With priority only (#13490), the API server rejects the mirror pods
and the kubelet does not give the pods the node-critical OOM score.
Set both fields, like kubeadm does for its static pods.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The check compares the Calico IP pool CIDR with the inventory as
strings, so the same network in a different notation fails, for
example fd85:ee78:d8a6:202::1:0000/112 and fd85:ee78:d8a6:202::1:0/112.
Use ipaddr('net') on the two sides.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Empty base/head facts render to None on Ansible Core 2.19, which
difference(['']) does not remove. Use select to drop both.
Co-authored-by: Shuu <shuu.n@protonmail.com>
Add the checksums for 3.22.0, 3.21.x and 3.20.x.
Remove the checksums for 3.16.x, 3.17.x and 3.18.x, so that the list
keeps the three latest minor versions.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* chore(deps): bump local-path-provisioner to v0.0.37
Includes the fix for GHSA-7fxv-8wr2-mfc4, a high-severity HelperPod
template injection issue fixed in v0.0.36, where a user able to edit
the local-path-config ConfigMap could cause unsafe HelperPods to be
created. v0.0.36 adds template validation for this; Kubespray's
helperPod template already passes it (no privileged containers,
hostPath volumes or unsafe pod security settings).
Also syncs two gaps in the vendored manifests, verified against
upstream's v0.0.37 chart RBAC and deploy/local-path-storage.yaml:
- ClusterRole: grant update on persistentvolumeclaims (rancher/
local-path-provisioner#530) and read access to pods/log, which the
provisioner needs to read helper pod output. Note the existing
pods: ["*"] rule does not cover the pods/log subresource.
- helperPod: add priorityClassName system-node-critical and a
toleration for node.kubernetes.io/disk-pressure, so cleanup pods
can still be scheduled onto a node that is under disk pressure.
* fix(local-path-provisioner): add health probes and config env vars
local_release_dir has insufficient nuances, as it needs to handle
several cases,
- where to put downloaded artifacts
- where to search for when installing artifacts
- where to search for when using artifacts (passing them via lookup to
kubectl stdin for instance)
Furthermore, depending on how the user set up download delegation, the
value we want can be on the host the tasks is executing, on the
delegated hosts, etc.
Define variables on top of local_release_dir for differents contexts,
handling which host context to use depending on `download_delegate`.
Mostly, this boils down to choosing the correct `host` for
hostvars[host]['local_release_dir'].
* chore(deps): bump node-feature-discovery to v0.19.0
Checked all intermediate releases (0.17.0, 0.18.0, 0.19.0) for breaking changes. v0.19.0's RBAC breaking change (nfd-topology-updater needs list+watch on pods) does not apply here: Kubespray does not deploy an nfd-topology-updater workload (only an unused ConfigMap template for it exists in this role). v0.19.0 also removed env/expandenv/getHostByName from NodeFeatureRule templates -- only affects user-authored custom NodeFeatureRule resources, not anything this role ships by default.
* fix(nfd): add missing namespaces RBAC rule and fix nodefeaturegroups typo
* fix(nfd): add missing delete verb to nfd-worker Role
* chore(nfd): sync CRD manifest with upstream v0.19.0
* fix(nfd): drop removed gRPC-era flags/ports from nfd-master
* fix(nfd): remove leftover crd-controller args block
Previous commit added the new args but left the old -crd-controller
and -metrics block in place instead of replacing it.
* fix(nfd): drop removed gRPC-era flags from nfd-worker
* chore(nfd): drop variables no longer read by any template
* fix(nfd): align nfd-worker port naming and add health probes
* fix(nfd): remove obsolete nfd-master Service
* chore(nfd): register removed variables in validate_inventory
* fix(nfd): clean up the obsolete Service manifest on disk
* fix(nfd): add health probes and http port to nfd-gc
* fix(nfd): align nfd-worker env and mounts with upstream
No breaking changes per upstream release notes (CLI flags, RBAC, and
deployment shape unchanged). metrics-server is image-only in Kubespray
(no checksum pinning to update). Upstream also bumped their own
Kubernetes client deps to v1.36.2, matching what Kubespray currently
targets.
The bgp changes are a bit verbose, because I chose to reproduce the
exact semantics of the current code, so that the manifest handed to
calicoctl does not contain unset fields (instead of just using defaults
value).
It would be more readable to just accept default value in the
manifests, but might be a problem if there is other writer of the same
Calico resources.
The lineinfile tasks that rewrite the server field in kubelet.conf
replaced the whole line with a hard-coded indentation, corrupting the
file when the existing entry was indented differently. Capture the
original leading whitespace with a group regexp and restore it via
backrefs so the rewrite preserves the surrounding YAML structure.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
Use the upstream keys without converting them to snake case. This avoids
converting back to camel case when rendering, and aligns ourselves more
with our upstream.
The "Remove legacy namespace" task unconditionally ran
kubectl delete namespace on every playbook run carrying the upgrade
tag, wiping user-managed resources in the cert-manager namespace (for
example custom Issuer secrets) as well as cert-manager's own state,
before the namespace was recreated and the manifests re-applied.
The legacy addon migration this cleanup was written for dates back to
2018 and no longer applies; the apply path (kube module, state latest)
upgrades cert-manager in place without a namespace reset.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
* feat: add preflight admission readiness check before kubeadm upgrade
- linked to issue #13139
- Add opt-in dry-run Job probe to verify the admission pipeline is ready before running kubeadm upgrade apply (workaround for Kubernetes #124237)
- Gate the check behind kubeadm_upgrade_preflight_check_enabled (default false) with configurable retries and delay
- Emit a warning instead of failing if the preflight check does not pass
* fix: refine preflight admission check Job and warning
- Use generateName for the dry-run preflight Job to avoid fixed-name collisions
- Expand the Kubernetes issue reference in the warning to a full GitHub URL
Created with AI-assistance
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Add openeuler_repo_baseurl variable to override the default baseurl
(repo.openeuler.org) with a faster mirror. CI uses Huawei Cloud CDN,
reducing package installation from >900s timeout to ~2min.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
* fix: remove cni dependency for flannel
Inspired by https://github.com/kubernetes-sigs/kubespray/pull/9563.
* fix: remove cni dependency for kube-router/macvlan/multus
It is not needed there since network_plugin meta already has it. For plugins which have reset tasks it is also breaking them since downloaded CNI archive is no longer present.
- also remove macvlan on debian support since the role works neither on
debian 12 nor 13
- macvlan is no longer tested in CI as it does not work on rockylinux10
either
2.19 disallow methods with side effects in Jinja. Use a simple loop by
adding all the SANs source in one list.
Also check the sources before hand for failing on CIDR notation.
Link: https://github.com/ansible/ansible/issues/85202
k8s-infra-cherrypick-robotandMohammadreza Vashian
Max Gautierandgithub-actions[bot]
Kay Yan
longxiucai
jskrill
Nikhil Kumar
felipe88alves
wangsifei99
Seena Fallah
ERIK
Oleksandr Kozmenko
Meza
Sandaru Wijewardhana