* ci: run the Ansible controller as an unprivileged user
* ci: clarify non-root controller check
* ci: make the sudo privilege check fail when sudo succeeds
Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds.
Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.
This reverts commit e19d1c9a55.
Allow further maintainer discussion without introducing additional changes.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI
Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.
EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.
Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Fix EL8 containerd compatibility and SELinux runtime transitions
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* image-builder: add Ubuntu 26.04 image
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add Ubuntu 26.04 support
Add an Ubuntu 26.04 CI job (ubuntu26-calico-all-in-one) to the main PR
matrix, OS-specific node vars, and update the coverage docs.
The VM image is published as quay.io/kubespray/vm-ubuntu-2604.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Add openeuler_repo_baseurl variable to override the default baseurl
(repo.openeuler.org) with a faster mirror. CI uses Huawei Cloud CDN,
reducing package installation from >900s timeout to ~2min.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
- also remove macvlan on debian support since the role works neither on
debian 12 nor 13
- macvlan is no longer tested in CI as it does not work on rockylinux10
either
* fix(custom_cni): make namespace optional
Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* docs(custom_cni): document multi-namespace manifests
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---------
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* Reboot only when required, add the option to clean packages.
* Update docs to reflect only Debian based distribution can be apt
autocleaned
* Add apt cleanup to upgrade tests
* fix(tests): use kube_network_plugin in fedora43-flannel-crio test
The fedora43-flannel-crio-collection-scale.yml test config set
'network_plugin: flannel', but all Kubespray roles read
'kube_network_plugin' (defaulting to 'calico'). The test silently
ran Calico instead of Flannel.
Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>
* Update CI matrix to reflect fedora43-flannel-crio test correctly
---------
Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>
Fedora 39 (EOL 2024-11-26), Fedora 40 (EOL 2025-05-13), and Fedora 41
(EOL 2025-12-15) are all out of support and no longer receive security
updates. This bumps the kubevirt CI test matrix to currently supported
releases, distributing tests across Fedora 42 (supported until
2026-05-13) and Fedora 43 (supported until 2026-12-09) to keep
multi-version coverage.
- Add fedora-43 image entry to the kubevirt image-builder
- Rename fedora39-* tests to fedora43-* (4 tests)
- Rename fedora40-* tests to fedora43-* (2 tests)
- Rename fedora41-* tests to fedora42-* (4 tests)
- Update .gitlab-ci/kubevirt.yml testcase names
- Regenerate docs/developers/ci.md
All 10 existing Fedora test configurations (kube-router, calico-selinux,
calico-swap-selinux, crio with/without SELinux enforcing, docker-calico,
flannel-crio-collection-scale) are preserved.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
Enable openEuler metalink and clear dnf cache after repo updates so package downloads use refreshed mirror metadata. Keep openeuler24-calico in the main CI matrix with a longer package timeout, and clean up failed pods before running-state checks to reduce transient CI noise.
Made-with: Cursor
Made-with: Cursor
Made-with: Cursor
Made-with: Cursor
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
* CI: add no_proxy regression test
* proxy: Fix the no_proxy variable
Since 2.29, probably due to a change in ansible templating, the no_proxy
variable is rendered as an array of character rather than a string.
This results in broken cluster in some case.
Eliminate the custom jinja looping to use filters and list flatteing +
join instead.
Also simplify some things (no separate tasks file, just use `run_once`
instead of delegating to localhost)
Upgrade the Cilium version used in custom_cni tests from 1.16.3 to
1.18.6 to align with the current cilium_version in Kubespray.
- Update custom_cni_chart_version in debian12-custom-cni-helm.yml
- Regenerate static manifest in tests/files/custom_cni/cilium.yaml
using helm template cilium/cilium --version 1.18.6
Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
dependabot[bot]
MohammadReza
Frank
Ali Afsharzadeh
Javad
Jay.HandAli Afsharzadeh
Kay Yan
Max Gautier
Narwhal-fish
wangsifei99
Nikhil Kumar
Jeroen Rijken
Adesh Deshmukh
ChengHao Yang
Kubernetes Prow Robot
labaq
蔡秀吉
rayui
Mohamed Omar Zaian
Srishti Jaiswal
neo