Remove support and CI for EOL Debian 11 (#13483)

- also remove macvlan on debian support since the role works neither on
  debian 12 nor 13
- macvlan is no longer tested in CI as it does not work on rockylinux10
  either

.gitlab-ci/kubevirt.yml

@@ -36,28 +36,27 @@ pr:
       - TESTCASE:
           - almalinux9-crio
           - almalinux9-kube-ovn
-          - debian11-calico-collection
-          - debian11-macvlan
           - debian12-cilium
+          - debian13-calico-collection
           - debian13-cilium
-          - fedora42-kube-router
-          - fedora43-kube-router
           - fedora42-calico
-          - rockylinux9-cilium
-          - rockylinux10-cilium
+          - fedora42-kube-router
+          - fedora43-flannel-crio-collection-scale
+          - fedora43-kube-router
           - opensuse-leap16-calico
+          - rockylinux10-cilium
+          - rockylinux9-cilium
           - ubuntu22-calico-all-in-one
           - ubuntu22-calico-all-in-one-upgrade
-          - ubuntu24-calico-etcd-datastore
           - ubuntu24-calico-all-in-one-hardening
+          - ubuntu24-calico-etcd-datastore
           - ubuntu24-cilium-sep
           - ubuntu24-crio-scale
           - ubuntu24-crio-upgrade
           - ubuntu24-flannel-collection
+          - ubuntu24-ha-separate-etcd
           - ubuntu24-kube-router-sep
           - ubuntu24-kube-router-svc-proxy
-          - ubuntu24-ha-separate-etcd
-          - fedora43-flannel-crio-collection-scale
 
 # This is for flakey test so they don't disrupt the PR worklflow too much.
 # Jobs here MUST have a open issue so we don't lose sight of them
@@ -102,8 +101,8 @@ pr_full:
       - TESTCASE:
           - almalinux9-calico-ha-ebpf
           - almalinux9-calico-nodelocaldns-secondary
-          - debian11-custom-cni
-          - debian11-kubelet-csr-approver
+          - debian13-custom-cni
+          - debian13-kubelet-csr-approver
           - debian12-custom-cni-helm
           - fedora42-calico-swap-selinux
           - fedora42-crio
@@ -142,7 +141,7 @@ pr_extended:
           - almalinux9-calico
           - almalinux9-calico-remove-node
           - almalinux9-docker
-          - debian11-docker
+          - debian13-docker
           - debian12-calico
           - debian12-docker
           - debian13-calico
@@ -164,8 +163,8 @@ periodic:
   parallel:
     matrix:
       - TESTCASE:
-          - debian11-calico-upgrade
-          - debian11-calico-upgrade-once
+          - debian13-calico-upgrade
+          - debian13-calico-upgrade-once
           - debian12-cilium-svc-proxy
           - fedora42-calico-selinux
           - fedora43-calico-selinux

README.md

@@ -87,7 +87,7 @@ vagrant up
 ## Supported Linux Distributions
 
 - **Flatcar Container Linux by Kinvolk**
-- **Debian** Bookworm, Bullseye, Trixie
+- **Debian** Bookworm, Trixie
 - **Ubuntu** 22.04, 24.04
 - **CentOS Stream / RHEL** 9, 10
 - **Fedora** 39, 40, 41, 42

docs/developers/ci.md

@@ -4,57 +4,54 @@ To generate this Matrix run `./tests/scripts/md-table/main.py`
 
 ## containerd
 
-| OS / CNI | calico | cilium | custom_cni | flannel | kube-ovn | kube-router | macvlan |
-|---| --- | --- | --- | --- | --- | --- | --- |
-almalinux9 |  :white_check_mark: | :x: | :x: | :x: | :white_check_mark: | :x: | :x: |
-amazon |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-debian11 |  :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | :x: | :white_check_mark: |
-debian12 |  :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
-debian13 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-flatcar4081 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-openeuler24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-opensuse |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-rockylinux10 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
-rockylinux9 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
-ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-ubuntu24 |  :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | :x: | :white_check_mark: | :x: |
+| OS / CNI | calico | cilium | custom_cni | flannel | kube-ovn | kube-router |
+|---| --- | --- | --- | --- | --- | --- |
+almalinux9 |  :white_check_mark: | :x: | :x: | :x: | :white_check_mark: | :x: |
+amazon |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+debian12 |  :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: |
+debian13 |  :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: |
+fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: |
+fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: |
+flatcar4081 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+openeuler24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+opensuse |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+rockylinux10 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
+rockylinux9 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
+ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+ubuntu24 |  :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | :x: | :white_check_mark: |
 
 ## crio
 
-| OS / CNI | calico | cilium | custom_cni | flannel | kube-ovn | kube-router | macvlan |
-|---| --- | --- | --- | --- | --- | --- | --- |
-almalinux9 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-debian11 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-debian12 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :white_check_mark: | :x: | :x: | :x: |
-flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-opensuse |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-rockylinux9 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-ubuntu24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+| OS / CNI | calico | cilium | custom_cni | flannel | kube-ovn | kube-router |
+|---| --- | --- | --- | --- | --- | --- |
+almalinux9 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+amazon |  :x: | :x: | :x: | :x: | :x: | :x: |
+debian12 |  :x: | :x: | :x: | :x: | :x: | :x: |
+debian13 |  :x: | :x: | :x: | :x: | :x: | :x: |
+fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :white_check_mark: | :x: | :x: |
+flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: |
+openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: |
+opensuse |  :x: | :x: | :x: | :x: | :x: | :x: |
+rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: |
+rockylinux9 |  :x: | :x: | :x: | :x: | :x: | :x: |
+ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+ubuntu24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
 
 ## docker
 
-| OS / CNI | calico | cilium | custom_cni | flannel | kube-ovn | kube-router | macvlan |
-|---| --- | --- | --- | --- | --- | --- | --- |
-almalinux9 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-debian11 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-debian12 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-opensuse |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-rockylinux9 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-ubuntu24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+| OS / CNI | calico | cilium | custom_cni | flannel | kube-ovn | kube-router |
+|---| --- | --- | --- | --- | --- | --- |
+almalinux9 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+amazon |  :x: | :x: | :x: | :x: | :x: | :x: |
+debian12 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+debian13 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: |
+openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: |
+opensuse |  :x: | :x: | :x: | :x: | :x: | :x: |
+rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: |
+rockylinux9 |  :x: | :x: | :x: | :x: | :x: | :x: |
+ubuntu22 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
+ubuntu24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: |

roles/network_plugin/macvlan/handlers/main.yml

@@ -7,8 +7,6 @@
       network
       {%- elif ansible_facts['distribution'] == "Ubuntu" and ansible_facts['distribution_release'] == "bionic" -%}
       systemd-networkd
-      {%- elif ansible_facts['os_family'] == "Debian" -%}
-      networking
       {%- endif %}
     state: restarted
   when: not ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and kube_network_plugin not in ['calico']

roles/network_plugin/macvlan/tasks/main.yml

@@ -19,14 +19,6 @@
   set_fact:
     node_default_gateway_interface: "{{ node_default_gateway_interface_cmd.stdout | trim }}"
 
-- name: Macvlan | Install network gateway interface on debian
-  template:
-    src: debian-network-macvlan.cfg.j2
-    dest: /etc/network/interfaces.d/60-mac0.cfg
-    mode: "0644"
-  notify: Macvlan | restart network
-  when: ansible_facts['os_family'] in ["Debian"]
-
 - name: Install macvlan config on RH distros
   when: ansible_facts['os_family'] == "RedHat"
   block:

roles/network_plugin/macvlan/templates/debian-network-macvlan.cfg.j2

@@ -1,26 +0,0 @@
-auto mac0
-iface mac0 inet static
-    address {{ node_pod_cidr|ansible.utils.ipaddr('net')|ansible.utils.ipaddr(1)|ansible.utils.ipaddr('address') }}
-    network {{ node_pod_cidr|ansible.utils.ipaddr('network') }}
-    netmask {{ node_pod_cidr|ansible.utils.ipaddr('netmask') }}
-    broadcast {{ node_pod_cidr|ansible.utils.ipaddr('broadcast') }}
-    pre-up ip link add link {{ macvlan_interface }} mac0 type macvlan mode bridge
-{% for host in groups['kube_node'] %}
-{% if hostvars[host]['access_ip'] is defined  %}
-{% if hostvars[host]['node_pod_cidr'] != node_pod_cidr  %}
-    post-up ip route add {{ hostvars[host]['node_pod_cidr'] }} via {{ hostvars[host]['access_ip'] }}
-{% endif %}
-{% endif %}
-{% endfor %}
-{% if enable_nat_default_gateway %}
-    post-up iptables -t nat -I POSTROUTING -s {{ node_pod_cidr|ansible.utils.ipaddr('net') }} -o {{ node_default_gateway_interface }} -j MASQUERADE
-{% endif %}
-{% for host in groups['kube_node'] %}
-{% if hostvars[host]['access_ip'] is defined  %}
-{% if hostvars[host]['node_pod_cidr'] != node_pod_cidr  %}
-    post-down ip route del {{ hostvars[host]['node_pod_cidr'] }} via {{ hostvars[host]['access_ip'] }}
-{% endif %}
-{% endif %}
-{% endfor %}
-    post-down iptables -t nat -D POSTROUTING -s {{ node_pod_cidr|ansible.utils.ipaddr('net') }} -o {{ node_default_gateway_interface }} -j MASQUERADE
-    post-down ip link delete mac0

roles/system_packages/vars/main.yml

@@ -43,7 +43,7 @@ pkgs:
   ebtables: []
   gnupg:
     - "{{ ansible_distribution == 'Debian' }}"
-    - "{{ ansible_distribution_major_version in ['11', '12'] }}"
+    - "{{ ansible_distribution_major_version == '12' }}"
     - "{{ 'k8s_cluster' in group_names }}"
   iproute:
     - "{{ ansible_os_family == 'RedHat' }}"

tests/files/debian11-calico-collection.yml

@@ -1,6 +0,0 @@
----
-# Instance settings
-cloud_image: debian-11
-
-# Use static containerd binary for older distributions like Debian 11.
-containerd_static_binary: true

tests/files/debian11-macvlan.yml

@@ -1,13 +0,0 @@
----
-# Instance settings
-cloud_image: debian-11
-
-# Kubespray settings
-kube_network_plugin: macvlan
-enable_nodelocaldns: false
-kube_proxy_masquerade_all: true
-macvlan_interface: "eth0"
-auto_renew_certificates: true
-
-# Use static containerd binary for older distributions like Debian 11.
-containerd_static_binary: true

tests/files/debian13-calico-collection.yml

@@ -0,0 +1,3 @@
+---
+# Instance settings
+cloud_image: debian-13

tests/files/debian13-calico-upgrade-once.yml

@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: debian-11
+cloud_image: debian-13
 
 # Kubespray settings
 download_run_once: true
@@ -13,6 +13,3 @@ calico_network_backend: bird
 
 # Needed to bypass deprecation check
 ignore_assert_errors: true
-
-# Use static containerd binary for older distributions like Debian 11.
-containerd_static_binary: true

tests/files/debian13-calico-upgrade.yml

@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: debian-11
+cloud_image: debian-13
 
 # Pin disabling ipip mode to ensure proper upgrade
 ipip: false
@@ -13,6 +13,3 @@ ignore_assert_errors: true
 
 # Remove anonymous access to cluster
 remove_anonymous_access: true
-
-# Use static containerd binary for older distributions like Debian 11.
-containerd_static_binary: true

tests/files/debian13-custom-cni.yml

@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: debian-11
+cloud_image: debian-13
 
 # Kubespray settings
 kube_owner: root
@@ -8,6 +8,3 @@ kube_network_plugin: custom_cni
 custom_cni_manifests:
   - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
 custom_cni_namespace: ""
-
-# Use static containerd binary for older distributions like Debian 11.
-containerd_static_binary: true

tests/files/debian13-docker.yml

@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: debian-11
+cloud_image: debian-13
 
 # Use docker
 container_manager: docker

tests/files/debian13-kubelet-csr-approver.yml

@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: debian-11
+cloud_image: debian-13
 
 # Kubespray settings
 kubelet_rotate_server_certificates: true
@@ -8,6 +8,3 @@ kubelet_csr_approver_enabled: true
 kubelet_csr_approver_values:
   # Do not check DNS resolution in testing (not recommended in production)
   bypassDnsResolution: true
-
-# Use static containerd binary for older distributions like Debian 11.
-containerd_static_binary: true