* #13157: Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
Signed-off-by: root <kanyahal.abhishek@gmail.com>
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
---------
Signed-off-by: root <kanyahal.abhishek@gmail.com>
Three defects in the IPv6 branch of check.yml kept the IPv6 pool
assertion from ever executing:
1. 'alico_ipv6 is defined' - typo of calico_ipv6, so the set_fact
was always skipped (Jinja2 treats the undefined var as False).
2. The set_fact stored the pool as calico_pool_conf, overwriting the
IPv4 pool fact on dual-stack clusters, while the IPv6 assertion
gated on calico_pool_ipv6_conf - a name that was never set.
3. The assertion body also read calico_pool_conf, so even with the
gate fixed it would validate against the IPv4 pool's values.
Store the IPv6 pool as calico_pool_ipv6_conf, gate the set_fact on
the registered calico_ipv6 result, and make the assertion read the
IPv6 fact - mirroring the IPv4 pattern directly above.
Verified with ansible-playbook on mocked calicoctl output:
- old code: set_fact skipped, no validation (reproduces the report)
- new code: mismatched blockSize caught with a clear assertion msg
- matching config passes through unchanged
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(custom_cni): make namespace optional
Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs(custom_cni): document multi-namespace manifests
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix: render routingMode native when cilium_tunnel_mode is disabled
When cilium_tunnel_mode is set to 'disabled', the previous template rendered
'tunnelProtocol: disabled', which Cilium does not recognise and falls back to
vxlan. With native routing this conflicts and agents CrashLoopBackOff.
Render 'routingMode: native' instead when disabled, matching the Cilium Helm
chart API (per maintainer review on #13427 and #13314).
Refs kubernetes-sigs/kubespray#13267
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(cilium): tighten routingMode native render (remove stray blank line)
Per review comment on kubernetes-sigs/kubespray#13427, drop the extra
blank line after the routingMode/tunnelProtocol if-block so the rendered
Helm values file is clean.
Validated by rendering the template for cilium_tunnel_mode in
{disabled, vxlan, geneve}: disabled yields 'routingMode: native' with no
tunnelProtocol; vxlan/geneve yield 'tunnelProtocol: <mode>'.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
- Updated download URLs to fetch the kata-static<...>.zst files from github repo.
- Added zstd package in kata-continers role.
- Updated version checksums to match the new release files.
Moved zstd dependency to roles/system_package
* kubelet.service: use standard permissions
systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
* crio.service: reduce execute permission
systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
Cilium's init containers run as UID 0 with capabilities (including
CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin)
must be owned by root or it will fail with a permission error.
Add a pre-flight assert that fails fast with a clear message when
kube_network_plugin == cilium and kube_owner != root, instead of
changing CNI bin ownership defaults for all network plugins.
* Reboot only when required, add the option to clean packages.
* Update docs to reflect only Debian based distribution can be apt
autocleaned
* Add apt cleanup to upgrade tests
* Add authentication support for custom CNI Helm repository
Pass optional Helm repository username and password values to the custom CNI chart configuration. These values use default(omit) so authentication fields are only included when explicitly defined by the user.
* Document custom CNI Helm repository authentication variables
Add commented sample variables for configuring a username and password when the custom CNI Helm repository requires authentication.
* Address Copilot documentation feedback
Document paired repository credentials and secure password storage.
Remove authentication placeholders from the public Cilium example.
The ignore_errors condition on the etcd-events service startup task
(Configure | Ensure etcd-events is running) uses != instead of ==,
which is the inverse of the correct pattern used for the main etcd
service on the line above.
This was introduced in commit 7516fe142 when the # noqa ignore-errors
comment was added to the line, accidentally flipping the operator.
* Fix Multus manifest generation with global inventory
* Update roles/network_plugin/multus/tasks/main.yml
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Mention cordon explicitly in the pre-upgrade prompt and add the node
name plus the same continue/cancel hint to the uncordon prompt so both
prompts share consistent wording.
* flannel: set EnableNFTables when kube_proxy_mode use nftables
* Clean up cni-flannel.yml.j2 by removing comments
Removed commented-out environment variable for cache readiness.
* update cni-flannel.yml.j2
---------
Co-authored-by: ric-mb <noreply@github.com>
The Cilium Helm chart appends a -generic suffix to the operator image
repository for non-cloud deployments. Sync the operator-generic image
to offline registries so it matches what the chart requests.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
When installing with `download_run_once`, nerdctl will log to stderr and
cause a failure even if the image was saved successfully. Instead we
rely on the shell exit code to detect the failure.
Signed-off-by: Alejandro Macedo <alex.macedopereira@gmail.com>
* fix: make assert test for netaddr actually return a boolean
The netaddr test returns a string when the netaddr is installed. This makes
Ansible 2.20 angry. Here's a fix to make sure the true case also returns a
boolean instead of a string.
* fix: more fixes for non-boolean conditions
The `cloud_provider` assertion change is a little more involved. The only two
allowed values are "" and "external". Let's just always check the assertion
instead of skipping it when it's the default value, which is "".
All the other changes should be fairly obvious.
Max Gautier
Sandaru Wijewardhana
Nikhil Kumar
Alexander Skiba (MANZ Solutions)
Ali Afsharzadeh
Abhishek Kanyahal
Dhakshin Raghav
Mehrdad Biukian
Kay Yan
ChillRedChilli
Shaleen Bathla
tophac
Debasish Mohanty
emma034186-stack
wangsifei99
Frank
Toshihiko Kimura
Jeroen Rijken
somaz
Ali Soltaninasab
kubernetes-prow[bot]
Adesh Deshmukh
Aleksandr BorisovandAli Afsharzadeh
Matthias Lohr
ICHxandric-mb
Sumit Solanki
Alejandro Macedo
Wren Turkal
longxiucai
Denis