* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
Cilium's init containers run as UID 0 with capabilities (including
CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin)
must be owned by root or it will fail with a permission error.
Add a pre-flight assert that fails fast with a clear message when
kube_network_plugin == cilium and kube_owner != root, instead of
changing CNI bin ownership defaults for all network plugins.
Remove the Flatcar/Fedora CoreOS exclusion from the wait handler
and unify the Flatcar-specific notify channel into the shared
"propagate resolvconf to k8s components" channel.
* Remove tag master
Following it's deprecation in 4b324cb0f (Rename master to control plane
- non-breaking changes only (#11394), 2024-09-06)
* Add fail fast path when using removed tags
- Used for the master tag, but this could be used for other things in
the future
The preinstall assert cover a number of things, many of which depends
only on the inventory, and can be run without any ansible_facts
collected.
Split them off to simplify re-ordering.
The versions which are by default derived from `kube_version` can break
the assert if kube_version start with `v`, because they use the start of
`kube_version` as dict key.
By putting them in their own assert, the first assert should trigger on
`kube_version`, with a more explicit error.
This has been deprecated for a long time, time to pull the plug.
We leave an assert for one release to have a straightforward failure if
some users were still using the variable.
Since 'none' can be, for instance, a manual calico deployment, don't
check whether there is enough ip for pods on a node, because the plugin
can use another mechanism than the podCIDR to allocate IPs.
When the etcd group is not specified we assume it's kube_control_plane.
In that case, etcd still can't be even, so instead of only checking the
etcd group we need to default to kube_control_plane
This avoids spurious failure with 'localhost'.
It should also be more correct the inventory contains uncached hosts
which are not in `k8s_cluster` and therefore should not be Kubespray
business.
(We still use hostvars for uncached hosts, because it's easier to select
on 'ansible_default_ipv4' that way and does not change the end result)
We use a lot of facts where variables are enough, and format too early,
which prevent reusing the variables in different contexts.
- Moves set_fact variables to the vars directory, remove unnecessary
intermediate variables, and render them at usage sites to only do logic
on native Ansible/Jinja lists.
- Use defaults/ rather than default filters for several variables.
Kay Yan
Max Gautier
emma034186-stack
Zakhar Dvurechensky
Nikhil Kumar
Sumit Solanki
R. P. Taylor
Yang-Ming Lin
Bas
David Bidorff
Anshuman Agarwala
ERIK
Kubernetes Prow Robot
ChengHao Yang
Jan Breitkopf
Boris