The check compares the Calico IP pool CIDR with the inventory as
strings, so the same network in a different notation fails, for
example fd85:ee78:d8a6:202::1:0000/112 and fd85:ee78:d8a6:202::1:0/112.
Use ipaddr('net') on the two sides.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The bgp changes are a bit verbose, because I chose to reproduce the
exact semantics of the current code, so that the manifest handed to
calicoctl does not contain unset fields (instead of just using defaults
value).
It would be more readable to just accept default value in the
manifests, but might be a problem if there is other writer of the same
Calico resources.
* #13157: Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
Signed-off-by: root <kanyahal.abhishek@gmail.com>
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
---------
Signed-off-by: root <kanyahal.abhishek@gmail.com>
Three defects in the IPv6 branch of check.yml kept the IPv6 pool
assertion from ever executing:
1. 'alico_ipv6 is defined' - typo of calico_ipv6, so the set_fact
was always skipped (Jinja2 treats the undefined var as False).
2. The set_fact stored the pool as calico_pool_conf, overwriting the
IPv4 pool fact on dual-stack clusters, while the IPv6 assertion
gated on calico_pool_ipv6_conf - a name that was never set.
3. The assertion body also read calico_pool_conf, so even with the
gate fixed it would validate against the IPv4 pool's values.
Store the IPv6 pool as calico_pool_ipv6_conf, gate the set_fact on
the registered calico_ipv6 result, and make the assertion read the
IPv6 fact - mirroring the IPv4 pattern directly above.
Verified with ansible-playbook on mocked calicoctl output:
- old code: set_fact skipped, no validation (reproduces the report)
- new code: mismatched blockSize caught with a clear assertion msg
- matching config passes through unchanged
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
When loadbalancer_apiserver_localhost is enabled, Calico falls back to the
Kubernetes service IP because the kubernetes-services-endpoint ConfigMap is
empty. CNI then fails to reach the API server even though an nginx proxy is
listening on localhost.
Update kube_apiserver_global_endpoint to always reference the localhost load
balancer (respecting the configured port) and populate the ConfigMap for both
eBPF and localhost LB modes.
Add missing RBAC permissions for Calico apiserver to function correctly
with Kubernetes 1.33+
Changes:
1. Add K8s 1.33 ValidatingAdmissionPolicy resources to calico-webhook-reader
- validatingadmissionpolicies
- validatingadmissionpolicybindings
Kubernetes 1.33 introduced ValidatingAdmissionPolicy resources (KEP-3488)
that require explicit RBAC permissions. Without these changes, Calico
apiserver on k8s 1.33+ will not work and needless errors are logged
Upstream calico isn't doing that, and:
- this can cause throttling
- the cpu needed by calico is very cluster / workload dependent
- missing cpu limits will not starve other pods (unlike missing memory
requests), because the kernel scheduler will still gives priority to
other process in pods not exceeding their requests
Testing for group membership with group names makes Kubespray more
tolerant towards the structure of the inventory.
Where 'inventory_hostname in groups["some_group"] would fail if
"some_group" is not defined, '"some_group" in group_names' would not.
* make calico api server manifest backward compatible with version older than 3.27.3
Add 3.28.1 checksums
Add 3.28.0 checksums
Change default version to 3.27.3
* change default calico version to 3.28.1
* Set mount type to DirectoryOrCreate for hostPath needed by Calico
if node.projectcalico.org already existe patch node to set asNumber
instead of apply resource to prevent remove of existing fields feed by
calico-node pods
✅ Closes: 11096
* Disable control plane allocating podCIDR for nodes when using calico
Calico does not use the .spec.podCIDR field for its IP address
management.
Furthermore, it can false positives from the kube controller manager if
kube_network_node_prefix and calico_pool_blocksize are unaligned, which
is the case with the default shipped by kubespray.
If the subnets obtained from using kube_network_node_prefix are bigger,
this would result at some point in the control plane thinking it does
not have subnets left for a new node, while calico will work without
problems.
Explicitely set a default value of false for calico_ipam_host_local to
facilitate its use in templates.
* Don't default to kube_network_node_prefix for calico_pool_blocksize
They have different semantics: kube_network_node_prefix is intended to
be the size of the subnet for all pods on a node, while there can be
more than on calico block of the specified size (they are allocated on
demand).
Besides, this commit does not actually change anything, because the
current code is buggy: we don't ever default to
kube_network_node_prefix, since the variable is defined in the role
defaults.
* containerd: refactor handlers to use 'listen'
* cri-dockerd: refactor handlers to use 'listen'
* cri-o: refactor handlers to use 'listen'
* docker: refactor handlers to use 'listen'
* etcd: refactor handlers to use 'listen'
* control-plane: refactor handlers to use 'listen'
* kubeadm: refactor handlers to use 'listen'
* node: refactor handlers to use 'listen'
* preinstall: refactor handlers to use 'listen'
* calico: refactor handlers to use 'listen'
* kube-router: refactor handlers to use 'listen'
* macvlan: refactor handlers to use 'listen'
The blockSize attribute from Calico IPPool resources cannot be changed
once set [1]. Consequently, we use the one currently defined when
configuring the existing IPPool, avoiding upgrade errors by trying to
change it.
In particular, this can be useful when calico_pool_blocksize default
changes in kubespray, which would otherwise force users to add an
explicit setting to their inventories.
[1]: https://docs.tigera.io/calico/latest/reference/resources/ippool#spec
k8s-infra-cherrypick-robotandAli Afsharzadeh
Max Gautier
Abhishek Kanyahal
Mehrdad Biukian
Nikhil Kumar
Srishti Jaiswal
Chris Ricker
Takuya Murakami
mathgaming
ChengHao Yang
Boris
Antoine Legrand
c-romeo
Mohamed Omar Zaian
kyrie
Erwan Miran
Bogdan Sass
Ehsan Golpayegani
Vlad Korolev
Bas
MatthieuFin
Lihai Tu
RaSerge
Robert Volkmann
Olivier Levitt
Alexander