actualized for kubespray version 2.28.0

kubespray/project/roles/network_plugin/calico/tasks/check.yml

@@ -24,22 +24,11 @@
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
 
 
-- name: Stop if incompatible network plugin and cloudprovider
-  assert:
-    that:
-      - calico_ipip_mode == 'Never'
-      - calico_vxlan_mode in ['Always', 'CrossSubnet']
-    msg: "When using cloud_provider azure and network_plugin calico calico_ipip_mode must be 'Never' and calico_vxlan_mode 'Always' or 'CrossSubnet'"
-  when:
-    - cloud_provider is defined and cloud_provider == 'azure'
-  run_once: true
-  delegate_to: "{{ groups['kube_control_plane'][0] }}"
-
 - name: Stop if supported Calico versions
   assert:
     that:
-      - "calico_version in calico_crds_archive_checksums.keys()"
-    msg: "Calico version not supported {{ calico_version }} not in {{ calico_crds_archive_checksums.keys() }}"
+      - "calico_version in calico_crds_archive_checksums.no_arch.keys()"
+    msg: "Calico version not supported {{ calico_version }} not in {{ calico_crds_archive_checksums.no_arch.keys() }}"
   run_once: true
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
 
@@ -76,7 +65,7 @@
     - name: Assert that current calico version is enough for upgrade
       assert:
         that:
-          - calico_version_on_server.stdout is version(calico_min_version_required, '>=')
+          - calico_version_on_server.stdout.removeprefix('v') is version(calico_min_version_required, '>=')
         msg: >
           Your version of calico is not fresh enough for upgrade.
           Minimum version is {{ calico_min_version_required }} supported by the previous kubespray release.
@@ -157,12 +146,16 @@
   check_mode: false
   register: calico
   run_once: true
+  when: ipv4_stack | bool
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
 
 - name: "Set calico_pool_conf"
   set_fact:
     calico_pool_conf: '{{ calico.stdout | from_json }}'
-  when: calico.rc == 0 and calico.stdout
+  when:
+    - ipv4_stack | bool
+    - calico is defined
+    - calico.rc == 0 and calico.stdout
   run_once: true
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
 
@@ -175,10 +168,45 @@
       - not calico_pool_conf.spec.vxlanMode is defined or calico_pool_conf.spec.vxlanMode == calico_vxlan_mode
     msg: "Your inventory doesn't match the current cluster configuration"
   when:
+    - ipv4_stack | bool
     - calico_pool_conf is defined
   run_once: true
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
 
+- name: "Get Calico {{ calico_pool_name }}-ipv6 configuration"
+  command: "{{ bin_dir }}/calicoctl.sh get ipPool {{ calico_pool_name }}-ipv6 -o json"
+  failed_when: false
+  changed_when: false
+  check_mode: false
+  register: calico_ipv6
+  run_once: true
+  when: ipv6_stack | bool
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+
+- name: "Set calico_pool_ipv6_conf"
+  set_fact:
+    calico_pool_conf: '{{ calico_ipv6.stdout | from_json }}'
+  when:
+    - ipv6_stack | bool
+    - alico_ipv6 is defined
+    - calico_ipv6.rc == 0 and calico_ipv6.stdout
+  run_once: true
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+
+- name: "Check if ipv6 inventory match current cluster configuration"
+  assert:
+    that:
+      - calico_pool_conf.spec.blockSize | int == calico_pool_blocksize_ipv6 | int
+      - calico_pool_conf.spec.cidr == (calico_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6))
+      - not calico_pool_conf.spec.ipipMode is defined or calico_pool_conf.spec.ipipMode == calico_ipip_mode_ipv6
+      - not calico_pool_conf.spec.vxlanMode is defined or calico_pool_conf.spec.vxlanMode == calico_vxlan_mode_ipv6
+    msg: "Your ipv6 inventory doesn't match the current cluster configuration"
+  when:
+    - ipv6_stack | bool
+    - calico_pool_ipv6_conf is defined
+  run_once: true
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+
 - name: "Check kdd calico_datastore if calico_apiserver_enabled"
   assert:
     that: calico_datastore == "kdd"
@@ -202,7 +230,6 @@
     that:
       - "calico_ipip_mode_ipv6 in ['Never']"
     msg: "Calico doesn't support ipip tunneling for the IPv6"
-  when:
-    - enable_dual_stack_networks
+  when: ipv6_stack | bool
   run_once: true
   delegate_to: "{{ groups['kube_control_plane'][0] }}"

kubespray/project/roles/network_plugin/calico/tasks/install.yml

@@ -84,6 +84,7 @@
   changed_when: false
   when:
     - inventory_hostname == groups['kube_control_plane'][0]
+    - ipv4_stack | bool
 
 - name: Calico | Ensure that calico_pool_cidr is within kube_pods_subnet when defined
   assert:
@@ -91,8 +92,9 @@
     msg: "{{ calico_pool_cidr }} is not within or equal to {{ kube_pods_subnet }}"
   when:
     - inventory_hostname == groups['kube_control_plane'][0]
-    - 'calico_conf.stdout == "0"'
+    - ipv4_stack | bool
     - calico_pool_cidr is defined
+    - 'calico_conf.stdout == "0"'
 
 - name: Calico | Check if calico IPv6 network pool has already been configured
   # noqa risky-shell-pipe - grep will exit 1 if no match found
@@ -107,7 +109,7 @@
   changed_when: false
   when:
     - inventory_hostname == groups['kube_control_plane'][0]
-    - enable_dual_stack_networks
+    - ipv6_stack
 
 - name: Calico | Ensure that calico_pool_cidr_ipv6 is within kube_pods_subnet_ipv6 when defined
   assert:
@@ -115,29 +117,29 @@
     msg: "{{ calico_pool_cidr_ipv6 }} is not within or equal to {{ kube_pods_subnet_ipv6 }}"
   when:
     - inventory_hostname == groups['kube_control_plane'][0]
+    - ipv6_stack | bool
     - calico_conf_ipv6.stdout is defined and calico_conf_ipv6.stdout == "0"
     - calico_pool_cidr_ipv6 is defined
-    - enable_dual_stack_networks
 
 - name: Calico | kdd specific configuration
   when:
-    - inventory_hostname in groups['kube_control_plane']
+    - ('kube_control_plane' in group_names)
     - calico_datastore == "kdd"
   block:
     - name: Calico | Check if extra directory is needed
       stat:
-        path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/{{ 'kdd' if (calico_version is version('v3.22.3', '<')) else 'crd' }}"
+        path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/{{ 'kdd' if (calico_version is version('3.22.3', '<')) else 'crd' }}"
       register: kdd_path
     - name: Calico | Set kdd path when calico < v3.22.3
       set_fact:
         calico_kdd_path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds{{ '/kdd' if kdd_path.stat.exists is defined and kdd_path.stat.exists }}"
       when:
-        - calico_version is version('v3.22.3', '<')
-    - name: Calico | Set kdd path when calico > v3.22.2
+        - calico_version is version('3.22.3', '<')
+    - name: Calico | Set kdd path when calico > 3.22.2
       set_fact:
         calico_kdd_path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds{{ '/crd' if kdd_path.stat.exists is defined and kdd_path.stat.exists }}"
       when:
-        - calico_version is version('v3.22.2', '>')
+        - calico_version is version('3.22.2', '>')
     - name: Calico | Create calico manifests for kdd
       assemble:
         src: "{{ calico_kdd_path }}"
@@ -206,6 +208,7 @@
 - name: Calico | Configure Calico IP Pool
   when:
     - inventory_hostname == groups['kube_control_plane'][0]
+    - ipv4_stack | bool
   block:
     - name: Calico | Get existing calico network pool
       command: "{{ bin_dir }}/calicoctl.sh get ippool {{ calico_pool_name }} -o json"
@@ -256,7 +259,7 @@
 - name: Calico | Configure Calico IPv6 Pool
   when:
     - inventory_hostname == groups['kube_control_plane'][0]
-    - enable_dual_stack_networks | bool
+    - ipv6_stack | bool
   block:
     - name: Calico | Get existing calico ipv6 network pool
       command: "{{ bin_dir }}/calicoctl.sh get ippool {{ calico_pool_name }}-ipv6 -o json"
@@ -321,7 +324,7 @@
     nodeToNodeMeshEnabled: "false"
   when:
     - peer_with_router | default(false) or peer_with_calico_rr | default(false)
-    - inventory_hostname in groups['k8s_cluster']
+    - ('k8s_cluster' in group_names)
   run_once: true
 
 - name: Calico | Configure Calico BGP
@@ -350,7 +353,15 @@
               {% if not calico_no_global_as_num | default(false) %}"asNumber": {{ global_as_num }},{% endif %}
               "nodeToNodeMeshEnabled": {{ nodeToNodeMeshEnabled | default('true') }} ,
               {% if calico_advertise_cluster_ips | default(false) %}
-              "serviceClusterIPs": [{"cidr": "{{ kube_service_addresses }}" } {{ ',{"cidr":"' + kube_service_addresses_ipv6 + '"}' if enable_dual_stack_networks else '' }}],{% endif %}
+              "serviceClusterIPs": >-
+                {%- if ipv4_stack and ipv6_stack-%}
+                [{"cidr": "{{ kube_service_addresses }}", "cidr": "{{ kube_service_addresses_ipv6 }}"}],
+                {%- elif ipv6_stack-%}
+                [{"cidr": "{{ kube_service_addresses_ipv6 }}"}],
+                {%- else -%}
+                [{"cidr": "{{ kube_service_addresses }}"}],
+                {%- endif -%}
+              {% endif %}
               {% if calico_advertise_service_loadbalancer_ips | length > 0  %}"serviceLoadBalancerIPs": {{ _service_loadbalancer_ips }},{% endif %}
               "serviceExternalIPs": {{ _service_external_ips | default([]) }}
             }
@@ -382,7 +393,7 @@
     - {name: kubernetes-services-endpoint, file: kubernetes-services-endpoint.yml, type: cm }
   register: calico_node_manifests
   when:
-    - inventory_hostname in groups['kube_control_plane']
+    - ('kube_control_plane' in group_names)
     - rbac_enabled or item.type not in rbac_resources
 
 - name: Calico | Create calico manifests for typha
@@ -394,7 +405,7 @@
     - {name: calico, file: calico-typha.yml, type: typha}
   register: calico_node_typha_manifest
   when:
-    - inventory_hostname in groups['kube_control_plane']
+    - ('kube_control_plane' in group_names)
     - typha_enabled
 
 - name: Calico | get calico apiserver caBundle
@@ -421,7 +432,7 @@
     - {name: calico, file: calico-apiserver.yml, type: calico-apiserver}
   register: calico_apiserver_manifest
   when:
-    - inventory_hostname in groups['kube_control_plane']
+    - ('kube_control_plane' in group_names)
     - calico_apiserver_enabled
 
 - name: Start Calico resources
@@ -473,7 +484,7 @@
   with_items:
     - {name: calico, file: calico-ipamconfig.yml, type: ipam}
   when:
-    - inventory_hostname in groups['kube_control_plane']
+    - ('kube_control_plane' in group_names)
     - calico_datastore == "kdd"
 
 - name: Calico | Create ipamconfig resources

kubespray/project/roles/network_plugin/calico/tasks/peer_with_calico_rr.yml

@@ -32,7 +32,7 @@
   when:
     - calico_rr_id is defined
     - calico_group_id is defined
-    - inventory_hostname in groups['calico_rr']
+    - ('calico_rr' in group_names)
 
 - name: Calico | Configure peering with route reflectors at global scope
   command:

kubespray/project/roles/network_plugin/calico/tasks/peer_with_router.yml

@@ -28,7 +28,7 @@
     cmd: "{{ bin_dir }}/calicoctl.sh get node {{ inventory_hostname }}"
   register: output_get_node
   when:
-    - inventory_hostname in groups['k8s_cluster']
+    - ('k8s_cluster' in group_names)
     - local_as is defined
     - groups['calico_rr'] | default([]) | length == 0
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
@@ -50,7 +50,7 @@
   until: output.rc == 0
   delay: "{{ retry_stagger | random + 3 }}"
   when:
-    - inventory_hostname in groups['k8s_cluster']
+    - ('k8s_cluster' in group_names)
     - local_as is defined
     - groups['calico_rr'] | default([]) | length == 0
     - output_get_node.rc == 0
@@ -77,7 +77,7 @@
   until: output.rc == 0
   delay: "{{ retry_stagger | random + 3 }}"
   when:
-    - inventory_hostname in groups['k8s_cluster']
+    - ('k8s_cluster' in group_names)
     - local_as is defined
     - groups['calico_rr'] | default([]) | length == 0
     - output_get_node.rc != 0
@@ -97,9 +97,12 @@
         "asNumber": "{{ item.as }}",
         "node": "{{ inventory_hostname }}",
         "peerIP": "{{ item.router_id }}",
-        {% if calico_version is version('v3.26.0', '>=') and (item.filters | default([]) | length > 0) %}
+        {% if calico_version is version('3.26.0', '>=') and (item.filters | default([]) | length > 0) %}
         "filters": {{ item.filters }},
         {% endif %}
+        {% if calico_version is version('3.23.0', '>=') and (item.numallowedlocalasnumbers | default(0) > 0) %}
+        "numAllowedLocalASNumbers": {{ item.numallowedlocalasnumbers }},
+        {% endif %}
         "sourceAddress": "{{ item.sourceaddress | default('UseNodeIP') }}"
       }}
   register: output
@@ -110,4 +113,4 @@
     - "{{ peers | default([]) | selectattr('scope', 'undefined') | list | union(peers | default([]) | selectattr('scope', 'defined') | selectattr('scope', 'equalto', 'node') | list ) }}"
   delegate_to: "{{ groups['kube_control_plane'][0] }}"
   when:
-    - inventory_hostname in groups['k8s_cluster']
+    - ('k8s_cluster' in group_names)

kubespray/project/roles/network_plugin/calico/tasks/pre.yml

@@ -20,17 +20,6 @@
     - "'plugins' in calico_cni_config"
     - "'etcd_endpoints' in calico_cni_config.plugins.0"
 
-- name: Calico | Get kubelet hostname
-  shell: >-
-    set -o pipefail && {{ kubectl }} get node -o custom-columns='NAME:.metadata.name,INTERNAL-IP:.status.addresses[?(@.type=="InternalIP")].address'
-    | egrep "{{ ansible_all_ipv4_addresses | join('$|') }}$" | cut -d" " -f1
-  args:
-    executable: /bin/bash
-  register: calico_kubelet_name
-  delegate_to: "{{ groups['kube_control_plane'][0] }}"
-  when:
-  - "cloud_provider is defined"
-
 - name: Calico | Gather os specific variables
   include_vars: "{{ item }}"
   with_first_found: