actualized for kubespray version 2.28.0

kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/azure-credential-check.yml

@@ -1,82 +0,0 @@
----
-- name: Check azure_tenant_id value
-  fail:
-    msg: "azure_tenant_id is missing"
-  when: azure_tenant_id is not defined or not azure_tenant_id
-
-- name: Check azure_subscription_id value
-  fail:
-    msg: "azure_subscription_id is missing"
-  when: azure_subscription_id is not defined or not azure_subscription_id
-
-- name: Check azure_aad_client_id value
-  fail:
-    msg: "azure_aad_client_id is missing"
-  when: azure_aad_client_id is not defined or not azure_aad_client_id
-
-- name: Check azure_aad_client_secret value
-  fail:
-    msg: "azure_aad_client_secret is missing"
-  when: azure_aad_client_secret is not defined or not azure_aad_client_secret
-
-- name: Check azure_resource_group value
-  fail:
-    msg: "azure_resource_group is missing"
-  when: azure_resource_group is not defined or not azure_resource_group
-
-- name: Check azure_location value
-  fail:
-    msg: "azure_location is missing"
-  when: azure_location is not defined or not azure_location
-
-- name: Check azure_subnet_name value
-  fail:
-    msg: "azure_subnet_name is missing"
-  when: azure_subnet_name is not defined or not azure_subnet_name
-
-- name: Check azure_security_group_name value
-  fail:
-    msg: "azure_security_group_name is missing"
-  when: azure_security_group_name is not defined or not azure_security_group_name
-
-- name: Check azure_vnet_name value
-  fail:
-    msg: "azure_vnet_name is missing"
-  when: azure_vnet_name is not defined or not azure_vnet_name
-
-- name: Check azure_vnet_resource_group value
-  fail:
-    msg: "azure_vnet_resource_group is missing"
-  when: azure_vnet_resource_group is not defined or not azure_vnet_resource_group
-
-- name: Check azure_route_table_name value
-  fail:
-    msg: "azure_route_table_name is missing"
-  when: azure_route_table_name is not defined or not azure_route_table_name
-
-- name: Check azure_loadbalancer_sku value
-  fail:
-    msg: "azure_loadbalancer_sku has an invalid value '{{ azure_loadbalancer_sku }}'. Supported values are 'basic', 'standard'"
-  when: azure_loadbalancer_sku not in ["basic", "standard"]
-
-- name: "Check azure_exclude_master_from_standard_lb is a bool"
-  assert:
-    that: azure_exclude_master_from_standard_lb | type_debug == 'bool'
-
-- name: "Check azure_disable_outbound_snat is a bool"
-  assert:
-    that: azure_disable_outbound_snat | type_debug == 'bool'
-
-- name: "Check azure_use_instance_metadata is a bool"
-  assert:
-    that: azure_use_instance_metadata | type_debug == 'bool'
-
-- name: Check azure_vmtype value
-  fail:
-    msg: "azure_vmtype is missing. Supported values are 'standard' or 'vmss'"
-  when: azure_vmtype is not defined or not azure_vmtype
-
-- name: Check azure_cloud value
-  fail:
-    msg: "azure_cloud has an invalid value '{{ azure_cloud }}'. Supported values are 'AzureChinaCloud', 'AzureGermanCloud', 'AzurePublicCloud', 'AzureUSGovernmentCloud'."
-  when: azure_cloud not in ["AzureChinaCloud", "AzureGermanCloud", "AzurePublicCloud", "AzureUSGovernmentCloud"]

kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/openstack-credential-check.yml

@@ -1,34 +0,0 @@
----
-- name: Check openstack_auth_url value
-  fail:
-    msg: "openstack_auth_url is missing"
-  when: openstack_auth_url is not defined or not openstack_auth_url
-
-- name: Check openstack_username value
-  fail:
-    msg: "openstack_username is missing"
-  when: openstack_username is not defined or not openstack_username
-
-- name: Check openstack_password value
-  fail:
-    msg: "openstack_password is missing"
-  when: openstack_password is not defined or not openstack_password
-
-- name: Check openstack_region value
-  fail:
-    msg: "openstack_region is missing"
-  when: openstack_region is not defined or not openstack_region
-
-- name: Check openstack_tenant_id value
-  fail:
-    msg: "one of openstack_tenant_id or openstack_trust_id must be specified"
-  when:
-    - openstack_tenant_id is not defined or not openstack_tenant_id
-    - openstack_trust_id is not defined
-
-- name: Check openstack_trust_id value
-  fail:
-    msg: "one of openstack_tenant_id or openstack_trust_id must be specified"
-  when:
-    - openstack_trust_id is not defined or not openstack_trust_id
-    - openstack_tenant_id is not defined

kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/vsphere-credential-check.yml

@@ -1,22 +0,0 @@
----
-- name: Check vsphere environment variables
-  fail:
-    msg: "{{ item.name }} is missing"
-  when: item.value is not defined or not item.value
-  with_items:
-    - name: vsphere_vcenter_ip
-      value: "{{ vsphere_vcenter_ip }}"
-    - name: vsphere_vcenter_port
-      value: "{{ vsphere_vcenter_port }}"
-    - name: vsphere_user
-      value: "{{ vsphere_user }}"
-    - name: vsphere_password
-      value: "{{ vsphere_password }}"
-    - name: vsphere_datacenter
-      value: "{{ vsphere_datacenter }}"
-    - name: vsphere_datastore
-      value: "{{ vsphere_datastore }}"
-    - name: vsphere_working_dir
-      value: "{{ vsphere_working_dir }}"
-    - name: vsphere_insecure
-      value: "{{ vsphere_insecure }}"

kubespray/project/roles/kubernetes/node/tasks/install.yml

@@ -8,7 +8,7 @@
   tags:
     - kubeadm
   when:
-    - not inventory_hostname in groups['kube_control_plane']
+    - not ('kube_control_plane' in group_names)
 
 - name: Install | Copy kubelet binary from download dir
   copy:

kubespray/project/roles/kubernetes/node/tasks/main.yml

@@ -5,11 +5,6 @@
     - facts
     - kubelet
 
-- name: Pre-upgrade kubelet
-  import_tasks: pre_upgrade.yml
-  tags:
-    - kubelet
-
 - name: Ensure /var/lib/cni exists
   file:
     path: /var/lib/cni
@@ -24,7 +19,7 @@
 - name: Install kube-vip
   import_tasks: loadbalancer/kube-vip.yml
   when:
-    - is_kube_master
+    - ('kube_control_plane' in group_names)
     - kube_vip_enabled
   tags:
     - kube-vip
@@ -32,7 +27,7 @@
 - name: Install nginx-proxy
   import_tasks: loadbalancer/nginx-proxy.yml
   when:
-    - not is_kube_master or kube_apiserver_bind_address != '0.0.0.0'
+    - ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::')
     - loadbalancer_apiserver_localhost
     - loadbalancer_apiserver_type == 'nginx'
   tags:
@@ -41,7 +36,7 @@
 - name: Install haproxy
   import_tasks: loadbalancer/haproxy.yml
   when:
-    - not is_kube_master or kube_apiserver_bind_address != '0.0.0.0'
+    - ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::')
     - loadbalancer_apiserver_localhost
     - loadbalancer_apiserver_type == 'haproxy'
   tags:
@@ -137,52 +132,14 @@
   tags:
     - kube-proxy
 
-- name: Check cloud provider credentials
-  include_tasks: "cloud-credentials/{{ cloud_provider }}-credential-check.yml"
-  when:
-    - cloud_provider is defined
-    - cloud_provider in [ 'openstack', 'azure', 'vsphere' ]
+- name: Modprobe Kernel Module for nftables
+  community.general.modprobe:
+    name: "nf_tables"
+    state: present
+    persistent: present
+  when: kube_proxy_mode == 'nftables'
   tags:
-    - cloud-provider
-    - facts
-
-- name: Test if openstack_cacert is a base64 string
-  set_fact:
-    openstack_cacert_is_base64: "{% if openstack_cacert is search('^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}= | [A-Za-z0-9+/]{2}==)?$') %}true{% else %}false{% endif %}"
-  when:
-    - cloud_provider is defined
-    - cloud_provider == 'openstack'
-    - openstack_cacert is defined
-    - openstack_cacert | length > 0
-
-
-- name: Write cacert file
-  copy:
-    src: "{{ openstack_cacert if not openstack_cacert_is_base64 else omit }}"
-    content: "{{ openstack_cacert | b64decode if openstack_cacert_is_base64 else omit }}"
-    dest: "{{ kube_config_dir }}/openstack-cacert.pem"
-    group: "{{ kube_cert_group }}"
-    mode: "0640"
-  when:
-    - cloud_provider is defined
-    - cloud_provider == 'openstack'
-    - openstack_cacert is defined
-    - openstack_cacert | length > 0
-  tags:
-    - cloud-provider
-
-- name: Write cloud-config
-  template:
-    src: "cloud-configs/{{ cloud_provider }}-cloud-config.j2"
-    dest: "{{ kube_config_dir }}/cloud_config"
-    group: "{{ kube_cert_group }}"
-    mode: "0640"
-  when:
-    - cloud_provider is defined
-    - cloud_provider in [ 'openstack', 'azure', 'vsphere', 'aws', 'gce' ]
-  notify: Node | restart kubelet
-  tags:
-    - cloud-provider
+    - kube-proxy
 
 - name: Install kubelet
   import_tasks: kubelet.yml

kubespray/project/roles/kubernetes/node/tasks/pre_upgrade.yml

@@ -1,48 +0,0 @@
----
-- name: "Pre-upgrade | check if kubelet container exists"
-  shell: >-
-    set -o pipefail &&
-    {% if container_manager in ['crio', 'docker'] %}
-    {{ docker_bin_dir }}/docker ps -af name=kubelet | grep kubelet
-    {% elif container_manager == 'containerd' %}
-    {{ bin_dir }}/crictl ps --all --name kubelet | grep kubelet
-    {% endif %}
-  args:
-    executable: /bin/bash
-  failed_when: false
-  changed_when: false
-  check_mode: false
-  register: kubelet_container_check
-
-- name: "Pre-upgrade | copy /var/lib/cni from kubelet"
-  command: >-
-    {% if container_manager in ['crio', 'docker'] %}
-    docker cp kubelet:/var/lib/cni /var/lib/cni
-    {% elif container_manager == 'containerd' %}
-    ctr run --rm --mount type=bind,src=/var/lib/cni,dst=/cnilibdir,options=rbind:rw kubelet kubelet-tmp sh -c 'cp /var/lib/cni/* /cnilibdir/'
-    {% endif %}
-  args:
-    creates: "/var/lib/cni"
-  failed_when: false
-  when: kubelet_container_check.rc == 0
-
-- name: "Pre-upgrade | ensure kubelet container service is stopped if using host deployment"
-  service:
-    name: kubelet
-    state: stopped
-  when: kubelet_container_check.rc == 0
-
-- name: "Pre-upgrade | ensure kubelet container is removed if using host deployment"
-  shell: >-
-    {% if container_manager in ['crio', 'docker'] %}
-    {{ docker_bin_dir }}/docker rm -fv kubelet
-    {% elif container_manager == 'containerd' %}
-    {{ bin_dir }}/crictl stop kubelet && {{ bin_dir }}/crictl rm kubelet
-    {% endif %}
-  failed_when: false
-  changed_when: false
-  register: remove_kubelet_container
-  retries: 4
-  until: remove_kubelet_container.rc == 0
-  delay: 5
-  when: kubelet_container_check.rc == 0