Re-running site.yml with a raised k3s_version replaced the on-disk
binary but left agents and joined servers running the old runtime,
because the install script skips the service start and the roles only
restarted the service on a config change. A version-only bump was
therefore not applied until the services were restarted by hand.
Always restart the k3s service in the server and agent roles on a
site.yml run, so the cluster reliably picks up a new config or runtime
without any logic to detect whether the binary changed. On a
multi-server cluster, run the playbook with --forks=1 so the servers
restart one at a time and the etcd quorum is preserved; document this
in the README.
Keep the dedicated upgrade.yml integration test and add a second
upgrade through site.yml, asserting the running version the kubelet
reports rather than the on-disk binary, so the tests fail if the
restart regresses.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
* fix: handle Oracle Linux UEK kernel package name for br_netfilter
Oracle Linux uses the Unbreakable Enterprise Kernel (UEK) instead of the
standard RHEL kernel. The `kernel-modules-extra` package does not exist
on Oracle Linux — the equivalent is `kernel-uek-modules-extra`.
Without this fix, the prereq role fails on Oracle Linux 10 with:
"No package kernel-modules-extra available."
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
* chore: update README to include Oracle Linux
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
---------
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
Co-authored-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
* Do not enable nftables by default
* If nftables is enables, configure exceptions for k3s service
Signed-off-by: Ionut Ciocoiu <ionutnciocoiu@gmail.com>
Co-authored-by: Derek Nola <derek.nola@suse.com>
- Use rancher/systemd-node which doesn't cause k3s to crash
- Expand requirements for testing, ensure deployments become ready at each playbook
- Add logging on failure for debugging
Signed-off-by: Derek Nola <derek.nola@suse.com>
Update the regular expression to have a more specific match search term
for cgroup flags
Issue #495
Signed-off-by: Gilles Habran <gilleshabran@protonmail.com>
* refactor(ansible): replace deprecated with_items and ansible facts
Replace deprecated `with_items` with `loop` keyword across all roles.
Migrate from legacy `ansible_*` top-level facts to `ansible_facts['*']`
syntax to prepare for ansible-core 2.24 where INJECT_FACTS_AS_VARS
will default to False.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
* chore(ansible): sync minimum version requirements to 2.15
Align version checks in prereq and airgap roles with README requirement
of ansible-core 2.15+.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---------
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Co-authored-by: Claude <noreply@anthropic.com>
* feat(k3s_upgrade): regenerate service files from templates instead of restoring backups
The k3s_upgrade role previously restored backup service files after binary
upgrade, which meant any changes to extra_server_args or extra_agent_args
would not be applied during upgrades.
This change:
- Replaces backup restoration with template-based service file regeneration
- Reuses templates from k3s_server role via symlink
- Adds necessary defaults for template variables
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin
dependabot[bot]
Archy
Derek Nola
Rémi Paulmier
Jonathan Cremin
shadow1runner
Chris Wayne
Ionut Ciocoiu
Pavlo
Jon S. Stumpf
laszlojau
Gilles H.
Ken Powers
ppascente
Mörgæsis
Aleksei Sviridkin