diff --git a/manifests/enable-coreos-podman-check.yaml b/manifests/enable-coreos-podman-check.yaml new file mode 100644 index 0000000000..3ecc5a8a2c --- /dev/null +++ b/manifests/enable-coreos-podman-check.yaml @@ -0,0 +1,2 @@ +ostree-layers: + - overlay/14container diff --git a/overlay.d/14container/usr/lib/systemd/system-preset/14-fcos.preset b/overlay.d/14container/usr/lib/systemd/system-preset/14-fcos.preset new file mode 100644 index 0000000000..b03b47b5f3 --- /dev/null +++ b/overlay.d/14container/usr/lib/systemd/system-preset/14-fcos.preset @@ -0,0 +1 @@ +enable coreos-podman-changes-check.service diff --git a/overlay.d/14container/usr/lib/systemd/system/coreos-podman-changes-check.service b/overlay.d/14container/usr/lib/systemd/system/coreos-podman-changes-check.service new file mode 100644 index 0000000000..f3cbb58145 --- /dev/null +++ b/overlay.d/14container/usr/lib/systemd/system/coreos-podman-changes-check.service @@ -0,0 +1,11 @@ +# This service checks if the system nodes are still using +# cgroups v1 and CNI networking. If so, they will be warned +# to move their nodes to cgroups v2 and netavark respectively. +[Unit] +Description=Check if nodes are still using cgroupv1 or CNI networking +[Service] +Type=oneshot +ExecStart=/usr/libexec/coreos-podman-changes-check +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target diff --git a/overlay.d/14container/usr/libexec/coreos-podman-changes-check b/overlay.d/14container/usr/libexec/coreos-podman-changes-check new file mode 100644 index 0000000000..6df9be8d36 --- /dev/null +++ b/overlay.d/14container/usr/libexec/coreos-podman-changes-check @@ -0,0 +1,33 @@ +#!/usr/bin/bash +# Podman is dropping support for cgroup v1 and CNI networking. +# Podman 5 changes: https://fedoraproject.org/wiki/Changes/Podman5 +# This script checks if the system nodes are still using +# cgroups v1 and CNI networking. If so, they will warned +# to move their nodes to cgroups v2 and netavark respectively. + +# Change the output color to yellow +warn=$(echo -e '\033[0;33m') +# No color +nc=$(echo -e '\033[0m') + +# For cgroup v2, the output is cgroup2fs. +# For cgroup v1, the output is tmpfs. +# Ref: https://kubernetes.io/docs/concepts/architecture/cgroups/#check-cgroup-version +# Update an existing system from cgroupsv1 to cgroupsv2 and immediately reboot +# Run $ sudo rpm-ostree kargs --delete=systemd.unified_cgroup_hierarchy --reboot + +cgroupVersion=$(stat -fc %T /sys/fs/cgroup/) + +if [[ $cgroupVersion == "tmpfs" ]]; then + echo -e "${warn}Podman is dropping support for cgroups v1. Move your nodes to cgroups v2 if not already${nc}" +fi + +# Podman supports two network backends Netavark and CNI. +# Netavark is the default network backend and was added in +# Podman version 4.0. CNI is deprecated and is removed +# in Podman version 5.0, in preference of Netavark. +podmanBackend=$(podman info --format "{{.Host.NetworkBackend}}") + +if [[ $podmanBackend != "netavark" ]]; then + echo -e "${warn}Podman is dropping support for CNI networking entirely. Switch to netavark${nc}" + fi