The etcd twin of "Join Member | Ensure member is in etcd-events cluster"
retries the etcdctl member list check (retries/delay/until), the events
copy does not: a transient etcdctl failure right after the member was
added - exactly when the events cluster quorum is shifting - aborts the
play on etcd_events_cluster deployments while the main etcd path rides
the same blip out. Mirror the twin's retry block with the events register
variable. Second instance of the etcd/etcd-events task divergence; the
first was #13640.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
The [[:alnum:]]* capture truncates interface names at the first character
that is not a letter or digit: eth0.100 (VLAN) becomes eth0, br-9a93...
becomes br, bond0.200 becomes bond0. The result feeds
node_default_gateway_interface, which the macvlan MASQUERADE rules use as
the -o match (RedHat post-up/post-down and the Flatcar NAT service under
enable_nat_default_gateway), so pod traffic egressing the default gateway
loses NAT because the rule references a wrong or nonexistent interface.
Capture the whole whitespace-delimited token after ' dev ' instead. The
leading space also keeps the greedy match from latching onto names that
themselves end in 'dev' (e.g. lan-dev).
join_etcd_member.yml tolerates 'Peer URLs already exists' since #6587,
but the etcd-events twin was missed: when a previous run was interrupted
after the member was added, the re-run keeps retrying etcdctl member add
until etcd_retries is exhausted and aborts the play. Mirror the exact
until/failed_when pair from the etcd version.
With an empty 'ip netns list' (the common case), xargs without -r still
runs 'ip netns delete' once with no argument. That fails, so the && chain
short-circuits and 'crictl rmp -a -f' never runs: the rescue path leaves
the pod sandboxes behind, which is exactly what it is there to clean up.
Other tasks in the same file already use xargs -r.
The lineinfile tasks that rewrite the server field in kubelet.conf
replaced the whole line with a hard-coded indentation, corrupting the
file when the existing entry was indented differently. Capture the
original leading whitespace with a group regexp and restore it via
backrefs so the rewrite preserves the surrounding YAML structure.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
The "Remove legacy namespace" task unconditionally ran
kubectl delete namespace on every playbook run carrying the upgrade
tag, wiping user-managed resources in the cert-manager namespace (for
example custom Issuer secrets) as well as cert-manager's own state,
before the namespace was recreated and the manifests re-applied.
The legacy addon migration this cleanup was written for dates back to
2018 and no longer applies; the apply path (kube module, state latest)
upgrades cert-manager in place without a namespace reset.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
longxiucai