53f62d9976
Provide more control over install the registry `CA` by adding an additional conditional using the existing `_registry_insecure` variable for either `Podman` or `Docker`. Change-Id: If1ba49e23e1b3acc57bcc6313a8688f29fce4e37 Signed-off-by: Jack Hodgkiss <jack@stackhpc.com>
80 lines
2.1 KiB
YAML
80 lines
2.1 KiB
YAML
---
|
|
- name: Ensure podman config directory exists
|
|
file:
|
|
path: /etc/containers/{{ item }}
|
|
state: directory
|
|
mode: "0755"
|
|
become: true
|
|
with_items:
|
|
- "containers.conf.d"
|
|
- "registries.conf.d"
|
|
- "storage.conf.d"
|
|
|
|
- name: Write registries config
|
|
become: true
|
|
vars:
|
|
registry: |
|
|
[[registry]]
|
|
location = "{{ podman_registry }}"
|
|
insecure = {{ podman_registry_insecure | bool | lower }}
|
|
copy:
|
|
content: "{{ registry }}"
|
|
dest: /etc/containers/registries.conf.d/registries.conf
|
|
mode: "0644"
|
|
when: podman_registry is not none
|
|
|
|
- name: Write registry mirror config
|
|
become: true
|
|
vars:
|
|
registry_mirror: |
|
|
[[registry.mirror]]
|
|
prefix = docker.io
|
|
location = "{{ podman_registry_mirror }}"
|
|
copy:
|
|
content: "{{ registry_mirror }}"
|
|
dest: /etc/containers/registries.conf.d/registry-mirror.conf
|
|
mode: "0644"
|
|
when: podman_registry_mirror is not none
|
|
|
|
- name: Write storage config
|
|
become: true
|
|
vars:
|
|
config: |
|
|
{% if podman_storage_driver is not none %}
|
|
driver = {{ podman_storage_driver }}
|
|
{% endif %}
|
|
{% if podman_runtime_directory is not none %}
|
|
runroot = {{ podman_runtime_directory }}
|
|
{% endif %}
|
|
copy:
|
|
content: "{{ config }}"
|
|
dest: /etc/containers/storage.conf.d/storage.conf
|
|
mode: "0644"
|
|
when: podman_storage_driver is not none or podman_runtime_directory is not none
|
|
|
|
- name: Ensure the path for CA file for podman registry exists
|
|
file:
|
|
path: "/etc/containers/certs.d/{{ podman_registry }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
state: directory
|
|
become: true
|
|
when:
|
|
- podman_registry is not none
|
|
- podman_registry_ca is not none
|
|
- not podman_registry_insecure | bool
|
|
|
|
- name: Ensure the CA file for private registry exists
|
|
copy:
|
|
src: "{{ private_registry_ca }}"
|
|
dest: "/etc/containers/certs.d/{{ private_registry }}/ca.crt"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
become: true
|
|
when:
|
|
- podman_registry is not none
|
|
- podman_registry_ca is not none
|
|
- not podman_registry_insecure | bool
|