Use the upstream keys without converting them to snake case. This avoids
converting back to camel case when rendering, and aligns ourselves more
with our upstream.
* feat: add preflight admission readiness check before kubeadm upgrade
- linked to issue #13139
- Add opt-in dry-run Job probe to verify the admission pipeline is ready before running kubeadm upgrade apply (workaround for Kubernetes #124237)
- Gate the check behind kubeadm_upgrade_preflight_check_enabled (default false) with configurable retries and delay
- Emit a warning instead of failing if the preflight check does not pass
* fix: refine preflight admission check Job and warning
- Use generateName for the dry-run preflight Job to avoid fixed-name collisions
- Expand the Kubernetes issue reference in the warning to a full GitHub URL
Created with AI-assistance
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
* kubelet.service: use standard permissions
systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
* crio.service: reduce execute permission
systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
Cilium's init containers run as UID 0 with capabilities (including
CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin)
must be owned by root or it will fail with a permission error.
Add a pre-flight assert that fails fast with a clear message when
kube_network_plugin == cilium and kube_owner != root, instead of
changing CNI bin ownership defaults for all network plugins.
Add kube_vip_metrics_enabled and kube_vip_metrics_port; wire
prometheus_server and container port in the static pod manifest.
Default metrics port to 2112 to match kube-vip upstream. Document
and sample inventory updated.
Remove the Flatcar/Fedora CoreOS exclusion from the wait handler
and unify the Flatcar-specific notify channel into the shared
"propagate resolvconf to k8s components" channel.
Currently, if changing the inventory variable `kubeadm_patches`, new
patches will be created, but the existing ones will also be left on the
filesystem, and applied by kubeadm ; this means that removed or changed
configuration can linger.
Cleanup old patches (which are the difference between existing patches
on filesystem and the one created for the current runs).
When joining a control plane node and "upgrading" the cluster setup (for
example, to update etcd addresses after adding a new etcd) in the same
playbook run, the node can take a bit of time to become ready after
joining.
This triggers a kubeadm preflight check (ControlPlaneNodesReady) in
kubeadm upgrade, which is run directly after the join tasks.
Add a configurable wait for the control plane node to become Ready to
fix this race condition.
Since we're not longer injecting pseudo DNS into /etc/hosts,
'lb-apiserver.kubernetes.local' (the previous default) won't resolve to
anything.
Instead, default to the loadbalancer IP if defined, or to the node local
loadbalancer if it's in use.
Make the necessary adjustements in use site to deal with ip addresses as
well as hostnames.
Max Gautier
jskrill
felipe88alves
Kay Yan
wangsifei99
Seena Fallah
Alexander Skiba (MANZ Solutions)
Ali Afsharzadeh
Shaleen Bathla
tophac
emma034186-stack
ujstor
Nikhil Kumar
Zakhar Dvurechensky
Sumit Solanki
Justin Lamp
R. P. Taylor
Chad Swenson
Yang-Ming Lin
Srishti Jaiswal
Cheprasov Daniil
Mohamed Omar Zaian
Tushar240503
Kubernetes Prow Robot
Bas
Will Xiang
Qasim Mehmood