* fix(control-plane): fetch discovery kubeconfig when adding control plane nodes
The 'Get kubeconfig for join discovery process' task is run_once, so its
'when' is evaluated only for the first control plane node. On an existing
cluster that node has already run kubeadm, so the task is skipped for all
hosts and 'Copy discovery kubeconfig' fails on the new control plane nodes
with "'dict object' has no attribute 'stdout'" when
remove_anonymous_access (file discovery) is enabled.
Drop the kubeadm_already_run condition from the run_once fetch. The copy
and join tasks keep their per-host conditions.
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
* control-plane: mark discovery kubeconfig fetch as not changed
Co-authored-by: guoard <guoard@users.noreply.github.com>
---------
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
Co-authored-by: guoard <guoard@users.noreply.github.com>
Splits the definitions into two dicts, while joining then for now to
preserve the downloads dict.
Update all consumers of the variables, which are roughly:
- manual includes of the download role (which will be removed in the
short future)
- install tasks using the resolved 'dest' to find the artefacts
This will make further division of the downloads role easier.
kubeadm upgrade reads ClusterConfiguration only from the kubeadm-config
ConfigMap, so it keeps the old etcd version. The etcd version then
changes on all control plane nodes at the same time, and the control
plane stops. Upload the ClusterConfiguration first. Then kubeadm
upgrades etcd on one node at a time.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* feat: add preflight admission readiness check before kubeadm upgrade
- linked to issue #13139
- Add opt-in dry-run Job probe to verify the admission pipeline is ready before running kubeadm upgrade apply (workaround for Kubernetes #124237)
- Gate the check behind kubeadm_upgrade_preflight_check_enabled (default false) with configurable retries and delay
- Emit a warning instead of failing if the preflight check does not pass
* fix: refine preflight admission check Job and warning
- Use generateName for the dry-run preflight Job to avoid fixed-name collisions
- Expand the Kubernetes issue reference in the warning to a full GitHub URL
Created with AI-assistance
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
When joining a control plane node and "upgrading" the cluster setup (for
example, to update etcd addresses after adding a new etcd) in the same
playbook run, the node can take a bit of time to become ready after
joining.
This triggers a kubeadm preflight check (ControlPlaneNodesReady) in
kubeadm upgrade, which is run directly after the join tasks.
Add a configurable wait for the control plane node to become Ready to
fix this race condition.
Since we're not longer injecting pseudo DNS into /etc/hosts,
'lb-apiserver.kubernetes.local' (the previous default) won't resolve to
anything.
Instead, default to the loadbalancer IP if defined, or to the node local
loadbalancer if it's in use.
Make the necessary adjustements in use site to deal with ip addresses as
well as hostnames.
- invoke setup module only once to gather ipv4 and ipv6 addresses
- eliminate remaining use of `fallback_ip` and `fallback_ip6`, allowing
us to define (with `set_fact` all the "computed" IPs variable in one
go, since there is no longer a dependency between them.
Before "5ca23e3bf (Changed to use first_kube_control_plane to parse
kubeadm_certificate_key (#11875), 2025-01-14)", kubespray would have
problem adding new control planes when the order of the nodes in kubectl
output and the ansible inventory were not the same.
But the underlying problem is that the operation is fundamentally
something that should be done only once, and recorded for all host in
play.
Since `register` and `sef_fact` when used with `run_once` set the
variable for all the hosts, use it. Also allows to use the variable
directly instead of relying on hostvars to make the task more readable.
Most variables should have a default instead of relying on the default
filter.
(Note that the variable is misnomed, this should be certs and not keys,
but it's not worth breaking compat).
* control-plane: fix first_kube_control_plane delegation with kube_override_hostname
When kube_override_hostname is configured, the node names reported by
`kubectl get nodes` differ from the inventory_hostname known to Ansible.
This causes delegation failures in subsequent tasks since Ansible cannot
resolve the hostname from kubectl output to an inventory host.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: remove fragile first_control_plane selection logic
Current implementation breaks with kube_override_hostname and has
multiple edge cases. Drop until proper kubectl-based node lookup
can be implemented.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
Fixes a bug where `kube-apiserver` fails to start if the PodSecurity
configuration file doesn't have the `apiVersion` and `kind` keys.
Signed-off-by: Alejandro Macedo <alex.macedopereira@gmail.com>
Remove --auth-anonymous if kube_api_anonymous_auth in undefined, to avoid
compatibility errors with other arguments of the kube-apiserver, such as
--authentication-config when anonymous field is configured.
The validation step is moved to the end to avoid the loss of files that
may lead to verification failure.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
* Fix: check expiraty before renew
Since certificate renewal and container restarts involve higher risks,
they should be executed with extra caution.
* squash to Fix: check expiraty before renew
* squash to Fix: address more comments from VannTen
Signed-off-by: Peter Pan <Peter.Pan@daocloud.io>
---------
Signed-off-by: Peter Pan <Peter.Pan@daocloud.io>
SEONGHYUN HONGandguoard
Frank
Ali Afsharzadeh
Max Gautier
JaeyungLee
Javad
Dasmat Hansda
Jay.HandAli Afsharzadeh
felipe88alves
wangsifei99
Seena Fallah
ujstor
Nikhil Kumar
Justin Lamp
Chad Swenson
Srishti Jaiswal
Mohamed Omar Zaian
Hyeonki Hong
Alejandro Macedo
Ho Kim
Aman Shrivastava
Psycho Mantys
vdveldet
ERIK
_xat_
Kubernetes Prow Robot
Peter Pan
Imran Ahmed