ArgoCD upstream manifests do not include namespace for the objects, so
there is no need to override it, and simply using kubectl flags allow to
set it.
Use the upstream file directly , considerably simplifying the argocd
install.
ansible-lint: the refactor apparently newly exposes the password hash
filter to ansible and this needs passlib, so add it to the pre-commit
dependencies.
local_release_dir has insufficient nuances, as it needs to handle
several cases,
- where to put downloaded artifacts
- where to search for when installing artifacts
- where to search for when using artifacts (passing them via lookup to
kubectl stdin for instance)
Furthermore, depending on how the user set up download delegation, the
value we want can be on the host the tasks is executing, on the
delegated hosts, etc.
Define variables on top of local_release_dir for differents contexts,
handling which host context to use depending on `download_delegate`.
Mostly, this boils down to choosing the correct `host` for
hostvars[host]['local_release_dir'].
The bgp changes are a bit verbose, because I chose to reproduce the
exact semantics of the current code, so that the manifest handed to
calicoctl does not contain unset fields (instead of just using defaults
value).
It would be more readable to just accept default value in the
manifests, but might be a problem if there is other writer of the same
Calico resources.
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
* Reboot only when required, add the option to clean packages.
* Update docs to reflect only Debian based distribution can be apt
autocleaned
* Add apt cleanup to upgrade tests
* [docs] Remove ingress-nginx references in docs and scripts jinja
Signed-off-by: Meza <meza-xyz@proton.me>
* Remove ingress-nginx doc and remove references in readme and sidebar
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress-nginx dir from kubernetes-apps
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress-nginx from inventory addons
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress_nginx_enabled from default main
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress_nginx from download
Signed-off-by: Meza <meza-xyz@proton.me>
* Delete ingress_nginx from dependencies
Signed-off-by: Meza <meza-xyz@proton.me>
* Remove ingress_nginx from registry task
Signed-off-by: Meza <meza-xyz@proton.me>
---------
Signed-off-by: Meza <meza-xyz@proton.me>
Since we're not longer injecting pseudo DNS into /etc/hosts,
'lb-apiserver.kubernetes.local' (the previous default) won't resolve to
anything.
Instead, default to the loadbalancer IP if defined, or to the node local
loadbalancer if it's in use.
Make the necessary adjustements in use site to deal with ip addresses as
well as hostnames.
When loadbalancer_apiserver_localhost is enabled, Calico falls back to the
Kubernetes service IP because the kubernetes-services-endpoint ConfigMap is
empty. CNI then fails to reach the API server even though an nginx proxy is
listening on localhost.
Update kube_apiserver_global_endpoint to always reference the localhost load
balancer (respecting the configured port) and populate the ConfigMap for both
eBPF and localhost LB modes.
* control-plane: fix first_kube_control_plane delegation with kube_override_hostname
When kube_override_hostname is configured, the node names reported by
`kubectl get nodes` differ from the inventory_hostname known to Ansible.
This causes delegation failures in subsequent tasks since Ansible cannot
resolve the hostname from kubectl output to an inventory host.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: remove fragile first_control_plane selection logic
Current implementation breaks with kube_override_hostname and has
multiple edge cases. Drop until proper kubectl-based node lookup
can be implemented.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
Remove --auth-anonymous if kube_api_anonymous_auth in undefined, to avoid
compatibility errors with other arguments of the kube-apiserver, such as
--authentication-config when anonymous field is configured.
Max Gautier
Kay Yan
Jeroen Rijken
Nikhil Kumar
Ali Afsharzadeh
Sumit Solanki
Chad Swenson
ERIK
Srishti Jaiswal
Meza
Mohamed Omar Zaian
neo
Chris Ricker
Seena Fallah
jaehanbyun
David Bidorff
ChengHao Yang
Psycho Mantys
Anshuman Agarwala