The artifacts acquisition does not need particular owner or mode, it
only needs to be readable by other parts of kubespray actually installing
the artefacts where needed.
Thus, remove all mode / owner specific maniulation in download and
hardcode to 0644/0755 for file/directory.
Add the 0.6.0 and 0.7.0 checksums, drop 0.4.x, and move youki back
into the blocking molecule matrix. The seccomp bug behind the old
FIXME (youki#3479) is fixed in 0.7.0.
The 0.7.0 gnu tarball is linked against glibc 2.39, because cross-rs
moved its base image to Ubuntu 24.04 and youki installs cross from
git. It does not run on EL9, Amazon Linux 2023, Ubuntu 22.04 or
Debian 12, and it needs libseccomp on the host.
The musl tarball is static, has the same default features and no
runtime requirements. It is the build upstream recommends in its
setup docs.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Mixing two semantically distincts artefacts makes things harder to read
and to consume from other code.
Needed for clean filtering on container / file.
This prevent evaluation of the whole item even if not used, and the
tasks scheduling of skipped tasks.
Preventing evaluation in particular helps avoiding irrelevant errors,
like when an unused downloads member has undefined members.
Every entry in the file is for the jinja[spacing] rule. That rule has
been in the global skip_list of .ansible-lint since #12848, so the file
has had no effect since then.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
The pull by digest hasn't been working since 800c84dcc (download: use
full hash form (including hash alg), 2025-01-14), where the key was
renamed to checksum, but the download_container still checked sha256.
Stop pretending we pull by digest.
Add the checksums for 3.22.0, 3.21.x and 3.20.x.
Remove the checksums for 3.16.x, 3.17.x and 3.18.x, so that the list
keeps the three latest minor versions.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* chore(deps): bump local-path-provisioner to v0.0.37
Includes the fix for GHSA-7fxv-8wr2-mfc4, a high-severity HelperPod
template injection issue fixed in v0.0.36, where a user able to edit
the local-path-config ConfigMap could cause unsafe HelperPods to be
created. v0.0.36 adds template validation for this; Kubespray's
helperPod template already passes it (no privileged containers,
hostPath volumes or unsafe pod security settings).
Also syncs two gaps in the vendored manifests, verified against
upstream's v0.0.37 chart RBAC and deploy/local-path-storage.yaml:
- ClusterRole: grant update on persistentvolumeclaims (rancher/
local-path-provisioner#530) and read access to pods/log, which the
provisioner needs to read helper pod output. Note the existing
pods: ["*"] rule does not cover the pods/log subresource.
- helperPod: add priorityClassName system-node-critical and a
toleration for node.kubernetes.io/disk-pressure, so cleanup pods
can still be scheduled onto a node that is under disk pressure.
* fix(local-path-provisioner): add health probes and config env vars
local_release_dir has insufficient nuances, as it needs to handle
several cases,
- where to put downloaded artifacts
- where to search for when installing artifacts
- where to search for when using artifacts (passing them via lookup to
kubectl stdin for instance)
Furthermore, depending on how the user set up download delegation, the
value we want can be on the host the tasks is executing, on the
delegated hosts, etc.
Define variables on top of local_release_dir for differents contexts,
handling which host context to use depending on `download_delegate`.
Mostly, this boils down to choosing the correct `host` for
hostvars[host]['local_release_dir'].
* chore(deps): bump node-feature-discovery to v0.19.0
Checked all intermediate releases (0.17.0, 0.18.0, 0.19.0) for breaking changes. v0.19.0's RBAC breaking change (nfd-topology-updater needs list+watch on pods) does not apply here: Kubespray does not deploy an nfd-topology-updater workload (only an unused ConfigMap template for it exists in this role). v0.19.0 also removed env/expandenv/getHostByName from NodeFeatureRule templates -- only affects user-authored custom NodeFeatureRule resources, not anything this role ships by default.
* fix(nfd): add missing namespaces RBAC rule and fix nodefeaturegroups typo
* fix(nfd): add missing delete verb to nfd-worker Role
* chore(nfd): sync CRD manifest with upstream v0.19.0
* fix(nfd): drop removed gRPC-era flags/ports from nfd-master
* fix(nfd): remove leftover crd-controller args block
Previous commit added the new args but left the old -crd-controller
and -metrics block in place instead of replacing it.
* fix(nfd): drop removed gRPC-era flags from nfd-worker
* chore(nfd): drop variables no longer read by any template
* fix(nfd): align nfd-worker port naming and add health probes
* fix(nfd): remove obsolete nfd-master Service
* chore(nfd): register removed variables in validate_inventory
* fix(nfd): clean up the obsolete Service manifest on disk
* fix(nfd): add health probes and http port to nfd-gc
* fix(nfd): align nfd-worker env and mounts with upstream
* fix: move kube_control_plane reserved vars to correct group_vars location
The file inventory/sample/group_vars/k8s_cluster/kube_control_plane.yml
was being applied to the whole k8s_cluster group instead of only
kube_control_plane. Move it to group_vars/kube_control_plane.yml so the
higher CPU/memory reservations only affect control-plane nodes.
* fix getting-started.md with new kube_control_plane.yml path
No breaking changes per upstream release notes (CLI flags, RBAC, and
deployment shape unchanged). metrics-server is image-only in Kubespray
(no checksum pinning to update). Upstream also bumped their own
Kubernetes client deps to v1.36.2, matching what Kubespray currently
targets.
The bgp changes are a bit verbose, because I chose to reproduce the
exact semantics of the current code, so that the manifest handed to
calicoctl does not contain unset fields (instead of just using defaults
value).
It would be more readable to just accept default value in the
manifests, but might be a problem if there is other writer of the same
Calico resources.
The lineinfile tasks that rewrite the server field in kubelet.conf
replaced the whole line with a hard-coded indentation, corrupting the
file when the existing entry was indented differently. Capture the
original leading whitespace with a group regexp and restore it via
backrefs so the rewrite preserves the surrounding YAML structure.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
Use the upstream keys without converting them to snake case. This avoids
converting back to camel case when rendering, and aligns ourselves more
with our upstream.
This jobs is regularly failing for external reasons (can't provision the
VMs, unable to SSH into them, etc) and is also slower than the rest.
Mkae it manual.
collection-build-install and check-checksums-sorted have low value for
local development, as what they check isn't likely to be touched by most
contributors
It's also enough to run once pre-commit with --hook-stage manual in CI
to run all hooks (since hooks without a 'stages' applies to all stages)
Max Gautier
Ali Afsharzadeh
Shuu
kubernetes-prow[bot]
Kay Yan
MohammadReza
Mohammad Reza Ghahramani
longxiucai
jskrill
Shruti
arhuman