edgenet-kubernetes: ensure containerd and kubernetes packages are up …

…to date

edgenet-node-upgrade.yml

@@ -29,5 +29,4 @@
       yum:
         name: '*'
         state: latest
-        exclude: kernel*,kube*,containerd*
       when: ansible_os_family == 'RedHat'

edgenet-repair-geni.yml

@@ -0,0 +1,34 @@
+---
+- hosts: all
+  become: true
+  tasks:
+    # Fix grubby fatal error when updating the kernel:
+    # https://serverfault.com/questions/673486/grubby-fatal-error-unable-to-find-a-suitable-template
+    - name: Regenerate grub2 configuration
+      tags: ['skip_ansible_lint']
+      command: grub2-mkconfig -o /boot/grub2/grub.cfg
+      when: ansible_os_family == 'RedHat'
+
+    - name: Ensure kernel-devel is installed and up-to-date
+      yum:
+        name: kernel-devel
+        state: latest
+      when: ansible_os_family == 'RedHat'
+
+    - name: Ensure kernel is up-to-date
+      yum:
+        name: kernel
+        state: latest
+      when: ansible_os_family == 'RedHat'
+
+    # Fix "Error: failed to create containerd container: get apparmor_parser version: exec: "apparmor_parser": executable file not found in $PATH"
+    - name: Ensure apparmor is installed and up-to-date
+      apt:
+        name:
+          - apparmor
+          - apparmor-utils
+        state: latest
+      when: ansible_os_family == 'Debian'
+
+    - name: Reboot the machine
+      reboot:

roles/edgenet-kubernetes/tasks/containerd-debian.yml

@@ -26,7 +26,7 @@
     dest: /etc/apt/preferences.d/containerd
     mode: 0644
 
-- name: Ensure containerd is installed
+- name: Ensure containerd is installed and up-to-date
   apt:
     name: "containerd.io={{ containerd_version }}*"
     state: present

roles/edgenet-kubernetes/tasks/containerd-redhat.yml

@@ -14,9 +14,22 @@
     group: root
     mode: 0644
 
-- name: Ensure containerd is installed
+- name: Ensure containerd is not version-locked
+  lineinfile:
+    path: /etc/yum/pluginconf.d/versionlock.list
+    line: "0:containerd.io*"
+    state: absent
+
+- name: Ensure containerd is installed and up-to-date
+  tags: ['skip_ansible_lint']
   yum:
     name: "containerd.io-*{{ containerd_version }}*"
-    state: present
+    state: latest
     update_cache: true
   notify: restart containerd
+
+- name: Ensure containerd is version-locked
+  lineinfile:
+    path: /etc/yum/pluginconf.d/versionlock.list
+    line: "0:containerd.io*"
+    state: present

roles/edgenet-kubernetes/tasks/kube-debian.yml

@@ -26,7 +26,7 @@
     dest: /etc/apt/preferences.d/kubernetes
     mode: 0644
 
-- name: Ensure Kubernetes packages are installed
+- name: Ensure Kubernetes packages are installed and up-to-date
   apt:
     name:
       - "kubeadm={{ kubernetes_version }}*"

roles/edgenet-kubernetes/tasks/kube-redhat.yml

@@ -17,12 +17,33 @@
     baseurl: "{{ kubernetes_yum_repo_url }}"
     gpgkey: "{{ kubernetes_yum_gpg_key }}"
 
-- name: Ensure Kubernetes packages are installed
+- name: Ensure Kubernetes is not version-locked
+  lineinfile:
+    path: /etc/yum/pluginconf.d/versionlock.list
+    line: "{{ item }}"
+    state: absent
+  loop:
+    - "0:kubeadm*"
+    - "0:kubectl*"
+    - "0:kubelet*"
+
+- name: Ensure Kubernetes packages are installed and up-to-date
+  tags: ['skip_ansible_lint']
   yum:
     name:
       - "kubeadm-*{{ kubernetes_version }}*"
       - "kubectl-*{{ kubernetes_version }}*"
       - "kubelet-*{{ kubernetes_version }}*"
-    state: present
+    state: latest
     update_cache: true
   notify: restart kubelet
+
+- name: Ensure Kubernetes is version-locked
+  lineinfile:
+    path: /etc/yum/pluginconf.d/versionlock.list
+    line: "{{ item }}"
+    state: present
+  loop:
+    - "0:kubeadm*"
+    - "0:kubectl*"
+    - "0:kubelet*"

roles/edgenet-kubernetes/tasks/main.yml

@@ -29,6 +29,12 @@
     content: 'Acquire::ForceIPv4 "true";'
   when: ansible_os_family == 'Debian'
 
+- name: Ensure `yum-versionlock` is installed
+  yum:
+    name: 'yum-versionlock'
+    state: present
+  when: ansible_os_family == 'RedHat'
+
 - name: Install containerd
   include_tasks: containerd.yml
 

roles/edgenet-kubernetes/tasks/wireguard.yml

@@ -15,7 +15,9 @@
 
 - name: Ensure the WireGuard kernel module is installed (CentOS, RHEL)
   yum:
-    name: kmod-wireguard
+    name:
+      - kernel-devel
+      - kmod-wireguard
     state: present
   when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'
 

vars/edgenet-production.yml

@@ -1,4 +1,4 @@
 # edgenet-kubernetes
 containerd_version: 1.4
 kubernetes_version: 1.21
-edgenet_node_version: 1.0.9
+edgenet_node_version: 1.0.10