Add the checksums for 3.22.0, 3.21.x and 3.20.x.
Remove the checksums for 3.16.x, 3.17.x and 3.18.x, so that the list
keeps the three latest minor versions.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* chore(deps): bump local-path-provisioner to v0.0.37
Includes the fix for GHSA-7fxv-8wr2-mfc4, a high-severity HelperPod
template injection issue fixed in v0.0.36, where a user able to edit
the local-path-config ConfigMap could cause unsafe HelperPods to be
created. v0.0.36 adds template validation for this; Kubespray's
helperPod template already passes it (no privileged containers,
hostPath volumes or unsafe pod security settings).
Also syncs two gaps in the vendored manifests, verified against
upstream's v0.0.37 chart RBAC and deploy/local-path-storage.yaml:
- ClusterRole: grant update on persistentvolumeclaims (rancher/
local-path-provisioner#530) and read access to pods/log, which the
provisioner needs to read helper pod output. Note the existing
pods: ["*"] rule does not cover the pods/log subresource.
- helperPod: add priorityClassName system-node-critical and a
toleration for node.kubernetes.io/disk-pressure, so cleanup pods
can still be scheduled onto a node that is under disk pressure.
* fix(local-path-provisioner): add health probes and config env vars
local_release_dir has insufficient nuances, as it needs to handle
several cases,
- where to put downloaded artifacts
- where to search for when installing artifacts
- where to search for when using artifacts (passing them via lookup to
kubectl stdin for instance)
Furthermore, depending on how the user set up download delegation, the
value we want can be on the host the tasks is executing, on the
delegated hosts, etc.
Define variables on top of local_release_dir for differents contexts,
handling which host context to use depending on `download_delegate`.
Mostly, this boils down to choosing the correct `host` for
hostvars[host]['local_release_dir'].
* chore(deps): bump node-feature-discovery to v0.19.0
Checked all intermediate releases (0.17.0, 0.18.0, 0.19.0) for breaking changes. v0.19.0's RBAC breaking change (nfd-topology-updater needs list+watch on pods) does not apply here: Kubespray does not deploy an nfd-topology-updater workload (only an unused ConfigMap template for it exists in this role). v0.19.0 also removed env/expandenv/getHostByName from NodeFeatureRule templates -- only affects user-authored custom NodeFeatureRule resources, not anything this role ships by default.
* fix(nfd): add missing namespaces RBAC rule and fix nodefeaturegroups typo
* fix(nfd): add missing delete verb to nfd-worker Role
* chore(nfd): sync CRD manifest with upstream v0.19.0
* fix(nfd): drop removed gRPC-era flags/ports from nfd-master
* fix(nfd): remove leftover crd-controller args block
Previous commit added the new args but left the old -crd-controller
and -metrics block in place instead of replacing it.
* fix(nfd): drop removed gRPC-era flags from nfd-worker
* chore(nfd): drop variables no longer read by any template
* fix(nfd): align nfd-worker port naming and add health probes
* fix(nfd): remove obsolete nfd-master Service
* chore(nfd): register removed variables in validate_inventory
* fix(nfd): clean up the obsolete Service manifest on disk
* fix(nfd): add health probes and http port to nfd-gc
* fix(nfd): align nfd-worker env and mounts with upstream
No breaking changes per upstream release notes (CLI flags, RBAC, and
deployment shape unchanged). metrics-server is image-only in Kubespray
(no checksum pinning to update). Upstream also bumped their own
Kubernetes client deps to v1.36.2, matching what Kubespray currently
targets.
The bgp changes are a bit verbose, because I chose to reproduce the
exact semantics of the current code, so that the manifest handed to
calicoctl does not contain unset fields (instead of just using defaults
value).
It would be more readable to just accept default value in the
manifests, but might be a problem if there is other writer of the same
Calico resources.
Use the upstream keys without converting them to snake case. This avoids
converting back to camel case when rendering, and aligns ourselves more
with our upstream.
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
- Updated download URLs to fetch the kata-static<...>.zst files from github repo.
- Added zstd package in kata-continers role.
- Updated version checksums to match the new release files.
Moved zstd dependency to roles/system_package
* Reboot only when required, add the option to clean packages.
* Update docs to reflect only Debian based distribution can be apt
autocleaned
* Add apt cleanup to upgrade tests
The Cilium Helm chart appends a -generic suffix to the operator image
repository for non-cloud deployments. Sync the operator-generic image
to offline registries so it matches what the chart requests.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
k8s-infra-cherrypick-robotandMohammadreza Vashian
Max Gautierandgithub-actions[bot]
Ali Afsharzadehandgithub-actions[bot]
Kay Yan
ERIK
Sandaru Wijewardhana
Dhakshin Raghav
ChillRedChilli
Debasish Mohanty
Jeroen Rijken
ChengHao Yangandgithub-actions[bot]
Nikhil Kumar
Sumit Solanki
Takuya Murakami
Srishti Jaiswal
Karim Farid