- Updated download URLs to fetch the kata-static<...>.zst files from github repo.
- Added zstd package in kata-continers role.
- Updated version checksums to match the new release files.
Moved zstd dependency to roles/system_package
Document the rolling three-minor Kubernetes support window and derive the README minimum version from kube_version_min_required.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* kubelet.service: use standard permissions
systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
* crio.service: reduce execute permission
systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
Cilium's init containers run as UID 0 with capabilities (including
CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin)
must be owned by root or it will fail with a permission error.
Add a pre-flight assert that fails fast with a clear message when
kube_network_plugin == cilium and kube_owner != root, instead of
changing CNI bin ownership defaults for all network plugins.
* Reboot only when required, add the option to clean packages.
* Update docs to reflect only Debian based distribution can be apt
autocleaned
* Add apt cleanup to upgrade tests
* Add authentication support for custom CNI Helm repository
Pass optional Helm repository username and password values to the custom CNI chart configuration. These values use default(omit) so authentication fields are only included when explicitly defined by the user.
* Document custom CNI Helm repository authentication variables
Add commented sample variables for configuring a username and password when the custom CNI Helm repository requires authentication.
* Address Copilot documentation feedback
Document paired repository credentials and secure password storage.
Remove authentication placeholders from the public Cilium example.
The mutually_exclusive constraint referenced 'list', a parameter that does not exist in argument_spec. Remove the dead constraint.
Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>
The ignore_errors condition on the etcd-events service startup task
(Configure | Ensure etcd-events is running) uses != instead of ==,
which is the inverse of the correct pattern used for the main etcd
service on the line above.
This was introduced in commit 7516fe142 when the # noqa ignore-errors
comment was added to the line, accidentally flipping the operator.
* fix(tests): use kube_network_plugin in fedora43-flannel-crio test
The fedora43-flannel-crio-collection-scale.yml test config set
'network_plugin: flannel', but all Kubespray roles read
'kube_network_plugin' (defaulting to 'calico'). The test silently
ran Calico instead of Flannel.
Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>
* Update CI matrix to reflect fedora43-flannel-crio test correctly
---------
Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>
* Fix Multus manifest generation with global inventory
* Update roles/network_plugin/multus/tasks/main.yml
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Mention cordon explicitly in the pre-upgrade prompt and add the node
name plus the same continue/cancel hint to the uncordon prompt so both
prompts share consistent wording.
* flannel: set EnableNFTables when kube_proxy_mode use nftables
* Clean up cni-flannel.yml.j2 by removing comments
Removed commented-out environment variable for cache readiness.
* update cni-flannel.yml.j2
---------
Co-authored-by: ric-mb <noreply@github.com>
The jinja version test conditional uses jinja in the condition, which is
deprecated. I have removed the assertion since ansible 2.18 has a dependency
on jinja2>=3.0.0.
Ansible major versions are upgraded manually to support multiple
OS/Python versions. Configure Dependabot to still propose minor and
patch updates while skipping semver-major bumps.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
The Cilium Helm chart appends a -generic suffix to the operator image
repository for non-cloud deployments. Sync the operator-generic image
to offline registries so it matches what the chart requests.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
When installing with `download_run_once`, nerdctl will log to stderr and
cause a failure even if the image was saved successfully. Instead we
rely on the shell exit code to detect the failure.
Signed-off-by: Alejandro Macedo <alex.macedopereira@gmail.com>
dependabot[bot]
ChillRedChilli
Nikhil Kumar
Kay Yan
Ali Afsharzadeh
Shaleen Bathla
tophac
Debasish Mohanty
R. P. Taylor
emma034186-stack
Frank
wangsifei99
Toshihiko Kimura
Jeroen Rijken
somaz
Ali Soltaninasab
ChengHao Yangandgithub-actions[bot]
Adesh Deshmukh
kubernetes-prow[bot]
Aleksandr BorisovandAli Afsharzadeh
Matthias Lohr
ICHxandric-mb
Wren Turkal
Sumit Solanki
Alejandro Macedo
DongYoung Kim