The plays carry `any_errors_fatal: "{{ any_errors_fatal | default(true) }}"`,
added in #1201 so the behaviour could be turned off.
`any_errors_fatal` is an Ansible play keyword, and Ansible reserves keyword
names in the variable namespace. Setting it through -e, group_vars or
host_vars is rejected with "Found variable using reserved name:
any_errors_fatal" and the value never reaches the play, so the expression
always falls through to `default(true)`. The knob has been inert since it was
introduced.
Rename the variable to `kubespray_any_errors_fatal`. Default behaviour is
unchanged -- still fatal -- but `-e kubespray_any_errors_fatal=false` now
works as #1201 intended.
This matters most in playbooks/internal_facts.yml, where the fatal bootstrap
play runs ahead of the play that gathers and caches facts: one unreachable
host aborts the run before any facts are cached, the playbook still exits 0,
and a later `scale.yml --limit=...` refuses because the excluded hosts have
no cache entries. roles/network_facts already sets ignore_unreachable: true
for this reason, but it never executes.
Refs #13407
Claude-Session: https://claude.ai/code/session_017RCEoUNR9gthd455d8Anrx
Signed-off-by: Weigang Geng <3356786+gengwg@users.noreply.github.com>
Co-authored-by: Weigang Geng <3356786+gengwg@users.noreply.github.com>
* feat: add preflight admission readiness check before kubeadm upgrade
- linked to issue #13139
- Add opt-in dry-run Job probe to verify the admission pipeline is ready before running kubeadm upgrade apply (workaround for Kubernetes #124237)
- Gate the check behind kubeadm_upgrade_preflight_check_enabled (default false) with configurable retries and delay
- Emit a warning instead of failing if the preflight check does not pass
* fix: refine preflight admission check Job and warning
- Use generateName for the dry-run preflight Job to avoid fixed-name collisions
- Expand the Kubernetes issue reference in the warning to a full GitHub URL
Created with AI-assistance
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Add openeuler_repo_baseurl variable to override the default baseurl
(repo.openeuler.org) with a faster mirror. CI uses Huawei Cloud CDN,
reducing package installation from >900s timeout to ~2min.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
* fix: remove cni dependency for flannel
Inspired by https://github.com/kubernetes-sigs/kubespray/pull/9563.
* fix: remove cni dependency for kube-router/macvlan/multus
It is not needed there since network_plugin meta already has it. For plugins which have reset tasks it is also breaking them since downloaded CNI archive is no longer present.
- also remove macvlan on debian support since the role works neither on
debian 12 nor 13
- macvlan is no longer tested in CI as it does not work on rockylinux10
either
* Skip component releases published without binary artifacts
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* Don't use intermediate variable
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* Fail update-hashes when a component only returns 404s
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
2.19 disallow methods with side effects in Jinja. Use a simple loop by
adding all the SANs source in one list.
Also check the sources before hand for failing on CIDR notation.
Link: https://github.com/ansible/ansible/issues/85202
ansible-lint is pretty opiniated, and a lots of its opinion are not
particularly useful for Kubespray, so delete the comment about not
adding skip rule entries.
We should not add them willy-nilly but some stuff just does not make
sense, in that case name[casing] when prefixing tasks name with role
name.
* #13157: Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
Signed-off-by: root <kanyahal.abhishek@gmail.com>
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
---------
Signed-off-by: root <kanyahal.abhishek@gmail.com>
Three defects in the IPv6 branch of check.yml kept the IPv6 pool
assertion from ever executing:
1. 'alico_ipv6 is defined' - typo of calico_ipv6, so the set_fact
was always skipped (Jinja2 treats the undefined var as False).
2. The set_fact stored the pool as calico_pool_conf, overwriting the
IPv4 pool fact on dual-stack clusters, while the IPv6 assertion
gated on calico_pool_ipv6_conf - a name that was never set.
3. The assertion body also read calico_pool_conf, so even with the
gate fixed it would validate against the IPv4 pool's values.
Store the IPv6 pool as calico_pool_ipv6_conf, gate the set_fact on
the registered calico_ipv6 result, and make the assertion read the
IPv6 fact - mirroring the IPv4 pattern directly above.
Verified with ansible-playbook on mocked calicoctl output:
- old code: set_fact skipped, no validation (reproduces the report)
- new code: mismatched blockSize caught with a clear assertion msg
- matching config passes through unchanged
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(custom_cni): make namespace optional
Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs(custom_cni): document multi-namespace manifests
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
The pinned daily Noble image was pruned and now returns HTTP 404. Use the immutable Ubuntu release build and its matching checksum instead.
Default validate-single-docker to ubuntu-2404 so the presubmit command does not need to repeat the image name.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix: render routingMode native when cilium_tunnel_mode is disabled
When cilium_tunnel_mode is set to 'disabled', the previous template rendered
'tunnelProtocol: disabled', which Cilium does not recognise and falls back to
vxlan. With native routing this conflicts and agents CrashLoopBackOff.
Render 'routingMode: native' instead when disabled, matching the Cilium Helm
chart API (per maintainer review on #13427 and #13314).
Refs kubernetes-sigs/kubespray#13267
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(cilium): tighten routingMode native render (remove stray blank line)
Per review comment on kubernetes-sigs/kubespray#13427, drop the extra
blank line after the routingMode/tunnelProtocol if-block so the rendered
Helm values file is clean.
Validated by rendering the template for cilium_tunnel_mode in
{disabled, vxlan, geneve}: disabled yields 'routingMode: native' with no
tunnelProtocol; vxlan/geneve yield 'tunnelProtocol: <mode>'.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
- Updated download URLs to fetch the kata-static<...>.zst files from github repo.
- Added zstd package in kata-continers role.
- Updated version checksums to match the new release files.
Moved zstd dependency to roles/system_package
Document the rolling three-minor Kubernetes support window and derive the README minimum version from kube_version_min_required.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Max Gautier
W GengandWeigang Geng
felipe88alves
Kay Yan
wangsifei99
Seena Fallah
ERIK
Oleksandr Kozmenko
Meza
arhuman
Ali Afsharzadeh
Razvan Petrescu
Sandaru Wijewardhana
Nikhil Kumar
Alexander Skiba (MANZ Solutions)
Abhishek Kanyahal
Dhakshin Raghav
ChillRedChilli
Mehrdad Biukian
dependabot[bot]
