Update Enroot to install optional dependencies (#224)

* Initial commit for adding enroot optional packages

* Adding nvidia-container role for repository

Removing tty from gpg dearmor to prevent error in ansible build

* Fixes for RHEL based distros

* Update to address PR review

ansible/roles/enroot/defaults/main.yml

@@ -20,3 +20,4 @@
 enroot_version: 09ae4b2c18a18ed5ab34b7697006aa18697c4cec
 enroot_url: https://github.com/NVIDIA/enroot/
 enroot_installation_path: "{{ paths.install }}"
+enroot_install_optional_deps: true

ansible/roles/enroot/meta/main.yml

@@ -0,0 +1,18 @@
+---
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+dependencies:
+- role: nvidia_container_toolkit_repo
+  when: enroot_install_optional_deps

ansible/roles/enroot/tasks/main.yml

@@ -47,6 +47,12 @@
       name: '{{ enroot_runtime_dependencies }}'
       state: present
 
+  - name: Install enroot optional runtime dependencies
+    ansible.builtin.package:
+      name: '{{ enroot_optional_runtime_dependencies }}'
+      state: present
+    when: enroot_install_optional_deps
+
   - name: Download enroot
     ansible.builtin.git:
       repo: '{{ enroot_url }}'

ansible/roles/enroot/vars/debian.yml

@@ -29,3 +29,9 @@ enroot_runtime_dependencies:
 - squashfs-tools
 - parallel
 - zstd
+
+enroot_optional_runtime_dependencies:
+- fuse-overlayfs
+- libnvidia-container-tools
+- pigz
+- squashfuse

ansible/roles/enroot/vars/redhat.yml

@@ -27,3 +27,9 @@ enroot_runtime_dependencies:
 - squashfs-tools
 - parallel
 - zstd
+
+enroot_optional_runtime_dependencies:
+- fuse-overlayfs
+- libnvidia-container-tools
+- pigz
+- squashfuse

ansible/roles/nvidia_container_toolkit_repo/defaults/main.yml

@@ -0,0 +1,19 @@
+---
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+nvidia_gpg_key_url: https://nvidia.github.io/libnvidia-container/gpgkey
+nvidia_repo_url_deb: https://nvidia.github.io/libnvidia-container/stable/deb
+nvidia_gpg_key_deb: /etc/apt/keyrings/nvidia-container-toolkit-keyring.asc
+nvidia_repo_file_rpm: https://nvidia.github.io/libnvidia-container/stable/rpm/nvidia-container-toolkit.repo

ansible/roles/nvidia_container_toolkit_repo/tasks/main.yml

@@ -0,0 +1,24 @@
+---
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Include OS Family Dependent Tasks
+  include_tasks: '{{ item }}'
+  with_first_found:
+  - os/{{ ansible_distribution|lower }}-{{ ansible_distribution_version }}.yml
+  - os/{{ ansible_distribution|lower }}-{{ ansible_distribution_major_version }}.yml
+  - os/{{ ansible_distribution|lower }}.yml
+  - os/{{ ansible_os_family|lower }}-{{ ansible_distribution_version }}.yml
+  - os/{{ ansible_os_family|lower }}-{{ ansible_distribution_major_version }}.yml
+  - os/{{ ansible_os_family|lower }}.yml

ansible/roles/nvidia_container_toolkit_repo/tasks/os/debian.yml

@@ -0,0 +1,26 @@
+---
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Collect Nvidia Container Repo GPG Key
+  ansible.builtin.get_url:
+    url: "{{ nvidia_gpg_key_url }}"
+    dest: "{{ nvidia_gpg_key_deb }}"
+    mode: '0644'
+    force: true
+
+- name: Add Nvidia Container Repo
+  ansible.builtin.apt_repository:
+    repo: "deb [arch=amd64 signed-by={{ nvidia_gpg_key_deb }}] {{ nvidia_repo_url_deb }}/$(ARCH) /"
+    filename: nvidia-container-toolkit

ansible/roles/nvidia_container_toolkit_repo/tasks/os/redhat.yml

@@ -0,0 +1,19 @@
+---
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Add Nvidia Container Repo
+  ansible.builtin.get_url:
+    url: '{{ nvidia_repo_file_rpm }}'
+    dest: /etc/yum.repos.d/nvidia-container-toolkit.repo