From 869a7ccbd3c5df9d9c5b0cebf467bb880054d574 Mon Sep 17 00:00:00 2001 From: Timothy Stewart Date: Sat, 1 Aug 2026 22:45:46 -0500 Subject: [PATCH] fix(dependencies): resolve re-review findings - correct the Calico TigeraStatus resource kind\n- document tunnel as the supported Cilium routing mode\n- validate load balancer addresses across range and CIDR pools --- README.md | 2 +- inventory/sample/group_vars/all.yml | 2 +- .../tasks/test/deploy-example.yml | 56 ++++++++++++------- .../tasks/test/verify-components.yml | 2 +- 4 files changed, 38 insertions(+), 24 deletions(-) diff --git a/README.md b/README.md index 9211472..87063ec 100644 --- a/README.md +++ b/README.md @@ -197,7 +197,7 @@ See the commands [here](https://technotim.com/posts/k3s-etcd-ansible/#testing-yo | `k3s_server_post` | `cilium_bgp_lb_cidr` | string | `192.168.31.0/24` | Not required | BGP load balancer IP range | | `k3s_server_post` | `cilium_exportPodCIDR` | bool | `true` | Not required | Export pod CIDR | | `k3s_server_post` | `cilium_hubble` | bool | `true` | Not required | Enable Cilium Hubble | -| `k3s_server_post` | `cilium_mode` | string | `native` | Not required | Inner-node communication mode (choices are `native` and `routed`) | +| `k3s_server_post` | `cilium_mode` | string | `native` | Not required | Inner-node communication mode (choices are `native` and `tunnel`; `routed` is a deprecated alias for `tunnel`) | | `k3s_server_post` | `cilium_tag` | string | `v1.20.0` | Not required | Cilium version tag | | `k3s_server_post` | `cilium_cli_tag` | string | `v0.19.7` | Not required | Cilium CLI version tag | | `k3s_server_post` | `cluster_cidr` | string | `10.52.0.0/16` | Not required | Inner-cluster IP range | diff --git a/inventory/sample/group_vars/all.yml b/inventory/sample/group_vars/all.yml index a678911..ac0cb71 100644 --- a/inventory/sample/group_vars/all.yml +++ b/inventory/sample/group_vars/all.yml @@ -18,7 +18,7 @@ calico_tag: v3.32.1 # calico version tag # uncomment cilium_iface to use cilium cni instead of flannel or calico # ensure v4.19.57, v5.1.16, v5.2.0 or more recent kernel # cilium_iface: "eth0" -cilium_mode: native # native when nodes on same subnet or using bgp, else set routed +cilium_mode: native # native when nodes are on the same subnet or use BGP, otherwise set tunnel cilium_tag: v1.20.0 # cilium version tag cilium_cli_tag: v0.19.7 # cilium cli version tag cilium_hubble: true # enable hubble observability relay and ui diff --git a/molecule/resources/verify_from_outside/tasks/test/deploy-example.yml b/molecule/resources/verify_from_outside/tasks/test/deploy-example.yml index 8a890d5..ed81e94 100644 --- a/molecule/resources/verify_from_outside/tasks/test/deploy-example.yml +++ b/molecule/resources/verify_from_outside/tasks/test/deploy-example.yml @@ -44,31 +44,45 @@ port_: >- {{ nginx_services.resources[0].spec.ports[0].port }} - - name: Assert that the load balancer address is within the configured pool + - name: Initialize load balancer address range check + ansible.builtin.set_fact: + lb_addr_in_range: false + lb_ip_value: >- + {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }} + + - name: Check load balancer address against start-end pools + ansible.builtin.set_fact: + lb_addr_in_range: true + loop: "{{ verify_lb_ip_range }}" + loop_control: + label: "{{ item }}" + when: + - "'-' in item" + - "'/' not in item" + - >- + (lb_ip_value | ansible.utils.ipaddr('int') | int) >= + (item.split('-')[0] | ansible.utils.ipaddr('int') | int) + - >- + (lb_ip_value | ansible.utils.ipaddr('int') | int) <= + (item.split('-')[1] | ansible.utils.ipaddr('int') | int) + + - name: Check load balancer address against CIDR pools + ansible.builtin.set_fact: + lb_addr_in_range: true + loop: "{{ verify_lb_ip_range }}" + loop_control: + label: "{{ item }}" + when: + - "'/' in item" + - (lb_ip_value | ansible.utils.ipaddr(item)) is string + + - name: Assert that the load balancer address is within a configured pool ansible.builtin.assert: that: lb_addr_in_range - success_msg: "LoadBalancer address {{ ip_value }} is in the configured range" + success_msg: "LoadBalancer address {{ lb_ip_value }} is in a configured range" fail_msg: >- - LoadBalancer address {{ ip_value }} is not in the configured + LoadBalancer address {{ lb_ip_value }} is not in a configured range {{ verify_lb_ip_range }} - vars: - ip_value: >- - {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }} - lb_first: "{{ verify_lb_ip_range[0] | default('') }}" - lb_is_range: "{{ '-' in lb_first and '/' not in lb_first }}" - lb_start: "{{ lb_first.split('-')[0] | default(ip_value) }}" - lb_end: "{{ lb_first.split('-')[1] | default(ip_value) }}" - # Strict membership is checked only when the first range entry is a - # start-end pair. CIDR entries (used by the ipv6 scenario) fall back to - # the reachability probe above. - lb_addr_in_range: >- - {{ - (verify_lb_ip_range | length > 0) and - ((not lb_is_range) or ( - (ip_value | ansible.utils.ipaddr('int') >= lb_start | ansible.utils.ipaddr('int')) and - (ip_value | ansible.utils.ipaddr('int') <= lb_end | ansible.utils.ipaddr('int')) - )) - }} # Deactivated linter rules: # - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap # would be undefined. This will not be the case during playbook execution. diff --git a/molecule/resources/verify_from_outside/tasks/test/verify-components.yml b/molecule/resources/verify_from_outside/tasks/test/verify-components.yml index d5279b5..769c43b 100644 --- a/molecule/resources/verify_from_outside/tasks/test/verify-components.yml +++ b/molecule/resources/verify_from_outside/tasks/test/verify-components.yml @@ -86,7 +86,7 @@ - name: Get Calico TigeraStatus for calico and apiserver kubernetes.core.k8s_info: api_version: operator.tigera.io/v1 - kind: Tigerastatus + kind: TigeraStatus name: "{{ item }}" kubeconfig: "{{ kubecfg_path }}" register: calico_tigerastatus