{"id":130451,"date":"2022-12-12T08:00:00","date_gmt":"2022-12-12T08:00:00","guid":{"rendered":"https:\/\/fedoramagazine.org\/?p=37360"},"modified":"2022-12-12T08:00:00","modified_gmt":"2022-12-12T08:00:00","slug":"automate-container-management-on-fedora-linux-with-the-podman-linux-system-role","status":"publish","type":"post","link":"https:\/\/sickgaming.net\/blog\/2022\/12\/12\/automate-container-management-on-fedora-linux-with-the-podman-linux-system-role\/","title":{"rendered":"Automate container management on Fedora Linux with the Podman Linux System Role"},"content":{"rendered":"

Containers are a popular way to distribute and run software on Linux. One of the tools included in Fedora Linux to work with containers is the Pod Manager tool, also known as Podman<\/a>. This article describes the use of the Ansible Podman Linux System Roles to automate container management.<\/p>\n

<\/span> <\/p>\n

With Podman, you can quickly and easily download container images and run containers. For more information on Podman, check out the Getting Started section<\/a> on the podman.io<\/a> site. <\/p>\n

While Podman is very easy to use, many people are interested in automating Podman for a variety of reasons. For example, maybe you have multiple Fedora Linux systems that you would like to deploy a container workload across, or perhaps you’re a developer and would like to setup an automated process to deploy containers on your local workstation for testing purposes. Whether you are working with containers on a single system, or need to manage containers across a number of systems, automation can be critical to being efficient and saving time. <\/p>\n

Overview of Linux System Roles<\/h2>\n

Linux System Roles<\/a> are a set of Ansible roles\/collections that can help automate the configuration and management of several aspects of Fedora Linux, CentOS Stream, RHEL, and RHEL derivatives. Linux System Roles is packaged in Fedora as an RPM (linux-system-roles<\/em>) and is also available on Ansible Galaxy. For more information on Linux System Roles, and to see a list of included roles, refer to the Linux System Roles project page<\/a>.<\/p>\n

Linux System Roles recently added a new podman<\/a> role for automating the management of Podman containers. One of Podman’s unique features is that it is daemonless, so the podman<\/em> role directly sets the desired configuration on each host, and is capable of configuring the containers.conf<\/em>, containers-registries.conf<\/em>, containers-storage.conf<\/em>, and containers-policy.json<\/em> settings. <\/p>\n

Podman systemd integration and Kubernetes YAML support<\/h2>\n

The podman<\/em> system role utilizes the systemd integration with Kubernetes YAML<\/a> introduced in Podman version 4.2. Podman supports the ability to run containers based on Kubernetes YAML, which can make it easier to transition between Podman and Kubernetes. Podman 4.2 introduced a new podman-kube@.service<\/em> which uses systemd to manage containers defined in Kubernetes YAML. You’ll see an example of how the podman<\/em> system role utilizes this functionality below. <\/p>\n

Demo environment overview<\/h2>\n

In my environment I have four systems running Fedora Linux. The fedora-controlnode.example.com<\/em> system will be the Ansible control node — this is where I’ll install Ansible and Linux System Roles. The other three systems, fedora-node1.example.com<\/em>, fedora-node2.example.com<\/em>, and fedora3-node3.example.com<\/em> are the systems that I would like to deploy container workloads on to. <\/p>\n

On these three systems, I would like to deploy a Nextcloud<\/a> container. I would also like to deploy a web server container on these systems and run this as a non-privileged user (also referred to as a rootless container). I’ll use the httpd-24 container image<\/a> that is a Red Hat Universal Base Image<\/a> (UBI).<\/p>\n

Setting up the control node system<\/h2>\n

Starting on the fedora-controlnode.example.com<\/em> system, I’ll need to install the linux-system-roles<\/em> and ansible<\/em> packages:<\/p>\n

[ansible@fedora-controlnode ~]$ sudo dnf install linux-system-roles ansible <\/pre>\n
I’ll also need to configure SSH keys and the sudo configuration so that a user on the fedora-controlnode.example.com<\/em> host can authenticate and escalate to root privileges on each of the three managed nodes. In this example, I am using an account named ansible<\/em>. <\/p>\n
Defining the Kubernetes YAML for the Nextcloud container<\/h2>\n
I’ll create a Kubernetes YAML file named nextcloud.yml<\/em> with the following content that defines how I want the Nextcloud container<\/a> configured:<\/p>\n
apiVersion: v1\nkind: Pod\nmetadata: name: nextcloud\nspec: containers: - name: nextcloud image: docker.io\/library\/nextcloud ports: - containerPort: 80 hostPort: 8000 volumeMounts: - mountPath: \/var\/www\/html:Z name: nextcloud-html volumes: - name: nextcloud-html hostPath: path: \/nextcloud-html<\/pre>\n
The key parts of this YAML specify: <\/p>\n
    \n
  • the name of the container, <\/li>\n
  • the URL for the container image, <\/li>\n
  • that the container’s port 80 will be published on the host as port 8000, <\/li>\n
  • that the \/var\/www\/html<\/em> directory should use a volume mount using the \/nextcloud-html<\/em> directory on the host. <\/li>\n<\/ul>\n
    Defining the Kubernetes YAML for the web server<\/h2>\n
    I’d also like to deploy a container running a web server, so I’ll define the following Kubernetes YAML file for it, named ubi8-httpd.yml<\/em>:<\/p>\n
    apiVersion: v1\nkind: Pod\nmetadata: name: ubi8-httpd\nspec: containers: - name: ubi8-httpd image: registry.access.redhat.com\/ubi8\/httpd-24 ports: - containerPort: 8080 hostPort: 8080 volumeMounts: - mountPath: \/var\/www\/html:Z name: ubi8-html volumes: - name: ubi8-html hostPath: path: ubi8-html<\/pre>\n
    This is similar to the nextcloud.yml<\/em> file: <\/p>\n
      \n
    • specifying the name of the container,<\/li>\n
    • the URL for the container image, <\/li>\n
    • that the container’s port 8080 should be published on the host as port 8080, <\/li>\n
    • that the \/var\/www\/html<\/em> directory should use a volume mount using the ubi8-html<\/em> directory on the host. <\/li>\n<\/ul>\n
      Note that later on we’ll configure this container to run as a non-privileged user, so this path will be relative to the user’s home directory. <\/p>\n
      Defining the Ansible inventory file<\/h2>\n
      I need to define a Ansible inventory file that lists the host names of the systems I would like to deploy the containers on. I’ll create a simple inventory file, named inventory<\/em>, with the list of my three managed nodes:<\/p>\n
      fedora-node1.example.com\nfedora-node2.example.com\nfedora-node3.example.com<\/pre>\n
      Defining the Ansible playbook<\/h2>\n
      The final file I need to create is the actual Ansible playbook file, which I’ll name podman.yml<\/em> with the following content:<\/p>\n
      - name: Run the podman system role hosts: all vars: podman_firewall: - port: 8080\/tcp state: enabled - port: 8000\/tcp state: enabled podman_create_host_directories: true podman_host_directories: \"ubi8-html\": owner: ansible group: ansible mode: \"0755\" podman_kube_specs: - state: started run_as_user: ansible run_as_group: ansible kube_file_src: ubi8-httpd.yml - state: started kube_file_src: nextcloud.yml roles: - fedora.linux_system_roles.podman\n<\/mark>\n- name: Create index.html file hosts: all tasks: - ansible.builtin.copy: content: \"Hello from {{ ansible_hostname }}\" dest: \/home\/ansible\/ubi8-html\/index.html owner: ansible group: ansible mode: 0644 serole: object_r setype: container_file_t seuser: system_u<\/pre>\n
      This playbook contains two plays, the first is named Run the podman system role<\/em>. This play defines variables that control the podman<\/em> system role, which is called as part of this play. The variables defined are:<\/p>\n
        \n
      • podman_firewall<\/em>: specifies that port 8080\/tcp and 8000\/tcp should be enabled. These ports are used by the ubi8-httpd<\/em> and nextcloud<\/em> containers, respectively.<\/li>\n
      • podman_create_host_directories<\/em>: specifies that host directories defined in the Kubernetes files will be created if they don’t exist<\/li>\n
      • podman_host_directories<\/em>: Within the ubi8-httpd.html<\/em> Kubernetes YAML file, I defined a ubi8-html <\/em>volume. This variable specifies that this ubi8-html<\/em> directory on the hosts will be created with the ansible<\/em> owner and group, and with a 0755<\/em> mode. Note that the nextcloud-html<\/em> volume, defined in the nextcloud.yml<\/em> file, is not listed here so the default ownership and permissions will be used when the directory is created on the hosts. <\/li>\n
      • podman_kube_specs<\/em>: This lists the Kubernetes YAML files that the podman<\/em> system role should manage. It refers to the two files that were previously explained, ubi8-httpd.yml<\/em>, and nextcloud.yml<\/em> . Note that for the ubi8-httpd.yml<\/em> container, it is also specified that this should be run as the ansible<\/em> user and group. <\/li>\n<\/ul>\n
        The second play, Create index.html file<\/em>, uses the ansible.builtin.copy<\/em> module to deploy a index.html<\/em> file to the \/home\/ansible\/ubi8-html\/<\/em> directory. This will provide the web server running from the ubi8-html <\/em>containers content to serve. <\/p>\n
        Running the playbook<\/h2>\n
        The next step is to run the playbook from the fedora-controlnode.example.com<\/em> host with the following command:<\/p>\n
        [ansible@fedora-controlnode ~]$ ansible-playbook -i inventory -b podman.yml<\/pre>\n
        I’ll verify that the playbook completes successfully with no failed tasks:<\/p>\n
        \"\"<\/figure>\n
        At this point, the nextcloud<\/em> and ubi8-html<\/em> containers should be deployed on each of the three managed nodes. <\/p>\n
        Validating the Nextcloud containers <\/h2>\n
        Now, I’ll validate the successful deployment of the nextcloud<\/em> containers on the three managed nodes. I can validate that Nextcloud is accessible by connecting to each host on port 8000 using a web browser, which shows the Nextcloud configuration screen on each host:<\/p>\n
        \"\"<\/figure>\n
        I’ll further investigate the fedora-node1.example.com<\/em> host by connecting to it over SSH and using sudo to access a root shell:<\/p>\n
        [ansible@fedora-controlnode ~]$ ssh fedora-node1.example.com [ansible@fedora-node1 ~]$ sudo su - [root@fedora-node1 ~]# <\/pre>\n
        Run podman ps<\/em> to validate that the nextcloud<\/em> container is running:<\/p>\n
        [root@fedora-node1 ~]# podman ps\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n7b6b131a652d localhost\/podman-pause:4.2.1-1662580699 4 minutes ago Up 4 minutes ago 0aa0edcf4b08-service\n71a2a1a48232 localhost\/podman-pause:4.2.1-1662580699 4 minutes ago Up 4 minutes ago 0.0.0.0:8000->80\/tcp 8b226e4ad5c1-infra\nc307a07c7cae docker.io\/library\/nextcloud:latest apache2-foregroun... 4 minutes ago Up 4 minutes ago 0.0.0.0:8000->80\/tcp nextcloud-nextcloud<\/strong><\/pre>\n
        Validate that the \/nextcloud-html<\/em> directory on the host has been populated with content from the container:<\/p>\n
        [root@fedora-node1 ~]# ls -al \/nextcloud-html\/\ntotal 112\ndrwxr-xr-x. 1 33 tape 420 Nov 7 13:16 .\ndr-xr-xr-x. 1 root root 186 Nov 7 13:12 ..\ndrwxr-xr-x. 1 33 tape 880 Nov 7 13:16 3rdparty\ndrwxr-xr-x. 1 33 tape 1182 Nov 7 13:16 apps\n-rw-r--r--. 1 33 tape 19327 Nov 7 13:16 AUTHORS\ndrwxr-xr-x. 1 33 tape 408 Nov 7 13:17 config\n-rw-r--r--. 1 33 tape 4095 Nov 7 13:16 console.php\n-rw-r--r--. 1 33 tape 34520 Nov 7 13:16 COPYING\ndrwxr-xr-x. 1 33 tape 440 Nov 7 13:16 core\n...\n...<\/pre>\n
        I can also see that a systemd unit has created for this container:<\/p>\n
        [root@fedora-node1 ~]# systemctl list-units | grep nextcloud podman-kube@-etc-containers-ansible\\x2dkubernetes.d-nextcloud.yml.service loaded active running A template for running K8s workloads via podman-play-kube [root@fedora-node1 ~]# systemctl status podman-kube@-etc-containers-ansible\\\\x2dkubernetes.d-nextcloud.yml.service \u25cf podman-kube@-etc-containers-ansible\\x2dkubernetes.d-nextcloud.yml.service - A template for running K8s workloads via podman-play-kube Loaded: loaded (\/usr\/lib\/systemd\/system\/podman-kube@.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2022-11-07 13:16:52 MST; 7min ago Docs: man:podman-play-kube(1) Main PID: 7601 (conmon) Tasks: 3 (limit: 4655) Memory: 31.1M CPU: 2.562s\n...\n...<\/pre>\n
        Note that the name of the service is quite long because it refers to the name of the Kubernetes YAML file, \/etc\/containers\/ansible-kubernetes.d\/nextcloud.yml<\/em>. This file was deployed by the podman<\/em> system role. If I display the contents of the file, it matches the contents of the nextcloud.yml<\/em> Kubernetes YAML file I created on the control node host. <\/p>\n
        [root@fedora-node1 ~]# cat \/etc\/containers\/ansible-kubernetes.d\/nextcloud.yml apiVersion: v1\nkind: Pod\nmetadata: name: nextcloud\nspec: containers: - image: docker.io\/library\/nextcloud name: nextcloud ports: - containerPort: 80 hostPort: 8000 volumeMounts: - mountPath: \/var\/www\/html:Z name: nextcloud-html volumes: - hostPath: path: \/nextcloud-html name: nextcloud-html<\/pre>\n
        Validating the ubi8-httpd containers<\/h2>\n
        I’ll also validate that the ub8-httpd<\/em> container, which was deployed to run as the ansible<\/em> user and group, is working properly. Back on the fedora-controlnode.example.com<\/em> host, I’ll validate that I can access the web server on port 8080 on each of the three managed nodes:<\/p>\n
        [ansible@fedora-controlnode ~]$ for server in fedora-node1.example.com fedora-node2.example.com fedora-node3.example.com; do curl ${server}:8080; echo; done
        Hello from fedora-node1
        Hello from fedora-node2
        Hello from fedora-node3<\/pre>\n
        I’ll also connect to one of the managed nodes as the ansible<\/em> user to further investigate:<\/p>\n
        [ansible@fedora-controlnode ~]$ ssh fedora-node1.example.com\n[ansible@fedora-node1 ~]$ whoami\nansible<\/pre>\n
        I’ll run podman ps<\/em> and validate that the ubi8-httpd container is running:<\/p>\n
        [ansible@fedora-node1 ~]$ podman ps\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n7b42efd7c9c0 localhost\/podman-pause:4.2.1-1662580699 20 minutes ago Up 20 minutes ago 1b46d9874ed0-service\nf62b9a2ef9b8 localhost\/podman-pause:4.2.1-1662580699 20 minutes ago Up 20 minutes ago 0.0.0.0:8080->8080\/tcp 0938dc63acfd-infra\n4b3a64783aeb registry.access.redhat.com\/ubi8\/httpd-24:latest \/usr\/bin\/run-http... 20 minutes ago Up 20 minutes ago 0.0.0.0:8080->8080\/tcp ubi8-httpd-ubi8-httpd<\/strong><\/pre>\n
        This container was deployed as a non-privileged user (the ansible<\/em> user) so there is a systemd user instance running as the ansible<\/em> user. I’ll need to specify the –user<\/em> option on the systemctl<\/em> command when validating that the systemd unit was created and is running:<\/p>\n
        [ansible@fedora-node1 ~]$ systemctl --user list-units | grep ubi8 podman-kube@-home-ansible-.config-containers-ansible\\x2dkubernetes.d-ubi8\\x2dhttpd.yml.service loaded active running A template for running K8s workloads via podman-play-kube [ansible@fedora-node1 ~]$ systemctl --user status podman-kube@-home-ansible-.config-containers-ansible\\\\x2dkubernetes.d-ubi8\\\\x2dhttpd.yml.service \u25cf podman-kube@-home-ansible-.config-containers-ansible\\x2dkubernetes.d-ubi8\\x2dhttpd.yml.service - A template for running K8s workloads via podman-play-kube Loaded: loaded (\/usr\/lib\/systemd\/user\/podman-kube@.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2022-11-07 13:12:31 MST; 24min ago Docs: man:podman-play-kube(1) Main PID: 5260 (conmon) Tasks: 17 (limit: 4655) Memory: 9.3M CPU: 1.245s\n...\n...<\/pre>\n
        As previously mentioned, the systemd unit name is so long because it contains the path to the Kubernetes YAML file, which in this case is \/home\/ansible\/.config\/containers\/ansible-kubernetes.d\/ubi8-httpd.yml<\/em>. This file was deployed by the podman<\/em> system role and contains the contents of the ubi8-httpd.yml<\/em> file previously configured on the fedora-controlnode.example.com<\/em> host. <\/p>\n
        Validating containers automatically start at boot<\/h2>\n
        I’ll reboot the three managed nodes to validate that the containers automatically start up at boot. <\/p>\n
        After the reboot, the nextcloud<\/em> containers are still accessible on each host on port 8000, and the ubi8-httpd<\/em> containers are accessible on each host at port 8080. <\/p>\n
        The systemd units for the nextcloud<\/em> containers and ubi8-httpd<\/em> containers are both enabled to start at boot. However, note that the ubi8-httpd<\/em> container is running as a non-privileged user (the ansible<\/em> user) , so the podman<\/em> system role has automatically enabled user lingering for the ansible<\/em> user. This setting enables a systemd user instance to be started at boot, and to keep running when the user logs out, so that the container will automatically start at boot. <\/p>\n
        Conclusion<\/h2>\n
        The podman<\/em> Linux System Role can help automate the deployment of Podman containers across your Fedora Linux environment. You can also combine the podman<\/em> system role with the other Linux System Roles in the Fedora linux-system-roles<\/em> package to automate even more. For example, you could write a playbook that utilizes the storage<\/em> Linux System Role to configure filesystems across your environment, and then use the podman<\/em> system role to deploy containers that utilize those filesystems. <\/p>\n","protected":false},"excerpt":{"rendered":"
        Containers are a popular way to distribute and run software on Linux. One of the tools included in Fedora Linux to work with containers is the Pod Manager tool, also known as Podman. This article describes the use of the Ansible Podman Linux System Roles to automate container management. With Podman, you can quickly and […]<\/p>\n","protected":false},"author":2,"featured_media":130452,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[45,61,46,47],"class_list":["post-130451","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-fedora-os","tag-fedora","tag-fedora-project-community","tag-magazine","tag-news"],"_links":{"self":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/130451","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/comments?post=130451"}],"version-history":[{"count":0,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/130451\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media\/130452"}],"wp:attachment":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media?parent=130451"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/categories?post=130451"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/tags?post=130451"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}