kubernetes-sigs/kubespray

What would you like to be added Extract the tasks related to DNS management from kubernetes/preinstall in a new role, and change the playbooks using it (cluster.yml, upgrade-cluster.yml, check also the others) accordingly. Why is this needed A number of include in kubernetes preinstall are guarded with a when: not dns_late. This is because the role is reused at the end of kubespray playbook to finish DNS configuration after the cluster configuration has been setup. This is however bad architecture. There is no reason to couple DNS config like this, and we could instead have a specific role to call at the end of the playbooks. The tasks related to DNS in kubernetes/preinstall should therefore be extracted in a new role, which will replace kubernetes/preinstall where it is invoked with dns_late: true. /good-first-issue

What would you like to be added Bump the default CRI-O version from v1.36.3 to v1.36.4. Add v1.36.4 checksums to roles/kubespray_defaults/vars/main/checksums.yml using the update-hashes tool Ensure the derived default crio_version resolves to v1.36.4 Run propagate-ansible-variables to update generated version references Release notes: https://github.com/cri-o/cri-o/releases/tag/v1.36.4 Diff: cri-o/[email protected] Why is this needed CRI-O v1.36.4 fixes a nil pointer dereference in ListPodSandboxStats when a container cgroup is removed during teardown. It also adds per-container targeting for CPU load balancing, IRQ load balancing, and CPU quota annotations. Keeping CRI-O on the latest 1.36 patch release reduces runtime crash risk and brings the current upstream fixes to Kubespray users.

What happened? Kubespray generates different ownership and permissions for etcd certificates on the first control-plane/etcd node compared to the remaining control-plane nodes. First control plane / etcd node shows following ownership and permissions for pem certificates in /etc/ssl/etcd/ssl/ -rw------- root root for *key.pem and -rw-r--r-- root root for pem files. Additional control planes / etcd nodes shows following: -rw-r----- etcd root for all *.pem files This is reproducible on all our cluster (4 clusters). Issue is probably because certificates seems to be generated on the first node, and only then copied with appropriate permissions and ownership to other nodes. If my understanding is right than they get generated in task roles/etcd/tasks/gen_certs_script.yml in task name Gen_certs | run cert generation script for etcd and kube control plane nodes and then copied to other nodes with task name name: Gen_certs | Write etcd member/admin and kube_control_plane client certs to other

What happened? Hi all, we are trying setting up our airgapped cluster using: KUBESPRAY 2.31.0 K8S: 1.35.0 Our cluster is not open to internet public registries and uses an AZURE ACR as pull-through cache. Due to this infrastructure configuration we are working with following variables: download_run_once: true download_localhost: true download_force_cache: true download_cache_dir: /opt/gitlab-runner/ansible/kubespray_cache download_container: true Containerd is hosted on our ansible controller host and always succeeds pulling from acr. Some months ago we have tried to setup and upgrade the cluster with kubespray 2.29 and 2.30, but always failed at download container time with error like the following: ctr: failed to get reader: content digest sha256:045fc1c20da893bef6d0ed64e92b243213b0cebcd478389573bdfb095e212a98: not found We have added some tasks before kubespray playbook execution to be sure to have the registry completely clean/empty and then we succeeded. We were pretty sure to h

What would you like to be added Metallb included is dated Oct 20, 2023, there was a few releases back then. Any specific reason to use an d version? Shouldn't be keep update? Why is this needed Just to make sure use latest technology available, general bugfix from streamline package and maintain high level of security I think packages should be updated to reflect state of art of their own lifecycle