The [[:alnum:]]* capture truncates interface names at the first character
that is not a letter or digit: eth0.100 (VLAN) becomes eth0, br-9a93...
becomes br, bond0.200 becomes bond0. The result feeds
node_default_gateway_interface, which the macvlan MASQUERADE rules use as
the -o match (RedHat post-up/post-down and the Flatcar NAT service under
enable_nat_default_gateway), so pod traffic egressing the default gateway
loses NAT because the rule references a wrong or nonexistent interface.
Capture the whole whitespace-delimited token after ' dev ' instead. The
leading space also keeps the greedy match from latching onto names that
themselves end in 'dev' (e.g. lan-dev).
Splits the definitions into two dicts, while joining then for now to
preserve the downloads dict.
Update all consumers of the variables, which are roughly:
- manual includes of the download role (which will be removed in the
short future)
- install tasks using the resolved 'dest' to find the artefacts
This will make further division of the downloads role easier.
join_etcd_member.yml tolerates 'Peer URLs already exists' since #6587,
but the etcd-events twin was missed: when a previous run was interrupted
after the member was added, the re-run keeps retrying etcdctl member add
until etcd_retries is exhausted and aborts the play. Mirror the exact
until/failed_when pair from the etcd version.
With an empty 'ip netns list' (the common case), xargs without -r still
runs 'ip netns delete' once with no argument. That fails, so the && chain
short-circuits and 'crictl rmp -a -f' never runs: the rescue path leaves
the pod sandboxes behind, which is exactly what it is there to clean up.
Other tasks in the same file already use xargs -r.
calico-kube-controllers ran without the loadbalancer controller, so
Service LoadBalancer IPs were never allocated from Calico IP pools.
Add it to both datastore lists on Calico 3.30.0 and later, where the
controller exists, and make the lists configurable.
Signed-off-by: Jathavedhan M <jathavedhan.m@ibm.com>
* chore: remove upgrade shims shipped in 2.31.0 and 2.32.0
* fix(validate_inventory): anchor every name in the removed_vars regex
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Argo CD publishes its tested Kubernetes versions at
https://argo-cd.readthedocs.io/en/stable/operator-manual/tested-kubernetes-versions/
3.5.3 is the latest available Argo CD release. Its matrix covers v1.33
through v1.36, which does not include the v1.37.1 shipped by this
branch, so this is the best available option rather than a combination
upstream has marked as tested. The 2.14 series is no longer listed on
that matrix.
argocd_version is derived from the first entry of
argocd_install_checksums, so adding the checksum for 3.5.3 at the top
of the list selects it.
kubeadm upgrade reads ClusterConfiguration only from the kubeadm-config
ConfigMap, so it keeps the old etcd version. The etcd version then
changes on all control plane nodes at the same time, and the control
plane stops. Upload the ClusterConfiguration first. Then kubeadm
upgrades etcd on one node at a time.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
This reverts commit e19d1c9a55.
Allow further maintainer discussion without introducing additional changes.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI
Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.
EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.
Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Fix EL8 containerd compatibility and SELinux runtime transitions
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix(etcd): ensure consistent certificate permissions on first etcd node
The etcd certificate generation script runs on the first etcd node and
creates certs with default ownership and permissions. Subsequent copy
tasks set explicit ownership and permissions on the remaining etcd
nodes, resulting in inconsistent permissions across the cluster.
This can cause issues such as etcd backup jobs failing on the first
node due to missing read access to certificate files.
Add an ansible.builtin.file task after cert generation to explicitly
set the correct ownership and permissions on the first etcd node.
* fix(etcd): guard client certificate permissions
* fix(etcd): set certificate permissions during installation
* fix: correct CiliumBGPNodeConfigOverride CRD wait condition and deprecate legacy BGP Peering Policy
- Fix copy-paste bug where cilium_bgp_advertisements was used instead of
cilium_bgp_node_config_overrides when waiting for the
CiliumBGPNodeConfigOverride CRD. This caused the CRD readiness check
to be skipped when only node config overrides were configured.
- Add deprecation notices across docs, sample inventory, and defaults
to guide users away from the legacy v2alpha1 CiliumBGPPeeringPolicy
toward the supported BGP v2 API variables.
* fix(cilium): simplify BGP node override condition
* fix(container-engine/cri-o): flush Restart crio handler inside the role
During a Kubernetes upgrade (e.g. 1.32 -> 1.33) the cri-o systemd service is
not restarted even though the new cri-o binaries are deployed. This leaves the
node running the old cri-o version (reported as crio://1.32.x after kubelet is
upgraded to 1.33.x); a manual 'systemctl restart crio' fixes it.
The cri-o role notifies 'Restart crio' from several tasks (binary copy,
registries, proxy drop-in, service file, etc.) but never flushes the handler
itself. The handler only fired when the kubernetes/node role ran its own
'meta: flush_handlers' later in the same play. That cross-role dependency is
fragile during upgrades: if kubernetes/node is skipped, tagged out, or the
flush is reordered, the restart is silently dropped.
Route every restart through the single handler: crio.conf and config.json now
notify 'Restart crio' and the ad-hoc 'trigger service restart only when needed'
task is dropped (its restart duplicated what the handler already does, and a
restarted unit also starts a stopped one). Then add 'meta: flush_handlers'
right after the service start task so the pending handlers run as part of this
role regardless of any downstream role's flush timing.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* test(youki): run youki before cri-o in molecule converge
The converge ran container-engine/cri-o before container-engine/youki, the reverse of the order used by the container-engine role, which installs the runtime roles (kata-containers, gvisor, crun, youki) before the container manager role.
With cri-o flushing its restart handler inside the role, cri-o is now restarted while /usr/local/bin/youki does not exist yet: CRI-O skips the runtime whose binary is missing, so the youki runtime handler is never registered and the verify step fails with 'failed to find runtime handler youki from runtime list map[crun:...]'. Running the roles in the playbook order puts the youki binary in place before cri-o starts.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
With priority only (#13490), the API server rejects the mirror pods
and the kubelet does not give the pods the node-critical OOM score.
Set both fields, like kubeadm does for its static pods.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The check compares the Calico IP pool CIDR with the inventory as
strings, so the same network in a different notation fails, for
example fd85:ee78:d8a6:202::1:0000/112 and fd85:ee78:d8a6:202::1:0/112.
Use ipaddr('net') on the two sides.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
ArgoCD upstream manifests do not include namespace for the objects, so
there is no need to override it, and simply using kubectl flags allow to
set it.
Use the upstream file directly , considerably simplifying the argocd
install.
ansible-lint: the refactor apparently newly exposes the password hash
filter to ansible and this needs passlib, so add it to the pre-commit
dependencies.
The artifacts acquisition does not need particular owner or mode, it
only needs to be readable by other parts of kubespray actually installing
the artefacts where needed.
Thus, remove all mode / owner specific maniulation in download and
hardcode to 0644/0755 for file/directory.
Add the 0.6.0 and 0.7.0 checksums, drop 0.4.x, and move youki back
into the blocking molecule matrix. The seccomp bug behind the old
FIXME (youki#3479) is fixed in 0.7.0.
The 0.7.0 gnu tarball is linked against glibc 2.39, because cross-rs
moved its base image to Ubuntu 24.04 and youki installs cross from
git. It does not run on EL9, Amazon Linux 2023, Ubuntu 22.04 or
Debian 12, and it needs libseccomp on the host.
The musl tarball is static, has the same default features and no
runtime requirements. It is the build upstream recommends in its
setup docs.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Mixing two semantically distincts artefacts makes things harder to read
and to consume from other code.
Needed for clean filtering on container / file.
This prevent evaluation of the whole item even if not used, and the
tasks scheduling of skipped tasks.
Preventing evaluation in particular helps avoiding irrelevant errors,
like when an unused downloads member has undefined members.
MohammadReza
Frank
Ali Afsharzadeh
Mathieu Parent
longxiucai
Max Gautierandgithub-actions[bot]
JaeyungLee
Javad
Dasmat Hansda
Jathavedhan
Jay.HandAli Afsharzadeh
ERIK
Farshad Asadpour
Kay Yan
Mehrdad Biukian
Shuu