* Use upstream GHCR images for Flannel and its CNI plugin
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Remove redundant Flannel image documentation
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* chore: remove unused Vagrant release image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: keep Vagrant image retirement in release notes
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
This reverts commit e19d1c9a55.
Allow further maintainer discussion without introducing additional changes.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI
Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.
EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.
Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Fix EL8 containerd compatibility and SELinux runtime transitions
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: require full CI before tagging a release
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: use daily CI as release gate
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: clarify daily CI release check
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Add openeuler_repo_baseurl variable to override the default baseurl
(repo.openeuler.org) with a faster mirror. CI uses Huawei Cloud CDN,
reducing package installation from >900s timeout to ~2min.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix(custom_cni): make namespace optional
Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs(custom_cni): document multi-namespace manifests
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
The pinned daily Noble image was pruned and now returns HTTP 404. Use the immutable Ubuntu release build and its matching checksum instead.
Default validate-single-docker to ubuntu-2404 so the presubmit command does not need to repeat the image name.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Document the rolling three-minor Kubernetes support window and derive the README minimum version from kube_version_min_required.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Fedora 39 (EOL 2024-11-26), Fedora 40 (EOL 2025-05-13), and Fedora 41
(EOL 2025-12-15) are all out of support and no longer receive security
updates. This bumps the kubevirt CI test matrix to currently supported
releases, distributing tests across Fedora 42 (supported until
2026-05-13) and Fedora 43 (supported until 2026-12-09) to keep
multi-version coverage.
- Add fedora-43 image entry to the kubevirt image-builder
- Rename fedora39-* tests to fedora43-* (4 tests)
- Rename fedora40-* tests to fedora43-* (2 tests)
- Rename fedora41-* tests to fedora42-* (4 tests)
- Update .gitlab-ci/kubevirt.yml testcase names
- Regenerate docs/developers/ci.md
All 10 existing Fedora test configurations (kube-router, calico-selinux,
calico-swap-selinux, crio with/without SELinux enforcing, docker-calico,
flannel-crio-collection-scale) are preserved.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Cilium < 1.20 unconditionally registers a field indexer for TLSRoute
v1alpha2 when the Gateway API controller is enabled, but Gateway API
>= 1.5.0 ships TLSRoute v1alpha2 with served=false in the standard
channel. The result is cilium-operator CrashLoopBackOff with:
no matches for kind "TLSRoute" in version "gateway.networking.k8s.io/v1alpha2"
The fix landed in Cilium 1.20 only and will not be backported.
Add a preflight assert that triggers only when all of the following
hold: cilium_gateway_api_enabled, gateway_api_enabled, cilium_version
< 1.20.0, gateway_api_version >= 1.5.0, and gateway_api_channel ==
"standard". Users hit by this combo get a clear error and two
workarounds (pin gateway_api_version to 1.4.1, or switch
gateway_api_channel to "experimental") instead of debugging a crash
loop after the fact.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
The documented example still uses the removed --required-author flag and
misses --repo-path, which breaks with current release-notes binaries.
Update it to use the generate subcommand and point at the local checkout.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Also add checksums for newly released patch versions:
- containerd 2.2.2, 2.2.3
- containerd 2.1.7
- containerd 2.0.8
- containerd 1.7.31
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
The cilium_enable_prometheus variable was defined in defaults and
documented in sample inventory but never mapped to the Helm values
template, making it a no-op. Add the prometheus.enabled field to
values.yaml.j2 so that setting cilium_enable_prometheus: true
correctly enables Prometheus metrics on the Cilium agent.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Enable openEuler metalink and clear dnf cache after repo updates so package downloads use refreshed mirror metadata. Keep openeuler24-calico in the main CI matrix with a longer package timeout, and clean up failed pods before running-state checks to reduce transient CI noise.
Made-with: Cursor
Made-with: Cursor
Made-with: Cursor
Made-with: Cursor
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* exclude .ansible in ansible-lint
* remote ctr i pull workdaround
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Kay Yan
