collection-build-install and check-checksums-sorted have low value for
local development, as what they check isn't likely to be touched by most
contributors
It's also enough to run once pre-commit with --hook-stage manual in CI
to run all hooks (since hooks without a 'stages' applies to all stages)
The "Remove legacy namespace" task unconditionally ran
kubectl delete namespace on every playbook run carrying the upgrade
tag, wiping user-managed resources in the cert-manager namespace (for
example custom Issuer secrets) as well as cert-manager's own state,
before the namespace was recreated and the manifests re-applied.
The legacy addon migration this cleanup was written for dates back to
2018 and no longer applies; the apply path (kube module, state latest)
upgrades cert-manager in place without a namespace reset.
Signed-off-by: longyuxiang <longyuxiang@kylinos.cn>
The plays carry `any_errors_fatal: "{{ any_errors_fatal | default(true) }}"`,
added in #1201 so the behaviour could be turned off.
`any_errors_fatal` is an Ansible play keyword, and Ansible reserves keyword
names in the variable namespace. Setting it through -e, group_vars or
host_vars is rejected with "Found variable using reserved name:
any_errors_fatal" and the value never reaches the play, so the expression
always falls through to `default(true)`. The knob has been inert since it was
introduced.
Rename the variable to `kubespray_any_errors_fatal`. Default behaviour is
unchanged -- still fatal -- but `-e kubespray_any_errors_fatal=false` now
works as #1201 intended.
This matters most in playbooks/internal_facts.yml, where the fatal bootstrap
play runs ahead of the play that gathers and caches facts: one unreachable
host aborts the run before any facts are cached, the playbook still exits 0,
and a later `scale.yml --limit=...` refuses because the excluded hosts have
no cache entries. roles/network_facts already sets ignore_unreachable: true
for this reason, but it never executes.
Refs #13407
Claude-Session: https://claude.ai/code/session_017RCEoUNR9gthd455d8Anrx
Signed-off-by: Weigang Geng <3356786+gengwg@users.noreply.github.com>
Co-authored-by: Weigang Geng <3356786+gengwg@users.noreply.github.com>
* feat: add preflight admission readiness check before kubeadm upgrade
- linked to issue #13139
- Add opt-in dry-run Job probe to verify the admission pipeline is ready before running kubeadm upgrade apply (workaround for Kubernetes #124237)
- Gate the check behind kubeadm_upgrade_preflight_check_enabled (default false) with configurable retries and delay
- Emit a warning instead of failing if the preflight check does not pass
* fix: refine preflight admission check Job and warning
- Use generateName for the dry-run preflight Job to avoid fixed-name collisions
- Expand the Kubernetes issue reference in the warning to a full GitHub URL
Created with AI-assistance
* preinstall: generalize minimum-value semantics for managed sysctls
Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.
Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.
additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* preinstall: refine sysctl floor handling
Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.
Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* download: add apiserver ip in InitConfiguration
In setups where the advertiseAddress cannot be derived from the
default gateway, setting localAPIEndpoint.advertiseAddress will
eliminate the error caused by that. this is like other kubeadm
configs that we have.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* control-plane: pass kubeadm config when creating token
kubeadm token create subcommand will generate a default config when
nothing as --config is passed. therefore if we have setups that need
the config values to let kubeadm work (like if the ip cannot be derived
by the default gateway) it will fail.
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
---------
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Add openeuler_repo_baseurl variable to override the default baseurl
(repo.openeuler.org) with a faster mirror. CI uses Huawei Cloud CDN,
reducing package installation from >900s timeout to ~2min.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove mitogen workaround from local_volume_provisioner since
creating the dirs is handled by kubernetes/preinstall instead
- correct the tag in kubernetes/preinstall as persistent_volumes isn't
the same thing
* fix: remove cni dependency for flannel
Inspired by https://github.com/kubernetes-sigs/kubespray/pull/9563.
* fix: remove cni dependency for kube-router/macvlan/multus
It is not needed there since network_plugin meta already has it. For plugins which have reset tasks it is also breaking them since downloaded CNI archive is no longer present.
- also remove macvlan on debian support since the role works neither on
debian 12 nor 13
- macvlan is no longer tested in CI as it does not work on rockylinux10
either
* Skip component releases published without binary artifacts
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* Don't use intermediate variable
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
* Fail update-hashes when a component only returns 404s
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---------
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
2.19 disallow methods with side effects in Jinja. Use a simple loop by
adding all the SANs source in one list.
Also check the sources before hand for failing on CIDR notation.
Link: https://github.com/ansible/ansible/issues/85202
ansible-lint is pretty opiniated, and a lots of its opinion are not
particularly useful for Kubespray, so delete the comment about not
adding skip rule entries.
We should not add them willy-nilly but some stuff just does not make
sense, in that case name[casing] when prefixing tasks name with role
name.
* #13157: Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
Signed-off-by: root <kanyahal.abhishek@gmail.com>
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
* Updates in the calico config and template to support disabling ipv4 pools during pure ipv6 deployment
---------
Signed-off-by: root <kanyahal.abhishek@gmail.com>
Three defects in the IPv6 branch of check.yml kept the IPv6 pool
assertion from ever executing:
1. 'alico_ipv6 is defined' - typo of calico_ipv6, so the set_fact
was always skipped (Jinja2 treats the undefined var as False).
2. The set_fact stored the pool as calico_pool_conf, overwriting the
IPv4 pool fact on dual-stack clusters, while the IPv6 assertion
gated on calico_pool_ipv6_conf - a name that was never set.
3. The assertion body also read calico_pool_conf, so even with the
gate fixed it would validate against the IPv4 pool's values.
Store the IPv6 pool as calico_pool_ipv6_conf, gate the set_fact on
the registered calico_ipv6 result, and make the assertion read the
IPv6 fact - mirroring the IPv4 pattern directly above.
Verified with ansible-playbook on mocked calicoctl output:
- old code: set_fact skipped, no validation (reproduces the report)
- new code: mismatched blockSize caught with a clear assertion msg
- matching config passes through unchanged
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(custom_cni): make namespace optional
Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs(custom_cni): document multi-namespace manifests
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Shruti
arhuman
Max Gautier
Narwhal-fish
Nikhil Kumar
longxiucai
W GengandWeigang Geng
felipe88alves
Kay Yan
wangsifei99
Seena Fallah
ERIK
Oleksandr Kozmenko
Meza
Ali Afsharzadeh
Razvan Petrescu
Sandaru Wijewardhana
Alexander Skiba (MANZ Solutions)
Abhishek Kanyahal
Dhakshin Raghav
ChillRedChilli
Mehrdad Biukian
dependabot[bot]