From cc65b8d9e356c74d91f2a7359636e66cf846e886 Mon Sep 17 00:00:00 2001 From: Ali Afsharzadeh Date: Fri, 25 Sep 2026 09:46:30 +0330 Subject: [PATCH] Upgrade etcd to 3.7 for Kubernetes 1.37 (#13363) Signed-off-by: Ali Afsharzadeh --- README.md | 2 +- roles/etcd/tasks/check_upgrade.yml | 11 +++++++++++ roles/etcd/tasks/install_docker.yml | 3 +++ roles/etcd/tasks/install_host.yml | 3 +++ roles/etcd/templates/etcd-events.env.j2 | 1 - roles/etcd/templates/etcd.env.j2 | 15 +++++++-------- roles/etcd_defaults/defaults/main.yml | 1 + roles/kubespray_defaults/vars/main/checksums.yml | 9 +++++++++ roles/kubespray_defaults/vars/main/main.yml | 2 +- 9 files changed, 36 insertions(+), 11 deletions(-) create mode 100644 roles/etcd/tasks/check_upgrade.yml diff --git a/README.md b/README.md index 5989b8b06..3c18d199c 100644 --- a/README.md +++ b/README.md @@ -112,7 +112,7 @@ Note: - Core - [kubernetes](https://github.com/kubernetes/kubernetes) 1.37.1 - - [etcd](https://github.com/etcd-io/etcd) 3.6.14 + - [etcd](https://github.com/etcd-io/etcd) 3.7.2 - [docker](https://www.docker.com/) 28.3 - [containerd](https://containerd.io/) 2.3.5 - [cri-o](https://cri-o.io/) 1.36.5 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS) diff --git a/roles/etcd/tasks/check_upgrade.yml b/roles/etcd/tasks/check_upgrade.yml new file mode 100644 index 000000000..d703cecb9 --- /dev/null +++ b/roles/etcd/tasks/check_upgrade.yml @@ -0,0 +1,11 @@ +--- +# All members must run etcd 3.6.11 or later before the upgrade to 3.7. +# https://etcd.io/docs/v3.7/upgrades/upgrade_3_7/ +- name: Ensure etcd version is >=3.6.11 before upgrade to 3.7 + when: + - etcd_cluster_setup + - etcd_current_version != '' + - etcd_current_version is version('3.6.11', '<') + - etcd_version is version('3.7.0', '>=') + fail: + msg: "You need to upgrade etcd to 3.6.11 or later before upgrade to 3.7. Current version is {{ etcd_current_version }}." diff --git a/roles/etcd/tasks/install_docker.yml b/roles/etcd/tasks/install_docker.yml index f6e9067b7..bb05f6b4f 100644 --- a/roles/etcd/tasks/install_docker.yml +++ b/roles/etcd/tasks/install_docker.yml @@ -28,6 +28,9 @@ etcd_current_version: "{{ (etcd_current_docker_image.stdout | regex_search('.*:v([0-9]+\\.[0-9]+\\.[0-9]+)', '\\1'))[0] | default('') }}" when: etcd_cluster_setup +- name: Check etcd upgrade path + import_tasks: check_upgrade.yml + - name: Cleanup v2 store data import_tasks: clean_v2_store.yml diff --git a/roles/etcd/tasks/install_host.yml b/roles/etcd/tasks/install_host.yml index f76dd2df6..b59798c1b 100644 --- a/roles/etcd/tasks/install_host.yml +++ b/roles/etcd/tasks/install_host.yml @@ -26,6 +26,9 @@ etcd_current_version: "{{ (etcd_current_host_version.stdout | regex_search('etcd Version: ([0-9]+\\.[0-9]+\\.[0-9]+)', '\\1'))[0] | default('') }}" when: etcd_cluster_setup +- name: Check etcd upgrade path + import_tasks: check_upgrade.yml + - name: Cleanup v2 store data import_tasks: clean_v2_store.yml diff --git a/roles/etcd/templates/etcd-events.env.j2 b/roles/etcd/templates/etcd-events.env.j2 index 1c33856cb..cf08d4a10 100644 --- a/roles/etcd/templates/etcd-events.env.j2 +++ b/roles/etcd/templates/etcd-events.env.j2 @@ -10,7 +10,6 @@ ETCD_HEARTBEAT_INTERVAL={{ etcd_heartbeat_interval }} ETCD_INITIAL_CLUSTER_TOKEN=k8s_events_etcd ETCD_LISTEN_PEER_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2382 ETCD_NAME={{ etcd_member_name }}-events -ETCD_PROXY=off ETCD_INITIAL_CLUSTER={{ etcd_events_peer_addresses }} ETCD_AUTO_COMPACTION_RETENTION={{ etcd_compaction_retention }} ETCD_SNAPSHOT_COUNT={{ etcd_snapshot_count }} diff --git a/roles/etcd/templates/etcd.env.j2 b/roles/etcd/templates/etcd.env.j2 index 36bf59c5c..ec2a6828c 100644 --- a/roles/etcd/templates/etcd.env.j2 +++ b/roles/etcd/templates/etcd.env.j2 @@ -16,7 +16,6 @@ ETCD_HEARTBEAT_INTERVAL={{ etcd_heartbeat_interval }} ETCD_INITIAL_CLUSTER_TOKEN=k8s_etcd ETCD_LISTEN_PEER_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2380 ETCD_NAME={{ etcd_member_name }} -ETCD_PROXY=off ETCD_INITIAL_CLUSTER={{ etcd_peer_addresses }} ETCD_AUTO_COMPACTION_RETENTION={{ etcd_compaction_retention }} ETCD_SNAPSHOT_COUNT={{ etcd_snapshot_count }} @@ -53,14 +52,14 @@ ETCDCTL_CERT={{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem # ETCD 3.5.x issue # https://groups.google.com/a/kubernetes.io/g/dev/c/B7gJs88XtQc/m/rSgNOzV2BwAJ?utm_medium=email&utm_source=footer -ETCD_EXPERIMENTAL_INITIAL_CORRUPT_CHECK={{ etcd_experimental_initial_corrupt_check }} +ETCD_FEATURE_GATES=InitialCorruptCheck={{ etcd_experimental_initial_corrupt_check }} {% if etcd_experimental_enable_distributed_tracing %} -ETCD_EXPERIMENTAL_ENABLE_DISTRIBUTED_TRACING=true -ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_SAMPLING_RATE={{ etcd_experimental_distributed_tracing_sample_rate }} -ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_ADDRESS={{ etcd_experimental_distributed_tracing_address }} -ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_SERVICE_NAME={{ etcd_experimental_distributed_tracing_service_name }} -ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_INSTANCE_ID={{ etcd_member_name }} +ETCD_ENABLE_DISTRIBUTED_TRACING=true +ETCD_DISTRIBUTED_TRACING_SAMPLING_RATE={{ etcd_experimental_distributed_tracing_sample_rate }} +ETCD_DISTRIBUTED_TRACING_ADDRESS={{ etcd_experimental_distributed_tracing_address }} +ETCD_DISTRIBUTED_TRACING_SERVICE_NAME={{ etcd_experimental_distributed_tracing_service_name }} +ETCD_DISTRIBUTED_TRACING_INSTANCE_ID={{ etcd_member_name }} {% endif %} -ETCD_EXPERIMENTAL_WATCH_PROGRESS_NOTIFY_INTERVAL={{ etcd_experimental_watch_progress_notify_interval }} +ETCD_WATCH_PROGRESS_NOTIFY_INTERVAL={{ etcd_experimental_watch_progress_notify_interval }} diff --git a/roles/etcd_defaults/defaults/main.yml b/roles/etcd_defaults/defaults/main.yml index 937c7fa2f..7b5b5717d 100644 --- a/roles/etcd_defaults/defaults/main.yml +++ b/roles/etcd_defaults/defaults/main.yml @@ -114,6 +114,7 @@ etcd_retries: 4 # ETCD 3.5.x issue # https://groups.google.com/a/kubernetes.io/g/dev/c/B7gJs88XtQc/m/rSgNOzV2BwAJ?utm_medium=email&utm_source=footer +# Rendered as the InitialCorruptCheck feature gate (etcd 3.6+) etcd_experimental_initial_corrupt_check: true # Enable distributed tracing diff --git a/roles/kubespray_defaults/vars/main/checksums.yml b/roles/kubespray_defaults/vars/main/checksums.yml index b92848b6d..8e92b8ce0 100644 --- a/roles/kubespray_defaults/vars/main/checksums.yml +++ b/roles/kubespray_defaults/vars/main/checksums.yml @@ -278,6 +278,9 @@ kubeadm_checksums: 1.35.0: sha256:77a466e1b6a8e28362a729541269de0a7c4a6b9e7770cccefcd745502e656b90 etcd_binary_checksums: arm64: + 3.7.2: sha256:5e3ff99d428fabfcefdc95348f6560d1efe835f7b2d1ab3334fe0831076966b7 + 3.7.1: sha256:d7e25e08f694b6ed7792fc7b7a891fe2c3f3d3dccfe2f3bfdb1547b0eb75b6da + 3.7.0: sha256:e61a0954fe6a3003ee20f45e773e12e15c58323ea485deb8a55d065170cdafe8 3.6.14: sha256:fa1b80565ee6fc2df1ae6f57a508b221f3ecc7d591c317c581cd8281b0842b3e 3.6.13: sha256:5ab53ff70301fa9d782fa4b59fdfc1fae49ffdf427a0afb3cd313a93449800fc 3.6.12: sha256:147afc710e164fa342ad8561bcca8903f3913bd9fb9ae0c83c857b1d868189cc @@ -322,6 +325,9 @@ etcd_binary_checksums: 3.5.7: sha256:1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51 3.5.6: sha256:888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87 amd64: + 3.7.2: sha256:3a3679bc51a4ee9d30bccea1da7cd4fe62c6fc1d2ca1255068d2c53bf3026135 + 3.7.1: sha256:e8cd3fa8064c98137c5dbd78b76f969417ace84efb83c481041d7a52ffdd8fb9 + 3.7.0: sha256:b05cb07f5686dab8f9cdab89986b44f0dd24aaf5c627176aff325e21fa56f9f0 3.6.14: sha256:ffe840ff9295808e88cce2794a18a5ac87f12a5203c8314d0bf6aa119b41bac5 3.6.13: sha256:b4928654aed84d90952620c7144555e4186d795e1e7414e65fe0cf6265fd0465 3.6.12: sha256:d2564bb50b58e52fbaf3bde4a9561a1d04e20cdc761f795580e4d615d5d41355 @@ -366,6 +372,9 @@ etcd_binary_checksums: 3.5.7: sha256:a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396 3.5.6: sha256:4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb ppc64le: + 3.7.2: sha256:39842713685c2d33e7642be0e831d4158e3fd7022138356676c947322c0f64d3 + 3.7.1: sha256:7518b3f13963d600127c8a38f7b9a56dd8335130886df96a46c975021b33fd57 + 3.7.0: sha256:4e1096e501c31fae248c5004ed000959ae4a34ca4ab8d01cc7d798b97d0ca029 3.6.14: sha256:1155c5eaff94906f138104f1df71d8c6c99e15ae24f50e5b7120bab25e5e2a1e 3.6.13: sha256:9ce0405b83fa4c2fb92727ab6b46f011078057b28b3381c8ec6f42697eed33bd 3.6.12: sha256:2888e1a443dfe2294b463fb1e735c0e57de9dc6cd02397ce1596ddf3ba78242d diff --git a/roles/kubespray_defaults/vars/main/main.yml b/roles/kubespray_defaults/vars/main/main.yml index a50d37fba..893e91845 100644 --- a/roles/kubespray_defaults/vars/main/main.yml +++ b/roles/kubespray_defaults/vars/main/main.yml @@ -12,7 +12,7 @@ pod_infra_supported_versions: '1.35': '3.10.1' etcd_supported_versions: - '1.37': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}" + '1.37': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.8', '<'))[0] }}" '1.36': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}" '1.35': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"