ansible-lint is pretty opiniated, and a lots of its opinion are not
particularly useful for Kubespray, so delete the comment about not
adding skip rule entries.
We should not add them willy-nilly but some stuff just does not make
sense, in that case name[casing] when prefixing tasks name with role
name.
* #13157: Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
Signed-off-by: root <kanyahal.abhishek@gmail.com>
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
---------
Signed-off-by: root <kanyahal.abhishek@gmail.com>
Three defects in the IPv6 branch of check.yml kept the IPv6 pool
assertion from ever executing:
1. 'alico_ipv6 is defined' - typo of calico_ipv6, so the set_fact
was always skipped (Jinja2 treats the undefined var as False).
2. The set_fact stored the pool as calico_pool_conf, overwriting the
IPv4 pool fact on dual-stack clusters, while the IPv6 assertion
gated on calico_pool_ipv6_conf - a name that was never set.
3. The assertion body also read calico_pool_conf, so even with the
gate fixed it would validate against the IPv4 pool's values.
Store the IPv6 pool as calico_pool_ipv6_conf, gate the set_fact on
the registered calico_ipv6 result, and make the assertion read the
IPv6 fact - mirroring the IPv4 pattern directly above.
Verified with ansible-playbook on mocked calicoctl output:
- old code: set_fact skipped, no validation (reproduces the report)
- new code: mismatched blockSize caught with a clear assertion msg
- matching config passes through unchanged
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(custom_cni): make namespace optional
Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs(custom_cni): document multi-namespace manifests
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
The pinned daily Noble image was pruned and now returns HTTP 404. Use the immutable Ubuntu release build and its matching checksum instead.
Default validate-single-docker to ubuntu-2404 so the presubmit command does not need to repeat the image name.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* fix: render routingMode native when cilium_tunnel_mode is disabled
When cilium_tunnel_mode is set to 'disabled', the previous template rendered
'tunnelProtocol: disabled', which Cilium does not recognise and falls back to
vxlan. With native routing this conflicts and agents CrashLoopBackOff.
Render 'routingMode: native' instead when disabled, matching the Cilium Helm
chart API (per maintainer review on #13427 and #13314).
Refs kubernetes-sigs/kubespray#13267
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(cilium): tighten routingMode native render (remove stray blank line)
Per review comment on kubernetes-sigs/kubespray#13427, drop the extra
blank line after the routingMode/tunnelProtocol if-block so the rendered
Helm values file is clean.
Validated by rendering the template for cilium_tunnel_mode in
{disabled, vxlan, geneve}: disabled yields 'routingMode: native' with no
tunnelProtocol; vxlan/geneve yield 'tunnelProtocol: <mode>'.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
- Updated download URLs to fetch the kata-static<...>.zst files from github repo.
- Added zstd package in kata-continers role.
- Updated version checksums to match the new release files.
Moved zstd dependency to roles/system_package
Document the rolling three-minor Kubernetes support window and derive the README minimum version from kube_version_min_required.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* kubelet.service: use standard permissions
systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
* crio.service: reduce execute permission
systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
Cilium's init containers run as UID 0 with capabilities (including
CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin)
must be owned by root or it will fail with a permission error.
Add a pre-flight assert that fails fast with a clear message when
kube_network_plugin == cilium and kube_owner != root, instead of
changing CNI bin ownership defaults for all network plugins.
* Reboot only when required, add the option to clean packages.
* Update docs to reflect only Debian based distribution can be apt
autocleaned
* Add apt cleanup to upgrade tests
* Add authentication support for custom CNI Helm repository
Pass optional Helm repository username and password values to the custom CNI chart configuration. These values use default(omit) so authentication fields are only included when explicitly defined by the user.
* Document custom CNI Helm repository authentication variables
Add commented sample variables for configuring a username and password when the custom CNI Helm repository requires authentication.
* Address Copilot documentation feedback
Document paired repository credentials and secure password storage.
Remove authentication placeholders from the public Cilium example.
The mutually_exclusive constraint referenced 'list', a parameter that does not exist in argument_spec. Remove the dead constraint.
Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>
The ignore_errors condition on the etcd-events service startup task
(Configure | Ensure etcd-events is running) uses != instead of ==,
which is the inverse of the correct pattern used for the main etcd
service on the line above.
This was introduced in commit 7516fe142 when the # noqa ignore-errors
comment was added to the line, accidentally flipping the operator.
Max Gautier
Alexander Skiba (MANZ Solutions)
Kay Yan
Ali Afsharzadeh
Abhishek Kanyahal
Dhakshin Raghav
ChillRedChilli
Mehrdad Biukian
dependabot[bot]
Nikhil Kumar
Shaleen Bathla
tophac
Debasish Mohanty
R. P. Taylor
emma034186-stack
Frank
wangsifei99
Toshihiko Kimura
Jeroen Rijken
somaz
Ali Soltaninasab
Adesh Deshmukh
kubernetes-prow[bot]