The pull by digest hasn't been working since 800c84dcc (download: use
full hash form (including hash alg), 2025-01-14), where the key was
renamed to checksum, but the download_container still checked sha256.
Stop pretending we pull by digest.
* chore(deps): bump local-path-provisioner to v0.0.37
Includes the fix for GHSA-7fxv-8wr2-mfc4, a high-severity HelperPod
template injection issue fixed in v0.0.36, where a user able to edit
the local-path-config ConfigMap could cause unsafe HelperPods to be
created. v0.0.36 adds template validation for this; Kubespray's
helperPod template already passes it (no privileged containers,
hostPath volumes or unsafe pod security settings).
Also syncs two gaps in the vendored manifests, verified against
upstream's v0.0.37 chart RBAC and deploy/local-path-storage.yaml:
- ClusterRole: grant update on persistentvolumeclaims (rancher/
local-path-provisioner#530) and read access to pods/log, which the
provisioner needs to read helper pod output. Note the existing
pods: ["*"] rule does not cover the pods/log subresource.
- helperPod: add priorityClassName system-node-critical and a
toleration for node.kubernetes.io/disk-pressure, so cleanup pods
can still be scheduled onto a node that is under disk pressure.
* fix(local-path-provisioner): add health probes and config env vars
local_release_dir has insufficient nuances, as it needs to handle
several cases,
- where to put downloaded artifacts
- where to search for when installing artifacts
- where to search for when using artifacts (passing them via lookup to
kubectl stdin for instance)
Furthermore, depending on how the user set up download delegation, the
value we want can be on the host the tasks is executing, on the
delegated hosts, etc.
Define variables on top of local_release_dir for differents contexts,
handling which host context to use depending on `download_delegate`.
Mostly, this boils down to choosing the correct `host` for
hostvars[host]['local_release_dir'].
* chore(deps): bump node-feature-discovery to v0.19.0
Checked all intermediate releases (0.17.0, 0.18.0, 0.19.0) for breaking changes. v0.19.0's RBAC breaking change (nfd-topology-updater needs list+watch on pods) does not apply here: Kubespray does not deploy an nfd-topology-updater workload (only an unused ConfigMap template for it exists in this role). v0.19.0 also removed env/expandenv/getHostByName from NodeFeatureRule templates -- only affects user-authored custom NodeFeatureRule resources, not anything this role ships by default.
* fix(nfd): add missing namespaces RBAC rule and fix nodefeaturegroups typo
* fix(nfd): add missing delete verb to nfd-worker Role
* chore(nfd): sync CRD manifest with upstream v0.19.0
* fix(nfd): drop removed gRPC-era flags/ports from nfd-master
* fix(nfd): remove leftover crd-controller args block
Previous commit added the new args but left the old -crd-controller
and -metrics block in place instead of replacing it.
* fix(nfd): drop removed gRPC-era flags from nfd-worker
* chore(nfd): drop variables no longer read by any template
* fix(nfd): align nfd-worker port naming and add health probes
* fix(nfd): remove obsolete nfd-master Service
* chore(nfd): register removed variables in validate_inventory
* fix(nfd): clean up the obsolete Service manifest on disk
* fix(nfd): add health probes and http port to nfd-gc
* fix(nfd): align nfd-worker env and mounts with upstream
No breaking changes per upstream release notes (CLI flags, RBAC, and
deployment shape unchanged). metrics-server is image-only in Kubespray
(no checksum pinning to update). Upstream also bumped their own
Kubernetes client deps to v1.36.2, matching what Kubespray currently
targets.
- Updated download URLs to fetch the kata-static<...>.zst files from github repo.
- Added zstd package in kata-continers role.
- Updated version checksums to match the new release files.
Moved zstd dependency to roles/system_package
The Cilium Helm chart appends a -generic suffix to the operator image
repository for non-cloud deployments. Sync the operator-generic image
to offline registries so it matches what the chart requests.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
* [etcd] Update etcd 3.5.x to 3.6.5
- Add hashes for etcd 3.6.5
- Remove etcd v2 backup task for etcd 3.6
The etcd 3.6 removes 'etcdctl backup' command with ETCDCTL_API=2
- Downgrade etcd to 3.5 in netchecker
The netchecker does not work with etcd 3.6 becaust it removes v2 API support (--enable-v2).
And netchekcer does not support v3 API.
* Fix: Change etcd config to clean up v2 store before upgrading etcd to 3.6
* Bump etcd to 3.6.8
* [docs] Remove ingress-nginx references in docs and scripts jinja
Signed-off-by: Meza <meza-xyz@proton.me>
* Remove ingress-nginx doc and remove references in readme and sidebar
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress-nginx dir from kubernetes-apps
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress-nginx from inventory addons
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress_nginx_enabled from default main
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress_nginx from download
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress_nginx from dependencies
Signed-off-by: Meza <meza-xyz@proton.me>
* Remove ingress_nginx from registry task
Signed-off-by: Meza <meza-xyz@proton.me>
---------
Signed-off-by: Meza <meza-xyz@proton.me>
Ali Afsharzadeh
kubernetes-prow[bot]
Max Gautier
MohammadReza
ERIK
Dhakshin Raghav
ChillRedChilli
Debasish Mohanty
Nikhil Kumar
Sumit Solanki
Takuya Murakami
Karim Farid
Mohamed Omar Zaian
Srishti Jaiswal
Meza
Mark Tsai
neo
Qasim Mehmood
LawiK974
ChengHao Yang
xin053
i-yasudaandTakuya Murakami