fix(dependencies): resolve re-review findings

- correct the Calico TigeraStatus resource kind\n- document tunnel as the supported Cilium routing mode\n- validate load balancer addresses across range and CIDR pools

README.md

@@ -197,7 +197,7 @@ See the commands [here](https://technotim.com/posts/k3s-etcd-ansible/#testing-yo
 | `k3s_server_post` | `cilium_bgp_lb_cidr` | string | `192.168.31.0/24` | Not required | BGP load balancer IP range |
 | `k3s_server_post` | `cilium_exportPodCIDR` | bool | `true` | Not required | Export pod CIDR |
 | `k3s_server_post` | `cilium_hubble` | bool | `true` | Not required | Enable Cilium Hubble |
-| `k3s_server_post` | `cilium_mode` | string | `native` | Not required | Inner-node communication mode (choices are `native` and `routed`) |
+| `k3s_server_post` | `cilium_mode` | string | `native` | Not required | Inner-node communication mode (choices are `native` and `tunnel`; `routed` is a deprecated alias for `tunnel`) |
 | `k3s_server_post` | `cilium_tag` | string | `v1.20.0` | Not required | Cilium version tag |
 | `k3s_server_post` | `cilium_cli_tag` | string | `v0.19.7` | Not required | Cilium CLI version tag |
 | `k3s_server_post` | `cluster_cidr` | string | `10.52.0.0/16` | Not required | Inner-cluster IP range |

inventory/sample/group_vars/all.yml

@@ -18,7 +18,7 @@ calico_tag: v3.32.1 # calico version tag
 # uncomment cilium_iface to use cilium cni instead of flannel or calico
 # ensure v4.19.57, v5.1.16, v5.2.0 or more recent kernel
 # cilium_iface: "eth0"
-cilium_mode: native # native when nodes on same subnet or using bgp, else set routed
+cilium_mode: native # native when nodes are on the same subnet or use BGP, otherwise set tunnel
 cilium_tag: v1.20.0 # cilium version tag
 cilium_cli_tag: v0.19.7 # cilium cli version tag
 cilium_hubble: true # enable hubble observability relay and ui

molecule/resources/verify_from_outside/tasks/test/deploy-example.yml

@@ -44,31 +44,45 @@
         port_: >-
           {{ nginx_services.resources[0].spec.ports[0].port }}
 
-    - name: Assert that the load balancer address is within the configured pool
+    - name: Initialize load balancer address range check
+      ansible.builtin.set_fact:
+        lb_addr_in_range: false
+        lb_ip_value: >-
+          {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
+
+    - name: Check load balancer address against start-end pools
+      ansible.builtin.set_fact:
+        lb_addr_in_range: true
+      loop: "{{ verify_lb_ip_range }}"
+      loop_control:
+        label: "{{ item }}"
+      when:
+        - "'-' in item"
+        - "'/' not in item"
+        - >-
+          (lb_ip_value | ansible.utils.ipaddr('int') | int) >=
+          (item.split('-')[0] | ansible.utils.ipaddr('int') | int)
+        - >-
+          (lb_ip_value | ansible.utils.ipaddr('int') | int) <=
+          (item.split('-')[1] | ansible.utils.ipaddr('int') | int)
+
+    - name: Check load balancer address against CIDR pools
+      ansible.builtin.set_fact:
+        lb_addr_in_range: true
+      loop: "{{ verify_lb_ip_range }}"
+      loop_control:
+        label: "{{ item }}"
+      when:
+        - "'/' in item"
+        - (lb_ip_value | ansible.utils.ipaddr(item)) is string
+
+    - name: Assert that the load balancer address is within a configured pool
       ansible.builtin.assert:
         that: lb_addr_in_range
-        success_msg: "LoadBalancer address {{ ip_value }} is in the configured range"
+        success_msg: "LoadBalancer address {{ lb_ip_value }} is in a configured range"
         fail_msg: >-
-          LoadBalancer address {{ ip_value }} is not in the configured
+          LoadBalancer address {{ lb_ip_value }} is not in a configured
           range {{ verify_lb_ip_range }}
-      vars:
-        ip_value: >-
-          {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
-        lb_first: "{{ verify_lb_ip_range[0] | default('') }}"
-        lb_is_range: "{{ '-' in lb_first and '/' not in lb_first }}"
-        lb_start: "{{ lb_first.split('-')[0] | default(ip_value) }}"
-        lb_end: "{{ lb_first.split('-')[1] | default(ip_value) }}"
-        # Strict membership is checked only when the first range entry is a
-        # start-end pair. CIDR entries (used by the ipv6 scenario) fall back to
-        # the reachability probe above.
-        lb_addr_in_range: >-
-          {{
-            (verify_lb_ip_range | length > 0) and
-            ((not lb_is_range) or (
-              (ip_value | ansible.utils.ipaddr('int') >= lb_start | ansible.utils.ipaddr('int')) and
-              (ip_value | ansible.utils.ipaddr('int') <= lb_end | ansible.utils.ipaddr('int'))
-            ))
-          }}
   # Deactivated linter rules:
   #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
   #                     would be undefined. This will not be the case during playbook execution.

molecule/resources/verify_from_outside/tasks/test/verify-components.yml

@@ -86,7 +86,7 @@
         - name: Get Calico TigeraStatus for calico and apiserver
           kubernetes.core.k8s_info:
             api_version: operator.tigera.io/v1
-            kind: Tigerastatus
+            kind: TigeraStatus
             name: "{{ item }}"
             kubeconfig: "{{ kubecfg_path }}"
           register: calico_tigerastatus