This repo is for my attempts to get full podman
capabilities working in OpenShift Dev Spaces (Eclipse Che)
The capability is needed for the following non-exclusive list:
- Java test-containers
- AWS development with Localstack
- AWS Lambda development with SAM CLI
- Ansible development
Early Demo Here - Eclipse Che / OpenShift Dev Spaces - Podman With Fuse Overlay
NOTE: Do not apply these changes to a production or shared instance of OCP. These changes will put your cluster in a non-upgradable state
-
Install
butane
:https://coreos.github.io/butane/
We need
butane
to assist with the creation of MachineConfigs. It's really handy for that.Note: If you previously followed one of my blog posts to install your OpenShift cluster, then you should already have
butane
installed. -
Apply the following MachineConfig: Note: Your cluster will restart the targeted nodes.
This MachineConfig does 3 things:
- Allow Pods with the
io.openshift.nested-podman
access to/dev/fuse
and/dev/net/tun
- Load the kernel modules:
tun
,rtnl-link-bridge
, andipt_addrtype
- Apply an
selinux
module.
- Allow Pods with the
-
Set a variable for the OpenShift Node role that you are going to apply the changes to:
If you are using a Single Node cluster or OpenShift Local, then set:
NODE_ROLE=master
If you are using an OpenShift cluster with separate control-plane and compute nodes, then set:
NODE_ROLE=worker
-
Apply the MachineConfig:
cat << EOF | butane | oc apply -f - variant: openshift version: 4.13.0 metadata: labels: machineconfiguration.openshift.io/role: ${NODE_ROLE} name: nested-podman-${NODE_ROLE} storage: files: - path: /etc/crio/crio.conf.d/99-nested-podman mode: 0644 overwrite: true contents: inline: | [crio.runtime.workloads.nested-podman] activation_annotation = "io.openshift.nested-podman" allowed_annotations = [ "io.kubernetes.cri-o.Devices" ] [crio.runtime] allowed_devices = [ "/dev/fuse", "/dev/net/tun" ] - path: /etc/modules-load.d/nested-podman.conf mode: 0644 overwrite: true contents: inline: | tun rtnl-link-bridge ipt_addrtype - path: /etc/nested-podman/nested-podman.te mode: 0644 overwrite: true contents: inline: | module nested-podman 1.0; require { type container_t; type cgroup_t; type devpts_t; type tmpfs_t; type sysfs_t; type nsfs_t; type devpts_t; type proc_t; type sysctl_t; type sysctl_irq_t; type proc_kcore_t; class dir mounton; class chr_file { setattr open} ; class file mounton; class filesystem { mount remount unmount }; } allow container_t tmpfs_t:filesystem mount; allow container_t devpts_t:filesystem mount; allow container_t devpts_t:filesystem remount; allow container_t devpts_t:chr_file open; allow container_t devpts_t:chr_file setattr; allow container_t nsfs_t:filesystem unmount; allow container_t sysfs_t:filesystem mount; allow container_t sysfs_t:filesystem remount; allow container_t cgroup_t:filesystem remount; allow container_t proc_kcore_t:file mounton; allow container_t proc_t:dir mounton; allow container_t proc_t:file mounton; allow container_t proc_t:filesystem mount; allow container_t sysctl_irq_t:dir mounton; allow container_t sysctl_t:dir mounton; allow container_t sysctl_t:file mounton; systemd: units: - contents: | [Unit] Description=Modify SeLinux Type container_t to allow devpts_t and tmpfs_t DefaultDependencies=no After=kubelet.service [Service] Type=oneshot RemainAfterExit=yes ExecStart=bash -c "/bin/checkmodule -M -m -o /tmp/nested-podman.mod /etc/nested-podman/nested-podman.te && /bin/semodule_package -o /tmp/nested-podman.pp -m /tmp/nested-podman.mod && /sbin/semodule -i /tmp/nested-podman.pp" TimeoutSec=0 [Install] WantedBy=multi-user.target enabled: true name: systemd-nested-podman-selinux.service EOF
-
Enable the
ProcMountType
Kubernetes feature gate.Note: Because this feature gate is still in Alpha state, enabling it will render your cluster non-upgradable.
oc patch FeatureGate cluster --type merge --patch '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["ProcMountType"]}}}'
- Create an Eclipse Che workspace from this git repo:
https://github.com/cgruver/openshift-nested-containers.git
-
Open a terminal into the
openshift-nested-containers
project. -
Clear the
CONTAINER_HOST
environment variable: (We're going to run this without a "remote" podman socket)unset CONTAINER_HOST
-
Run the following:
podman run -d --rm --name webserver -p 8080:80 quay.io/libpod/banner curl http://localhost:8080
-
Run an interactive container:
podman run -it --rm registry.access.redhat.com/ubi9/ubi-minimal
-
Clear the
CONTAINER_HOST
environment variable: (We're going to run this without a "remote" podman socket)unset CONTAINER_HOST
-
Open a terminal into the
ansible-demo
project. -
Run the following command:
ansible-navigator run helloworld.yaml
-
Use the
Task Manager
extension to run theStart Podman Service
task. -
Open a terminal in the
sam-cli-demo
project:sam init --name sam-py-app --architecture=x86_64 --location="./python3.9/hello" --no-tracing --no-application-insights --no-input cd sam-py-app sam build sam local start-api --debug --docker-network=podman
-
Open a second terminal to invoke the Lambda function:
curl http://127.0.0.1:3000/hello
-
Open a terminal in the
quarkus-dev-services-demo
project:mvn clean mvn test
-
Use the
Task Manager
extension to run theStart Localstack Service
task. -
Open a terminal in the
localstack-demo
project:make deploy awslocal s3 ls s3://archive-bucket/