Splits the definitions into two dicts, while joining then for now to
preserve the downloads dict.
Update all consumers of the variables, which are roughly:
- manual includes of the download role (which will be removed in the
short future)
- install tasks using the resolved 'dest' to find the artefacts
This will make further division of the downloads role easier.
* fix(container-engine/cri-o): flush Restart crio handler inside the role
During a Kubernetes upgrade (e.g. 1.32 -> 1.33) the cri-o systemd service is
not restarted even though the new cri-o binaries are deployed. This leaves the
node running the old cri-o version (reported as crio://1.32.x after kubelet is
upgraded to 1.33.x); a manual 'systemctl restart crio' fixes it.
The cri-o role notifies 'Restart crio' from several tasks (binary copy,
registries, proxy drop-in, service file, etc.) but never flushes the handler
itself. The handler only fired when the kubernetes/node role ran its own
'meta: flush_handlers' later in the same play. That cross-role dependency is
fragile during upgrades: if kubernetes/node is skipped, tagged out, or the
flush is reordered, the restart is silently dropped.
Route every restart through the single handler: crio.conf and config.json now
notify 'Restart crio' and the ad-hoc 'trigger service restart only when needed'
task is dropped (its restart duplicated what the handler already does, and a
restarted unit also starts a stopped one). Then add 'meta: flush_handlers'
right after the service start task so the pending handlers run as part of this
role regardless of any downstream role's flush timing.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* test(youki): run youki before cri-o in molecule converge
The converge ran container-engine/cri-o before container-engine/youki, the reverse of the order used by the container-engine role, which installs the runtime roles (kata-containers, gvisor, crun, youki) before the container manager role.
With cri-o flushing its restart handler inside the role, cri-o is now restarted while /usr/local/bin/youki does not exist yet: CRI-O skips the runtime whose binary is missing, so the youki runtime handler is never registered and the verify step fails with 'failed to find runtime handler youki from runtime list map[crun:...]'. Running the roles in the playbook order puts the youki binary in place before cri-o starts.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* kubelet.service: use standard permissions
systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
* crio.service: reduce execute permission
systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
kata containers added create_container_timeout parameter.
If this parameter is missing, the new version of Kata cannot create containers properly and will encounter an error: failed to create shim task: context deadline exceeded
The config.json.j2 template was generating invalid JSON when multiple
crio_registry_auth entries were defined, resulting in multiple top-level
"auths" objects being rendered, e.g.:
{
"auths": { "registry1": { "auth": "xxxx" } },
"auths": { "registry2": { "auth": "yyyy" } }
}
This change moves the loop inside the "auths" object so that all registries
are rendered as siblings under a single "auths" key, producing valid JSON:
{
"auths": {
"registry1": { "auth": "xxxx" },
"registry2": { "auth": "yyyy" }
}
}
Only set `discard_unpacked_layers` in the CRI image config for containerd
versions earlier than 2.1.0.
Starting with containerd v2.1, the CRI plugin uses the Transfer Service for
image pulls by default. The `discard_unpacked_layers` option is incompatible
with the Transfer Service and triggers containerd to fall back to local
image pulls, logging a warning.
This change prevents unsupported configuration from being applied on newer
containerd versions, avoiding runtime warnings and ensuring default image
pull behavior.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
fixed kubelet condition
CRI-O: fix for handling of container runtime switching
refactored kubelet start condition
stop/start kubelet and crio only when default runtime is changed
fixed condition for runtime_matches fact variable
fixed set facts for existing container runtime
added crio runtime switch variable
changed condition to use runtime switch variable
added comment for not-found for readers
* Add header configuration in containerd hosts.toml
Signed-off-by: Alexander Gil <pando855@gmail.com>
* Disable log output on containerd mirrors settings if required
Signed-off-by: Alexander Gil <pando855@gmail.com>
---------
Signed-off-by: Alexander Gil <pando855@gmail.com>
* Test: molecule replace ubuntu2004 with ubuntu2204 ubuntu2404
cri-dockerd, adduser and bastion-ssh-config can't run ubuntu2404, maybe needs to check login.
"System is booting up. Unprivileged users are not permitted to log in yet. Please come back later. For technical details, see pam_nologin(8)."
Signed-off-by: ChengHao Yang
<17496418+tico88612@users.noreply.github.com>
* Test: replace ubuntu-2004 with ubuntu-2404
All ubuntu-2004 tests are removed.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
* Docs: update ci.md
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
* Docs: update README.md
Remove Ubuntu 20.04 support
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
---------
Signed-off-by: ChengHao Yang
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
The switch to not use system packages for containerd packages happened
multiples releases ago ; there should not be any up-to-date installation
of kubespray needing that cleanup.
Remove those steps and variables only used by them.
kubespray-defaults currently does two things:
- records a number of default variable values (in particular values used
in several places)
- gather and compose some complex network facts (in particular,
`fallback_ip` and `no_proxy`
There is no actual reason to couple those two things, and it makes using
defaults more difficult (because computing the network facts is somewhat
expensive, we don't want to do it willy-nilly)
Split the two and adjust import paths as needed.
Max Gautier
MohammadReza
Mehrdad Biukian
Kay Yan
Ali Afsharzadeh
Shaleen Bathla
Nikhil Kumar
longxiucai
ChengHao Yang
PangQingcheng
Tushar240503
accuROAMC
peterw
Mahendra Reddy
Kim Hyunyoung, Abel
ujstor
vdveldet
Takuya Murakami
pando85
Kubernetes Prow Robot
bin.pan