Add the checksums for 3.22.0, 3.21.x and 3.20.x.
Remove the checksums for 3.16.x, 3.17.x and 3.18.x, so that the list
keeps the three latest minor versions.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* chore(deps): bump local-path-provisioner to v0.0.37
Includes the fix for GHSA-7fxv-8wr2-mfc4, a high-severity HelperPod
template injection issue fixed in v0.0.36, where a user able to edit
the local-path-config ConfigMap could cause unsafe HelperPods to be
created. v0.0.36 adds template validation for this; Kubespray's
helperPod template already passes it (no privileged containers,
hostPath volumes or unsafe pod security settings).
Also syncs two gaps in the vendored manifests, verified against
upstream's v0.0.37 chart RBAC and deploy/local-path-storage.yaml:
- ClusterRole: grant update on persistentvolumeclaims (rancher/
local-path-provisioner#530) and read access to pods/log, which the
provisioner needs to read helper pod output. Note the existing
pods: ["*"] rule does not cover the pods/log subresource.
- helperPod: add priorityClassName system-node-critical and a
toleration for node.kubernetes.io/disk-pressure, so cleanup pods
can still be scheduled onto a node that is under disk pressure.
* fix(local-path-provisioner): add health probes and config env vars
local_release_dir has insufficient nuances, as it needs to handle
several cases,
- where to put downloaded artifacts
- where to search for when installing artifacts
- where to search for when using artifacts (passing them via lookup to
kubectl stdin for instance)
Furthermore, depending on how the user set up download delegation, the
value we want can be on the host the tasks is executing, on the
delegated hosts, etc.
Define variables on top of local_release_dir for differents contexts,
handling which host context to use depending on `download_delegate`.
Mostly, this boils down to choosing the correct `host` for
hostvars[host]['local_release_dir'].
* chore(deps): bump node-feature-discovery to v0.19.0
Checked all intermediate releases (0.17.0, 0.18.0, 0.19.0) for breaking changes. v0.19.0's RBAC breaking change (nfd-topology-updater needs list+watch on pods) does not apply here: Kubespray does not deploy an nfd-topology-updater workload (only an unused ConfigMap template for it exists in this role). v0.19.0 also removed env/expandenv/getHostByName from NodeFeatureRule templates -- only affects user-authored custom NodeFeatureRule resources, not anything this role ships by default.
* fix(nfd): add missing namespaces RBAC rule and fix nodefeaturegroups typo
* fix(nfd): add missing delete verb to nfd-worker Role
* chore(nfd): sync CRD manifest with upstream v0.19.0
* fix(nfd): drop removed gRPC-era flags/ports from nfd-master
* fix(nfd): remove leftover crd-controller args block
Previous commit added the new args but left the old -crd-controller
and -metrics block in place instead of replacing it.
* fix(nfd): drop removed gRPC-era flags from nfd-worker
* chore(nfd): drop variables no longer read by any template
* fix(nfd): align nfd-worker port naming and add health probes
* fix(nfd): remove obsolete nfd-master Service
* chore(nfd): register removed variables in validate_inventory
* fix(nfd): clean up the obsolete Service manifest on disk
* fix(nfd): add health probes and http port to nfd-gc
* fix(nfd): align nfd-worker env and mounts with upstream
* fix: move kube_control_plane reserved vars to correct group_vars location
The file inventory/sample/group_vars/k8s_cluster/kube_control_plane.yml
was being applied to the whole k8s_cluster group instead of only
kube_control_plane. Move it to group_vars/kube_control_plane.yml so the
higher CPU/memory reservations only affect control-plane nodes.
* fix getting-started.md with new kube_control_plane.yml path
No breaking changes per upstream release notes (CLI flags, RBAC, and
deployment shape unchanged). metrics-server is image-only in Kubespray
(no checksum pinning to update). Upstream also bumped their own
Kubernetes client deps to v1.36.2, matching what Kubespray currently
targets.
The bgp changes are a bit verbose, because I chose to reproduce the
exact semantics of the current code, so that the manifest handed to
calicoctl does not contain unset fields (instead of just using defaults
value).
It would be more readable to just accept default value in the
manifests, but might be a problem if there is other writer of the same
Calico resources.
The lineinfile tasks that rewrite the server field in kubelet.conf
replaced the whole line with a hard-coded indentation, corrupting the
file when the existing entry was indented differently. Capture the
original leading whitespace with a group regexp and restore it via
backrefs so the rewrite preserves the surrounding YAML structure.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
Use the upstream keys without converting them to snake case. This avoids
converting back to camel case when rendering, and aligns ourselves more
with our upstream.
This jobs is regularly failing for external reasons (can't provision the
VMs, unable to SSH into them, etc) and is also slower than the rest.
Mkae it manual.
collection-build-install and check-checksums-sorted have low value for
local development, as what they check isn't likely to be touched by most
contributors
It's also enough to run once pre-commit with --hook-stage manual in CI
to run all hooks (since hooks without a 'stages' applies to all stages)
The "Remove legacy namespace" task unconditionally ran
kubectl delete namespace on every playbook run carrying the upgrade
tag, wiping user-managed resources in the cert-manager namespace (for
example custom Issuer secrets) as well as cert-manager's own state,
before the namespace was recreated and the manifests re-applied.
The legacy addon migration this cleanup was written for dates back to
2018 and no longer applies; the apply path (kube module, state latest)
upgrades cert-manager in place without a namespace reset.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
The plays carry `any_errors_fatal: "{{ any_errors_fatal | default(true) }}"`,
added in #1201 so the behaviour could be turned off.
`any_errors_fatal` is an Ansible play keyword, and Ansible reserves keyword
names in the variable namespace. Setting it through -e, group_vars or
host_vars is rejected with "Found variable using reserved name:
any_errors_fatal" and the value never reaches the play, so the expression
always falls through to `default(true)`. The knob has been inert since it was
introduced.
Rename the variable to `kubespray_any_errors_fatal`. Default behaviour is
unchanged -- still fatal -- but `-e kubespray_any_errors_fatal=false` now
works as #1201 intended.
This matters most in playbooks/internal_facts.yml, where the fatal bootstrap
play runs ahead of the play that gathers and caches facts: one unreachable
host aborts the run before any facts are cached, the playbook still exits 0,
and a later `scale.yml --limit=...` refuses because the excluded hosts have
no cache entries. roles/network_facts already sets ignore_unreachable: true
for this reason, but it never executes.
Refs #13407
Claude-Session: https://claude.ai/code/session_017RCEoUNR9gthd455d8Anrx
Signed-off-by: Weigang Geng <3356786+gengwg@users.noreply.github.com>
Co-authored-by: Weigang Geng <3356786+gengwg@users.noreply.github.com>
* feat: add preflight admission readiness check before kubeadm upgrade
- linked to issue #13139
- Add opt-in dry-run Job probe to verify the admission pipeline is ready before running kubeadm upgrade apply (workaround for Kubernetes #124237)
- Gate the check behind kubeadm_upgrade_preflight_check_enabled (default false) with configurable retries and delay
- Emit a warning instead of failing if the preflight check does not pass
* fix: refine preflight admission check Job and warning
- Use generateName for the dry-run preflight Job to avoid fixed-name collisions
- Expand the Kubernetes issue reference in the warning to a full GitHub URL
Created with AI-assistance
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Add openeuler_repo_baseurl variable to override the default baseurl
(repo.openeuler.org) with a faster mirror. CI uses Huawei Cloud CDN,
reducing package installation from >900s timeout to ~2min.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
Kay Yan
Ali Afsharzadeh
MohammadReza
Max Gautier
Mohammad Reza Ghahramani
kubernetes-prow[bot]
longxiucai
jskrill
Shruti
arhuman
Narwhal-fish
Nikhil Kumar
W GengandWeigang Geng
felipe88alves
wangsifei99
Seena Fallah
ERIK
