r/vmagent: Rework as container deployment

Like the _blackbox-exporter_ role, the _vmagent_ role now deploys
`vmagent` as a container.  This simplifies the process considerably,
eliminating the download/transfer step.

While refactoring this role, I also changed how the trusted CA
certificates are handled.  Rather than copy files, the role now expects
a `vmagent_ca_certs` variable.  This variable is a mapping of
certificate name (file name without extension) to PEM contents.  This
allows certificates to be defined using normal host/group variables.

roles/vmagent/defaults/main.yml

@@ -1,3 +1,8 @@
+vmagent_container_image_name: docker.io/victoriametrics/vmagent
+vmagent_container_image_tag: latest
+
+vmagent_ca_certs: {}
+
 vmagent_remotewrite_url: http://[::1]:8428/api/v1/write
 
 vmagent_scrape_interval: 1m

roles/vmagent/files/ca-certs/kube-root-ca.crt

@@ -1 +0,0 @@
-../../../../kube-root-ca.crt

roles/vmagent/files/vmagent.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=Victoria Metrics vmagent
-
-[Service]
-Type=exec
-Environment=httpListenAddr=[::1]:8429
-Environment=loggerDisableTimestamps=true
-EnvironmentFile=-/etc/sysconfig/vmagent
-ExecStart=/usr/bin/vmagent -enableTCP6 -envflag.enable
-User=victoriametrics
-
-[Install]
-WantedBy=multi-user.target

roles/vmagent/handlers/main.yml

@@ -8,6 +8,7 @@
     state: restarted
 
 - name: reload vmagent
-  uri:
+  service:
-    url: http://[::1]:8429/-/reload
+    name: vmagent
+    state: reloaded
   changed_when: true

roles/vmagent/tasks/deploy.yml

@@ -1,13 +1,27 @@
-- name: ensure victoria metrics user exists
+- name: ensure vmagent container image is present
-  user:
+  podman_image:
-    name: victoriametrics
+    name: '{{ vmagent_container_image_name }}'
-    system: true
+    tag: '{{ vmagent_container_image_tag }}'
-    home: /var/lib/victoria-metrics
-    createhome: false
-    shell: /sbin/nologin
     state: present
+    pull: '{{ vmagent_pull_image|d(false)|bool }}'
+  notify:
+  - restart vmagent
   tags:
-  - user
+  - container-image
+
+- name: ensure vmagent system container is configured
+  template:
+    src: vmagent.container.j2
+    dest: /etc/containers/systemd/vmagent.container
+    owner: root
+    group: root
+    mode: u=rw,go=r
+  notify:
+  - reload systemd
+  - restart vmagent
+  tags:
+  - container
+  - systemd
 
 - name: ensure /etc/sysconfig directory exists
   file:
@@ -48,20 +62,21 @@
 
 - name: ensure additional ca certificates are installed
   copy:
-    src: '{{ item }}'
+    content: '{{ item.1 }}'
-    dest: /etc/victoria-metrics/{{ item | basename }}
+    dest: /etc/victoria-metrics/{{ item.0 }}.crt
     mode: u=rw,go=r
     owner: root
     group: root
-  with_fileglob:
+  loop: '{{ vmagent_ca_certs|dictsort }}'
-  - ca-certs/{{ inventory_hostname }}/*.crt
-  - ca-certs/*.crt
   notify:
   - reload vmagent
   tags:
   - cert
   - scrape-config
 
+- name: flush handlers
+  meta: flush_handlers
+
 - name: ensure vmagent starts at boot
   service:
     name: vmagent

roles/vmagent/tasks/install.yml

@@ -1,11 +1,4 @@
-- name: ensure vmagent systemd unit is installed
+- name: ensure podman is installed
-  copy:
+  package:
-    src: vmagent.service
+    name: podman
-    dest: /etc/systemd/system/vmagent.service
+    state: present
-    mode: '0644'
-  notify:
-  - reload systemd
-  - restart vmagent
-  tags:
-  - service
-  - systemd

roles/vmagent/templates/vmagent.container.j2

@@ -0,0 +1,26 @@
+[Unit]
+Description=Victoria Metrics vmagent
+After=network.target
+Wants=network.target
+
+[Container]
+Image={{ vmagent_container_image_name }}:{{ vmagent_container_image_tag }}
+Pull=never
+Exec=-enableTCP6 -envflag.enable
+Environment=loggerDisableTimestamps=true
+EnvironmentFile=/etc/sysconfig/vmagent
+Mount=type=bind,source=/etc/victoria-metrics,target=/etc/victoria-metrics,readonly=true
+Mount=type=bind,source=/var/lib/victoria-metrics,target=/var/lib/victoria-metrics,chown=true,relabel=shared
+WorkingDir=/var/lib/victoria-metrics/vmagent
+ReadOnly=yes
+ReadOnlyTmpfs=yes
+NoNewPrivileges=yes
+User=212
+Group=212
+Network=host
+
+[Service]
+Restart=always
+RestartSec=1s
+ExecReload=/usr/bin/podman kill --cidfile=%t/%N.cid -s HUP
+StateDirectory=victoria-metrics victoria-metrics/vmagent