From a369d66c43a3fc4d9706c29da646d3b7180c061b Mon Sep 17 00:00:00 2001 From: Mehrdad Biukian <80095851+mehrdadbn9@users.noreply.github.com> Date: Thu, 3 Sep 2026 14:32:21 +0400 Subject: [PATCH] fix(calico): make IPv6 pool validation actually run (#13450) Three defects in the IPv6 branch of check.yml kept the IPv6 pool assertion from ever executing: 1. 'alico_ipv6 is defined' - typo of calico_ipv6, so the set_fact was always skipped (Jinja2 treats the undefined var as False). 2. The set_fact stored the pool as calico_pool_conf, overwriting the IPv4 pool fact on dual-stack clusters, while the IPv6 assertion gated on calico_pool_ipv6_conf - a name that was never set. 3. The assertion body also read calico_pool_conf, so even with the gate fixed it would validate against the IPv4 pool's values. Store the IPv6 pool as calico_pool_ipv6_conf, gate the set_fact on the registered calico_ipv6 result, and make the assertion read the IPv6 fact - mirroring the IPv4 pattern directly above. Verified with ansible-playbook on mocked calicoctl output: - old code: set_fact skipped, no validation (reproduces the report) - new code: mismatched blockSize caught with a clear assertion msg - matching config passes through unchanged Signed-off-by: Mehrdad Biukian Naeini --- roles/network_plugin/calico/tasks/check.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/roles/network_plugin/calico/tasks/check.yml b/roles/network_plugin/calico/tasks/check.yml index 94a49aead..2d7c5751b 100644 --- a/roles/network_plugin/calico/tasks/check.yml +++ b/roles/network_plugin/calico/tasks/check.yml @@ -186,10 +186,10 @@ - name: "Set calico_pool_ipv6_conf" set_fact: - calico_pool_conf: '{{ calico_ipv6.stdout | from_json }}' + calico_pool_ipv6_conf: '{{ calico_ipv6.stdout | from_json }}' when: - ipv6_stack | bool - - alico_ipv6 is defined + - calico_ipv6 is defined - calico_ipv6.rc == 0 and calico_ipv6.stdout run_once: true delegate_to: "{{ groups['kube_control_plane'][0] }}" @@ -197,10 +197,10 @@ - name: "Check if ipv6 inventory match current cluster configuration" assert: that: - - calico_pool_conf.spec.blockSize | int == calico_pool_blocksize_ipv6 | int - - calico_pool_conf.spec.cidr == (calico_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6)) - - not calico_pool_conf.spec.ipipMode is defined or calico_pool_conf.spec.ipipMode == calico_ipip_mode_ipv6 - - not calico_pool_conf.spec.vxlanMode is defined or calico_pool_conf.spec.vxlanMode == calico_vxlan_mode_ipv6 + - calico_pool_ipv6_conf.spec.blockSize | int == calico_pool_blocksize_ipv6 | int + - calico_pool_ipv6_conf.spec.cidr == (calico_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6)) + - not calico_pool_ipv6_conf.spec.ipipMode is defined or calico_pool_ipv6_conf.spec.ipipMode == calico_ipip_mode_ipv6 + - not calico_pool_ipv6_conf.spec.vxlanMode is defined or calico_pool_ipv6_conf.spec.vxlanMode == calico_vxlan_mode_ipv6 msg: "Your ipv6 inventory doesn't match the current cluster configuration" when: - ipv6_stack | bool