Commit Graph
100 Commits
Author SHA1 Message Date
Max Gautier 452d4e63e0 Fix the (upgrade/remove_node) + collection test cases (#12672)
The 'old' playbook and the collection use '-' and '_' as separator,
which breaks the logic in scripts/testcases_run.sh.

Add aliases using the old schemes to make the test work and avoid
breaking anything.

Both '-' and '_' variants will be deleted once we switch to supporting
collection only.
2025-11-07 07:22:55 -08:00
Max Gautier e090c9ee26 Factor kubectl_apply_stdin into separate "vars only" role
This is needed to make it available to other roles than kubernetes-apps
2025-11-07 09:34:57 +01:00
Max Gautier 0d6d3f5828 kubectl_apply_stdin SSA support 2025-11-07 09:34:29 +01:00
Max Gautier b9662dbd86 cleanup: don't cleanup runc orphan binary on immutable distros (#12669) 2025-11-06 22:16:53 -08:00
Max Gautier 5acde6cfe2 Get conf checksum directly for localhost CP loadbalancer (#12632)
There is no need to stat the templated file, because the template module
already returns a checksum.
2025-10-23 22:57:36 -07:00
Max Gautier cde7b2b022 Remove leftover docs fragment about mitogen (#12630)
This was left behind from 1fb14b746 (docs: remove outdated mitogen
documentation. (#12619), 2025-10-14)
2025-10-17 08:44:43 -07:00
Max Gautier fbf957ab5d Fix breakage when ignoring all kubeadm preflight errors (#12606)
kubeadm errors out if 'all' is specified with specific checks, so check
that case when we add hardcoded checks.

Add a test to catch regression.
2025-10-13 05:54:58 -07:00
Max Gautier 8d7d9907a1 Rough rework of the CI setup documentation (#12094) 2025-09-15 03:24:11 -07:00
Max Gautierandgithub-actions[bot] 0b082ac2f4 Patch versions updates (#12518)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2025-09-01 20:05:12 -07:00
Max Gautier c03c68e8c7 Do not suppress output during cert generation (#12479)
Makes debugging easier.
2025-08-28 19:43:09 -07:00
Max Gautier 84504d156f Fold kubernetes-apps/network_plugin into network_plugin (#12506)
For what I can see, there is no reason for the split, and it makes
things confusing.
2025-08-27 18:43:10 -07:00
Max Gautierandgithub-actions[bot] acdc338fa4 Patch versions updates (#12503)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2025-08-26 02:36:11 -07:00
Max Gautier f832271f5c Directly list conntrack modules instead of using a variable (#12475)
The conntrack kernel modules have no reason to be something else than
those two options, so there is no reason to have a variable.
2025-08-18 09:05:13 -07:00
Max Gautier cbdfad8e80 CI: fix broken debugging (#12381) 2025-07-08 04:33:27 -07:00
Max Gautier 15c8a4768d Do not alter etc/hosts (#12382)
This is no longer needed, likely for a long time.
2025-07-07 04:53:26 -07:00
Max Gautier 6354aa686e Allow vagrant jobs to be triggered manually in Gitlab UI (#12349) 2025-07-06 23:57:25 -07:00
Max Gautier e0018268d6 CI: Add a test for scale.yml (#12285) 2025-06-28 01:16:29 -07:00
Max Gautier f55de03fa6 CI: update sonobuoy url (heptio is now part of VMware)
Suggested-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
2025-06-27 14:32:21 +02:00
Max Gautier 7b6ff769f0 CI: 020_check_pods -> more readable output
Filter pod to describe / logs only the broken ones.
2025-06-27 14:32:20 +02:00
Max Gautier e369ac2f24 CI: more readable loop
Avoids putting whole pod spec in loop label
2025-06-27 14:32:19 +02:00
Max Gautier 4a0a73b307 CI: fix check for kube_version 2025-06-27 14:15:11 +02:00
Max Gautier 253fc5ee59 CI: factorize tests into a single playbook
This allows to use kubespray_defaults (once) instead of redefining
defaults in the tests.
Test test files becomes imported tasks rather thand standalone
playbooks.
2025-06-27 14:15:11 +02:00
Max Gautier bf41d3bfea CI: Simplify running playbooks as collection 2025-06-27 14:15:09 +02:00
Max Gautier 85cf0014cd CI: Run vagrant validate on master as well (#12311)
Not really a reason not to, and this actually breaks daily-ci because
some jobs depends on this one so the whole pipeline is invalid if it's
not created.
2025-06-18 02:12:53 -07:00
Max Gautier 50a32acf51 CI: use debug stdout callback everywhere (except pre-commit) 2025-06-17 14:56:16 +02:00
Max Gautier b372a6f0f3 Fix alternatives runtimes CI
- youki and gvisor molecule tests are now passing
- kata-containers still broken
2025-06-17 14:56:15 +02:00
Max Gautier 5671037b0e Convert alternatives runtimes molecule to ansible verifier 2025-06-17 14:56:14 +02:00
Max Gautier 1ccb3a38a2 Convert cri-dockerd molecule to ansible verifier 2025-06-17 14:56:06 +02:00
Max Gautier 68c4ee23cb Convert CRI-O molecule to ansible verifier 2025-06-17 14:56:04 +02:00
Max Gautier 3f26203ed0 Convert containerd molecule to ansible verifier 2025-06-17 14:56:02 +02:00
Max Gautier a5ede2a5c7 container-engine: factorize molecule testing infra 2025-06-17 14:56:00 +02:00
Max Gautier 69c4c90634 Factorize dynamic groups into a role 2025-06-17 14:55:59 +02:00
Max Gautier 06d8d48488 Add previous release to the auto update script. (#12312) 2025-06-16 22:53:00 -07:00
Max Gautierandgithub-actions[bot] f866fd76f8 Patch versions updates (#12313)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2025-06-15 20:20:57 -07:00
Max Gautier 144742cbce Use last patch versions by default for etcd/crio/crictl (#12233)
This uses the same logic than the other versions, with simplications for
crictl and crio whose versionning scheme is tied to upstream kubernetes.

Also move some version variables in vars/ rather than defaults/, because
they are not used elsewhere and don't really make sense as modifiable by
the user.
2025-06-14 18:56:55 -07:00
Max Gautier f6d29a27fc Remove stale TODOs (#12298)
Upstream consider it working as expected, won't fix
https://github.com/ansible-collections/community.general/issues/7717#issuecomment-2061880929
2025-06-12 20:14:57 -07:00
Max Gautier 5243b33bd7 Cleanup support for removed OS in bootstrap
- centos < 8
- debian 10
2025-06-05 11:16:25 +02:00
Max Gautier d5b2a9b5ba opensuse: move package installation to system_packages
No reason to special case
2025-06-05 11:16:24 +02:00
Max Gautier 2152022926 debian-based distro: handle apt update cache when installing packages
The package module pass options to the underlying packages manager
module if they support it. No need to handle it in bootstrap.
2025-06-05 11:16:24 +02:00
Max Gautier f13b80cac0 ClearLinux: remove special casing
- put package install in system_packages
- docker should be handled by the approriate roles if used as container
  engine
2025-06-05 11:16:23 +02:00
Max Gautier 2fbbf2e1e4 CI/kubevirt: Configure ignition provisioning
Flatcar does not support cloud-init
2025-05-27 23:29:56 +08:00
Max Gautier 92e8ac9de2 Remove tag 'master' (#12228)
* Remove tag master

Following it's deprecation in 4b324cb0f (Rename master to control plane
- non-breaking changes only (#11394), 2024-09-06)

* Add fail fast path when using removed tags

- Used for the master tag, but this could be used for other things in
  the future
2025-05-22 01:20:36 -07:00
Max Gautier b79f7d79f0 docs: remove obsolete cgroups variables (#12239)
Those variables are removed since 1bc61c9f3 (Simplify kubelet-config
template, 2023-11-23), removing them from docs as well.
2025-05-21 22:40:35 -07:00
Max Gautier 490dece3bf Cleanup assert after 2.28 (#12245)
Users should have used 2.28 and adapted their inventories now.
2025-05-21 20:28:35 -07:00
Max Gautier 175babc4df Move some approvers to emeritus (#12156)
Thanks for you work !
2025-05-20 03:11:17 -07:00
Max Gautier 3a2862ea19 Move checksums to kubespray_defaults/vars (#12234)
The checksums are not a defaults and are not meant to be changed from
the inventories.

Furthermore, role defaults have a lower priority that hosts facts, which
technically means a rogue hosts could hijack the hashes for its
variables.
2025-05-18 16:13:14 -07:00
Max Gautierandgithub-actions[bot] faae36086c Patch versions updates (#12226)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2025-05-16 14:13:14 -07:00
Max Gautier 9c2bdeec63 Decouple etcd defaults in a separate role
This allows us to reuse the defaults in other places without putting
everything in kubespray-defaults.

In that, for kubernetes/control-plane.
2025-05-16 14:51:29 +02:00
Max Gautier bca5a4ce3b CI: remove ci-not-authorized job (#12225)
This is now handled directly at the failfast-ci level (== integration
Github <-> Gitlab).
The whole pipeline will not be triggered unless:
- The author is a maintainer
- The PR has the /ok-to-test label
2025-05-16 03:27:13 -07:00
Max Gautier 22d3cf9c2b Move 'pretend certificates' **after** cert distribution
The link target will only exist after we distribute the certs on each node.
2025-05-15 18:35:34 +02:00
Max Gautier 2d3bd8686f Add testcase separate ha-etcd
Also use a distinct node to test certificate distribution.
2025-05-15 18:20:13 +02:00
Max Gautierandgithub-actions[bot] a55932e1de Patch versions updates (#12204)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2025-05-14 18:55:20 -07:00
Max Gautier 973bd2e520 Stop cleaning up containerd packages (#12213)
The switch to not use system packages for containerd packages happened
multiples releases ago ; there should not be any up-to-date installation
of kubespray needing that cleanup.

Remove those steps and variables only used by them.
2025-05-13 21:07:16 -07:00
Max Gautier 1d15baf405 Add compat and deprecation warning for boostrap-os 2025-05-13 09:39:59 +02:00
Max Gautier 47508d5c6e Rename bootstrap-os to bootstrap_os
Role names in ansible collections should not have hyphens.
2025-05-13 09:39:54 +02:00
Max Gautier 2a1ae14275 Compat layer remove-node/pre-remove 2025-05-12 22:22:20 +02:00
Max Gautier e361def9cd Rename remove-node/pre-remove (no hypens for role in collection) 2025-05-12 22:19:50 +02:00
Max Gautier fa6888df4c kubernetes_audit: Remove redundant defaults filter (#12208) 2025-05-12 07:23:14 -07:00
Max Gautier 373b952a0c Cleanup CI scripts (#12205)
* Delete unused scripts

- gen_tags.sh: not the right file, produce garbage even if path is fixed
- premoderator.sh: not used since ef6d24a49 (CI require a 'lgtm' or
  'ok-to-test' labels to pass (#11251), 2024-05-31)
- gitlab-branch-cleanup: unused AFAICT

* CI: inline molecule logs

Single use site -> less indirection makes it easier to read.
2025-05-12 05:53:15 -07:00
Max Gautier 4052cd5237 Add compat and deprecation warning for kubespray-defaults 2025-05-12 09:46:07 +02:00
Max Gautier 23d8c9a820 CI: enabled all jobs on daily CI (#12207) 2025-05-11 19:51:14 -07:00
Max Gautier e618421697 Don't run upgrade-patch jobs on forks (#12206)
With the current github-workflow setup, workflows are triggered on every
forked repository (which is quite wasteful).

Add a condition to only run on the main repository.
2025-05-10 06:15:14 -07:00
Max Gautier 7db2aa1cba Rename kubespray-defaults to kubespray_defaults
Role names in ansible collection should not contains hyphens.
2025-05-10 10:04:37 +02:00
Max Gautier 25e4fa17a8 Split kubespray-defaults (-> network_facts)
kubespray-defaults currently does two things:
- records a number of default variable values (in particular values used
  in several places)
- gather and compose some complex network facts (in particular,
  `fallback_ip` and `no_proxy`

There is no actual reason to couple those two things, and it makes using
defaults more difficult (because computing the network facts is somewhat
expensive, we don't want to do it willy-nilly)

Split the two and adjust import paths as needed.
2025-05-09 21:14:26 +02:00
Max Gautier bb4b2af02e Drop install of python-libselinux for RHEL family below 8
RHEL 7 and derivates support has been removed from some time, clean up
of leftovers.
2025-05-09 21:14:25 +02:00
Max Gautier d6d87e9a83 Move cilium_deploy_additionnaly to kubespray-default (#12191)
Instead of using default(false) all over the place, use
kubespray-defaults
2025-05-07 05:05:17 -07:00
Max Gautier 985e4ebb23 Remove versions from inventory sample (#12164)
The recommended usage of kubespray is to use the default versions.
So putting them in inventory/sample is not really very helpful, and
causes:
- churn (keeping the inventory/sample up to date)
- support issues (mismatch between defaults and sample inventory)

Remove all concrete versions from the inventory sample.
2025-05-06 08:43:14 -07:00
Max Gautier fcc294600c Workaround missing etcd certds on control plane node (#12181) 2025-05-05 01:05:57 -07:00
Max Gautier 9631b5fd44 Move etcd inventory sample doc to role defaults 2025-05-04 21:24:26 +02:00
Max Gautier a7d681abff Install iputils with other packages 2025-05-04 21:22:49 +02:00
Max Gautier 5867fa1b9f Move back iproute install to system_packages
Packages are now installed before network facts collection, so we can
install iproute with the rest.
2025-05-04 21:22:49 +02:00
Max Gautier 1e79c7b3cb Move package install to bootstrap-os 2025-05-04 21:22:48 +02:00
Max Gautier 34d64d4d04 Remove outdated comment
bootstrap-os does not do anything in sudoers since e2ad6aad5 (bootstrap:
rework role (#4045), 2019-02-11).

So SSH pipelining working is effectively a pre-requisite anyway.
2025-05-04 21:22:48 +02:00
Max Gautier 87726faab4 Move check 'sorted pkgs list to pre-commit'
This is a lint check, which should not live in the playbook itself.
2025-05-04 21:22:47 +02:00
Max Gautier 1b9919547a Split 'offline' assert into their own role
The preinstall assert cover a number of things, many of which depends
only on the inventory, and can be run without any ansible_facts
collected.

Split them off to simplify re-ordering.
2025-05-04 21:22:46 +02:00
Max Gautierandgithub-actions[bot] 38cea5b866 Patch versions updates (#12119)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2025-04-23 21:48:30 -07:00
Max Gautier 79fbfdf271 component_hash_update: support calico_crds (#12122)
- add support for "no_arch" downloads: arch-indendendant files such as
  YAML manifests, helm charts, etc.
- wire calico_crds with it.
2025-04-10 02:18:47 -07:00
Max Gautier 5a6ef1dafa Timeout on RHEL subscription check (#12115)
subscription-manager status can in some circumstances just never
terminates, with nothing indicating the problem from the Ansible
playbook log.
This makes it difficult to find the hosts misbehaving.

Add a timeout to the subscription checks (defaulting to 3 minutes). This
should be more than enough for normal circumstances while allowing
easier troubleshooting, as the hosts will be FAILED instead of the
playbook just waiting indefinitely.
2025-04-08 01:24:44 -07:00
Max Gautier 0ae9ab36ce CI: Pin github actions for security (#12105)
Dependabot can still upgrade the action version.
2025-04-03 06:22:38 -07:00
Max Gautier fe2ab898b8 component_hash_update: remove obsolete todos (#12098) 2025-03-31 15:18:35 -07:00
Max Gautier 5222f48978 auto-update: use a branch prefix rather than suffix (#12097)
This is more in-line with dependabot and similar auto-updaters.

Reduce ci coverage on github action updating (it does not change
kubespray code, no need for testing).
2025-03-31 01:04:36 -07:00
Max Gautier 7b6b7318b2 Remove unused manifest (docs) (#12092)
This file is no longer referenced since e0d67367e (Update installation
doc with vagrant (#8406), 2022-01-11).
2025-03-29 11:26:34 -07:00
Max Gautier 7c9870d15b Remove contrib/mitogen
- the playbook does not work
- the mitogen version is not up to date

This strongly suggests this is not used ; let's drop it.
2025-03-28 09:49:28 +01:00
Max Gautier c8ea1468d1 Remove unmaintained contrib: kvm-setup 2025-03-28 09:39:30 +01:00
Max Gautier ad26fe77f5 [contrib] Remove heketi and glusterfs (#12091)
* Remove heketi

Heketi is no longer developed or supported and should not be used
anymore.
Remove the contrib playbook.

* Remove contrib glusterfs

Glusterfs integration with glusterfs is now either deprecated or
unsupported.

Other storage solutions should be preferred.
2025-03-27 15:32:38 -07:00
Max Gautier aae53a9df5 Add github workflow to auto update hashes daily (#12053) 2025-03-27 14:10:34 -07:00
Max Gautier aa0c0851f8 Upgrade kube-router (#12066)
- This happens to fix the fact that kube-router is broken when using the
  service proxy: https://github.com/cloudnativelabs/kube-router/issues/1558
2025-03-26 17:04:38 -07:00
Max Gautier 0fc56ed344 CI: fix terraform
- add default testcase
- fix ansible ssh connection
2025-03-26 20:05:26 +01:00
Max Gautier 5c4e597987 CI: workaround build: disable rebase 2025-03-26 20:05:25 +01:00
Max Gautier ef133fd93d CI: cleanups leftovers things
include_vars is redundant as the file is already included by extra_vars
2025-03-26 20:05:25 +01:00
Max Gautier f6ca3bf477 CI: simplify image build job 2025-03-26 20:05:24 +01:00
Max Gautier b9e251ac7a CI: cleanup terraform + deduplicate and simplify 2025-03-26 20:05:23 +01:00
Max Gautier 43fceebdd3 CI: convert vagrant jobs to kubevirt
Vagrant jobs needs a big cache which makes them slow / sometimes stuck
completely. Using the kubevirt provisionning playbook is now
significantly faster, so do just that.

Having only one provisionner in CI will also allows us to remove some of
the custom runners executors we use for vagrant, and more generally
reduce the CI maintenance.

Our kubevirt CI platform does not support ivp6 yet, so we keep the
relevant jobs in vagrant, but we'll migrate them as well as soon as
possible.
2025-03-26 20:05:21 +01:00
Max Gautier 862aec4dc6 CI: remove 'packet' from jobs name + rename to kubevirt
This is more accurate, the name 'packet' being an aterfact of history
(the Kubevirt jobs used to run on Packet, the previous name of Equinix)
2025-03-26 14:32:26 +01:00
Max Gautier 4f3b214ef5 CI: streamline packet jobs definition
- Take advantage of `parallel:matrix` to make the jobs definition shorter
  and more readable.
- Remove helper scripts which are no longer needed
- Remove redundant indirection in the gitlab-ci pipelines definitions
  (only one user)
2025-03-26 14:32:24 +01:00
Max Gautier cd9c21b7d6 CI: fix wrong git config env variables (#12079) 2025-03-25 05:48:39 -07:00
Max Gautier c00fc9f221 Check separately for 'v'-prefixed versions for ones which are derived (#12057)
The versions which are by default derived from `kube_version` can break
the assert if kube_version start with `v`, because they use the start of
`kube_version` as dict key.
By putting them in their own assert, the first assert should trigger on
`kube_version`, with a more explicit error.
2025-03-20 02:36:31 -07:00
Max Gautier 03b40e71a3 Cleanup unneeded vagrant python packages from test deps (#12051) 2025-03-18 02:19:50 -07:00
Max Gautier e0920b33d7 vagrant: allow to config vagrant with separate etcd (#12045)
This should help test separate etcd configuration locally more easily.
2025-03-18 02:15:49 -07:00
Max Gautier fffc1b4ac0 CI: remove KUBESPRAY_VERSION 2025-03-17 18:13:11 +01:00