100 Commits
Author SHA1 Message Date
Cristian Calin 64dbf2e429 update equinox terraform code to fix kubespray CI (#9702)
* add terraform lock files to ignore list

* move contrib/terraform/metal to contrib/terraform/equinix to reflect upstream change
2023-01-26 21:24:25 -08:00
Cristian Calin 57638124c5 document the CI environment (#9714) 2023-01-26 05:02:26 -08:00
Cristian Calin 1530411218 use cri-o from upstream instead of kubic/OBS (#9374)
* [cri-o] use cri-o from upstream instead of kubic/OBS

* [cri-o] add proper molecule coverage

* [skopeo] download skopeo from upstream build

* [cri-o] clean up legacy deployments

* disable cri-o per-distribution variables
2022-10-19 05:47:05 -07:00
Cristian Calin 23716b0eff don't define kubeadm_patches by default (#9372) 2022-10-14 01:20:46 -07:00
Cristian Calin 6db6c8678c disable kubelet_authorization_mode_webhook by default (#9238) 2022-08-31 04:53:00 -07:00
Cristian Calin e60ece2b5e [CI] remove opensuse Leap from molecule test blocking CI (#9229) 2022-08-29 11:44:49 -07:00
Cristian Calin e6976a54e1 add pre-commit hook to facilitate local testing (#9158)
* add pre-commit hook configuration

* add tmp.md to .gitignore

* describe the use of pre-commit hook in CONTRIBUTING.md

* fix docs/integration.md errors identified by markdownlint

* fix docs/<file>.md errors identified by markdownlint

* docs/azure-csi.md
* docs/azure.md
* docs/bootstrap-os.md
* docs/calico.md
* docs/debian.md
* docs/fcos.md
* docs/vagrant.md
* docs/gcp-lb.md
* docs/kubernetes-apps/registry.md
* docs/setting-up-your-first-cluster.md
* docs/vagrant.md
* docs/vars.md

* fix contrib/<file>.md errors identified by markdownlint
2022-08-24 06:54:03 -07:00
Cristian Calin b9e4e27195 [CI] fix molecule tests on opensuse by upgrading to 15.4 (#9175)
* [CI] fix molecule tests on opensuse by upgrading to 15.4

* [opensuse] use correct python crytography package name depending on distribution version
2022-08-14 19:02:13 -07:00
Cristian Calin 8585134db4 when ingress-nginx is deployes without a class, we need to use 'ingress-controller-leader' resource instead of the default 'ingress-controller-leader-nginx' (#9156) 2022-08-09 04:52:50 -07:00
Cristian Calin 76b0cbcb4e bump pause container to 3.6 (#9024)
* [pod-infra] bump pod infra container version to 3.6

* [cri-dockerd] align pod infra container image with other CRIs
2022-06-23 01:43:44 -07:00
Cristian Calin 3a89e31dee [ansible] update ansible and cryptography requirements to work on ubuntu 22.04 (#8826) 2022-05-16 11:14:17 -07:00
Cristian Calin 0c504e4984 [docs] document support for ansible versions (#8827)
drop note about not supporting ansible 2.9 since we still cover it in
nightly CI
2022-05-16 00:50:17 -07:00
Cristian Calin 94484873d1 [containerd] add 1.6.4 which is needed for kubernetes 1.24.0 and make it the default (#8791) 2022-05-05 14:10:43 -07:00
Cristian Calin 9605bbaa67 [nerdctl] upgrade to 0.19.0 (#8772) 2022-05-03 05:39:56 -07:00
Cristian Calin b7ce6a9f79 [ansible] upgrade to 5.7 (#8771) 2022-05-03 01:29:55 -07:00
Cristian Calin 56cf163a23 [kubernetes] actually make 1.23.6 the default (#8767) 2022-05-02 00:43:14 -07:00
Cristian Calin 835fd86a08 [CI] split molecule testes to run in parallel (#8756)
* add parametrization to molecule_run.sh

* [CI] split molecule tests to allow parallelization of work
2022-04-29 00:09:12 -07:00
Cristian Calin aa12f1c56b [CI] fix packet_ubuntu20-calico-etcd-kubeadm-upgrade-ha job (#8752) 2022-04-27 12:39:36 -07:00
Cristian Calin 6cc5b38a2e [terraform] use modern day equinix metal provider (#8748)
* [terraform] use modern day equinix metal provider

* [CI] ensure packet job tests metal
2022-04-27 10:34:13 -07:00
Cristian Calin 2c2d4513ac [helm] upgrade to 3.8.2 (#8723) 2022-04-18 12:51:50 -07:00
Cristian Calin 3261d26181 [etcd] ensure etcd is properly upgraded when managed by kubeadm (#8722)
* [etcd] ensure etcd is properly upgraded when managed by kubeadm

* [CI] add periodic job to test upgrade of etcd managed by kubeadm
2022-04-17 10:32:41 -07:00
Cristian Calin 45262da726 [calico] call calico checks early on to prevent altering the cluster with bad configuration (#8707) 2022-04-14 01:08:46 -07:00
Cristian Calin b67cadf743 [crun] upgrade to 1.4.4 (#8675) 2022-04-04 23:57:36 -07:00
Cristian Calin 34fec09ff1 [containerd] upgrade versions to address CVE-2022-24769 (#8671)
* [containerd] add hashes for 1.5.11

* [containerd] add hashes for 1.6.2

* [containerd] make 1.6.2 the new default
2022-04-04 05:30:11 -07:00
Cristian Calin cefd1339fc [vsphere_csi] update to 2.5.1 and make external_vsphere_version 7.0u1 by default (#8676) 2022-04-04 01:08:11 -07:00
Cristian Calin b915376194 [runc] upgrade to 1.1.1 (#8674) 2022-04-04 00:42:23 -07:00
Cristian Calin 455cc6ff75 [nerdctl] upgrade to 0.18.0 (#8672) 2022-04-04 00:42:11 -07:00
Cristian Calin cc9c376d0f [validate-container-engine] add facts tag to tasks needed for vagrant jobs (#8678) 2022-04-04 00:32:11 -07:00
Cristian Calin ef29455652 [ansible] make ansible 5.x the new default version (#8660)
* [ansible] make ansible 5.x the new default version and move different versions tested to nightly jobs

* [CI] jobs were missing proper ansible cleanup
2022-03-29 15:36:11 -07:00
Cristian Calin 113de8381c [ansible] add support for ansible 5 (ansible-core 2.12) (#8512) 2022-03-28 08:49:22 -07:00
Cristian Calin fa9f85c7e9 [sysctl] set fs.may_detach_mounts=1 even when CRIs don't set it themselves (#8635) 2022-03-21 17:36:13 -07:00
Cristian Calin 5e67ebeb9e [container image] use focal (ubuntu 20.04) base image for our docker builds (#8631) 2022-03-18 09:58:41 -07:00
Cristian Calin dd2d95ecdf [calico] don't enable ipip encapsulation by default and use vxlan in CI (#8434)
* [calico] make vxlan encapsulation the default

* don't enable ipip encapsulation by default
* set calico_network_backend by default to vxlan
* update sample inventory and documentation

* [CI] pin default calico parameters for upgrade tests to ensure proper upgrade

* [CI] improve netchecker connectivity testing

* [CI] show logs for tests

* [calico] tweak task name

* [CI] Don't run the provisioner from vagrant since we run it in testcases_run.sh

* [CI] move kube-router tests to vagrant to avoid network connectivity issues during netchecker check

* service proxy mode still fails connectivity tests so keeping it manual mode

* [kube-router] account for containerd use-case
2022-03-17 18:05:39 -07:00
Cristian Calin 394857b5ce [docker] add support for cri-dockerd as a replacement for dockershim (#8623) 2022-03-16 16:28:11 -07:00
Cristian Calin 5043517cfb [containerd] avoid cleanup of /usr/bin on ostree distributions (#8624) 2022-03-15 13:47:48 -07:00
Cristian Calin db1e30e4fc [calico] add 3.22.1 (#8612) 2022-03-07 22:54:34 -08:00
Cristian Calin b4a61370c8 [cri-o] add cri-0 1.23.x (#8599) 2022-03-07 05:39:07 -08:00
Cristian Calin f6342b6cf4 [crun] upgrade to 1.4.3 (#8598) 2022-03-04 08:22:52 -08:00
Cristian Calin 471585dcd5 [containerd]: upgrade versions to fix CVE-2022-23648 (#8597)
* [containerd] add hashes for 1.6.1

* [contained] make 1.6.1 the default

* [containerd] add hashes for 1.5.10

* [containerd] add hashes for 1.4.13

* [nerdct] bump to 0.17.1
2022-03-03 14:51:16 -08:00
Cristian Calin bf7a506f79 [containerd] Upgrade containerd to 1.6.0 and re-enable arm64 architecture with default options (#8555)
* [containerd] add checksums for 1.6.0

* [containerd] promote 1.6.0 as the new default

* [runc] promote 1.1.0 as the new default to allow arm deployments out of the box

* [nerdctl] bump to 0.17.0 to align with containerd 1.6.0

* [reset] allow crictl stopp and rmp commands to fail
2022-03-02 15:27:13 -08:00
Cristian Calin a090038d02 [CI] add ara to collect CI job logs (#8545) 2022-02-23 07:36:19 -08:00
Cristian Calin 063fc525b1 nerdctl: upgrade to 0.16.1 (#8539) 2022-02-16 02:04:37 -08:00
Cristian Calin 402e85ad6e [calico] upgrade release checksums (#8544)
* [calico] upgrade 3.19.x to 3.19.4

* [calico] upgrade 3.20.x to 3.20.4

* [calico] upgrade 3.21.x to 3.21.4 and make it the default

* [calico] add 3.22.0 checksums

* [calico] account for path changes in calico 3.21.4 crd archive and above
2022-02-15 16:35:02 -08:00
Cristian Calin c6e5314fab implement download mirrors support (#8474)
* [download] add mechanism to support mirrors

* [calico] support alternate download url
2022-02-14 13:19:32 -08:00
Cristian Calin 7759494c85 [terraform][openstack] allow disabling port_security at port level (#8455)
Use openstack_networking_port_v2 and openstack_networking_floatingip_associate_v2
to attach floating ips. This gives us more flexibility on disabling port security
when binding instances directly on provider networks in private cloud scenario.
2022-02-02 08:50:22 -08:00
Cristian Calin 5ecb07b59a [nerdctl] upgrade to 0.16.0 (#8484)
* [nerdctl] upgrade nerdctl to 0.16.0

* [nerdctl] add configuration file
2022-02-01 15:11:48 -08:00
Cristian Calin ff621fb7f1 [ingress-nginx] upgrade to 1.1.1 (#8490) 2022-02-01 09:50:11 -08:00
Cristian Calin 0e2ab5c273 [misc] add cristicalin to approvers list (#8494) 2022-02-01 08:08:11 -08:00
Cristian Calin c47634290e [helm] upgrade to 3.8.0 (#8489) 2022-02-01 06:34:12 -08:00
Cristian Calin c40b43de01 [mitogent] update to 0.3.2 (#8470) 2022-01-27 08:36:59 -08:00
Cristian Calin 26a5948d2a [reset] remove containerd storage during reset (#8469) 2022-01-26 05:10:01 -08:00
Cristian Calin f1adb734e3 [cri-tools] add hashes for 1.23.0 (#8442) 2022-01-24 00:21:56 -08:00
Cristian Calin ef34f5fe7d [calico] switch default iptables backend detection to Auto (#8429) 2022-01-23 23:47:57 -08:00
Cristian Calin 418f12f62a [calico] drop 3.18.x and make 3.21.x the new default (#8426) 2022-01-17 02:29:29 -08:00
Cristian Calin ea44d64511 [contrib] terraform openstack: allow disabling port security (#8410) 2022-01-14 12:58:32 -08:00
Cristian Calin 1337c9c244 [csi-snapshotter] upgrade to 5.0 (#8403) 2022-01-11 09:14:33 -08:00
Cristian Calin 29aafff2ce etcd: add 3.5.1 for kubernetes 1.23+ (#8320) 2022-01-10 22:45:15 -08:00
Cristian Calin 3eab1129b9 CI: Replace CentOS 8 with AlmaLinux 8 before CentOS 8 EOL end of 2021 (#8297) 2022-01-05 02:20:33 -08:00
Cristian Calin 4c4c83f0a1 crun update to 1.4 (#8330)
* [crun] update crun to 1.4

* [crun] drop pre-1.x versions
2022-01-04 08:30:53 -08:00
Cristian Calin ed3932b7d5 [cni-plugins] upgrade to stable 1.0.1 (#8331)
* [cni-plugins] upgrade to stable 1.0.1

* [flannel] use binary from dedicated project
2021-12-23 23:16:15 -08:00
Cristian Calin c1954ff918 Support deploying kubernetes 1.23 (#8323)
* Ensure entries for 1.23 are added for supported_versions vars

* cri-o: add support for kubernetes 1.23 but still use cri-o 1.22

* kubescheduler-config: diferentiate config versions based on kube_version
2021-12-21 01:38:46 -08:00
Cristian Calin fdc5d7458f Upgrade to nerdctl 0.15.0 and some fixes (#8315)
* nerdctl: move to 0.15.0

* nerdctl: reduce verbosity when pulling images

* download: use proxy environment when using nerdctl to download containers
2021-12-20 00:33:26 -08:00
Cristian Calin 4daa824b3c CI: fix test name debian10-aio was a 2 instance default (#8286)
* CI: fix test name debian10-aio was a 2 instance default

* CI: Fix running ubuntu20-aio-docker

* CI: Fix running ubuntu18-aio-docker
2021-12-13 14:50:25 -08:00
Cristian Calin 0e969c0b72 vSphere-CSI: update to 2.4.0 (#8295) 2021-12-10 11:07:23 -08:00
Cristian Calin 682c8a59c2 containerd: change default resolvconf_mode to host_resolvconf (#8247)
* containerd: change default resolvconf_mode to host_resolvconf

* Wait for kube-apiserver to come back after pod refresh

* Handle resolv.conf gracefully

* Retain currently configured DNS entries to ensure we don't break the resolvers

* Suse uses wickedd for network management so no dhcp hooks

* Molecule: increase ansible timeout

* CI: Increase ansible timeout to 120s for Packet jobs
2021-12-09 14:09:06 -08:00
Cristian Calin 990ca38d21 Kata-Containers: add 2.3.0 (#8276)
* Kata-Containers: add checksums for 2.3.0

* Kata-Containers: version 2.3.0 requires kubernetes 1.22.0+
2021-12-07 08:18:08 -08:00
Cristian Calin c7e430573f Calico: upgrade 3.21.x to 3.21.2 (#8275) 2021-12-07 08:18:01 -08:00
Cristian Calin a328b64464 runc: upgrade to v1.0.3 (#8274) 2021-12-07 06:10:02 -08:00
Cristian Calin c98a07825b Use cgroupsv2 where available (fedora) (#8237)
* Containerd: use cgroupsv2 where available (fedora)

* Docker: use cgroupsv2 where available (fedora)

* cri-o: use cgroupsv2 where available (fedora)
2021-12-06 11:19:33 -08:00
Cristian Calin dfdebda0b6 Calico: remove duplicate values for CALICO_DISABLE_FILE_LOGGING and FELIX_DEFAULTENDPOINTTOHOSTACTION (#8269) 2021-12-03 20:32:31 -08:00
Cristian Calin 9d8a83314b containerd: add hashes for 1.5.8 and 1.4.12 and make 1.5.8 the new default (#8239)
* containerd: add hashes for 1.5.8 and 1.4.12 and make 1.5.8 the new default

* containerd: make nerdctl mandatory for container_manager = containerd

* nerdctl: bump to version 0.14.0

* containerd: use nerdctl for image manipulation

* OpenSuSE: install basic nerdctl dependencies
2021-12-03 12:20:35 -08:00
Cristian Calin 4d711691d0 Fix calico crd archive checksums (#8266)
v3.20.3 and v3.21.1 were re-released with new checksums
2021-12-03 04:56:27 -08:00
Cristian Calin a24162f596 CI: upgrade vagrant to 2.2.19 (#8264) 2021-12-02 13:23:44 -08:00
Cristian Calin 9f052702e5 containerd: add support for suse distributions (#8261) 2021-12-02 07:51:33 -08:00
Cristian Calin 31c7b6747b Calico: add dependencies for 3.21.x (#8250) 2021-12-02 01:17:33 -08:00
Cristian Calin ee882fa462 Add capability to use swap, requires Kube 1.22 (#8241)
* Alpha-NodeSwap: allow nodes to use swap

* CI: Add Fedora 35 with experimental swap job
2021-11-30 00:52:56 -08:00
Cristian Calin 3431ed9857 containerd: properly pull images with containerd specific tools (#8245) 2021-11-30 00:48:56 -08:00
Cristian Calin 52ee5d0fff Various documentation updates (#8243)
* Docs: update CONTRIBUTING.md

* Docs: clean up outdated roadmap and point to github issues instead

* Docs: update note on kubelet_cgroup_driver

* Docs: update kata containers docs with note about cgroup driver

* Docs: note about CI specific overrides
2021-11-29 15:05:21 -08:00
Cristian Calin 2f44b40d68 OEL7: Fix CentOS7 Extras for OEL7 (#8219)
* OEL7: Fix CentOS7 Extras for OEL7

* Molecule: add logs collection for jobs
2021-11-29 13:39:21 -08:00
Cristian Calin 20157254c3 Update calico versions (#8238)
* Calico: Bump 3.20.x to 3.20.3

* Calico: Bump 3.18.x to 3.18.6

* Calico: add calico 3.21.1 hashes
2021-11-29 01:15:22 -08:00
Cristian Calin e78bda65fe Defaults: replace docker with containerd as our default container_manager (#8175)
* Defaults: replace docker with containerd as our default container_manager

* CI: Use docker for download_localhost test

* Defaults: with container_manager=containerd we need etcd_deployment_type=host

* CI: Run weave jobs with docker

* CI: Vagrant don't download_force_cache

* CI: Fix upgrade tests

* should run compatible with old settings, this means docker
* we need to run with a distro that has at least modern containerd,
  this means move from debian9 to debian10 to allow `containerd_version`
  to match between 2.17 and master
2021-11-25 06:54:33 -08:00
Cristian Calin c74e1c9db3 CI: use images from quay.io to prevent being throttled by docker hub (#8209)
* CI: use netchecker images from quay to prevent throttling

* Molecule: use hello-world image from quay.io
2021-11-19 13:23:40 -08:00
Cristian Calin acd5185ad4 Fix fedora reset (#8205)
* Reset: Fedora uses NetworkManager

* CI: test reset on fedora
2021-11-18 16:46:51 -08:00
Cristian Calin 28b5281c45 Python: bring back python 2.7 support for ansible 2.9 in supported EL distributions (#8192) 2021-11-15 08:06:48 -08:00
Cristian Calin 0d0468e127 Exercise multiple ansible versions in CI (#8172)
* Ansible: separate requirements files for supported ansible versions

* Ansible: allow using ansible 2.11

* CI: Exercise Ansible 2.9 and Ansible 2.11 in a basic AIO CI job

* CI: Allow running a reset test outside of idempotency tests and running it in stage1

* CI: move ubuntu18-calico-aio job to stage2 and relay only on ubuntu20 with the variously supported ansible versions for stage1

* CI: add capability to install collections or roles from ansible-galaxy to mitigate missing behavior in older ansible versions
2021-11-10 16:11:50 -08:00
Cristian Calin b7ae4a2cfd Kata-Containers: Fix kata-containers runtime (#8068)
* Kata-containes: Fix for ubuntu and centos sometimes kata containers fail to start because of access errors to /dev/vhost-vsock and /dev/vhost-net

* Kata-containers: use similar testing strategy as gvisor

* Kata-Containers: adjust values for 2.2.0 defaults

Make CI tests actually pass

* Kata-Containers: bump to 2.2.2 to fix sandbox_cgroup_only issue
2021-11-09 10:01:48 -08:00
Cristian Calin 039205560a nodelocaldns: allow a secondary pod for nodelocaldns for local-HA (#8100)
* nodelocaldns: allow a secondary pod for nodelocaldns for local-HA

* CI: add job to test nodelocaldns secondary
2021-11-09 09:57:47 -08:00
Cristian Calin 801268d5c1 containerd: upgrade versions 1.4.11 and 1.5.7 and make 1.4.11 the default (#8129) 2021-11-09 06:59:47 -08:00
Cristian Calin 4a8757161e Docker: replace the use of containerd_version with docker_containerd_version to avoid causing conflicts when bumping containerd_version (#8130) 2021-11-08 15:56:49 -08:00
Cristian Calin 8d553f7e91 Mitogen: deprecate the use of mitogen and remove coverage from CI (#8147) 2021-11-05 00:57:52 -07:00
Cristian Calin a0be7f0e26 heketi: fix deployment logic that was broken by the ansible 3.4 upgrade (#8118) 2021-11-04 13:10:23 -07:00
Cristian Calin 2ed211ba15 Fix-CI: python was upgraded in CI to 3.10 and pathlib is now included in python base making this dependency break the CI (#8153) 2021-11-03 12:52:32 -07:00
Cristian Calin 3c30be1320 cert-manager: update docs to reflect 1.5.x links (#8117) 2021-10-25 03:14:23 -07:00
Cristian Calin ea8e2fc651 containerd: download containerd from upstream instead of using distro specific packages (#7970)
* Containerd: download containerd from upstream instead of using distro specific packages

split runc download to separate role
make bootstrap-os role deploy container-selinux and seccomp libraries
clean up package manager provided containerd
move variables to docker role that are no longer common with containerd

* Containerd: make molecule testing more relevant

* replace ubuntu18 with ubuntu20
* add centos8 and debian11 to molecule tests
* run kubernetes/preinstall role to ensure relevancy
  of test including dependency packages

* CI: adjust test scenarios for downloaded containerd
2021-10-20 08:47:58 -07:00
Cristian Calin 6a5b87dda4 netchecker: update images to 1.2.2 from Mirantis (#8074)
* netchecker: update images to 1.2.2 from Mirantis which is slightly less ancinet than the l23networks images

* Netchecker: use local etcd instead of kubernetes v1beta1 crds which are no longer suported by kube 1.22+
2021-10-19 10:17:04 -07:00
Cristian Calin cee481f63d cert-manager: upgrade to 1.5.4 (#8069)
* cert-manager: update to 1.5.4

* cert-manager: remove outdated guidelines on creating an initial ClusterIssuer
2021-10-12 09:17:47 -07:00
Cristian Calin ab4356aa69 Calico: bump default version to 3.20.2 (#8058) 2021-10-07 12:59:33 -07:00
Cristian Calin c7e17688b9 gVisor: bump release to 20210921 version (#8015)
* gVisor: bump release to 20210921 version

* gVisor: drop support for 20210518.0 version
2021-09-29 11:35:20 -07:00
Cristian Calin 3a6230af6b Kata-Containers: update versions 2.2.0 (default) and 2.1.1 (#8017)
* Kata-Containers: add 2.2.0 hashes and make default

* Kata-Containers: replace 2.1.0 with bugfix version 2.1.1

* Kata-Containers: move to q35 a more modern VM architecture as 'pc' is removed in 2.2.0
2021-09-27 08:07:35 -07:00
Cristian Calin 33146b9481 CI: Add Calico eBPF in HA mode test (#7710)
* Sample-Inventory: add sample for calico_bpf_enabled

* Calico-Doc: note about CONFIG_NET_SCHED for eBPF support

* CI: Add Calico eBPF in HA mode test
2021-09-24 09:57:23 -07:00