kubeadm upgrade reads ClusterConfiguration only from the kubeadm-config
ConfigMap, so it keeps the old etcd version. The etcd version then
changes on all control plane nodes at the same time, and the control
plane stops. Upload the ClusterConfiguration first. Then kubeadm
upgrades etcd on one node at a time.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
This reverts commit e19d1c9a55.
Allow further maintainer discussion without introducing additional changes.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI
Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.
EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.
Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Fix EL8 containerd compatibility and SELinux runtime transitions
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
With priority only (#13490), the API server rejects the mirror pods
and the kubelet does not give the pods the node-critical OOM score.
Set both fields, like kubeadm does for its static pods.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The lineinfile tasks that rewrite the server field in kubelet.conf
replaced the whole line with a hard-coded indentation, corrupting the
file when the existing entry was indented differently. Capture the
original leading whitespace with a group regexp and restore it via
backrefs so the rewrite preserves the surrounding YAML structure.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
Use the upstream keys without converting them to snake case. This avoids
converting back to camel case when rendering, and aligns ourselves more
with our upstream.
* feat: add preflight admission readiness check before kubeadm upgrade
- linked to issue #13139
- Add opt-in dry-run Job probe to verify the admission pipeline is ready before running kubeadm upgrade apply (workaround for Kubernetes #124237)
- Gate the check behind kubeadm_upgrade_preflight_check_enabled (default false) with configurable retries and delay
- Emit a warning instead of failing if the preflight check does not pass
* fix: refine preflight admission check Job and warning
- Use generateName for the dry-run preflight Job to avoid fixed-name collisions
- Expand the Kubernetes issue reference in the warning to a full GitHub URL
Created with AI-assistance
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
* kubelet.service: use standard permissions
systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
* crio.service: reduce execute permission
systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
Cilium's init containers run as UID 0 with capabilities (including
CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin)
must be owned by root or it will fail with a permission error.
Add a pre-flight assert that fails fast with a clear message when
kube_network_plugin == cilium and kube_owner != root, instead of
changing CNI bin ownership defaults for all network plugins.
Add kube_vip_metrics_enabled and kube_vip_metrics_port; wire
prometheus_server and container port in the static pod manifest.
Default metrics port to 2112 to match kube-vip upstream. Document
and sample inventory updated.
Remove the Flatcar/Fedora CoreOS exclusion from the wait handler
and unify the Flatcar-specific notify channel into the shared
"propagate resolvconf to k8s components" channel.
Currently, if changing the inventory variable `kubeadm_patches`, new
patches will be created, but the existing ones will also be left on the
filesystem, and applied by kubeadm ; this means that removed or changed
configuration can linger.
Cleanup old patches (which are the difference between existing patches
on filesystem and the one created for the current runs).
Dasmat Hansda
Jay.HandAli Afsharzadeh
Kay Yan
Shuu
longxiucai
Max Gautier
jskrill
felipe88alves
wangsifei99
Seena Fallah
Alexander Skiba (MANZ Solutions)
Shaleen Bathla
tophac
emma034186-stack
ujstor
Nikhil Kumar
Zakhar Dvurechensky
Sumit Solanki
Justin Lamp
R. P. Taylor
Chad Swenson
Yang-Ming Lin
Srishti Jaiswal
Cheprasov Daniil