Splits the definitions into two dicts, while joining then for now to
preserve the downloads dict.
Update all consumers of the variables, which are roughly:
- manual includes of the download role (which will be removed in the
short future)
- install tasks using the resolved 'dest' to find the artefacts
This will make further division of the downloads role easier.
The artifacts acquisition does not need particular owner or mode, it
only needs to be readable by other parts of kubespray actually installing
the artefacts where needed.
Thus, remove all mode / owner specific maniulation in download and
hardcode to 0644/0755 for file/directory.
This prevent evaluation of the whole item even if not used, and the
tasks scheduling of skipped tasks.
Preventing evaluation in particular helps avoiding irrelevant errors,
like when an unused downloads member has undefined members.
The pull by digest hasn't been working since 800c84dcc (download: use
full hash form (including hash alg), 2025-01-14), where the key was
renamed to checksum, but the download_container still checked sha256.
Stop pretending we pull by digest.
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
When installing with `download_run_once`, nerdctl will log to stderr and
cause a failure even if the image was saved successfully. Instead we
rely on the shell exit code to detect the failure.
Signed-off-by: Alejandro Macedo <alex.macedopereira@gmail.com>
Allow the use of different hashes, as support by the get_url
Ansible module.
Change the variable name accordingly to 'checksum' since it's not
exclusively sha256 anymore.
This adds a new flag with default `kubeadm_config_validate_enabled: true` to use when debugging features and enhancements affected by the `kubeadm config validate command`.
This new flag should be set to `false` only for development and testing scenarios where validation is expected to fail (pre-release Kubernetes versions, etc).
While working with development and test versions of Kubernetes and Kubespray, I found this option very useful.
* kubeadm: do not ignore preflight errors blindly
The "ignoring all errors" seems to date back to the inception of the
kubeadm support (it was --skip-preflight-check before).
This can mask real errors and prevent users from seeing them.
Do not ignore any errors by default and make the set of ignored errors
configurable.
* download/kubeadm: remove redundant task
The mode is already set by the previous `copy` task.
* Validate kubeadm configs
This should help to fail early when we have invalid kubeadm configs (from
a kubespray bug or a misconfiguration).
* kubeadm-upgrade: remove unnecessary bool cast
* Convert kubeadm join discovery timeout to v1beta4 config
* CI: Ignore kubeadm:Mem errors on some setup.
Currently there is not much difference between the files, if there are more changes in the future,
please use different files to distinguish them (you can use the kubeadm_config_api_version variable)
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
Testing for group membership with group names makes Kubespray more
tolerant towards the structure of the inventory.
Where 'inventory_hostname in groups["some_group"] would fail if
"some_group" is not defined, '"some_group" in group_names' would not.
This reverts commit 4b0a134bc9.
The mentionned PR break scale.yml. This goes back to the status quo
until a proper fix can be provided, at which point we'll reapply the
PR.
This should avoid permissions problems when the user creating the
directory and the user creating the content are different (when
containers images are saved by root for instances, because the user
can't use the container runtime).
* Refactor of kubeadm images listing
Instead of setting multiples facts, we directly create the dict we need from
kubeadm output.
* Remove useless 'default' filters in roles/download
* Only download kubeadm images where needed
* Decouple role kubespray-defaults from download
Avoids doing re-importing the download role on every invocation of
kubespray-defaults (and skipping everything).
This has a measurable effect on playbook performance.
* Update docs refering to moved download defaults
Max Gautier
kubernetes-prow[bot]
Ali Afsharzadeh
Seena Fallah
Alejandro Macedo
Zakhar Dvurechensky
Srishti Jaiswal
Jan Breitkopf
Ho Kim
Chad Swenson
Bas
ChengHao Yang
Dmitry Chistyakov
Alexander
Vlad Korolev
Bas
Gianmarco Mameli
Romain
Mohamed Omar Zaian
Kay Yan
chansuke
Boris Barnier
chansuke