0.17.0+2.2.1 (#38)

githubixx · web-flow · commit e584883e4a15 · 2026-01-28T20:32:24.000+01:00
* chore(year): update year to 2026

* update containerd to v2.2.1

* feat(dropin): add conf.d include support in the default config

* CNI bin_dir in CRI runtime config: Change bin_dir to bin_dirs in the same section which supports a list of directories
diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,4 @@
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 molecule/kvm/.vagrant
diff --git a/.yamllint b/.yamllint
@@ -1,5 +1,5 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 extends: default
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,10 +1,22 @@
 <!--
-Copyright (C) 2021-2025 Robert Wimmer
+Copyright (C) 2021-2026 Robert Wimmer
 SPDX-License-Identifier: GPL-3.0-or-later
 -->
 
 # Changelog
 
+- **BREAKING**
+  - CNI `bin_dir` in CRI runtime config is deprecated (`plugins.'io.containerd.cri.v1.runtime'.cni.bin_dir`) and will be removed in containerd `v2.3`. It was replaced with `bin_dirs` in the same section which supports a list of directories. So, `plugins.'io.containerd.cri.v1.runtime'.cni.bin_dir = '/opt/cni/bin'` was changed to `plugins.'io.containerd.cri.v1.runtime'.cni.bin_dirs = ['/opt/cni/bin']` in `containerd_config` variable.
+
+- **UPDATE**
+  - update `containerd` to `v2.2.1`
+
+- **FEATURE**
+  - support `conf.d` include in the [default config](https://github.com/containerd/containerd/pull/12323)
+
+- **MOLECULE**
+  - add test for `conf.d` include feature
+
 ## 0.16.0+2.1.4
 
 - **Breaking**
diff --git a/README.md b/README.md
@@ -1,5 +1,5 @@
 <!--
-Copyright (C) 2021-2025 Robert Wimmer
+Copyright (C) 2021-2026 Robert Wimmer
 SPDX-License-Identifier: GPL-3.0-or-later
 -->
 
@@ -15,6 +15,20 @@ See full [CHANGELOG](https://github.com/githubixx/ansible-role-containerd/blob/m
 
 **Recent changes:**
 
+## 0.17.0+2.2.1
+
+- **BREAKING**
+  - CNI `bin_dir` in CRI runtime config is deprecated (`plugins.'io.containerd.cri.v1.runtime'.cni.bin_dir`) and will be removed in containerd `v2.3`. It was replaced with `bin_dirs` in the same section which supports a list of directories. So, `plugins.'io.containerd.cri.v1.runtime'.cni.bin_dir = '/opt/cni/bin'` was changed to `plugins.'io.containerd.cri.v1.runtime'.cni.bin_dirs = ['/opt/cni/bin']` in `containerd_config` variable.
+
+- **UPDATE**
+  - update `containerd` to `v2.2.1`
+
+- **FEATURE**
+  - support `conf.d` include in the [default config](https://github.com/containerd/containerd/pull/12323)
+
+- **MOLECULE**
+  - add test for `conf.d` include feature
+
 ## 0.16.0+2.1.4
 
 - **Breaking**
@@ -67,7 +81,7 @@ See full [CHANGELOG](https://github.com/githubixx/ansible-role-containerd/blob/m
 roles:
   - name: githubixx.containerd
     src: https://github.com/githubixx/ansible-role-containerd.git
-    version: 0.16.0+2.1.4
+    version: 0.17.0+2.2.1
 ```
 
 ## Role Variables
@@ -77,7 +91,7 @@ roles:
 containerd_flavor: "base"
 
 # containerd version to install
-containerd_version: "2.1.4"
+containerd_version: "2.2.1"
 
 # Directory where to store "containerd" binaries
 containerd_binary_directory: "/usr/local/bin"
@@ -159,8 +173,51 @@ containerd_config: |
               BinaryName = '/usr/local/sbin/runc'
               SystemdCgroup = true
       [plugins.'io.containerd.cri.v1.runtime'.cni]
-        bin_dir = '/opt/cni/bin'
+        bin_dirs = ['/opt/cni/bin']
         conf_dir = '/etc/cni/net.d'
+
+# Optional: containerd config drop-ins via `imports` (containerd >= v2.2.0)
+#
+# If you set `containerd_config_imports`, the role will:
+# - add `imports = [ ... ]` to the generated `config.toml` (unless your
+#   `containerd_config` already contains an `imports = ...` line)
+# - optionally create the referenced directories and manage `.toml` drop-in files
+#   defined under `configs`.
+#
+# Example 1: Enable imports and manage a few drop-in files in `/etc/containerd/conf.d`
+#
+# containerd_config_imports:
+#   - glob: "/etc/containerd/conf.d/*.toml"
+#     configs:
+#       10-nvidia.toml: |
+#         # Example override (use dotted keys to avoid table re-definition issues)
+#         disabled_plugins = []
+#
+#       20-cni.toml: |
+#         plugins.'io.containerd.cri.v1.runtime'.cni.bin_dirs = ['/opt/cni/bin']
+#         plugins.'io.containerd.cri.v1.runtime'.cni.conf_dir = '/etc/cni/net.d'
+#
+# Example 2: Import additional directories but manage files elsewhere
+#
+# containerd_config_imports:
+#   - glob: "/etc/containerd/conf.d/*.toml"
+#   - glob: "/etc/containerd/conf2.d/*.toml"
+#
+# Example 3: Override an existing default setting via a drop-in
+# (here: switch SystemdCgroup to false)
+#
+# containerd_config_imports:
+#   - glob: "/etc/containerd/conf.d/*.toml"
+#     configs:
+#       10-runc-options.toml: |
+#         plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options.SystemdCgroup = false
+#
+# Variable definition (default: disabled)
+containerd_config_imports: []
+
+# Validate the combined config (main config + imported drop-ins).
+# Uses: `containerd --config <path> config dump`. If invalid, the play fails.
+containerd_validate_config: false
 ```
 
 ## Dependencies
@@ -184,7 +241,7 @@ More examples are available in the [Molecule tests](https://github.com/githubixx
 
 ## Testing
 
-This role has a small test setup that is created using [Molecule](https://github.com/ansible-community/molecule), libvirt (vagrant-libvirt) and QEMU/KVM. Please see my blog post [Testing Ansible roles with Molecule, libvirt (vagrant-libvirt) and QEMU/KVM](https://www.tauceti.blog/posts/testing-ansible-roles-with-molecule-libvirt-vagrant-qemu-kvm/) how to setup. The test configuration is [here](https://github.com/githubixx/ansible-role-containerd/tree/master/molecule/kvm).
+This role has a small test setup that is created using [Molecule](https://github.com/ansible-community/molecule), libvirt (vagrant-libvirt) and QEMU/KVM. Please see my blog post [Testing Ansible roles with Molecule, libvirt (vagrant-libvirt) and QEMU/KVM](https://www.tauceti.blog/posts/testing-ansible-roles-with-molecule-libvirt-vagrant-qemu-kvm/) how to setup. The test configuration is in [molecule/kvm](https://github.com/githubixx/ansible-role-containerd/tree/master/molecule/kvm).
 
 Afterwards molecule can be executed:
 
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -1,12 +1,12 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 # Only value "base" is currently supported
 containerd_flavor: "base"
 
 # containerd version to install
-containerd_version: "2.1.4"
+containerd_version: "2.2.1"
 
 # Directory where to store "containerd" binaries
 containerd_binary_directory: "/usr/local/bin"
@@ -88,5 +88,48 @@ containerd_config: |
               BinaryName = '/usr/local/sbin/runc'
               SystemdCgroup = true
       [plugins.'io.containerd.cri.v1.runtime'.cni]
-        bin_dir = '/opt/cni/bin'
+        bin_dirs = ['/opt/cni/bin']
         conf_dir = '/etc/cni/net.d'
+
+# Optional: containerd config drop-ins via `imports` (containerd >= v2.2.0)
+#
+# If you set `containerd_config_imports`, the role will:
+# - add `imports = [ ... ]` to the generated `config.toml` (unless your
+#   `containerd_config` already contains an `imports = ...` line)
+# - optionally create the referenced directories and manage `.toml` drop-in files
+#   defined under `configs`.
+#
+# Example 1: Enable imports and manage a few drop-in files in `/etc/containerd/conf.d`
+#
+# containerd_config_imports:
+#   - glob: "/etc/containerd/conf.d/*.toml"
+#     configs:
+#       10-nvidia.toml: |
+#         # Example override (use dotted keys to avoid table re-definition issues)
+#         disabled_plugins = []
+#
+#       20-cni.toml: |
+#         plugins.'io.containerd.cri.v1.runtime'.cni.bin_dirs = ['/opt/cni/bin']
+#         plugins.'io.containerd.cri.v1.runtime'.cni.conf_dir = '/etc/cni/net.d'
+#
+# Example 2: Import additional directories but manage files elsewhere
+#
+# containerd_config_imports:
+#   - glob: "/etc/containerd/conf.d/*.toml"
+#   - glob: "/etc/containerd/conf2.d/*.toml"
+#
+# Example 3: Override an existing default setting via a drop-in
+# (here: switch SystemdCgroup to false)
+#
+# containerd_config_imports:
+#   - glob: "/etc/containerd/conf.d/*.toml"
+#     configs:
+#       10-runc-options.toml: |
+#         plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options.SystemdCgroup = false
+#
+# Variable definition (default: disabled)
+containerd_config_imports: []
+
+# Validate the combined config (main config + imported drop-ins).
+# Uses: `containerd --config <path> config dump`. If invalid, the play fails.
+containerd_validate_config: false
diff --git a/handlers/main.yml b/handlers/main.yml
@@ -1,5 +1,5 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 - name: Reload systemd
diff --git a/meta/main.yml b/meta/main.yml
@@ -1,5 +1,5 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 galaxy_info:
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
@@ -1,5 +1,5 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 - name: Install containerd
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
@@ -1,5 +1,5 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 dependency:
@@ -36,6 +36,18 @@ platforms:
         network_name: private_network
         type: static
         ip: 172.16.10.30
+  - name: test-cd-ubuntu2404-conf-d
+    box: alvistack/ubuntu-24.04
+    memory: 2048
+    cpus: 2
+    groups:
+      - ubuntu
+      - confd
+    interfaces:
+      - auto_config: true
+        network_name: private_network
+        type: static
+        ip: 172.16.10.40
   - name: test-cd-arch-base
     box: generic/arch
     memory: 2048
@@ -46,7 +58,7 @@ platforms:
       - auto_config: true
         network_name: private_network
         type: static
-        ip: 172.16.10.40
+        ip: 172.16.10.50
 
 provisioner:
   name: ansible
@@ -60,6 +72,14 @@ provisioner:
       all:
         containerd_tmp_directory: "/opt/tmp/containerd"
         containerd_binary_directory: "/usr/local/sbin"
+      test-cd-ubuntu2404-conf-d:
+        containerd_validate_config: true
+        containerd_config_imports:
+          - glob: "/etc/containerd/conf.d/*.toml"
+            configs:
+              10-molecule.toml: |
+                # Simple, non-critical override to prove imports work
+                plugins."io.containerd.cri.v1.runtime".max_container_log_line_size = 32768
 
 scenario:
   name: default
diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml
@@ -1,5 +1,5 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 - name: Run tasks for Archlinux
diff --git a/molecule/default/verify.yml b/molecule/default/verify.yml
@@ -1,12 +1,73 @@
 ---
-# Copyright (C) 2021-2025 Robert Wimmer
+# Copyright (C) 2021-2026 Robert Wimmer
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 - name: Verify setup
   hosts: all
   vars:
     containerd__nginx_version: "1.24"
+    # Molecule verifier doesn't automatically load role defaults, so provide
+    # safe fallbacks and discover the actual containerd binary path.
+    containerd__config_directory: "{{ containerd_config_directory | default('/etc/containerd') }}"
+    containerd__candidate_binaries:
+      - "{{ (containerd_binary_directory | default('/usr/local/sbin')) }}/containerd"
+      - "{{ (containerd_binary_directory | default('/usr/local/bin')) }}/containerd"
+      - "/usr/local/sbin/containerd"
+      - "/usr/local/bin/containerd"
+      - "/usr/bin/containerd"
   tasks:
+    - name: Locate containerd binary
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop: "{{ containerd__candidate_binaries }}"
+      register: containerd__binary_stats
+      changed_when: false
+
+    - name: Set containerd binary path
+      ansible.builtin.set_fact:
+        containerd__binary_path: "{{ (containerd__binary_stats.results | selectattr('stat.exists', '==', True) | map(attribute='stat.path') | first) }}"
+
+    - name: Assert containerd binary found
+      ansible.builtin.assert:
+        that:
+          - containerd__binary_path is defined
+          - containerd__binary_path | length > 0
+        fail_msg: "containerd binary not found in candidate paths: {{ containerd__candidate_binaries }}"
+
+    - name: Verify conf.d imports behavior
+      when: inventory_hostname == 'test-cd-ubuntu2404-conf-d'
+      block:
+        - name: Read containerd main config
+          ansible.builtin.slurp:
+            src: "{{ containerd__config_directory }}/config.toml"
+          register: containerd_config_toml
+
+        - name: Ensure imports are configured in main config
+          ansible.builtin.assert:
+            that:
+              - "(containerd_config_toml.content | b64decode) is regex('(?m)^\\s*imports\\s*=\\s*\\[.*conf\\.d/\\*\\.toml.*\\]')"
+
+        - name: Ensure conf.d drop-in file exists
+          ansible.builtin.stat:
+            path: "{{ containerd__config_directory }}/conf.d/10-molecule.toml"
+          register: containerd_dropin_stat
+
+        - name: Assert conf.d drop-in file exists
+          ansible.builtin.assert:
+            that:
+              - containerd_dropin_stat.stat.exists
+
+        - name: Dump containerd config (main + imports)
+          ansible.builtin.command:
+            cmd: "{{ containerd__binary_path }} --config {{ containerd__config_directory }}/config.toml config dump"
+          register: containerd_config_dump
+          changed_when: false
+
+        - name: Ensure conf.d drop-in override is present
+          ansible.builtin.assert:
+            that:
+              - "containerd_config_dump.stdout is regex('(?m)^\\s*max_container_log_line_size\\s*=\\s*32768\\s*$')"
+
     - name: Pull nginx image with ctr
       ansible.builtin.command:
         cmd: "ctr images pull docker.io/library/nginx:{{ containerd__nginx_version }}"
diff --git a/tasks/main.yml b/tasks/main.yml
diff --git a/tasks/manage_import.yml b/tasks/manage_import.yml
diff --git a/templates/etc/systemd/system/containerd.service.j2 b/templates/etc/systemd/system/containerd.service.j2
diff --git a/vars/flavor_base.yml b/vars/flavor_base.yml

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-# Copyright (C) 2021-2025 Robert Wimmer`
	`1`	`+# Copyright (C) 2021-2026 Robert Wimmer`
`2`	`2`	`# SPDX-License-Identifier: GPL-3.0-or-later`
`3`	`3`
`4`	`4`	`molecule/kvm/.vagrant`