etcd_secret_changed is only set by check_certs.yml, which runs only
when cert_management is "script". With cert_management set to "none",
the "Restart etcd if certs changed" tasks fail because the variable is
undefined.
Signed-off-by: Luca Marsella <marsluca7@gmail.com>
* fix(metallb): wire metallb_controller_tolerations into controller Deployment
The metallb_controller_tolerations default was introduced in #7334 along
with template wiring, but the wiring was lost in #9120 when the manifest
was regenerated for the CRD switch. Since then the variable has been
defined in roles/kubernetes-apps/metallb/defaults/main.yml but silently
ignored: only metallb_config.controller.tolerations reached the
controller Deployment, while the speaker DaemonSet still honors both
metallb_speaker_tolerations and its metallb_config override.
Merge the role default with the optional metallb_config override, and
only emit the tolerations key when the merged list is non-empty, so
current rendering is unchanged for users who set neither variable.
Signed-off-by: vexsx <p.gheiratian1382@yahoo.com>
* Update metallb.yaml.j2
simplify metallb_controller_tolerations merge using default([])
---------
Signed-off-by: vexsx <p.gheiratian1382@yahoo.com>
* Use upstream GHCR images for Flannel and its CNI plugin
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Remove redundant Flannel image documentation
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix(control-plane): fetch discovery kubeconfig when adding control plane nodes
The 'Get kubeconfig for join discovery process' task is run_once, so its
'when' is evaluated only for the first control plane node. On an existing
cluster that node has already run kubeadm, so the task is skipped for all
hosts and 'Copy discovery kubeconfig' fails on the new control plane nodes
with "'dict object' has no attribute 'stdout'" when
remove_anonymous_access (file discovery) is enabled.
Drop the kubeadm_already_run condition from the run_once fetch. The copy
and join tasks keep their per-host conditions.
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
* control-plane: mark discovery kubeconfig fetch as not changed
Co-authored-by: guoard <guoard@users.noreply.github.com>
---------
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
Co-authored-by: guoard <guoard@users.noreply.github.com>
The etcd twin of "Join Member | Ensure member is in etcd-events cluster"
retries the etcdctl member list check (retries/delay/until), the events
copy does not: a transient etcdctl failure right after the member was
added - exactly when the events cluster quorum is shifting - aborts the
play on etcd_events_cluster deployments while the main etcd path rides
the same blip out. Mirror the twin's retry block with the events register
variable. Second instance of the etcd/etcd-events task divergence; the
first was #13640.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
The [[:alnum:]]* capture truncates interface names at the first character
that is not a letter or digit: eth0.100 (VLAN) becomes eth0, br-9a93...
becomes br, bond0.200 becomes bond0. The result feeds
node_default_gateway_interface, which the macvlan MASQUERADE rules use as
the -o match (RedHat post-up/post-down and the Flatcar NAT service under
enable_nat_default_gateway), so pod traffic egressing the default gateway
loses NAT because the rule references a wrong or nonexistent interface.
Capture the whole whitespace-delimited token after ' dev ' instead. The
leading space also keeps the greedy match from latching onto names that
themselves end in 'dev' (e.g. lan-dev).
Splits the definitions into two dicts, while joining then for now to
preserve the downloads dict.
Update all consumers of the variables, which are roughly:
- manual includes of the download role (which will be removed in the
short future)
- install tasks using the resolved 'dest' to find the artefacts
This will make further division of the downloads role easier.
join_etcd_member.yml tolerates 'Peer URLs already exists' since #6587,
but the etcd-events twin was missed: when a previous run was interrupted
after the member was added, the re-run keeps retrying etcdctl member add
until etcd_retries is exhausted and aborts the play. Mirror the exact
until/failed_when pair from the etcd version.
With an empty 'ip netns list' (the common case), xargs without -r still
runs 'ip netns delete' once with no argument. That fails, so the && chain
short-circuits and 'crictl rmp -a -f' never runs: the rescue path leaves
the pod sandboxes behind, which is exactly what it is there to clean up.
Other tasks in the same file already use xargs -r.
calico-kube-controllers ran without the loadbalancer controller, so
Service LoadBalancer IPs were never allocated from Calico IP pools.
Add it to both datastore lists on Calico 3.30.0 and later, where the
controller exists, and make the lists configurable.
Signed-off-by: Jathavedhan M <jathavedhan.m@ibm.com>
* chore: remove upgrade shims shipped in 2.31.0 and 2.32.0
* fix(validate_inventory): anchor every name in the removed_vars regex
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Argo CD publishes its tested Kubernetes versions at
https://argo-cd.readthedocs.io/en/stable/operator-manual/tested-kubernetes-versions/
3.5.3 is the latest available Argo CD release. Its matrix covers v1.33
through v1.36, which does not include the v1.37.1 shipped by this
branch, so this is the best available option rather than a combination
upstream has marked as tested. The 2.14 series is no longer listed on
that matrix.
argocd_version is derived from the first entry of
argocd_install_checksums, so adding the checksum for 3.5.3 at the top
of the list selects it.
kubeadm upgrade reads ClusterConfiguration only from the kubeadm-config
ConfigMap, so it keeps the old etcd version. The etcd version then
changes on all control plane nodes at the same time, and the control
plane stops. Upload the ClusterConfiguration first. Then kubeadm
upgrades etcd on one node at a time.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
This reverts commit e19d1c9a55.
Allow further maintainer discussion without introducing additional changes.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI
Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.
EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.
Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Fix EL8 containerd compatibility and SELinux runtime transitions
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix(etcd): ensure consistent certificate permissions on first etcd node
The etcd certificate generation script runs on the first etcd node and
creates certs with default ownership and permissions. Subsequent copy
tasks set explicit ownership and permissions on the remaining etcd
nodes, resulting in inconsistent permissions across the cluster.
This can cause issues such as etcd backup jobs failing on the first
node due to missing read access to certificate files.
Add an ansible.builtin.file task after cert generation to explicitly
set the correct ownership and permissions on the first etcd node.
* fix(etcd): guard client certificate permissions
* fix(etcd): set certificate permissions during installation
* fix: correct CiliumBGPNodeConfigOverride CRD wait condition and deprecate legacy BGP Peering Policy
- Fix copy-paste bug where cilium_bgp_advertisements was used instead of
cilium_bgp_node_config_overrides when waiting for the
CiliumBGPNodeConfigOverride CRD. This caused the CRD readiness check
to be skipped when only node config overrides were configured.
- Add deprecation notices across docs, sample inventory, and defaults
to guide users away from the legacy v2alpha1 CiliumBGPPeeringPolicy
toward the supported BGP v2 API variables.
* fix(cilium): simplify BGP node override condition
* fix(container-engine/cri-o): flush Restart crio handler inside the role
During a Kubernetes upgrade (e.g. 1.32 -> 1.33) the cri-o systemd service is
not restarted even though the new cri-o binaries are deployed. This leaves the
node running the old cri-o version (reported as crio://1.32.x after kubelet is
upgraded to 1.33.x); a manual 'systemctl restart crio' fixes it.
The cri-o role notifies 'Restart crio' from several tasks (binary copy,
registries, proxy drop-in, service file, etc.) but never flushes the handler
itself. The handler only fired when the kubernetes/node role ran its own
'meta: flush_handlers' later in the same play. That cross-role dependency is
fragile during upgrades: if kubernetes/node is skipped, tagged out, or the
flush is reordered, the restart is silently dropped.
Route every restart through the single handler: crio.conf and config.json now
notify 'Restart crio' and the ad-hoc 'trigger service restart only when needed'
task is dropped (its restart duplicated what the handler already does, and a
restarted unit also starts a stopped one). Then add 'meta: flush_handlers'
right after the service start task so the pending handlers run as part of this
role regardless of any downstream role's flush timing.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* test(youki): run youki before cri-o in molecule converge
The converge ran container-engine/cri-o before container-engine/youki, the reverse of the order used by the container-engine role, which installs the runtime roles (kata-containers, gvisor, crun, youki) before the container manager role.
With cri-o flushing its restart handler inside the role, cri-o is now restarted while /usr/local/bin/youki does not exist yet: CRI-O skips the runtime whose binary is missing, so the youki runtime handler is never registered and the verify step fails with 'failed to find runtime handler youki from runtime list map[crun:...]'. Running the roles in the playbook order puts the youki binary in place before cri-o starts.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
With priority only (#13490), the API server rejects the mirror pods
and the kubelet does not give the pods the node-critical OOM score.
Set both fields, like kubeadm does for its static pods.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The check compares the Calico IP pool CIDR with the inventory as
strings, so the same network in a different notation fails, for
example fd85:ee78:d8a6:202::1:0000/112 and fd85:ee78:d8a6:202::1:0/112.
Use ipaddr('net') on the two sides.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Luca Marsella
MohammadReza
Ali Afsharzadeh
Parsa Gheiratian
Kay Yan
SEONGHYUN HONGandguoard
longxiucai
Frank
Mathieu Parent
Max Gautierandgithub-actions[bot]
JaeyungLee
Javad
Dasmat Hansda
Jathavedhan
Jay.HandAli Afsharzadeh
ERIK
Farshad Asadpour
Mehrdad Biukian