calico-kube-controllers ran without the loadbalancer controller, so
Service LoadBalancer IPs were never allocated from Calico IP pools.
Add it to both datastore lists on Calico 3.30.0 and later, where the
controller exists, and make the lists configurable.
Signed-off-by: Jathavedhan M <jathavedhan.m@ibm.com>
* chore: remove unused Vagrant release image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: keep Vagrant image retirement in release notes
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* ci: run the Ansible controller as an unprivileged user
* ci: clarify non-root controller check
* ci: make the sudo privilege check fail when sudo succeeds
Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds.
Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.
* chore: remove upgrade shims shipped in 2.31.0 and 2.32.0
* fix(validate_inventory): anchor every name in the removed_vars regex
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Argo CD publishes its tested Kubernetes versions at
https://argo-cd.readthedocs.io/en/stable/operator-manual/tested-kubernetes-versions/
3.5.3 is the latest available Argo CD release. Its matrix covers v1.33
through v1.36, which does not include the v1.37.1 shipped by this
branch, so this is the best available option rather than a combination
upstream has marked as tested. The 2.14 series is no longer listed on
that matrix.
argocd_version is derived from the first entry of
argocd_install_checksums, so adding the checksum for 3.5.3 at the top
of the list selects it.
kubeadm upgrade reads ClusterConfiguration only from the kubeadm-config
ConfigMap, so it keeps the old etcd version. The etcd version then
changes on all control plane nodes at the same time, and the control
plane stops. Upload the ClusterConfiguration first. Then kubeadm
upgrades etcd on one node at a time.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
This reverts commit e19d1c9a55.
Allow further maintainer discussion without introducing additional changes.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI
Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.
EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.
Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Fix EL8 containerd compatibility and SELinux runtime transitions
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix(etcd): ensure consistent certificate permissions on first etcd node
The etcd certificate generation script runs on the first etcd node and
creates certs with default ownership and permissions. Subsequent copy
tasks set explicit ownership and permissions on the remaining etcd
nodes, resulting in inconsistent permissions across the cluster.
This can cause issues such as etcd backup jobs failing on the first
node due to missing read access to certificate files.
Add an ansible.builtin.file task after cert generation to explicitly
set the correct ownership and permissions on the first etcd node.
* fix(etcd): guard client certificate permissions
* fix(etcd): set certificate permissions during installation
Raise ansible-core support to 2.21 for maintained upstream support through November 2027. This requires Python 3.12-3.14 on control nodes and 3.9-3.14 on targets.
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
* docs: require full CI before tagging a release
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: use daily CI as release gate
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs: clarify daily CI release check
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix: correct CiliumBGPNodeConfigOverride CRD wait condition and deprecate legacy BGP Peering Policy
- Fix copy-paste bug where cilium_bgp_advertisements was used instead of
cilium_bgp_node_config_overrides when waiting for the
CiliumBGPNodeConfigOverride CRD. This caused the CRD readiness check
to be skipped when only node config overrides were configured.
- Add deprecation notices across docs, sample inventory, and defaults
to guide users away from the legacy v2alpha1 CiliumBGPPeeringPolicy
toward the supported BGP v2 API variables.
* fix(cilium): simplify BGP node override condition
* fix(container-engine/cri-o): flush Restart crio handler inside the role
During a Kubernetes upgrade (e.g. 1.32 -> 1.33) the cri-o systemd service is
not restarted even though the new cri-o binaries are deployed. This leaves the
node running the old cri-o version (reported as crio://1.32.x after kubelet is
upgraded to 1.33.x); a manual 'systemctl restart crio' fixes it.
The cri-o role notifies 'Restart crio' from several tasks (binary copy,
registries, proxy drop-in, service file, etc.) but never flushes the handler
itself. The handler only fired when the kubernetes/node role ran its own
'meta: flush_handlers' later in the same play. That cross-role dependency is
fragile during upgrades: if kubernetes/node is skipped, tagged out, or the
flush is reordered, the restart is silently dropped.
Route every restart through the single handler: crio.conf and config.json now
notify 'Restart crio' and the ad-hoc 'trigger service restart only when needed'
task is dropped (its restart duplicated what the handler already does, and a
restarted unit also starts a stopped one). Then add 'meta: flush_handlers'
right after the service start task so the pending handlers run as part of this
role regardless of any downstream role's flush timing.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* test(youki): run youki before cri-o in molecule converge
The converge ran container-engine/cri-o before container-engine/youki, the reverse of the order used by the container-engine role, which installs the runtime roles (kata-containers, gvisor, crun, youki) before the container manager role.
With cri-o flushing its restart handler inside the role, cri-o is now restarted while /usr/local/bin/youki does not exist yet: CRI-O skips the runtime whose binary is missing, so the youki runtime handler is never registered and the verify step fails with 'failed to find runtime handler youki from runtime list map[crun:...]'. Running the roles in the playbook order puts the youki binary in place before cri-o starts.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
With priority only (#13490), the API server rejects the mirror pods
and the kubelet does not give the pods the node-critical OOM score.
Set both fields, like kubeadm does for its static pods.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The check compares the Calico IP pool CIDR with the inventory as
strings, so the same network in a different notation fails, for
example fd85:ee78:d8a6:202::1:0000/112 and fd85:ee78:d8a6:202::1:0/112.
Use ipaddr('net') on the two sides.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
ArgoCD upstream manifests do not include namespace for the objects, so
there is no need to override it, and simply using kubectl flags allow to
set it.
Use the upstream file directly , considerably simplifying the argocd
install.
ansible-lint: the refactor apparently newly exposes the password hash
filter to ansible and this needs passlib, so add it to the pre-commit
dependencies.
The artifacts acquisition does not need particular owner or mode, it
only needs to be readable by other parts of kubespray actually installing
the artefacts where needed.
Thus, remove all mode / owner specific maniulation in download and
hardcode to 0644/0755 for file/directory.
Add the 0.6.0 and 0.7.0 checksums, drop 0.4.x, and move youki back
into the blocking molecule matrix. The seccomp bug behind the old
FIXME (youki#3479) is fixed in 0.7.0.
The 0.7.0 gnu tarball is linked against glibc 2.39, because cross-rs
moved its base image to Ubuntu 24.04 and youki installs cross from
git. It does not run on EL9, Amazon Linux 2023, Ubuntu 22.04 or
Debian 12, and it needs libseccomp on the host.
The musl tarball is static, has the same default features and no
runtime requirements. It is the build upstream recommends in its
setup docs.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Mixing two semantically distincts artefacts makes things harder to read
and to consume from other code.
Needed for clean filtering on container / file.
This prevent evaluation of the whole item even if not used, and the
tasks scheduling of skipped tasks.
Preventing evaluation in particular helps avoiding irrelevant errors,
like when an unused downloads member has undefined members.
Every entry in the file is for the jinja[spacing] rule. That rule has
been in the global skip_list of .ansible-lint since #12848, so the file
has had no effect since then.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The pull by digest hasn't been working since 800c84dcc (download: use
full hash form (including hash alg), 2025-01-14), where the key was
renamed to checksum, but the download_container still checked sha256.
Stop pretending we pull by digest.
Dasmat Hansda
Jathavedhan
Jay.HandAli Afsharzadeh
Kay Yan
MohammadReza
ERIK
ChengHao Yang
Frank
dependabot[bot]
Farshad Asadpour
Max Gautier
Mehrdad Biukian
kubernetes-prow[bot]
Shuu