From afa64e17a4a556a6fc64fdb20786fa90d40e90cf Mon Sep 17 00:00:00 2001 From: UnPoilTefal Date: Sun, 26 Apr 2026 11:45:28 +0200 Subject: [PATCH] :wrench: prepare fork usage + fix update kube role naming --- galaxy.yml | 2 +- inventory/sample/group_vars/all.yml | 10 +++++----- molecule/ipv6/overrides.yml | 2 +- roles/k3s_server/tasks/main.yml | 2 +- roles/k3s_server/templates/vip.yaml.j2 | 3 --- roles/prereq/tasks/main.yml | 12 ++++++------ 6 files changed, 14 insertions(+), 17 deletions(-) diff --git a/galaxy.yml b/galaxy.yml index 26bef62..8b912b2 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -2,7 +2,7 @@ # The namespace of the collection. This can be a company/brand/organization or product namespace under which all # content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with # underscores or numbers and cannot contain consecutive underscores -namespace: techno_tim +namespace: unpoiltefal # The name of the collection. Has the same character restrictions as 'namespace' name: k3s_ansible diff --git a/inventory/sample/group_vars/all.yml b/inventory/sample/group_vars/all.yml index 8ddeb05..e5b9898 100644 --- a/inventory/sample/group_vars/all.yml +++ b/inventory/sample/group_vars/all.yml @@ -1,5 +1,5 @@ --- -k3s_version: v1.30.2+k3s2 +k3s_version: v1.35.3+k3s1 # this is the user that has ssh access to these machines ansible_user: ansibleuser systemd_dir: /etc/systemd/system @@ -13,13 +13,13 @@ flannel_iface: eth0 # uncomment calico_iface to use tigera operator/calico cni instead of flannel https://docs.tigera.io/calico/latest/about # calico_iface: "eth0" calico_ebpf: false # use eBPF dataplane instead of iptables -calico_tag: v3.28.0 # calico version tag +calico_tag: v3.31.0 # calico version tag # uncomment cilium_iface to use cilium cni instead of flannel or calico # ensure v4.19.57, v5.1.16, v5.2.0 or more recent kernel # cilium_iface: "eth0" cilium_mode: native # native when nodes on same subnet or using bgp, else set routed -cilium_tag: v1.16.0 # cilium version tag +cilium_tag: v1.18.5 # cilium version tag cilium_hubble: true # enable hubble observability relay and ui # if using calico or cilium, you may specify the cluster pod cidr pool @@ -70,7 +70,7 @@ extra_args: >- # the contents of the if block is also required if using calico or cilium extra_server_args: >- {{ extra_args }} - {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }} + {{ '--node-taint node-role.kubernetes.io/control-plane=true:NoSchedule' if k3s_master_taint else '' }} {% if calico_iface is defined or cilium_iface is defined %} --flannel-backend=none --disable-network-policy @@ -84,7 +84,7 @@ extra_agent_args: >- {{ extra_args }} # image tag for kube-vip -kube_vip_tag_version: v0.8.2 +kube_vip_tag_version: v1.1.2 # tag for kube-vip-cloud-provider manifest # kube_vip_cloud_provider_tag_version: "main" diff --git a/molecule/ipv6/overrides.yml b/molecule/ipv6/overrides.yml index 44bbc07..9b2f88f 100644 --- a/molecule/ipv6/overrides.yml +++ b/molecule/ipv6/overrides.yml @@ -43,7 +43,7 @@ extra_server_args: >- {{ extra_args }} --tls-san {{ apiserver_endpoint }} - {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }} + {{ '--node-taint node-role.kubernetes.io/control-plane=true:NoSchedule' if k3s_master_taint else '' }} --disable servicelb --disable traefik --disable-network-policy diff --git a/roles/k3s_server/tasks/main.yml b/roles/k3s_server/tasks/main.yml index 8ebaad7..a48ac43 100644 --- a/roles/k3s_server/tasks/main.yml +++ b/roles/k3s_server/tasks/main.yml @@ -44,7 +44,7 @@ block: - name: Verify that all nodes actually joined (check k3s-init.service if this fails) ansible.builtin.command: - cmd: "{{ k3s_kubectl_binary | default('k3s kubectl') }} get nodes -l 'node-role.kubernetes.io/master=true' -o=jsonpath='{.items[*].metadata.name}'" # yamllint disable-line rule:line-length + cmd: "{{ k3s_kubectl_binary | default('k3s kubectl') }} get nodes -l 'node-role.kubernetes.io/control-plane=true' -o=jsonpath='{.items[*].metadata.name}'" # yamllint disable-line rule:line-length register: nodes until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups[group_name_master | default('master')] | length) # yamllint disable-line rule:line-length retries: "{{ retry_count | default(20) }}" diff --git a/roles/k3s_server/templates/vip.yaml.j2 b/roles/k3s_server/templates/vip.yaml.j2 index 44469a6..8274d83 100644 --- a/roles/k3s_server/templates/vip.yaml.j2 +++ b/roles/k3s_server/templates/vip.yaml.j2 @@ -16,9 +16,6 @@ spec: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - - matchExpressions: - - key: node-role.kubernetes.io/master - operator: Exists - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml index 9161f7b..a8c475e 100644 --- a/roles/prereq/tasks/main.yml +++ b/roles/prereq/tasks/main.yml @@ -7,7 +7,7 @@ - name: Set SELinux to disabled state ansible.posix.selinux: state: disabled - when: ansible_os_family == "RedHat" + when: ansible_facts["os_family"] == "RedHat" - name: Enable IPv4 forwarding ansible.posix.sysctl: @@ -38,13 +38,13 @@ content: br_netfilter dest: /etc/modules-load.d/br_netfilter.conf mode: u=rw,g=,o= - when: ansible_os_family == "RedHat" + when: ansible_facts["os_family"] == "RedHat" - name: Load br_netfilter community.general.modprobe: name: br_netfilter state: present - when: ansible_os_family == "RedHat" + when: ansible_facts["os_family"] == "RedHat" - name: Set bridge-nf-call-iptables (just to be sure) ansible.posix.sysctl: @@ -52,7 +52,7 @@ value: "1" state: present reload: true - when: ansible_os_family == "RedHat" + when: ansible_facts["os_family"] == "RedHat" loop: - net.bridge.bridge-nf-call-iptables - net.bridge.bridge-nf-call-ip6tables @@ -60,10 +60,10 @@ - name: Add /usr/local/bin to sudo secure_path ansible.builtin.lineinfile: - line: Defaults secure_path = {{ secure_path[ansible_os_family] }} + line: Defaults secure_path = {{ secure_path[ansible_facts["os_family"]] }} regexp: Defaults(\s)*secure_path(\s)*= state: present insertafter: EOF path: /etc/sudoers validate: visudo -cf %s - when: ansible_os_family in [ "RedHat", "Suse" ] + when: ansible_facts["os_family"] in [ "RedHat", "Suse" ]