* fix(container-engine/cri-o): flush Restart crio handler inside the role
During a Kubernetes upgrade (e.g. 1.32 -> 1.33) the cri-o systemd service is
not restarted even though the new cri-o binaries are deployed. This leaves the
node running the old cri-o version (reported as crio://1.32.x after kubelet is
upgraded to 1.33.x); a manual 'systemctl restart crio' fixes it.
The cri-o role notifies 'Restart crio' from several tasks (binary copy,
registries, proxy drop-in, service file, etc.) but never flushes the handler
itself. The handler only fired when the kubernetes/node role ran its own
'meta: flush_handlers' later in the same play. That cross-role dependency is
fragile during upgrades: if kubernetes/node is skipped, tagged out, or the
flush is reordered, the restart is silently dropped.
Route every restart through the single handler: crio.conf and config.json now
notify 'Restart crio' and the ad-hoc 'trigger service restart only when needed'
task is dropped (its restart duplicated what the handler already does, and a
restarted unit also starts a stopped one). Then add 'meta: flush_handlers'
right after the service start task so the pending handlers run as part of this
role regardless of any downstream role's flush timing.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* test(youki): run youki before cri-o in molecule converge
The converge ran container-engine/cri-o before container-engine/youki, the reverse of the order used by the container-engine role, which installs the runtime roles (kata-containers, gvisor, crun, youki) before the container manager role.
With cri-o flushing its restart handler inside the role, cri-o is now restarted while /usr/local/bin/youki does not exist yet: CRI-O skips the runtime whose binary is missing, so the youki runtime handler is never registered and the verify step fails with 'failed to find runtime handler youki from runtime list map[crun:...]'. Running the roles in the playbook order puts the youki binary in place before cri-o starts.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
Three defects in the IPv6 branch of check.yml kept the IPv6 pool
assertion from ever executing:
1. 'alico_ipv6 is defined' - typo of calico_ipv6, so the set_fact
was always skipped (Jinja2 treats the undefined var as False).
2. The set_fact stored the pool as calico_pool_conf, overwriting the
IPv4 pool fact on dual-stack clusters, while the IPv6 assertion
gated on calico_pool_ipv6_conf - a name that was never set.
3. The assertion body also read calico_pool_conf, so even with the
gate fixed it would validate against the IPv4 pool's values.
Store the IPv6 pool as calico_pool_ipv6_conf, gate the set_fact on
the registered calico_ipv6 result, and make the assertion read the
IPv6 fact - mirroring the IPv4 pattern directly above.
Verified with ansible-playbook on mocked calicoctl output:
- old code: set_fact skipped, no validation (reproduces the report)
- new code: mismatched blockSize caught with a clear assertion msg
- matching config passes through unchanged
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix: render routingMode native when cilium_tunnel_mode is disabled
When cilium_tunnel_mode is set to 'disabled', the previous template rendered
'tunnelProtocol: disabled', which Cilium does not recognise and falls back to
vxlan. With native routing this conflicts and agents CrashLoopBackOff.
Render 'routingMode: native' instead when disabled, matching the Cilium Helm
chart API (per maintainer review on #13427 and #13314).
Refs kubernetes-sigs/kubespray#13267
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(cilium): tighten routingMode native render (remove stray blank line)
Per review comment on kubernetes-sigs/kubespray#13427, drop the extra
blank line after the routingMode/tunnelProtocol if-block so the rendered
Helm values file is clean.
Validated by rendering the template for cilium_tunnel_mode in
{disabled, vxlan, geneve}: disabled yields 'routingMode: native' with no
tunnelProtocol; vxlan/geneve yield 'tunnelProtocol: <mode>'.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
Mehrdad Biukian