etcd_secret_changed is only set by check_certs.yml, which runs only
when cert_management is "script". With cert_management set to "none",
the "Restart etcd if certs changed" tasks fail because the variable is
undefined.
Signed-off-by: Luca Marsella <marsluca7@gmail.com>
* fix(metallb): wire metallb_controller_tolerations into controller Deployment
The metallb_controller_tolerations default was introduced in #7334 along
with template wiring, but the wiring was lost in #9120 when the manifest
was regenerated for the CRD switch. Since then the variable has been
defined in roles/kubernetes-apps/metallb/defaults/main.yml but silently
ignored: only metallb_config.controller.tolerations reached the
controller Deployment, while the speaker DaemonSet still honors both
metallb_speaker_tolerations and its metallb_config override.
Merge the role default with the optional metallb_config override, and
only emit the tolerations key when the merged list is non-empty, so
current rendering is unchanged for users who set neither variable.
Signed-off-by: vexsx <p.gheiratian1382@yahoo.com>
* Update metallb.yaml.j2
simplify metallb_controller_tolerations merge using default([])
---------
Signed-off-by: vexsx <p.gheiratian1382@yahoo.com>
Reuse the existing Hydrophone installation and preserve the single test selected by Sonobuoy Quick mode. Rename the opt-in variable to conformance_enabled and update the Elastx testcase.
* Use upstream GHCR images for Flannel and its CNI plugin
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Remove redundant Flannel image documentation
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix(control-plane): fetch discovery kubeconfig when adding control plane nodes
The 'Get kubeconfig for join discovery process' task is run_once, so its
'when' is evaluated only for the first control plane node. On an existing
cluster that node has already run kubeadm, so the task is skipped for all
hosts and 'Copy discovery kubeconfig' fails on the new control plane nodes
with "'dict object' has no attribute 'stdout'" when
remove_anonymous_access (file discovery) is enabled.
Drop the kubeadm_already_run condition from the run_once fetch. The copy
and join tasks keep their per-host conditions.
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
* control-plane: mark discovery kubeconfig fetch as not changed
Co-authored-by: guoard <guoard@users.noreply.github.com>
---------
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
Co-authored-by: guoard <guoard@users.noreply.github.com>
The etcd twin of "Join Member | Ensure member is in etcd-events cluster"
retries the etcdctl member list check (retries/delay/until), the events
copy does not: a transient etcdctl failure right after the member was
added - exactly when the events cluster quorum is shifting - aborts the
play on etcd_events_cluster deployments while the main etcd path rides
the same blip out. Mirror the twin's retry block with the events register
variable. Second instance of the etcd/etcd-events task divergence; the
first was #13640.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
The [[:alnum:]]* capture truncates interface names at the first character
that is not a letter or digit: eth0.100 (VLAN) becomes eth0, br-9a93...
becomes br, bond0.200 becomes bond0. The result feeds
node_default_gateway_interface, which the macvlan MASQUERADE rules use as
the -o match (RedHat post-up/post-down and the Flatcar NAT service under
enable_nat_default_gateway), so pod traffic egressing the default gateway
loses NAT because the rule references a wrong or nonexistent interface.
Capture the whole whitespace-delimited token after ' dev ' instead. The
leading space also keeps the greedy match from latching onto names that
themselves end in 'dev' (e.g. lan-dev).
Splits the definitions into two dicts, while joining then for now to
preserve the downloads dict.
Update all consumers of the variables, which are roughly:
- manual includes of the download role (which will be removed in the
short future)
- install tasks using the resolved 'dest' to find the artefacts
This will make further division of the downloads role easier.
join_etcd_member.yml tolerates 'Peer URLs already exists' since #6587,
but the etcd-events twin was missed: when a previous run was interrupted
after the member was added, the re-run keeps retrying etcdctl member add
until etcd_retries is exhausted and aborts the play. Mirror the exact
until/failed_when pair from the etcd version.
* Pin the exoscale terraform provider below 0.75
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* Use lowercase state for exoscale compute instances
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
With an empty 'ip netns list' (the common case), xargs without -r still
runs 'ip netns delete' once with no argument. That fails, so the && chain
short-circuits and 'crictl rmp -a -f' never runs: the rescue path leaves
the pod sandboxes behind, which is exactly what it is there to clean up.
Other tasks in the same file already use xargs -r.
calico-kube-controllers ran without the loadbalancer controller, so
Service LoadBalancer IPs were never allocated from Calico IP pools.
Add it to both datastore lists on Calico 3.30.0 and later, where the
controller exists, and make the lists configurable.
Signed-off-by: Jathavedhan M <jathavedhan.m@ibm.com>
* chore: remove unused Vagrant release image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: keep Vagrant image retirement in release notes
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* ci: run the Ansible controller as an unprivileged user
* ci: clarify non-root controller check
* ci: make the sudo privilege check fail when sudo succeeds
Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds.
Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.
* chore: remove upgrade shims shipped in 2.31.0 and 2.32.0
* fix(validate_inventory): anchor every name in the removed_vars regex
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Argo CD publishes its tested Kubernetes versions at
https://argo-cd.readthedocs.io/en/stable/operator-manual/tested-kubernetes-versions/
3.5.3 is the latest available Argo CD release. Its matrix covers v1.33
through v1.36, which does not include the v1.37.1 shipped by this
branch, so this is the best available option rather than a combination
upstream has marked as tested. The 2.14 series is no longer listed on
that matrix.
argocd_version is derived from the first entry of
argocd_install_checksums, so adding the checksum for 3.5.3 at the top
of the list selects it.
kubeadm upgrade reads ClusterConfiguration only from the kubeadm-config
ConfigMap, so it keeps the old etcd version. The etcd version then
changes on all control plane nodes at the same time, and the control
plane stops. Upload the ClusterConfiguration first. Then kubeadm
upgrades etcd on one node at a time.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Luca Marsella
MohammadReza
Ali Afsharzadeh
dependabot[bot]
Parsa Gheiratian
Frank
Kay Yan
SEONGHYUN HONGandguoard
Immanuel Tikhonov
longxiucai
Mathieu Parent
Max Gautierandgithub-actions[bot]
Arman
JaeyungLee
Javad
Dasmat Hansda
Jathavedhan
Jay.HandAli Afsharzadeh
ERIK
ChengHao Yang
Farshad Asadpour