Upgrade etcd to 3.7 for Kubernetes 1.37 (#13363)

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

README.md

@@ -112,7 +112,7 @@ Note:
 
 - Core
   - [kubernetes](https://github.com/kubernetes/kubernetes) 1.37.1
-  - [etcd](https://github.com/etcd-io/etcd) 3.6.14
+  - [etcd](https://github.com/etcd-io/etcd) 3.7.2
   - [docker](https://www.docker.com/) 28.3
   - [containerd](https://containerd.io/) 2.3.5
   - [cri-o](https://cri-o.io/) 1.36.5 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)

roles/etcd/tasks/check_upgrade.yml

@@ -0,0 +1,11 @@
+---
+# All members must run etcd 3.6.11 or later before the upgrade to 3.7.
+# https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/
+- name: Ensure etcd version is >=3.6.11 before upgrade to 3.7
+  when:
+    - etcd_cluster_setup
+    - etcd_current_version != ''
+    - etcd_current_version is version('3.6.11', '<')
+    - etcd_version is version('3.7.0', '>=')
+  fail:
+    msg: "You need to upgrade etcd to 3.6.11 or later before upgrade to 3.7. Current version is {{ etcd_current_version }}."

roles/etcd/tasks/install_docker.yml

@@ -28,6 +28,9 @@
     etcd_current_version: "{{ (etcd_current_docker_image.stdout | regex_search('.*:v([0-9]+\\.[0-9]+\\.[0-9]+)', '\\1'))[0] | default('') }}"
   when: etcd_cluster_setup
 
+- name: Check etcd upgrade path
+  import_tasks: check_upgrade.yml
+
 - name: Cleanup v2 store data
   import_tasks: clean_v2_store.yml
 

roles/etcd/tasks/install_host.yml

@@ -26,6 +26,9 @@
     etcd_current_version: "{{ (etcd_current_host_version.stdout | regex_search('etcd Version: ([0-9]+\\.[0-9]+\\.[0-9]+)', '\\1'))[0] | default('') }}"
   when: etcd_cluster_setup
 
+- name: Check etcd upgrade path
+  import_tasks: check_upgrade.yml
+
 - name: Cleanup v2 store data
   import_tasks: clean_v2_store.yml
 

roles/etcd/templates/etcd-events.env.j2

@@ -10,7 +10,6 @@ ETCD_HEARTBEAT_INTERVAL={{ etcd_heartbeat_interval }}
 ETCD_INITIAL_CLUSTER_TOKEN=k8s_events_etcd
 ETCD_LISTEN_PEER_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2382
 ETCD_NAME={{ etcd_member_name }}-events
-ETCD_PROXY=off
 ETCD_INITIAL_CLUSTER={{ etcd_events_peer_addresses }}
 ETCD_AUTO_COMPACTION_RETENTION={{ etcd_compaction_retention }}
 ETCD_SNAPSHOT_COUNT={{ etcd_snapshot_count }}

roles/etcd/templates/etcd.env.j2

@@ -16,7 +16,6 @@ ETCD_HEARTBEAT_INTERVAL={{ etcd_heartbeat_interval }}
 ETCD_INITIAL_CLUSTER_TOKEN=k8s_etcd
 ETCD_LISTEN_PEER_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2380
 ETCD_NAME={{ etcd_member_name }}
-ETCD_PROXY=off
 ETCD_INITIAL_CLUSTER={{ etcd_peer_addresses }}
 ETCD_AUTO_COMPACTION_RETENTION={{ etcd_compaction_retention }}
 ETCD_SNAPSHOT_COUNT={{ etcd_snapshot_count }}
@@ -53,14 +52,14 @@ ETCDCTL_CERT={{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem
 
 # ETCD 3.5.x issue
 # https://groups.google.com/a/kubernetes.io/g/dev/c/B7gJs88XtQc/m/rSgNOzV2BwAJ?utm_medium=email&utm_source=footer
-ETCD_EXPERIMENTAL_INITIAL_CORRUPT_CHECK={{ etcd_experimental_initial_corrupt_check }}
+ETCD_FEATURE_GATES=InitialCorruptCheck={{ etcd_experimental_initial_corrupt_check }}
 
 {% if etcd_experimental_enable_distributed_tracing %}
-ETCD_EXPERIMENTAL_ENABLE_DISTRIBUTED_TRACING=true
-ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_SAMPLING_RATE={{ etcd_experimental_distributed_tracing_sample_rate }}
-ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_ADDRESS={{ etcd_experimental_distributed_tracing_address }}
-ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_SERVICE_NAME={{ etcd_experimental_distributed_tracing_service_name }}
-ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_INSTANCE_ID={{ etcd_member_name }}
+ETCD_ENABLE_DISTRIBUTED_TRACING=true
+ETCD_DISTRIBUTED_TRACING_SAMPLING_RATE={{ etcd_experimental_distributed_tracing_sample_rate }}
+ETCD_DISTRIBUTED_TRACING_ADDRESS={{ etcd_experimental_distributed_tracing_address }}
+ETCD_DISTRIBUTED_TRACING_SERVICE_NAME={{ etcd_experimental_distributed_tracing_service_name }}
+ETCD_DISTRIBUTED_TRACING_INSTANCE_ID={{ etcd_member_name }}
 {% endif %}
 
-ETCD_EXPERIMENTAL_WATCH_PROGRESS_NOTIFY_INTERVAL={{ etcd_experimental_watch_progress_notify_interval }}
+ETCD_WATCH_PROGRESS_NOTIFY_INTERVAL={{ etcd_experimental_watch_progress_notify_interval }}

roles/etcd_defaults/defaults/main.yml

@@ -114,6 +114,7 @@ etcd_retries: 4
 
 # ETCD 3.5.x issue
 # https://groups.google.com/a/kubernetes.io/g/dev/c/B7gJs88XtQc/m/rSgNOzV2BwAJ?utm_medium=email&utm_source=footer
+# Rendered as the InitialCorruptCheck feature gate (etcd 3.6+)
 etcd_experimental_initial_corrupt_check: true
 
 # Enable distributed tracing

roles/kubespray_defaults/vars/main/checksums.yml

@@ -278,6 +278,9 @@ kubeadm_checksums:
     1.35.0: sha256:77a466e1b6a8e28362a729541269de0a7c4a6b9e7770cccefcd745502e656b90
 etcd_binary_checksums:
   arm64:
+    3.7.2: sha256:5e3ff99d428fabfcefdc95348f6560d1efe835f7b2d1ab3334fe0831076966b7
+    3.7.1: sha256:d7e25e08f694b6ed7792fc7b7a891fe2c3f3d3dccfe2f3bfdb1547b0eb75b6da
+    3.7.0: sha256:e61a0954fe6a3003ee20f45e773e12e15c58323ea485deb8a55d065170cdafe8
     3.6.14: sha256:fa1b80565ee6fc2df1ae6f57a508b221f3ecc7d591c317c581cd8281b0842b3e
     3.6.13: sha256:5ab53ff70301fa9d782fa4b59fdfc1fae49ffdf427a0afb3cd313a93449800fc
     3.6.12: sha256:147afc710e164fa342ad8561bcca8903f3913bd9fb9ae0c83c857b1d868189cc
@@ -322,6 +325,9 @@ etcd_binary_checksums:
     3.5.7: sha256:1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51
     3.5.6: sha256:888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87
   amd64:
+    3.7.2: sha256:3a3679bc51a4ee9d30bccea1da7cd4fe62c6fc1d2ca1255068d2c53bf3026135
+    3.7.1: sha256:e8cd3fa8064c98137c5dbd78b76f969417ace84efb83c481041d7a52ffdd8fb9
+    3.7.0: sha256:b05cb07f5686dab8f9cdab89986b44f0dd24aaf5c627176aff325e21fa56f9f0
     3.6.14: sha256:ffe840ff9295808e88cce2794a18a5ac87f12a5203c8314d0bf6aa119b41bac5
     3.6.13: sha256:b4928654aed84d90952620c7144555e4186d795e1e7414e65fe0cf6265fd0465
     3.6.12: sha256:d2564bb50b58e52fbaf3bde4a9561a1d04e20cdc761f795580e4d615d5d41355
@@ -366,6 +372,9 @@ etcd_binary_checksums:
     3.5.7: sha256:a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396
     3.5.6: sha256:4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb
   ppc64le:
+    3.7.2: sha256:39842713685c2d33e7642be0e831d4158e3fd7022138356676c947322c0f64d3
+    3.7.1: sha256:7518b3f13963d600127c8a38f7b9a56dd8335130886df96a46c975021b33fd57
+    3.7.0: sha256:4e1096e501c31fae248c5004ed000959ae4a34ca4ab8d01cc7d798b97d0ca029
     3.6.14: sha256:1155c5eaff94906f138104f1df71d8c6c99e15ae24f50e5b7120bab25e5e2a1e
     3.6.13: sha256:9ce0405b83fa4c2fb92727ab6b46f011078057b28b3381c8ec6f42697eed33bd
     3.6.12: sha256:2888e1a443dfe2294b463fb1e735c0e57de9dc6cd02397ce1596ddf3ba78242d

roles/kubespray_defaults/vars/main/main.yml

@@ -12,7 +12,7 @@ pod_infra_supported_versions:
   '1.35': '3.10.1'
 
 etcd_supported_versions:
-  '1.37': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"
+  '1.37': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.8', '<'))[0] }}"
   '1.36': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"
   '1.35': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"