ |
|||||||
|
# This file is the configuration file for all tools |
||||||
|
# that use the containers/storage library. The storage.conf file |
||||||
|
# overrides all other storage.conf files. Container engines using the |
||||||
|
# container/storage library do not inherit fields from other storage.conf |
||||||
|
# files. |
||||||
|
# |
||||||
|
# Note: The storage.conf file overrides other storage.conf files based on this precedence: |
||||||
|
# /usr/containers/storage.conf |
||||||
|
# /etc/containers/storage.conf |
||||||
|
# $HOME/.config/containers/storage.conf |
||||||
|
# $XDG_CONFIG_HOME/containers/storage.conf (if XDG_CONFIG_HOME is set) |
||||||
|
# See man 5 containers-storage.conf for more information |
||||||
|
# The "storage" table contains all of the server options. |
||||||
|
[storage] |
||||||
|
|
||||||
|
# Default storage driver, must be set for proper operation. |
||||||
|
driver = "overlay" |
||||||
|
|
||||||
|
# Temporary storage location |
||||||
|
runroot = "/datas/kubernetes/tmpstorage" |
||||||
|
|
||||||
|
# Priority list for the storage drivers that will be tested one |
||||||
|
# after the other to pick the storage driver if it is not defined. |
||||||
|
# driver_priority = ["overlay", "btrfs"] |
||||||
|
|
||||||
|
# Primary Read/Write location of container storage |
||||||
|
# When changing the graphroot location on an SELinux system, you must |
||||||
|
# ensure the labeling matches the default location's labels with the |
||||||
|
# following commands: |
||||||
|
# semanage fcontext -a -e /var/lib/containers/storage /NEWSTORAGEPATH |
||||||
|
# restorecon -R -v /NEWSTORAGEPATH |
||||||
|
graphroot = "/datas/kubernetes/kubosm/storage" |
||||||
|
|
||||||
|
# Optional alternate location of image store if a location separate from the |
||||||
|
# container store is required. If set, it must be different than graphroot. |
||||||
|
# imagestore = "" |
||||||
|
|
||||||
|
|
||||||
|
# Storage path for rootless users |
||||||
|
# |
||||||
|
rootless_storage_path = "/datas/kubernetes/kubosm/storage" |
||||||
|
|
||||||
|
# Transient store mode makes all container metadata be saved in temporary storage |
||||||
|
# (i.e. runroot above). This is faster, but doesn't persist across reboots. |
||||||
|
# Additional garbage collection must also be performed at boot-time, so this |
||||||
|
# option should remain disabled in most configurations. |
||||||
|
# transient_store = true |
||||||
|
|
||||||
|
[storage.options] |
||||||
|
# Storage options to be passed to underlying storage drivers |
||||||
|
|
||||||
|
# AdditionalImageStores is used to pass paths to additional Read/Only image stores |
||||||
|
# Must be comma separated list. |
||||||
|
additionalimagestores = [ |
||||||
|
] |
||||||
|
|
||||||
|
# Options controlling how storage is populated when pulling images. |
||||||
|
[storage.options.pull_options] |
||||||
|
# Enable the "zstd:chunked" feature, which allows partial pulls, reusing |
||||||
|
# content that already exists on the system. This is disabled by default, |
||||||
|
# and must be explicitly enabled to be used. For more on zstd:chunked, see |
||||||
|
# https://github.com/containers/storage/blob/main/docs/containers-storage-zstd-chunked.md |
||||||
|
# This is a "string bool": "false" | "true" (cannot be native TOML boolean) |
||||||
|
# enable_partial_images = "false" |
||||||
|
|
||||||
|
# Tells containers/storage to use hard links rather then create new files in |
||||||
|
# the image, if an identical file already existed in storage. |
||||||
|
# This is a "string bool": "false" | "true" (cannot be native TOML boolean) |
||||||
|
# use_hard_links = "false" |
||||||
|
|
||||||
|
# Path to an ostree repository that might have |
||||||
|
# previously pulled content which can be used when attempting to avoid |
||||||
|
# pulling content from the container registry. |
||||||
|
# ostree_repos="" |
||||||
|
|
||||||
|
# If set to "true", containers/storage will convert images that are |
||||||
|
# not already in zstd:chunked format to that format before processing |
||||||
|
# in order to take advantage of local deduplication and hard linking. |
||||||
|
# It is an expensive operation so it is not enabled by default. |
||||||
|
# This is a "string bool": "false" | "true" (cannot be native TOML boolean) |
||||||
|
# convert_images = "false" |
||||||
|
|
||||||
|
# This should ALMOST NEVER be set. |
||||||
|
# It allows partial pulls of images without guaranteeing that "partial |
||||||
|
# pulls" and non-partial pulls both result in consistent image contents. |
||||||
|
# This allows pulling estargz images and early versions of zstd:chunked images; |
||||||
|
# otherwise, these layers always use the traditional non-partial pull path. |
||||||
|
# |
||||||
|
# This option should be enabled EXTREMELY rarely, only if ALL images that could |
||||||
|
# EVER be conceivably pulled on this system are GUARANTEED (e.g. using a signature policy) |
||||||
|
# to come from a build system trusted to never attack image integrity. |
||||||
|
# |
||||||
|
# If this consistency enforcement were disabled, malicious images could be built |
||||||
|
# in a way designed to evade other audit mechanisms, so presence of most other audit |
||||||
|
# mechanisms is not a replacement for the above-mentioned need for all images to come |
||||||
|
# from a trusted build system. |
||||||
|
# |
||||||
|
# As a side effect, enabling this option will also make image IDs unpredictable |
||||||
|
# (usually not equal to the traditional value matching the config digest). |
||||||
|
# insecure_allow_unpredictable_image_contents = "false" |
||||||
|
|
||||||
|
# Root-auto-userns-user is a user name which can be used to look up one or more UID/GID |
||||||
|
# ranges in the /etc/subuid and /etc/subgid file. These ranges will be partitioned |
||||||
|
# to containers configured to create automatically a user namespace. Containers |
||||||
|
# configured to automatically create a user namespace can still overlap with containers |
||||||
|
# having an explicit mapping set. |
||||||
|
# This setting is ignored when running as rootless. |
||||||
|
# root-auto-userns-user = "storage" |
||||||
|
# |
||||||
|
# Auto-userns-min-size is the minimum size for a user namespace created automatically. |
||||||
|
# auto-userns-min-size=1024 |
||||||
|
# |
||||||
|
# Auto-userns-max-size is the maximum size for a user namespace created automatically. |
||||||
|
# auto-userns-max-size=65536 |
||||||
|
|
||||||
|
[storage.options.overlay] |
||||||
|
# ignore_chown_errors can be set to allow a non privileged user running with |
||||||
|
# a single UID within a user namespace to run containers. The user can pull |
||||||
|
# and use any image even those with multiple uids. Note multiple UIDs will be |
||||||
|
# squashed down to the default uid in the container. These images will have no |
||||||
|
# separation between the users in the container. Only supported for the overlay |
||||||
|
# and vfs drivers. |
||||||
|
# This is a "string bool": "false" | "true" (cannot be native TOML boolean) |
||||||
|
#ignore_chown_errors = "false" |
||||||
|
|
||||||
|
# Inodes is used to set a maximum inodes of the container image. |
||||||
|
# inodes = "" |
||||||
|
|
||||||
|
# Path to an helper program to use for mounting the file system instead of mounting it |
||||||
|
# directly. |
||||||
|
#mount_program = "/usr/bin/fuse-overlayfs" |
||||||
|
|
||||||
|
# mountopt specifies comma separated list of extra mount options |
||||||
|
mountopt = "nodev" |
||||||
|
|
||||||
|
# Set to skip a PRIVATE bind mount on the storage home directory. |
||||||
|
# This is a "string bool": "false" | "true" (cannot be native TOML boolean) |
||||||
|
# skip_mount_home = "false" |
||||||
|
|
||||||
|
# Set to use composefs to mount data layers with overlay. |
||||||
|
# This is a "string bool": "false" | "true" (cannot be native TOML boolean) |
||||||
|
# use_composefs = "false" |
||||||
|
|
||||||
|
# Size is used to set a maximum size of the container image. |
||||||
|
# size = "" |
||||||
|
|
||||||
|
# ForceMask specifies the permissions mask that is used for new files and |
||||||
|
# directories. |
||||||
|
# |
||||||
|
# The values "shared" and "private" are accepted. |
||||||
|
# Octal permission masks are also accepted. |
||||||
|
# |
||||||
|
# "": No value specified. |
||||||
|
# All files/directories, get set with the permissions identified within the |
||||||
|
# image. |
||||||
|
# "private": it is equivalent to 0700. |
||||||
|
# All files/directories get set with 0700 permissions. The owner has rwx |
||||||
|
# access to the files. No other users on the system can access the files. |
||||||
|
# This setting could be used with networked based homedirs. |
||||||
|
# "shared": it is equivalent to 0755. |
||||||
|
# The owner has rwx access to the files and everyone else can read, access |
||||||
|
# and execute them. This setting is useful for sharing containers storage |
||||||
|
# with other users. For instance have a storage owned by root but shared |
||||||
|
# to rootless users as an additional store. |
||||||
|
# NOTE: All files within the image are made readable and executable by any |
||||||
|
# user on the system. Even /etc/shadow within your image is now readable by |
||||||
|
# any user. |
||||||
|
# |
||||||
|
# OCTAL: Users can experiment with other OCTAL Permissions. |
||||||
|
# |
||||||
|
# Note: The force_mask Flag is an experimental feature, it could change in the |
||||||
|
# future. When "force_mask" is set the original permission mask is stored in |
||||||
|
# the "user.containers.override_stat" xattr and the "mount_program" option must |
||||||
|
# be specified. Mount programs like "/usr/bin/fuse-overlayfs" present the |
||||||
|
# extended attribute permissions to processes within containers rather than the |
||||||
|
# "force_mask" permissions. |
||||||
|
# |
||||||
|
# force_mask = "" |
||||||
Loading…
Reference in new issue