The bgp changes are a bit verbose, because I chose to reproduce the
exact semantics of the current code, so that the manifest handed to
calicoctl does not contain unset fields (instead of just using defaults
value).
It would be more readable to just accept default value in the
manifests, but might be a problem if there is other writer of the same
Calico resources.
Use the upstream keys without converting them to snake case. This avoids
converting back to camel case when rendering, and aligns ourselves more
with our upstream.
This jobs is regularly failing for external reasons (can't provision the
VMs, unable to SSH into them, etc) and is also slower than the rest.
Mkae it manual.
collection-build-install and check-checksums-sorted have low value for
local development, as what they check isn't likely to be touched by most
contributors
It's also enough to run once pre-commit with --hook-stage manual in CI
to run all hooks (since hooks without a 'stages' applies to all stages)
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
- also remove macvlan on debian support since the role works neither on
debian 12 nor 13
- macvlan is no longer tested in CI as it does not work on rockylinux10
either
2.19 disallow methods with side effects in Jinja. Use a simple loop by
adding all the SANs source in one list.
Also check the sources before hand for failing on CIDR notation.
Link: https://github.com/ansible/ansible/issues/85202
ansible-lint is pretty opiniated, and a lots of its opinion are not
particularly useful for Kubespray, so delete the comment about not
adding skip rule entries.
We should not add them willy-nilly but some stuff just does not make
sense, in that case name[casing] when prefixing tasks name with role
name.
* CI: add no_proxy regression test
* proxy: Fix the no_proxy variable
Since 2.29, probably due to a change in ansible templating, the no_proxy
variable is rendered as an array of character rather than a string.
This results in broken cluster in some case.
Eliminate the custom jinja looping to use filters and list flatteing +
join instead.
Also simplify some things (no separate tasks file, just use `run_once`
instead of delegating to localhost)
We currently invoke the package module even if the set of package is
empty.
This apparently make the package manager of OpenEuler to regularly time
out.
Currently, if changing the inventory variable `kubeadm_patches`, new
patches will be created, but the existing ones will also be left on the
filesystem, and applied by kubeadm ; this means that removed or changed
configuration can linger.
Cleanup old patches (which are the difference between existing patches
on filesystem and the one created for the current runs).
We have a lot of PRs where we endlessy retry the same flakey jobs, which
is useless and frustating for everyone.
Put those jobs into a separate matrix with 1 retries to migitate the
issue.
Sometimes package installations can get into weird state and stuck for a
very long time.
Timeout the tasks to fail early, with a customizable timeout duration.
When joining a control plane node and "upgrading" the cluster setup (for
example, to update etcd addresses after adding a new etcd) in the same
playbook run, the node can take a bit of time to become ready after
joining.
This triggers a kubeadm preflight check (ControlPlaneNodesReady) in
kubeadm upgrade, which is run directly after the join tasks.
Add a configurable wait for the control plane node to become Ready to
fix this race condition.
We currently **recursively** set the permissions of /etc/ssl/etcd/ssl
(default path) to 700. But this removes group permission from the files
under it, and certain composents (like calio with etcd datastore) rely
on it ; thus, the upgrade of a cluster can fail because the
calico-kube-controller can't access the certs, and thus the etcd.
This works in other case because as far as I can tell, the apiserver
which do access the etcd run as root (the owner of the files, not just
the "group owner")
We also for some reasons do this twice.
Only create the etcd cert directory with the correct permissions once,
not recursively.
Since we're not longer injecting pseudo DNS into /etc/hosts,
'lb-apiserver.kubernetes.local' (the previous default) won't resolve to
anything.
Instead, default to the loadbalancer IP if defined, or to the node local
loadbalancer if it's in use.
Make the necessary adjustements in use site to deal with ip addresses as
well as hostnames.
This pollutes ansible-lint output and force us to scroll to check what
the actuall issues are.
The spacing issues are minor and very opinionated, so it's no great
loss.
- invoke setup module only once to gather ipv4 and ipv6 addresses
- eliminate remaining use of `fallback_ip` and `fallback_ip6`, allowing
us to define (with `set_fact` all the "computed" IPs variable in one
go, since there is no longer a dependency between them.
Before "5ca23e3bf (Changed to use first_kube_control_plane to parse
kubeadm_certificate_key (#11875), 2025-01-14)", kubespray would have
problem adding new control planes when the order of the nodes in kubectl
output and the ansible inventory were not the same.
But the underlying problem is that the operation is fundamentally
something that should be done only once, and recorded for all host in
play.
Since `register` and `sef_fact` when used with `run_once` set the
variable for all the hosts, use it. Also allows to use the variable
directly instead of relying on hostvars to make the task more readable.
Most variables should have a default instead of relying on the default
filter.
(Note that the variable is misnomed, this should be certs and not keys,
but it's not worth breaking compat).
This should make 'no space left on device' problems easier to handle
Use /tmp/releases as local_release_dir CI created machine, while keeping
the same folder on the runner (needed for gitlab-ci runner pods)
* CI: Try a full ssh connection on hosts instead of only checking the port
If we only try the port, we can try to connect in the playbook which is
executed next even though the managed node has not yet completed it's
boot-up sequence ("System is booting up. Unprivileged users are not
permitted to log in yet. Please come back later. For technical details,
see pam_nologin(8).")
This does not account for python-less hosts, but we don't use those in
CI anyway (for now, at least).
* CI: Remove connection method override when creating VMs
This prevented wait_for_connection to work correctly by hijacking the
connection to localhost, thus bypassing the connection check.
* Remove etcd member by peerURLs
The way to obtain the IP of a particular member is convoluted and depend
on multiple variables. The match is also textual and it's not clear
against what we're matching
It's also broken for etcd member which are not also Kubernetes nodes,
because the "Lookup node IP in kubernetes" task will fail and abort the
play.
Instead, match against 'peerURLs', which does not need new variable, and
use json output.
* Add testcase for etcd removal on external etcd
* do not merge
* fixup! Remove etcd member by peerURLs
* fixup! Remove etcd member by peerURLs
The 'old' playbook and the collection use '-' and '_' as separator,
which breaks the logic in scripts/testcases_run.sh.
Add aliases using the old schemes to make the test work and avoid
breaking anything.
Both '-' and '_' variants will be deleted once we switch to supporting
collection only.
Max Gautier
