Extract tasks related to host DNS management from kubernetes/preinstall
into a new kubernetes/dns_config role.
Previously, kubernetes/preinstall was re-invoked at the end of cluster
playbooks with dns_late: true to apply resolvconf changes after cluster
DNS came up. Because of this reuse, several unrelated tasks in preinstall
were guarded with 'when: not dns_late'.
Move resolvconf, systemd-resolved, networkmanager-dns, and dhclient tasks,
along with their associated templates, facts, variables, and handlers, into
kubernetes/dns_config. Update cluster.yml, upgrade_cluster.yml, scale.yml,
and reset.yml to invoke the new role directly and remove dns_late guards.
Signed-off-by: Dasmat13 <gptdasmat@gmail.com>
* fix(etcd): ensure consistent certificate permissions on first etcd node
The etcd certificate generation script runs on the first etcd node and
creates certs with default ownership and permissions. Subsequent copy
tasks set explicit ownership and permissions on the remaining etcd
nodes, resulting in inconsistent permissions across the cluster.
This can cause issues such as etcd backup jobs failing on the first
node due to missing read access to certificate files.
Add an ansible.builtin.file task after cert generation to explicitly
set the correct ownership and permissions on the first etcd node.
* fix(etcd): guard client certificate permissions
* fix(etcd): set certificate permissions during installation
* fix: correct CiliumBGPNodeConfigOverride CRD wait condition and deprecate legacy BGP Peering Policy
- Fix copy-paste bug where cilium_bgp_advertisements was used instead of
cilium_bgp_node_config_overrides when waiting for the
CiliumBGPNodeConfigOverride CRD. This caused the CRD readiness check
to be skipped when only node config overrides were configured.
- Add deprecation notices across docs, sample inventory, and defaults
to guide users away from the legacy v2alpha1 CiliumBGPPeeringPolicy
toward the supported BGP v2 API variables.
* fix(cilium): simplify BGP node override condition
Dasmat Hansda