* feat: make the server config file mode configurable
/etc/rancher/k3s/config.yaml holds the cluster token. The server and
upgrade roles write it at 0644, so every local account on a server node
can read the credential that joins a node to the cluster.
k3s_server_config_mode sets the mode of that file in both roles. It
defaults to 0644, so behaviour is unchanged unless it is set.
Signed-off-by: Kristofer <kristofer@atlascloud.is>
* docs: describe the server config file contents accurately
/etc/rancher/k3s/config.yaml does not always carry the cluster token. A
first server that lets K3s generate one writes the file without it, so the
file can contain the token rather than always holding it. Correct that
claim in the README, the inventory sample and the role default, and use
the US spelling of "honors".
Signed-off-by: Kristofer <kristofer@atlascloud.is>
* Name the floor the config file mode can be narrowed to
Saying any mode root can read works leaves the reader to work out what
that means in practice. The file is read only by k3s, running as root, so
0600 is the tightest mode that still works.
Signed-off-by: Kristofer <kristofer@atlascloud.is>
* Run the basic integration job with a non-default config file mode
The templated mode was only ever rendered with its default in CI, which
is the one value that cannot tell a working template from a broken one.
The basic inventory sets 0640 and the job reads the mode back off the
installed file.
Signed-off-by: Kristofer <kristofer@atlascloud.is>
---------
Signed-off-by: Kristofer <kristofer@atlascloud.is>
Re-running site.yml with a raised k3s_version replaced the on-disk
binary but left agents and joined servers running the old runtime,
because the install script skips the service start and the roles only
restarted the service on a config change. A version-only bump was
therefore not applied until the services were restarted by hand.
Always restart the k3s service in the server and agent roles on a
site.yml run, so the cluster reliably picks up a new config or runtime
without any logic to detect whether the binary changed. On a
multi-server cluster, run the playbook with --forks=1 so the servers
restart one at a time and the etcd quorum is preserved; document this
in the README.
Keep the dedicated upgrade.yml integration test and add a second
upgrade through site.yml, asserting the running version the kubelet
reports rather than the on-disk binary, so the tests fail if the
restart regresses.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
* fix: handle Oracle Linux UEK kernel package name for br_netfilter
Oracle Linux uses the Unbreakable Enterprise Kernel (UEK) instead of the
standard RHEL kernel. The `kernel-modules-extra` package does not exist
on Oracle Linux — the equivalent is `kernel-uek-modules-extra`.
Without this fix, the prereq role fails on Oracle Linux 10 with:
"No package kernel-modules-extra available."
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
* chore: update README to include Oracle Linux
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
---------
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
Co-authored-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
* Do not enable nftables by default
* If nftables is enables, configure exceptions for k3s service
Signed-off-by: Ionut Ciocoiu <ionutnciocoiu@gmail.com>
Co-authored-by: Derek Nola <derek.nola@suse.com>
- Use rancher/systemd-node which doesn't cause k3s to crash
- Expand requirements for testing, ensure deployments become ready at each playbook
- Add logging on failure for debugging
Signed-off-by: Derek Nola <derek.nola@suse.com>
Update the regular expression to have a more specific match search term
for cgroup flags
Issue #495
Signed-off-by: Gilles Habran <gilleshabran@protonmail.com>
* refactor(ansible): replace deprecated with_items and ansible facts
Replace deprecated `with_items` with `loop` keyword across all roles.
Migrate from legacy `ansible_*` top-level facts to `ansible_facts['*']`
syntax to prepare for ansible-core 2.24 where INJECT_FACTS_AS_VARS
will default to False.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
* chore(ansible): sync minimum version requirements to 2.15
Align version checks in prereq and airgap roles with README requirement
of ansible-core 2.15+.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---------
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Co-authored-by: Claude <noreply@anthropic.com>
* feat(k3s_upgrade): regenerate service files from templates instead of restoring backups
The k3s_upgrade role previously restored backup service files after binary
upgrade, which meant any changes to extra_server_args or extra_agent_args
would not be applied during upgrades.
This change:
- Replaces backup restoration with template-based service file regeneration
- Reuses templates from k3s_server role via symlink
- Adds necessary defaults for template variables
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Changed the condition from checking specific 'ansible_distribution' names to 'ansible_os_family == "RedHat"'. This correctly targets all RHEL-based systems (including AlmaLinux, Rocky, CentOS) and ensures dependencies like 'kernel-modules-extra' are installed without listing each distribution manually.
Signed-off-by: Hanseung Kim <u72mlzb@gmail.com>
* Auto-add --tls-san={{ api_endpoint }} when it differs from ansible_hostname
* Ensures first server generates certificate with all required SANs
* Add .ansible/ and PR_DESCRIPTION.md to gitignore
Signed-off-by: Guillaume Andre <mail@guillaumea.fr>
Kris
Stéphane Este-Gracias
mbathe19
Ian Lewis
Archy
Aleksei Sviridkin
Jonathan Cremin
shadow1runnerandHelmut Wolf
Ionut CiocoiuandDerek Nola
Pavlo
Jon S. Stumpf
laszlojau
Gilles H.
ppascenteandPete Pascente
Aleksei SviridkinandClaude
Phillip Thurston
Softplus+
fch-aaandfch-aa
Luis Salgado Alves
Riccardo Pressiani
Jonathan Hanson
too-gee
Guillaume A
Vadim Radu
David Barnett