From 8fb1e26c63b92b40475ffe79b2c5e8dd615759eb Mon Sep 17 00:00:00 2001
From: Fedello <31769405+pvillaverde@users.noreply.github.com>
Date: Mon, 21 Sep 2026 19:04:30 +0200
Subject: [PATCH] fix(ansible): update fact references to remove deprecation
 warnings (#715)

* chore(ansible): use ansible_facts

* fix(ansible): satisfy lint for fact migration

- wrap nested fact expressions to meet YAML line length limits
- update the bootstrap regression assertion for ansible_facts

* fix(pre-commit): install shellcheck for host architecture

- install shellcheck-py from PyPI in the local hook environment
- pin the platform-aware shellcheck package version

---------

Co-authored-by: Timothy Stewart <timothystewart6@gmail.com>
---
 .github/scripts/test-k3s-server-bootstrap.sh   |  2 +-
 .pre-commit-config.yaml                        | 10 ++++++----
 roles/k3s_server/defaults/main.yml             |  2 +-
 roles/k3s_server/tasks/fetch_k3s_init_logs.yml |  8 ++++----
 roles/k3s_server/tasks/join_master.yml         |  2 +-
 roles/k3s_server/tasks/kube-vip.yml            |  9 ++++++---
 roles/k3s_server/tasks/main.yml                | 12 ++++++------
 roles/k3s_server/tasks/metallb.yml             | 18 ++++++++++++------
 roles/k3s_server/tasks/vip.yml                 |  9 ++++++---
 roles/k3s_server_post/tasks/calico.yml         |  3 ++-
 roles/k3s_server_post/tasks/cilium.yml         |  4 ++--
 roles/k3s_server_post/tasks/metallb.yml        |  4 ++--
 roles/prereq/tasks/main.yml                    | 18 +++++++++---------
 roles/raspberrypi/tasks/main.yml               |  4 ++--
 site.yml                                       | 12 ++++++++----
 15 files changed, 68 insertions(+), 49 deletions(-)

diff --git a/.github/scripts/test-k3s-server-bootstrap.sh b/.github/scripts/test-k3s-server-bootstrap.sh
index c041112..f53db11 100755
--- a/.github/scripts/test-k3s-server-bootstrap.sh
+++ b/.github/scripts/test-k3s-server-bootstrap.sh
@@ -26,7 +26,7 @@ if grep -Fq -- "node-role.kubernetes.io/master=true' -o=jsonpath" "$main_tasks";
   exit 1
 fi
 
-grep -Fq -- "map('extract', hostvars, 'ansible_hostname')" "$main_tasks"
+grep -Fq -- "map('extract', hostvars, ['ansible_facts', 'hostname'])" "$main_tasks"
 grep -Fq -- 'difference(nodes.stdout.split())' "$main_tasks"
 grep -Fq -- 'crd/addons.k3s.cattle.io' "$main_tasks"
 grep -Fq -- 'crd/helmcharts.helm.cattle.io' "$main_tasks"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b816873..c50ee62 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -23,10 +23,6 @@ repos:
         additional_dependencies: [ansible-core==2.18.0]
         language_version: python3.12
         args: [--offline]
-  - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.9.0.6
-    hooks:
-      - id: shellcheck
   - repo: https://github.com/Lucas-C/pre-commit-hooks
     rev: v1.5.4
     hooks:
@@ -38,6 +34,12 @@ repos:
       - id: fix-smartquotes
   - repo: local
     hooks:
+      - id: shellcheck
+        name: shellcheck
+        entry: shellcheck
+        language: python
+        additional_dependencies: [shellcheck-py==0.11.0.1]
+        types: [shell]
       - id: cleanup-runner-resources-test
         name: cleanup runner resources test
         entry: .github/scripts/test-cleanup-runner-resources.sh
diff --git a/roles/k3s_server/defaults/main.yml b/roles/k3s_server/defaults/main.yml
index c5857a0..b5203f1 100644
--- a/roles/k3s_server/defaults/main.yml
+++ b/roles/k3s_server/defaults/main.yml
@@ -38,7 +38,7 @@ retry_count: 20
 # yamllint disable rule:line-length
 server_init_args: >-
   {% if groups[group_name_master | default('master')] | length > 1 %}
-    {% if ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname'] %}
+    {% if ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname'] %}
       --cluster-init
     {% else %}
       --server https://{{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip | split(",") | first | ansible.utils.ipwrap }}:6443
diff --git a/roles/k3s_server/tasks/fetch_k3s_init_logs.yml b/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
index 57dd357..ba26006 100644
--- a/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
+++ b/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
@@ -83,7 +83,7 @@
   no_log: true
   register: k3s_input_firewall_rules
 
-- name: Ping the primary Kubernetes API address from {{ ansible_hostname }}
+- name: Ping the primary Kubernetes API address from {{ ansible_facts.hostname }}
   ansible.builtin.command:
     argv:
       - ping
@@ -97,7 +97,7 @@
   no_log: true
   register: k3s_primary_api_ping
 
-- name: Probe primary Kubernetes API from {{ ansible_hostname }}
+- name: Probe primary Kubernetes API from {{ ansible_facts.hostname }}
   ansible.builtin.wait_for:
     host: "{{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip | split(',') | first }}"
     port: 6443
@@ -122,7 +122,7 @@
   become: false
   ansible.builtin.template:
     src: content.j2
-    dest: "{{ log_destination }}/k3s-init@{{ ansible_hostname }}.log"
+    dest: "{{ log_destination }}/k3s-init@{{ ansible_facts['hostname'] }}.log"
     mode: "0644"
   vars:
     content: |
@@ -137,7 +137,7 @@
   become: false
   ansible.builtin.template:
     src: content.j2
-    dest: "{{ log_destination }}/network@{{ ansible_hostname }}.log"
+    dest: "{{ log_destination }}/network@{{ ansible_facts['hostname'] }}.log"
     mode: "0644"
   vars:
     content: |
diff --git a/roles/k3s_server/tasks/join_master.yml b/roles/k3s_server/tasks/join_master.yml
index 59ae78a..89486b2 100644
--- a/roles/k3s_server/tasks/join_master.yml
+++ b/roles/k3s_server/tasks/join_master.yml
@@ -25,7 +25,7 @@
   ansible.builtin.command:
     cmd: >-
       {{ k3s_kubectl_binary | default('k3s kubectl') }} get node
-      {{ hostvars[joining_master].ansible_hostname }}
+      {{ hostvars[joining_master].ansible_facts['hostname'] }}
   delegate_to: "{{ groups[group_name_master | default('master')][0] }}"
   register: joined_master
   until: joined_master.rc == 0
diff --git a/roles/k3s_server/tasks/kube-vip.yml b/roles/k3s_server/tasks/kube-vip.yml
index 90c3a46..f68fb24 100644
--- a/roles/k3s_server/tasks/kube-vip.yml
+++ b/roles/k3s_server/tasks/kube-vip.yml
@@ -6,7 +6,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Download vip cloud provider manifest to first master
   ansible.builtin.get_url:
@@ -19,7 +20,8 @@
   retries: "{{ download_retries }}"
   delay: "{{ download_delay }}"
   until: kube_vip_manifest_download is succeeded
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Copy kubevip configMap manifest to first master
   ansible.builtin.template:
@@ -28,4 +30,5 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
diff --git a/roles/k3s_server/tasks/main.yml b/roles/k3s_server/tasks/main.yml
index a0f01d6..5f6c248 100644
--- a/roles/k3s_server/tasks/main.yml
+++ b/roles/k3s_server/tasks/main.yml
@@ -104,7 +104,7 @@
             expected_control_plane_names: >-
               {{
                 groups[group_name_master | default('master')]
-                | map('extract', hostvars, 'ansible_hostname')
+                | map('extract', hostvars, ['ansible_facts', 'hostname'])
                 | list
               }}
 
@@ -183,24 +183,24 @@
 
 - name: Create directory .kube
   ansible.builtin.file:
-    path: "{{ ansible_user_dir }}/.kube"
+    path: "{{ ansible_facts['user_dir'] }}/.kube"
     state: directory
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: u=rwx,g=rx,o=
 
 - name: Copy config file to user home directory
   ansible.builtin.copy:
     src: /etc/rancher/k3s/k3s.yaml
-    dest: "{{ ansible_user_dir }}/.kube/config"
+    dest: "{{ ansible_facts['user_dir'] }}/.kube/config"
     remote_src: true
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: u=rw,g=,o=
 
 - name: Configure kubectl cluster to {{ endpoint_url }}
   ansible.builtin.command: >-
     {{ k3s_kubectl_binary | default('k3s kubectl') }} config set-cluster default
       --server={{ endpoint_url }}
-      --kubeconfig {{ ansible_user_dir }}/.kube/config
+      --kubeconfig {{ ansible_facts['user_dir'] }}/.kube/config
   changed_when: true
   vars:
     endpoint_url: >-
diff --git a/roles/k3s_server/tasks/metallb.yml b/roles/k3s_server/tasks/metallb.yml
index 5e70a26..2b416cb 100644
--- a/roles/k3s_server/tasks/metallb.yml
+++ b/roles/k3s_server/tasks/metallb.yml
@@ -6,7 +6,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: "Download to first master: manifest for metallb-{{ metal_lb_type }}"
   ansible.builtin.get_url:
@@ -19,7 +20,8 @@
   retries: "{{ download_retries }}"
   delay: "{{ download_delay }}"
   until: metallb_manifest_download is succeeded
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Set image versions in manifest for metallb-{{ metal_lb_type }}
   ansible.builtin.replace:
@@ -31,13 +33,15 @@
       to: metallb/speaker:{{ metal_lb_speaker_tag_version }}
   loop_control:
     label: "{{ item.change }} => {{ item.to }}"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Read back MetalLB manifest from first master
   ansible.builtin.slurp:
     src: /var/lib/rancher/k3s/server/manifests/metallb-crds.yaml
   register: metallb_manifest
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Check the MetalLB speaker image reference is present
   ansible.builtin.set_fact:
@@ -46,7 +50,8 @@
         ('quay.io/metallb/speaker:' ~ metal_lb_speaker_tag_version) in
         (metallb_manifest.content | default('') | b64decode)
       }}
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Fail if MetalLB speaker tag was not applied to the manifest
   ansible.builtin.fail:
@@ -56,5 +61,6 @@
       was not found in the downloaded manifest. The upstream image
       reference may have changed.
   when:
-    - ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+    - >-
+      ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
     - not metallb_manifest_has_speaker_tag
diff --git a/roles/k3s_server/tasks/vip.yml b/roles/k3s_server/tasks/vip.yml
index 857ed90..1e4307d 100644
--- a/roles/k3s_server/tasks/vip.yml
+++ b/roles/k3s_server/tasks/vip.yml
@@ -10,7 +10,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Copy kube-vip RBAC manifest to first master
   ansible.builtin.template:
@@ -19,7 +20,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Copy vip manifest to first master
   ansible.builtin.template:
@@ -28,4 +30,5 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
diff --git a/roles/k3s_server_post/tasks/calico.yml b/roles/k3s_server_post/tasks/calico.yml
index 0fb70b4..a3e08b4 100644
--- a/roles/k3s_server_post/tasks/calico.yml
+++ b/roles/k3s_server_post/tasks/calico.yml
@@ -1,6 +1,7 @@
 ---
 - name: Deploy Calico to cluster
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
   run_once: true
   block:
     - name: Create manifests directory on first master
diff --git a/roles/k3s_server_post/tasks/cilium.yml b/roles/k3s_server_post/tasks/cilium.yml
index 46bca62..f7ddcfe 100644
--- a/roles/k3s_server_post/tasks/cilium.yml
+++ b/roles/k3s_server_post/tasks/cilium.yml
@@ -184,7 +184,7 @@
         --helm-set loadBalancer.mode={{ bpf_lb_mode }}
         {% endif %}
       environment:
-        KUBECONFIG: "{{ ansible_user_dir }}/.kube/config"
+        KUBECONFIG: "{{ ansible_facts['user_dir'] }}/.kube/config"
       register: cilium_install_result
       changed_when: cilium_install_result.rc == 0
       # cilium install/upgrade fetches the Helm chart from helm.cilium.io, which is
@@ -227,7 +227,7 @@
     - name: Wait for Cilium status to be healthy
       ansible.builtin.command: cilium status --wait
       environment:
-        KUBECONFIG: "{{ ansible_user_dir }}/.kube/config"
+        KUBECONFIG: "{{ ansible_facts['user_dir'] }}/.kube/config"
       register: cilium_status
       changed_when: false
       until: cilium_status.rc == 0
diff --git a/roles/k3s_server_post/tasks/metallb.yml b/roles/k3s_server_post/tasks/metallb.yml
index e06c906..c4c2087 100644
--- a/roles/k3s_server_post/tasks/metallb.yml
+++ b/roles/k3s_server_post/tasks/metallb.yml
@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: /tmp/k3s
     state: directory
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: "0755"
   with_items: "{{ groups[group_name_master | default('master')] }}"
   run_once: true
@@ -33,7 +33,7 @@
   ansible.builtin.template:
     src: metallb.crs.j2
     dest: /tmp/k3s/metallb-crs.yaml
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: "0755"
   with_items: "{{ groups[group_name_master | default('master')] }}"
   run_once: true
diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml
index cb0fe71..b2871c2 100644
--- a/roles/prereq/tasks/main.yml
+++ b/roles/prereq/tasks/main.yml
@@ -29,7 +29,7 @@
 - name: Set SELinux to disabled state
   ansible.posix.selinux:
     state: disabled
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
 
 - name: Enable IPv4 forwarding
   ansible.posix.sysctl:
@@ -63,7 +63,7 @@
     executable: /bin/bash
   register: br_netfilter_exists
   changed_when: false
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
   tags: sysctl
 
 - name: Install kernel-modules-extra if br_netfilter missing
@@ -73,7 +73,7 @@
     update_cache: true
   register: kernel_modules_installed
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts.os_family == "RedHat"
     - br_netfilter_exists.stdout | int == 0
 
 - name: Reboot node if kernel modules package was installed
@@ -81,7 +81,7 @@
     msg: "Rebooting to apply new kernel modules package"
     reboot_timeout: 300
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts.os_family == "RedHat"
     - kernel_modules_installed is changed
 
 - name: Add br_netfilter to /etc/modules-load.d/
@@ -89,13 +89,13 @@
     content: br_netfilter
     dest: /etc/modules-load.d/br_netfilter.conf
     mode: u=rw,g=,o=
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
 
 - name: Load br_netfilter
   community.general.modprobe:
     name: br_netfilter
     state: present
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
 
 - name: Set bridge-nf-call-iptables (just to be sure)
   ansible.posix.sysctl:
@@ -103,7 +103,7 @@
     value: "1"
     state: present
     reload: true
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
   loop:
     - net.bridge.bridge-nf-call-iptables
     - net.bridge.bridge-nf-call-ip6tables
@@ -111,10 +111,10 @@
 
 - name: Add /usr/local/bin to sudo secure_path
   ansible.builtin.lineinfile:
-    line: Defaults    secure_path = {{ secure_path[ansible_os_family] }}
+    line: Defaults    secure_path = {{ secure_path[ansible_facts.os_family] }}
     regexp: Defaults(\s)*secure_path(\s)*=
     state: present
     insertafter: EOF
     path: /etc/sudoers
     validate: visudo -cf %s
-  when: ansible_os_family in [ "RedHat", "Suse" ]
+  when: ansible_facts.os_family in [ "RedHat", "Suse" ]
diff --git a/roles/raspberrypi/tasks/main.yml b/roles/raspberrypi/tasks/main.yml
index eb21c9a..2319427 100644
--- a/roles/raspberrypi/tasks/main.yml
+++ b/roles/raspberrypi/tasks/main.yml
@@ -49,8 +49,8 @@
   with_first_found:
     - "{{ action_ }}/{{ detected_distribution }}-{{ detected_distribution_major_version }}.yml"
     - "{{ action_ }}/{{ detected_distribution }}.yml"
-    - "{{ action_ }}/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
-    - "{{ action_ }}/{{ ansible_distribution }}.yml"
+    - "{{ action_ }}/{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_major_version'] }}.yml"
+    - "{{ action_ }}/{{ ansible_facts['distribution'] }}.yml"
     - "{{ action_ }}/default.yml"
   vars:
     action_: >-
diff --git a/site.yml b/site.yml
index 8a11ce7..bd3e103 100644
--- a/site.yml
+++ b/site.yml
@@ -19,7 +19,7 @@
         cluster_hostnames: >-
           {{
             groups['k3s_cluster']
-            | map('extract', hostvars, 'ansible_hostname')
+            | map('extract', hostvars, ['ansible_facts', 'hostname'])
             | list
           }}
       run_once: true
@@ -77,9 +77,13 @@
   hosts: master
   environment: "{{ proxy_env | default({}) }}"
   tasks:
-    - name: Copying kubeconfig from {{ hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname'] }}
+    - name: >-
+        Copying kubeconfig from
+        {{ hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname'] }}
       ansible.builtin.fetch:
-        src: "{{ ansible_user_dir }}/.kube/config"
+        src: "{{ ansible_facts['user_dir'] }}/.kube/config"
         dest: ./kubeconfig
         flat: true
-      when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+      when: >-
+        ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]
+        ['ansible_facts']['hostname']