fix(metallb): retry the namespace check on transient kube API errors

- retry the explicit get namespace check until it succeeds
- extend the regression test to assert the retry wiring

.github/scripts/test-metallb-namespace.py

@@ -65,6 +65,25 @@ def main():
             "(got: {0!r})".format(command_text)
         )
 
+    # The sibling k3s_server_post metallb tasks retry kubectl because the kube
+    # API can briefly be unavailable while MetalLB converges. Without the same
+    # retry here, a transient API error aborts the whole converge play. Assert
+    # the retry wiring is present so it does not regress.
+    if not task.get("register"):
+        fail(
+            "task does not register a result; without retry wiring a transient "
+            "kube API error aborts the converge play"
+        )
+    if not isinstance(task.get("until"), str) or "rc == 0" not in task["until"]:
+        fail(
+            "task does not retry on rc == 0; the kube API can transiently fail "
+            "while MetalLB converges and abort the play"
+        )
+    if task.get("retries") is None:
+        fail("task is missing retries")
+    if task.get("delay") is None:
+        fail("task is missing delay")
+
     print("MetalLB namespace check regression test passed")
 
 

roles/k3s_server_post/tasks/metallb.yml

@@ -42,6 +42,12 @@
   ansible.builtin.command: >-
     {{ k3s_kubectl_binary | default('k3s kubectl') }} get namespace metallb-system
   changed_when: false
+  # The kube API can briefly return ServiceUnavailable while MetalLB converges,
+  # which would otherwise abort the whole converge play on a transient error.
+  register: metallb_namespace_result
+  until: metallb_namespace_result.rc == 0
+  retries: "{{ download_retries }}"
+  delay: "{{ download_delay }}"
   with_items: "{{ groups[group_name_master | default('master')] }}"
   run_once: true