From 6ff47af1ce5d6df46881993a2a8b8685357cdb52 Mon Sep 17 00:00:00 2001 From: Max Gautier Date: Thu, 17 Sep 2026 09:55:39 +0200 Subject: [PATCH] download: Remove checksums for all container The pull by digest hasn't been working since 800c84dcc (download: use full hash form (including hash alg), 2025-01-14), where the key was renamed to checksum, but the download_container still checked sha256. Stop pretending we pull by digest. --- roles/download/tasks/check_pull_required.yml | 10 ---- roles/download/tasks/set_container_facts.yml | 9 ---- .../defaults/main/download.yml | 47 +------------------ 3 files changed, 1 insertion(+), 65 deletions(-) diff --git a/roles/download/tasks/check_pull_required.yml b/roles/download/tasks/check_pull_required.yml index 5d7cc5cae..6c62ff519 100644 --- a/roles/download/tasks/check_pull_required.yml +++ b/roles/download/tasks/check_pull_required.yml @@ -12,13 +12,3 @@ set_fact: pull_required: "{{ (download.image_name | regex_replace('^docker\\.io/(library/)?', '')) not in docker_images.stdout.split(',') }}" when: not download_always_pull - -- name: Check_pull_required | Check that the local digest sha256 corresponds to the given image tag - assert: - that: "{{ download.repo }}:{{ download.tag }} in docker_images.stdout.split(',')" - when: - - not download_always_pull - - not pull_required - - pull_by_digest - tags: - - asserts diff --git a/roles/download/tasks/set_container_facts.yml b/roles/download/tasks/set_container_facts.yml index cbaf133e4..2a5e93adf 100644 --- a/roles/download/tasks/set_container_facts.yml +++ b/roles/download/tasks/set_container_facts.yml @@ -1,13 +1,4 @@ --- -- name: Set_container_facts | Set if containers should be pulled by digest - set_fact: - pull_by_digest: "{{ download.sha256 is defined and download.sha256 }}" - -- name: Set_container_facts | Define by what name to pull the image - set_fact: - image_reponame: >- - {%- if pull_by_digest %}{{ download.repo }}@sha256:{{ download.sha256 }}{%- else -%}{{ download.repo }}:{{ download.tag }}{%- endif -%} - - name: Set_container_facts | Define file name of image set_fact: image_filename: "{{ download.image_name | regex_replace('/|\0|:', '_') }}.tar" diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml index 7aecbb622..442436588 100644 --- a/roles/kubespray_defaults/defaults/main/download.yml +++ b/roles/kubespray_defaults/defaults/main/download.yml @@ -378,9 +378,7 @@ downloads: enabled: true dest: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ image_arch }}.tar.gz" image_name: "{{ etcd_image_repo }}:{{ etcd_image_tag }}" - checksum: >- - {{ etcd_binary_checksum if (etcd_deployment_type == 'host') - else etcd_digest_checksum | d(None) }} + checksum: "{{ etcd_binary_checksum if etcd_deployment_type == 'host' else None }}" url: "{{ etcd_download_url }}" unarchive: "{{ etcd_deployment_type == 'host' }}" owner: "root" @@ -586,7 +584,6 @@ downloads: enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}" container: true image_name: "{{ cilium_image_repo }}:{{ cilium_image_tag }}" - checksum: "{{ cilium_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -594,7 +591,6 @@ downloads: enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}" container: true image_name: "{{ cilium_operator_image_repo }}-generic:{{ cilium_operator_image_tag }}" - checksum: "{{ cilium_operator_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -602,7 +598,6 @@ downloads: enabled: "{{ cilium_enable_hubble }}" container: true image_name: "{{ cilium_hubble_relay_image_repo }}:{{ cilium_hubble_relay_image_tag }}" - checksum: "{{ cilium_hubble_relay_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -610,7 +605,6 @@ downloads: enabled: "{{ kube_network_plugin == 'cilium' }}" container: true image_name: "{{ cilium_certgen_image_repo }}:{{ cilium_certgen_image_tag }}" - checksum: "{{ cilium_certgen_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -618,7 +612,6 @@ downloads: enabled: "{{ cilium_enable_hubble }}" container: true image_name: "{{ cilium_hubble_ui_image_repo }}:{{ cilium_hubble_ui_image_tag }}" - checksum: "{{ cilium_hubble_ui_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -626,7 +619,6 @@ downloads: enabled: "{{ cilium_enable_hubble }}" container: true image_name: "{{ cilium_hubble_ui_backend_image_repo }}:{{ cilium_hubble_ui_backend_image_tag }}" - checksum: "{{ cilium_hubble_ui_backend_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -634,7 +626,6 @@ downloads: enabled: "{{ kube_network_plugin == 'cilium' }}" container: true image_name: "{{ cilium_envoy_image_repo }}:{{ cilium_envoy_image_tag }}" - checksum: "{{ cilium_envoy_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -654,7 +645,6 @@ downloads: enabled: "{{ kube_network_plugin_multus }}" container: true image_name: "{{ multus_image_repo }}:{{ multus_image_tag }}" - checksum: "{{ multus_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -662,7 +652,6 @@ downloads: enabled: "{{ kube_network_plugin == 'flannel' }}" container: true image_name: "{{ flannel_image_repo }}:{{ flannel_image_tag }}" - checksum: "{{ flannel_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -670,7 +659,6 @@ downloads: enabled: "{{ kube_network_plugin == 'flannel' }}" container: true image_name: "{{ flannel_init_image_repo }}:{{ flannel_init_image_tag }}" - checksum: "{{ flannel_init_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -690,7 +678,6 @@ downloads: enabled: "{{ kube_network_plugin == 'calico' }}" container: true image_name: "{{ calico_node_image_repo }}:{{ calico_node_image_tag }}" - checksum: "{{ calico_node_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -698,7 +685,6 @@ downloads: enabled: "{{ kube_network_plugin == 'calico' }}" container: true image_name: "{{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}" - checksum: "{{ calico_cni_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -706,7 +692,6 @@ downloads: enabled: "{{ enable_network_policy and kube_network_plugin in ['calico'] }}" container: true image_name: "{{ calico_policy_image_repo }}:{{ calico_policy_image_tag }}" - checksum: "{{ calico_policy_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -714,7 +699,6 @@ downloads: enabled: "{{ typha_enabled }}" container: true image_name: "{{ calico_typha_image_repo }}:{{ calico_typha_image_tag }}" - checksum: "{{ calico_typha_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -722,7 +706,6 @@ downloads: enabled: "{{ calico_apiserver_enabled }}" container: true image_name: "{{ calico_apiserver_image_repo }}:{{ calico_apiserver_image_tag }}" - checksum: "{{ calico_apiserver_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -741,7 +724,6 @@ downloads: enabled: "{{ kube_network_plugin == 'kube-ovn' }}" container: true image_name: "{{ kube_ovn_container_image_repo }}:{{ kube_ovn_container_image_tag }}" - checksum: "{{ kube_ovn_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -749,7 +731,6 @@ downloads: enabled: "{{ kube_network_plugin == 'kube-router' }}" container: true image_name: "{{ kube_router_image_repo }}:{{ kube_router_image_tag }}" - checksum: "{{ kube_router_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -757,7 +738,6 @@ downloads: enabled: true container: true image_name: "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}" - checksum: "{{ pod_infra_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -765,7 +745,6 @@ downloads: enabled: "{{ kube_vip_enabled }}" container: true image_name: "{{ kube_vip_image_repo }}:{{ kube_vip_image_tag }}" - checksum: "{{ kube_vip_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -773,7 +752,6 @@ downloads: enabled: "{{ loadbalancer_apiserver_localhost and loadbalancer_apiserver_type == 'nginx' }}" container: true image_name: "{{ nginx_image_repo }}:{{ nginx_image_tag }}" - checksum: "{{ nginx_digest_checksum | default(None) }}" groups: - kube_node @@ -781,7 +759,6 @@ downloads: enabled: "{{ loadbalancer_apiserver_localhost and loadbalancer_apiserver_type == 'haproxy' }}" container: true image_name: "{{ haproxy_image_repo }}:{{ haproxy_image_tag }}" - checksum: "{{ haproxy_digest_checksum | default(None) }}" groups: - kube_node @@ -789,7 +766,6 @@ downloads: enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] }}" container: true image_name: "{{ coredns_image_repo }}:{{ coredns_image_tag }}" - checksum: "{{ coredns_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -797,7 +773,6 @@ downloads: enabled: "{{ enable_nodelocaldns }}" container: true image_name: "{{ nodelocaldns_image_repo }}:{{ nodelocaldns_image_tag }}" - checksum: "{{ nodelocaldns_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -805,7 +780,6 @@ downloads: enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] and enable_dns_autoscaler }}" container: true image_name: "{{ dnsautoscaler_image_repo }}:{{ dnsautoscaler_image_tag }}" - checksum: "{{ dnsautoscaler_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -825,7 +799,6 @@ downloads: enabled: "{{ registry_enabled }}" container: true image_name: "{{ registry_image_repo }}:{{ registry_image_tag }}" - checksum: "{{ registry_digest_checksum | default(None) }}" groups: - kube_node @@ -833,7 +806,6 @@ downloads: enabled: "{{ metrics_server_enabled }}" container: true image_name: "{{ metrics_server_image_repo }}:{{ metrics_server_image_tag }}" - checksum: "{{ metrics_server_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -841,7 +813,6 @@ downloads: enabled: "{{ local_volume_provisioner_enabled }}" container: true image_name: "{{ local_volume_provisioner_image_repo }}:{{ local_volume_provisioner_image_tag }}" - checksum: "{{ local_volume_provisioner_digest_checksum | default(None) }}" groups: - kube_node @@ -849,7 +820,6 @@ downloads: enabled: "{{ local_path_provisioner_enabled }}" container: true image_name: "{{ local_path_provisioner_image_repo }}:{{ local_path_provisioner_image_tag }}" - checksum: "{{ local_path_provisioner_digest_checksum | default(None) }}" groups: - kube_node @@ -857,7 +827,6 @@ downloads: enabled: "{{ ingress_alb_enabled }}" container: true image_name: "{{ alb_ingress_image_repo }}:{{ alb_ingress_image_tag }}" - checksum: "{{ ingress_alb_controller_digest_checksum | default(None) }}" groups: - kube_node @@ -865,7 +834,6 @@ downloads: enabled: "{{ cert_manager_enabled }}" container: true image_name: "{{ cert_manager_controller_image_repo }}:{{ cert_manager_controller_image_tag }}" - checksum: "{{ cert_manager_controller_digest_checksum | default(None) }}" groups: - kube_node @@ -873,7 +841,6 @@ downloads: enabled: "{{ cert_manager_enabled }}" container: true image_name: "{{ cert_manager_cainjector_image_repo }}:{{ cert_manager_cainjector_image_tag }}" - checksum: "{{ cert_manager_cainjector_digest_checksum | default(None) }}" groups: - kube_node @@ -881,7 +848,6 @@ downloads: enabled: "{{ cert_manager_enabled }}" container: true image_name: "{{ cert_manager_webhook_image_repo }}:{{ cert_manager_webhook_image_tag }}" - checksum: "{{ cert_manager_webhook_digest_checksum | default(None) }}" groups: - kube_node @@ -913,7 +879,6 @@ downloads: enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}" container: true image_name: "{{ csi_attacher_image_repo }}:{{ csi_attacher_image_tag }}" - checksum: "{{ csi_attacher_digest_checksum | default(None) }}" groups: - kube_node @@ -921,7 +886,6 @@ downloads: enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}" container: true image_name: "{{ csi_provisioner_image_repo }}:{{ csi_provisioner_image_tag }}" - checksum: "{{ csi_provisioner_digest_checksum | default(None) }}" groups: - kube_node @@ -929,7 +893,6 @@ downloads: enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}" container: true image_name: "{{ csi_snapshotter_image_repo }}:{{ csi_snapshotter_image_tag }}" - checksum: "{{ csi_snapshotter_digest_checksum | default(None) }}" groups: - kube_node @@ -937,7 +900,6 @@ downloads: enabled: "{{ csi_snapshot_controller_enabled }}" container: true image_name: "{{ snapshot_controller_image_repo }}:{{ snapshot_controller_image_tag }}" - checksum: "{{ snapshot_controller_digest_checksum | default(None) }}" groups: - kube_node @@ -945,7 +907,6 @@ downloads: enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}" container: true image_name: "{{ csi_resizer_image_repo }}:{{ csi_resizer_image_tag }}" - checksum: "{{ csi_resizer_digest_checksum | default(None) }}" groups: - kube_node @@ -953,7 +914,6 @@ downloads: enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}" container: true image_name: "{{ csi_livenessprobe_image_repo }}:{{ csi_livenessprobe_image_tag }}" - checksum: "{{ csi_livenessprobe_digest_checksum | default(None) }}" groups: - kube_node @@ -961,7 +921,6 @@ downloads: enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}" container: true image_name: "{{ csi_node_driver_registrar_image_repo }}:{{ csi_node_driver_registrar_image_tag }}" - checksum: "{{ csi_node_driver_registrar_digest_checksum | default(None) }}" groups: - kube_node @@ -969,7 +928,6 @@ downloads: enabled: "{{ cinder_csi_enabled }}" container: true image_name: "{{ cinder_csi_plugin_image_repo }}:{{ cinder_csi_plugin_image_tag }}" - checksum: "{{ cinder_csi_plugin_digest_checksum | default(None) }}" groups: - kube_node @@ -977,7 +935,6 @@ downloads: enabled: "{{ aws_ebs_csi_enabled }}" container: true image_name: "{{ aws_ebs_csi_plugin_image_repo }}:{{ aws_ebs_csi_plugin_image_tag }}" - checksum: "{{ aws_ebs_csi_plugin_digest_checksum | default(None) }}" groups: - kube_node @@ -985,7 +942,6 @@ downloads: enabled: "{{ metallb_speaker_enabled }}" container: true image_name: "{{ metallb_speaker_image_repo }}:{{ metallb_image_tag }}" - checksum: "{{ metallb_speaker_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -993,7 +949,6 @@ downloads: enabled: "{{ metallb_enabled }}" container: true image_name: "{{ metallb_controller_image_repo }}:{{ metallb_image_tag }}" - checksum: "{{ metallb_controller_digest_checksum | default(None) }}" groups: - kube_control_plane