update to latest 2.26.0 kubespray version and add dns zones settings to coredns

kubespray/project/roles/network_plugin/cilium/defaults/main.yml

@@ -7,6 +7,9 @@ cilium_mtu: ""
 cilium_enable_ipv4: true
 cilium_enable_ipv6: false
 
+# Enable l2 announcement from cilium to replace Metallb Ref: https://docs.cilium.io/en/v1.14/network/l2-announcements/
+cilium_l2announcements: false
+
 # Cilium agent health port
 cilium_agent_health_port: "{%- if cilium_version | regex_replace('v') is version('1.11.6', '>=') -%}9879{%- else -%}9876{%- endif -%}"
 
@@ -39,6 +42,10 @@ cilium_cpu_requests: 100m
 
 # Overlay Network Mode
 cilium_tunnel_mode: vxlan
+
+# LoadBalancer Mode (snat/dsr/hybrid) Ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#dsr-mode
+cilium_loadbalancer_mode: snat
+
 # Optional features
 cilium_enable_prometheus: false
 # Enable if you want to make use of hostPort mappings
@@ -152,6 +159,12 @@ cilium_hubble_install: false
 ### Enable auto generate certs if cilium_hubble_install: true
 cilium_hubble_tls_generate: false
 
+### Capacity of Hubble events buffer. The provided value must be one less than an integer power of two and no larger than 65535
+### (ie: 1, 3, ..., 2047, 4095, ..., 65535) (default 4095)
+# cilium_hubble_event_buffer_capacity: 4095
+### Buffer size of the channel to receive monitor events.
+# cilium_hubble_event_queue_size: 50
+
 # The default IP address management mode is "Cluster Scope".
 # https://docs.cilium.io/en/stable/concepts/networking/ipam/
 cilium_ipam_mode: cluster-pool

kubespray/project/roles/network_plugin/cilium/tasks/check.yml

@@ -61,3 +61,9 @@
   when:
     - cilium_ipsec_enabled is defined
     - cilium_ipsec_enabled
+
+- name: Stop if cilium_hubble_event_buffer_capacity is not a power of 2 minus 1 and is not between 1 and 65535
+  assert:
+    that: "cilium_hubble_event_buffer_capacity in [1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191, 16383, 32767, 65535]"
+    msg: "Error: cilium_hubble_event_buffer_capacity:{{ cilium_hubble_event_buffer_capacity }} is not a power of 2 minus 1 and it should be between 1 and 65535."
+  when: cilium_hubble_event_buffer_capacity is defined

kubespray/project/roles/network_plugin/cilium/tasks/install.yml

@@ -10,7 +10,7 @@
   file:
     dest: "{{ cilium_cert_dir }}"
     state: directory
-    mode: 0750
+    mode: "0750"
     owner: root
     group: root
   when:
@@ -20,9 +20,9 @@
   file:
     src: "{{ etcd_cert_dir }}/{{ item.s }}"
     dest: "{{ cilium_cert_dir }}/{{ item.d }}"
-    mode: 0644
+    mode: "0644"
     state: hard
-    force: yes
+    force: true
   loop:
     - {s: "{{ kube_etcd_cacert_file }}", d: "ca_cert.crt"}
     - {s: "{{ kube_etcd_cert_file }}", d: "cert.crt"}
@@ -36,7 +36,7 @@
     state: directory
     owner: root
     group: root
-    mode: 0755
+    mode: "0755"
   when:
     - inventory_hostname == groups['kube_control_plane'][0]
     - cilium_hubble_install
@@ -45,7 +45,7 @@
   template:
     src: "{{ item.name }}/{{ item.file }}.j2"
     dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}"
-    mode: 0644
+    mode: "0644"
   loop:
     - {name: cilium, file: config.yml, type: cm}
     - {name: cilium-operator, file: crb.yml, type: clusterrolebinding}
@@ -66,7 +66,7 @@
   template:
     src: "{{ item.name }}/{{ item.file }}.j2"
     dest: "{{ kube_config_dir }}/addons/hubble/{{ item.name }}-{{ item.file }}"
-    mode: 0644
+    mode: "0644"
   loop:
     - {name: hubble, file: config.yml, type: cm}
     - {name: hubble, file: crb.yml, type: clusterrolebinding}
@@ -86,12 +86,12 @@
   template:
     src: 000-cilium-portmap.conflist.j2
     dest: /etc/cni/net.d/000-cilium-portmap.conflist
-    mode: 0644
+    mode: "0644"
   when: cilium_enable_portmap
 
 - name: Cilium | Copy Ciliumcli binary from download dir
   copy:
     src: "{{ local_release_dir }}/cilium"
     dest: "{{ bin_dir }}/cilium"
-    mode: 0755
-    remote_src: yes
+    mode: "0755"
+    remote_src: true

kubespray/project/roles/network_plugin/cilium/tasks/reset_iface.yml

@@ -2,9 +2,9 @@
 - name: "Reset | check if network device {{ iface }} is present"
   stat:
     path: "/sys/class/net/{{ iface }}"
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
   register: device_remains
 
 - name: "Reset | remove network device {{ iface }}"

kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/cr.yml.j2

@@ -97,6 +97,11 @@ rules:
   - ciliumloadbalancerippools/status
   - ciliumbgppeeringpolicies
   - ciliumenvoyconfigs
+{% endif %}
+{% if cilium_version | regex_replace('v') is version('1.15', '>=') %}
+  - ciliumbgppeerconfigs
+  - ciliumbgpadvertisements
+  - ciliumbgpnodeconfigs
 {% endif %}
   verbs:
   - '*'
@@ -146,6 +151,20 @@ rules:
   - ciliumlocalredirectpolicies.cilium.io
   - ciliumnetworkpolicies.cilium.io
   - ciliumnodes.cilium.io
+{% if cilium_version | regex_replace('v') is version('1.14', '>=') %}
+  - ciliumnodeconfigs.cilium.io
+  - ciliumcidrgroups.cilium.io
+  - ciliuml2announcementpolicies.cilium.io
+  - ciliumpodippools.cilium.io
+  - ciliumloadbalancerippools.cilium.io
+{% endif %}
+{% if cilium_version | regex_replace('v') is version('1.15', '>=') %}
+  - ciliumbgpclusterconfigs.cilium.io
+  - ciliumbgppeerconfigs.cilium.io
+  - ciliumbgpadvertisements.cilium.io
+  - ciliumbgpnodeconfigs.cilium.io
+  - ciliumbgpnodeconfigoverrides.cilium.io
+{% endif %}
 {% endif %}
 {% for rules in cilium_clusterrole_rules_operator_extra_vars %}
 - apiGroups:

kubespray/project/roles/network_plugin/cilium/templates/cilium/config.yml.j2

@@ -69,6 +69,13 @@ data:
   # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
   custom-cni-conf: "false"
 
+{% if cilium_version | regex_replace('v') is version('1.14.0', '>=') %}
+  # Tell the agent to generate and write a CNI configuration file
+  write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist
+  cni-exclusive: "{{ cilium_cni_exclusive }}"
+  cni-log-file: "{{ cilium_cni_log_file }}"
+{% endif %}
+
   # If you want cilium monitor to aggregate tracing for packets, set this level
   # to "low", "medium", or "maximum". The higher the level, the less packets
   # that will be seen in monitor output.
@@ -124,6 +131,12 @@ data:
   tunnel-protocol: "{{ cilium_tunnel_mode }}"
 {% endif %}
 
+  ## DSR setting
+  bpf-lb-mode: "{{ cilium_loadbalancer_mode }}"
+
+  # l2
+  enable-l2-announcements: "{{ cilium_l2announcements }}"
+
   # Enable Bandwidth Manager
   # Cilium’s bandwidth manager supports the kubernetes.io/egress-bandwidth Pod annotation.
   # Bandwidth enforcement currently does not work in combination with L7 Cilium Network Policies.
@@ -179,6 +192,12 @@ data:
 {% for hubble_metrics_cycle in cilium_hubble_metrics %}
     {{ hubble_metrics_cycle }}
 {% endfor %}
+{% endif %}
+{% if cilium_hubble_event_buffer_capacity is defined %}
+  hubble-event-buffer-capacity: "{{ cilium_hubble_event_buffer_capacity }}"
+{% endif %}
+{% if cilium_hubble_event_queue_size is defined %}
+  hubble-event-queue-size: "{{ cilium_hubble_event_queue_size }}"
 {% endif %}
   hubble-listen-address: ":4244"
 {% if cilium_enable_hubble and cilium_hubble_install %}

kubespray/project/roles/network_plugin/cilium/templates/cilium/cr.yml.j2

@@ -106,6 +106,15 @@ rules:
   - ciliumnodes/finalizers
   - ciliumidentities/finalizers
   - ciliumlocalredirectpolicies/finalizers
+{% endif %}
+{% if cilium_version | regex_replace('v') is version('1.14', '>=') %}
+  - ciliuml2announcementpolicies/status
+{% endif %}
+{% if cilium_version | regex_replace('v') is version('1.15', '>=') %}
+  - ciliumbgpnodeconfigs
+  - ciliumbgpnodeconfigs/status
+  - ciliumbgpadvertisements
+  - ciliumbgppeerconfigs
 {% endif %}
   verbs:
   - '*'
@@ -125,7 +134,22 @@ rules:
   - cilium.io
   resources:
   - ciliumcidrgroups
+  - ciliuml2announcementpolicies
+  - ciliumpodippools
+  - ciliuml2announcementpolicies/status
   verbs:
   - list
   - watch
+{% if cilium_version %}
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - update
+  - list
+  - delete
+{% endif %}
 {% endif %}

kubespray/project/roles/network_plugin/cilium/templates/hubble/config.yml.j2

@@ -12,10 +12,10 @@ data:
     peer-service: "hubble-peer.kube-system.svc.{{ dns_domain }}:443"
     listen-address: :4245
     metrics-listen-address: ":9966"
-    dial-timeout: 
-    retry-timeout: 
-    sort-buffer-len-max: 
-    sort-buffer-drain-timeout: 
+    dial-timeout:
+    retry-timeout:
+    sort-buffer-len-max:
+    sort-buffer-drain-timeout:
     tls-client-cert-file: /var/lib/hubble-relay/tls/client.crt
     tls-client-key-file: /var/lib/hubble-relay/tls/client.key
     tls-server-cert-file: /var/lib/hubble-relay/tls/server.crt

kubespray/project/roles/network_plugin/cilium/templates/hubble/service.yml.j2

@@ -102,4 +102,3 @@ spec:
     protocol: TCP
     targetPort: 4244
   internalTrafficPolicy: Local
-