initial commit

Signed-off-by: Robert Günzler <r@gnzler.io>

14 files changed, 131 insertions, 0 deletions

diff --git a/bundles/containers/files/etc/containers/containers.conf.d/10-firewall-driver.conf b/bundles/containers/files/etc/containers/containers.conf.d/10-firewall-driver.conf
new file mode 100644
index 0000000..be33d99
--- /dev/null
+++ b/bundles/containers/files/etc/containers/containers.conf.d/10-firewall-driver.conf
@@ -0,0 +1,2 @@
+[network]
+firewall_driver = "nftables"
diff --git a/bundles/containers/files/etc/init.d/podman-healthcheck b/bundles/containers/files/etc/init.d/podman-healthcheck
new file mode 100644
index 0000000..8e12fa4
--- /dev/null
+++ b/bundles/containers/files/etc/init.d/podman-healthcheck
@@ -0,0 +1,11 @@
+#!/sbin/openrc-run
+
+description="Run podman healthchecks when containers start."
+
+supervisor=supervise-daemon
+command="/bin/podman-healthcheckd"
+
+depend()
+{
+        need localmount
+}
diff --git a/bundles/containers/files/etc/periodic/15min/podman-healthcheck b/bundles/containers/files/etc/periodic/15min/podman-healthcheck
new file mode 100755
index 0000000..7aa6d41
--- /dev/null
+++ b/bundles/containers/files/etc/periodic/15min/podman-healthcheck
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+/bin/podman-healthcheck >/dev/null 2>&1
+exit 0
diff --git a/bundles/containers/files/etc/periodic/weekly/podman-prune b/bundles/containers/files/etc/periodic/weekly/podman-prune
new file mode 100755
index 0000000..5715b95
--- /dev/null
+++ b/bundles/containers/files/etc/periodic/weekly/podman-prune
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+/usr/bin/podman system prune --force --all --volumes >/dev/null 2>&1
+exit 0
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/consumer-for b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/consumer-for
new file mode 100644
index 0000000..83c1762
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/consumer-for
@@ -0,0 +1 @@
++service-srv
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/notification-fd b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/notification-fd
new file mode 100644
index 0000000..00750ed
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/notification-fd
@@ -0,0 +1 @@
+3
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/pipeline-name b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/pipeline-name
new file mode 100644
index 0000000..0db7d83
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/pipeline-name
@@ -0,0 +1 @@
++service
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/run b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/run
new file mode 100644
index 0000000..d558f3c
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/run
@@ -0,0 +1,10 @@
+#!/bin/execlineb -P
+
+envfile -I /etc/s6-rc/system.conf
+importas -sCuD "/run/log" s6_log_dir s6_log_dir
+
+envfile -I /etc/s6-rc/+service.conf
+importas -sCuD "n3 s2000000 T" s6_log_directives s6_log_directives
+
+foreground { install -d ${s6_log_dir}/+service }
+exec -c s6-log -d3 -b -- ${s6_log_directives} ${s6_log_dir}/+service
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/type b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/type
new file mode 100644
index 0000000..5883cff
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/type
@@ -0,0 +1 @@
+longrun
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/producer-for b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/producer-for
new file mode 100644
index 0000000..cba6eea
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/producer-for
@@ -0,0 +1 @@
++service-log
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/run b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/run
new file mode 100755
index 0000000..3ca06e2
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/run
@@ -0,0 +1,23 @@
+#!/bin/execlineb -P
+
+# load location of deployments from system config
+envfile /etc/s6-rc/system.conf
+importas -iu deployments_dir deployments_dir
+
+# route all logs to stdout
+fdmove -c 2 1
+
+ifthenelse { eltest -e ${deployments_dir}/+service/secret.yaml }
+{
+	foreground { podman secret rm -i +service }
+	foreground { podman secret create +service ${deployments_dir}/+service/secret.yaml }
+}
+{
+	# noop
+}
+
+exec podman play kube \
+	--log-driver=passthrough \
+	--replace \
+	--wait \
+	${deployments_dir}/+service/kube.yaml
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/type b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/type
new file mode 100644
index 0000000..5883cff
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/type
@@ -0,0 +1 @@
+longrun
diff --git a/bundles/containers/items.py b/bundles/containers/items.py
new file mode 100644
index 0000000..eb28c44
--- /dev/null
+++ b/bundles/containers/items.py
@@ -0,0 +1,63 @@
+if node.os != "alpine":
+    raise BundleError(f"{node.name}: OS {node.os} is not supported.")
+
+from os.path import join
+
+# TODO: healthcheck metrics?
+svc_openrc = {
+    "podman-healthcheck": {
+        "runlevel": "default",
+        "enabled": True,
+        "needs": {"file:/etc/init.d/podman-healthcheck"},
+    },
+}
+
+files = {
+    "/etc/containers/containers.conf.d/10-firewall-driver.conf": {
+        "needs": {
+            "bundle:firewall",
+        },
+    },
+
+    "/etc/s6-rc/templates/container/+service-srv/run": { "mode": "0755" },
+    "/etc/s6-rc/templates/container/+service-log/run": { "mode": "0755" },
+    "/etc/s6-rc/services/default/contents.d/containers": {
+        "content_type": "text",
+        "content": "",
+        "triggers": {
+            "svc_openrc:s6-rc-up:restart",
+        },
+    },
+    "/etc/s6-rc/services/containers/type": {
+        "content_type": "text",
+        "content": "bundle",
+        "triggers": {
+            "svc_openrc:s6-rc-up:restart",
+        },
+    },
+
+    "/bin/podman-healthcheck": { "mode": "0755" },
+    "/etc/periodic/15min/podman-healthcheck": { "mode": "0755" },
+    "/etc/periodic/weekly/podman-prune": { "mode": "0755" },
+    "/bin/podman-healthcheckd": { "mode": "0755" },
+    "/etc/init.d/podman-healthcheck": { "mode": "0755" },
+}
+
+repo.libs.gen.add_files_recursive(
+    files,
+    join(repo.path, "bundles", "containers", "files"),
+)
+
+directories = {
+    "/etc/s6-rc/services/containers/contents.d": {}
+}
+
+for container, _ in node.metadata.get("containers", {}).items():
+    svc_s6rc[container] = {
+        "bundle": "containers",
+        "generate": "container",
+        "triggers": {
+            "svc_openrc:s6-rc-init:reload",
+            "svc_openrc:s6-rc-up:reload",
+        },
+    }
diff --git a/bundles/containers/metadata.py b/bundles/containers/metadata.py
new file mode 100644
index 0000000..dc5832c
--- /dev/null
+++ b/bundles/containers/metadata.py
@@ -0,0 +1,8 @@
+defaults = {
+    "apk": {
+        "packages": {
+            "crun": {},
+            "podman": {},
+        },
+    },
+}