ansible-role-k3s/tasks/validate/check-unsupported-rootless.yml
Xan Manning f2a3f75f08 Added some validation steps, fixed issue with checksum, introducing rootless
as an option, however this is experimental in both K3s and this role.
2019-12-22 18:54:25 +00:00

55 lines
2.0 KiB
YAML

---
- name: Check if /proc/sys/kernel/unprivileged_userns_clone exists
stat:
path: /proc/sys/kernel/unprivileged_userns_clone
register: k3s_check_unprivileged_userns_exists
- name: Get the value of /proc/sys/kernel/unprivileged_userns_clone
slurp:
src: /proc/sys/kernel/unprivileged_userns_clone
register: k3s_get_unprivileged_userns_clone
when: k3s_check_unprivileged_userns_exists.stat.exists
- name: Set the value of k3s_get_unprivileged_userns_clone
set_fact:
k3s_get_unprivileged_userns_clone:
content: "MQo="
when: not k3s_check_unprivileged_userns_exists.stat.exists
- name: Get the value of /proc/sys/user/max_user_namespaces
slurp:
src: /proc/sys/user/max_user_namespaces
register: k3s_get_max_user_namespaces
- name: Get the contents of /etc/subuid
slurp:
src: /etc/subuid
register: k3s_get_subuid
- name: Get the contents of /etc/subgid
slurp:
src: /etc/subgid
register: k3s_get_subgid
- name: Get current user subuid and subgid values
set_fact:
k3s_current_user_subuid: "{{ (k3s_get_subuid['content'] | b64decode).split('\n')
| select('search', ansible_user_id) | first | default('UserNotFound:0:0') }}"
k3s_current_user_subgid: "{{ (k3s_get_subgid['content'] | b64decode).split('\n')
| select('search', ansible_user_id) | first | default('UserNotFound:0:0') }}"
- name: Check user namespaces kernel parameters are adequate
assert:
that:
- k3s_get_unprivileged_userns_clone['content'] | b64decode | int == 1
- k3s_get_max_user_namespaces['content'] | b64decode | int >= 28633
- k3s_current_user_subuid != "UserNotFound:0:0"
- k3s_current_user_subgid != "UserNotFound:0:0"
- k3s_current_user_subuid.split(':')[2] | int >= 65536
- k3s_current_user_subgid.split(':')[2] | int >= 65536
- ansible_env['XDG_RUNTIME_DIR'] is defined
success_msg: All kernel parameters passed
fail_msg: Kernel parameters are not set correctly, please check
https://github.com/rootless-containers/rootlesskit