Argo CD publishes its tested Kubernetes versions at
https://argo-cd.readthedocs.io/en/stable/operator-manual/tested-kubernetes-versions/
3.5.3 is the latest available Argo CD release. Its matrix covers v1.33
through v1.36, which does not include the v1.37.1 shipped by this
branch, so this is the best available option rather than a combination
upstream has marked as tested. The 2.14 series is no longer listed on
that matrix.
argocd_version is derived from the first entry of
argocd_install_checksums, so adding the checksum for 3.5.3 at the top
of the list selects it.
Raise ansible-core support to 2.21 for maintained upstream support through November 2027. This requires Python 3.12-3.14 on control nodes and 3.9-3.14 on targets.
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
ArgoCD upstream manifests do not include namespace for the objects, so
there is no need to override it, and simply using kubectl flags allow to
set it.
Use the upstream file directly , considerably simplifying the argocd
install.
ansible-lint: the refactor apparently newly exposes the password hash
filter to ansible and this needs passlib, so add it to the pre-commit
dependencies.
Add the checksums for 3.22.0, 3.21.x and 3.20.x.
Remove the checksums for 3.16.x, 3.17.x and 3.18.x, so that the list
keeps the three latest minor versions.
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* chore(deps): bump local-path-provisioner to v0.0.37
Includes the fix for GHSA-7fxv-8wr2-mfc4, a high-severity HelperPod
template injection issue fixed in v0.0.36, where a user able to edit
the local-path-config ConfigMap could cause unsafe HelperPods to be
created. v0.0.36 adds template validation for this; Kubespray's
helperPod template already passes it (no privileged containers,
hostPath volumes or unsafe pod security settings).
Also syncs two gaps in the vendored manifests, verified against
upstream's v0.0.37 chart RBAC and deploy/local-path-storage.yaml:
- ClusterRole: grant update on persistentvolumeclaims (rancher/
local-path-provisioner#530) and read access to pods/log, which the
provisioner needs to read helper pod output. Note the existing
pods: ["*"] rule does not cover the pods/log subresource.
- helperPod: add priorityClassName system-node-critical and a
toleration for node.kubernetes.io/disk-pressure, so cleanup pods
can still be scheduled onto a node that is under disk pressure.
* fix(local-path-provisioner): add health probes and config env vars
* chore(deps): bump node-feature-discovery to v0.19.0
Checked all intermediate releases (0.17.0, 0.18.0, 0.19.0) for breaking changes. v0.19.0's RBAC breaking change (nfd-topology-updater needs list+watch on pods) does not apply here: Kubespray does not deploy an nfd-topology-updater workload (only an unused ConfigMap template for it exists in this role). v0.19.0 also removed env/expandenv/getHostByName from NodeFeatureRule templates -- only affects user-authored custom NodeFeatureRule resources, not anything this role ships by default.
* fix(nfd): add missing namespaces RBAC rule and fix nodefeaturegroups typo
* fix(nfd): add missing delete verb to nfd-worker Role
* chore(nfd): sync CRD manifest with upstream v0.19.0
* fix(nfd): drop removed gRPC-era flags/ports from nfd-master
* fix(nfd): remove leftover crd-controller args block
Previous commit added the new args but left the old -crd-controller
and -metrics block in place instead of replacing it.
* fix(nfd): drop removed gRPC-era flags from nfd-worker
* chore(nfd): drop variables no longer read by any template
* fix(nfd): align nfd-worker port naming and add health probes
* fix(nfd): remove obsolete nfd-master Service
* chore(nfd): register removed variables in validate_inventory
* fix(nfd): clean up the obsolete Service manifest on disk
* fix(nfd): add health probes and http port to nfd-gc
* fix(nfd): align nfd-worker env and mounts with upstream
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove macvlan on debian support since the role works neither on
debian 12 nor 13
- macvlan is no longer tested in CI as it does not work on rockylinux10
either
Document the rolling three-minor Kubernetes support window and derive the README minimum version from kube_version_min_required.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Also add checksums for newly released patch versions:
- containerd 2.2.2, 2.2.3
- containerd 2.1.7
- containerd 2.0.8
- containerd 1.7.31
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
github-actions[bot]
Ali Afsharzadeh
MohammadReza
Max Gautierandgithub-actions[bot]
Arman
Farshad Asadpour
ERIK
Kay Yan
Nikhil Kumar
Dhakshin Raghav
ChengHao Yangandgithub-actions[bot]
Sumit Solanki
Takuya Murakami
Seokjun Yang
Srishti Jaiswal
Karim Farid
Mohamed Omar Zaian