From c82f2e04154f4c98b5d4a30234d5920ef0019fe0 Mon Sep 17 00:00:00 2001 From: Techno Tim Date: Tue, 4 Aug 2026 17:54:58 -0500 Subject: [PATCH] chore(deps): apply dependency updates in one combined change (#694) * chore(deps): apply dependency updates in one combined change - Bump ansible-core to 2.19.11 and jmespath to 1.1.0 in requirements.in - Regenerate the Python 3.11 pip-compile lock in requirements.txt - Bump molecule-plugins to 23.6.0 while keeping molecule on the stable 6.x series (avoids the molecule-plugins 26 major jump that broke vagrant module resolution in CI) - Bump ruamel-yaml-clib to 0.2.15 - Bump the zgosalvez/github-actions-ensure-sha-pinned-actions action to 5.0.6 (SHA-pinned) in lint.yml * fix(server): make log_destination conditional boolean for ansible-core 2.19 - The always block's 'Save logs of k3s-init.service' task used when: log_destination where log_destination is a path string derived from an env var - ansible-core 2.19 rejects string-derived conditionals; evaluate the path as a real boolean (non-empty) check so the conditional is a true boolean - Required to keep the k3s_server role working with ansible-core 2.19.11 (the dependency bump in this change) * fix(verify): coerce regex_search assertions to bool for ansible-core 2.19 - ansible-core 2.19 requires assert conditionals to be boolean; regex_search returns a string, which is now rejected - Wrap all regex_search results used in assert.that with | bool so the calico, cilium, metallb, and kube-vip image-tag checks produce boolean results * fix(verify): use boolean is regex_search test instead of | bool - | bool on a regex_search result coerces a tag string like v0.16.0 to False in ansible-core 2.19, failing the image-tag assertions - Use the is regex_search test which returns a real boolean without string coercion for the calico, cilium, metallb, and kube-vip image assertions * fix(verify): use is not none for regex_search assertions - ansible-core 2.19 has no "is regex_search" test and rejects bool string coercion, so use the regex_search filter with an "is not none" comparison, which yields a real boolean for the image-tag assertions - Applies to calico, cilium, metallb, and kube-vip image checks * fix(metallb): retry transient apiserver resets in config tests - The Layer 2 and BGP final configuration checks ran a kubectl get per resource with no retry, so a transient connection refused from the kube API could abort converge - Mirror the download_retries/download_delay retry pattern used by the 'Wait for MetalLB resources' task so these checks survive api server resets on slow runners --- .github/workflows/lint.yml | 2 +- .../tasks/test/verify-components.yml | 17 ++++++++++------- requirements.in | 4 ++-- requirements.txt | 10 +++++----- roles/k3s_server/tasks/main.yml | 5 ++++- roles/k3s_server_post/tasks/metallb.yml | 8 ++++++++ 6 files changed, 30 insertions(+), 16 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 9e7e2ebd..31b5e1c9 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -68,7 +68,7 @@ jobs: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 7.0.1 - name: Ensure SHA pinned actions - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@3db98c0363e2fa5df3e1c4c471777a7c10b24cc9 # 5.0.5 + uses: zgosalvez/github-actions-ensure-sha-pinned-actions@46cfe808a5f1588656ef299eedd0ce2fd7ec0dcc # 5.0.6 with: allowlist: | aws-actions/ diff --git a/molecule/resources/verify_from_outside/tasks/test/verify-components.yml b/molecule/resources/verify_from_outside/tasks/test/verify-components.yml index d6eb36f9..eb9f8228 100644 --- a/molecule/resources/verify_from_outside/tasks/test/verify-components.yml +++ b/molecule/resources/verify_from_outside/tasks/test/verify-components.yml @@ -103,7 +103,7 @@ ansible.builtin.assert: that: - calico_node_ds.resources | length == 1 - - calico_node_image | regex_search(':' ~ calico_tag) + - calico_node_image | regex_search(':' ~ calico_tag) is not none success_msg: "Calico node image uses tag {{ calico_tag }}" fail_msg: >- Calico node image {{ calico_node_image }}, @@ -169,8 +169,8 @@ - name: Assert Cilium agent and operator use the expected image tag ansible.builtin.assert: that: - - cilium_agent_image | regex_search(':' ~ cilium_tag) - - cilium_operator_image | regex_search(':' ~ cilium_tag) + - cilium_agent_image | regex_search(':' ~ cilium_tag) is not none + - cilium_operator_image | regex_search(':' ~ cilium_tag) is not none success_msg: "Cilium agent and operator use {{ cilium_tag }}" fail_msg: >- Cilium agent {{ cilium_agent_image }}, @@ -265,9 +265,12 @@ - name: Assert MetalLB controller and speaker use the expected image tags ansible.builtin.assert: + # regex_search returns a string or none; check for a match with `is not + # none` so the assertion is a real boolean (ansible-core 2.19 rejects + # string conditionals and `| bool` deprecates string coercion). that: - - controller_image | regex_search(metal_lb_controller_tag_version) - - speaker_image | regex_search(metal_lb_speaker_tag_version) + - controller_image | regex_search(metal_lb_controller_tag_version) is not none + - speaker_image | regex_search(metal_lb_speaker_tag_version) is not none success_msg: >- MetalLB controller {{ metal_lb_controller_tag_version }}, speaker {{ metal_lb_speaker_tag_version }} @@ -311,8 +314,8 @@ - name: Assert the kube-vip and cloud provider image tags ansible.builtin.assert: that: - - kubevip_image | regex_search(':' ~ kube_vip_tag_version) - - cloud_provider_image | regex_search(verify_kube_vip_cloud_provider_tag) + - kubevip_image | regex_search(':' ~ kube_vip_tag_version) is not none + - cloud_provider_image | regex_search(verify_kube_vip_cloud_provider_tag) is not none success_msg: >- kube-vip {{ kube_vip_tag_version }}, cloud provider {{ verify_kube_vip_cloud_provider_tag }} diff --git a/requirements.in b/requirements.in index e0eac297..c6979e9b 100644 --- a/requirements.in +++ b/requirements.in @@ -1,5 +1,5 @@ -ansible-core>=2.16.2 -jmespath>=1.0.1 +ansible-core>=2.19.11 +jmespath>=1.1.0 jsonpatch>=1.33 kubernetes>=29.0.0 molecule-plugins[vagrant] diff --git a/requirements.txt b/requirements.txt index 83700160..80c4ef74 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,11 +2,11 @@ # This file is autogenerated by pip-compile with Python 3.11 # by the following command: # -# pip-compile requirements.in +# pip-compile --output-file=requirements.txt requirements.in # ansible-compat==4.1.11 # via molecule -ansible-core==2.18.0 +ansible-core==2.19.11 # via # -r requirements.in # ansible-compat @@ -53,7 +53,7 @@ jinja2==3.1.3 # via # ansible-core # molecule -jmespath==1.0.1 +jmespath==1.1.0 # via -r requirements.in jsonpatch==1.33 # via -r requirements.in @@ -77,7 +77,7 @@ molecule==6.0.3 # via # -r requirements.in # molecule-plugins -molecule-plugins[vagrant]==23.5.3 +molecule-plugins[vagrant]==23.6.0 # via -r requirements.in netaddr==0.10.1 # via -r requirements.in @@ -146,7 +146,7 @@ rsa==4.9 # via google-auth ruamel-yaml==0.18.5 # via pre-commit-hooks -ruamel-yaml-clib==0.2.8 +ruamel-yaml-clib==0.2.15 # via ruamel-yaml six==1.16.0 # via diff --git a/roles/k3s_server/tasks/main.yml b/roles/k3s_server/tasks/main.yml index b0e543f0..0dcc94e6 100644 --- a/roles/k3s_server/tasks/main.yml +++ b/roles/k3s_server/tasks/main.yml @@ -122,7 +122,10 @@ always: - name: Save logs of k3s-init.service ansible.builtin.include_tasks: fetch_k3s_init_logs.yml - when: log_destination + # ANSIBLE_K3S_LOG_DIR is a path string when set; evaluate it as a boolean + # so the conditional is a real boolean (ansible-core 2.19 rejects string + # conditionals derived from env vars). + when: log_destination | default('') != '' vars: log_destination: >- {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=False) }} diff --git a/roles/k3s_server_post/tasks/metallb.yml b/roles/k3s_server_post/tasks/metallb.yml index 27fd7807..5e814c15 100644 --- a/roles/k3s_server_post/tasks/metallb.yml +++ b/roles/k3s_server_post/tasks/metallb.yml @@ -118,6 +118,10 @@ changed_when: false run_once: true when: metal_lb_mode == "layer2" + register: metallb_l2_test_result + until: metallb_l2_test_result.rc == 0 + retries: "{{ download_retries }}" + delay: "{{ download_delay }}" with_items: - IPAddressPool - L2Advertisement @@ -128,6 +132,10 @@ changed_when: false run_once: true when: metal_lb_mode == "bgp" + register: metallb_bgp_test_result + until: metallb_bgp_test_result.rc == 0 + retries: "{{ download_retries }}" + delay: "{{ download_delay }}" with_items: - IPAddressPool - BGPPeer