fix(molecule): use stable startup script path

- Resolve the bounded Vagrant startup helper relative to the playbook.
- Avoid relying on an unavailable Molecule project directory variable.

.github/scripts/prepare-vagrant-box-masters.sh

@@ -70,14 +70,6 @@ write_prewarm_vagrantfile() {
     printf '%s\n' "Vagrant.configure('2') do |config|"
     printf '  config.vm.box = "%s"\n' "$box"
     printf '  config.vm.box_version = "%s"\n' "$version"
-    # generic/ubuntu2204 does not accept Vagrant's bundled insecure key.
-    # Match the repository's Molecule connection settings for the short-lived
-    # prewarm clone so Vagrant can record its linked-clone master.
-    if [[ "$box" == 'generic/ubuntu2204' ]]; then
-      printf '%s\n' \
-        '  config.ssh.username = "vagrant"' \
-        '  config.ssh.password = "vagrant"'
-    fi
     printf '%s\n' \
       '  config.vm.synced_folder ".", "/vagrant", disabled: true' \
       '  config.vm.hostname = "k3s-ansible-box-prewarm"' \

.github/scripts/test-prepare-vagrant-box-masters.sh

@@ -10,12 +10,12 @@ mock_bin="$fixture/bin"
 mock_state="$fixture/state"
 mock_home="$fixture/home"
 mock_vagrant_home="$fixture/vagrant-home"
-mock_box_dir="$mock_vagrant_home/boxes/generic-VAGRANTSLASH-ubuntu2204/4.3.12/amd64/virtualbox"
+mock_box_dir="$mock_vagrant_home/boxes/bento-VAGRANTSLASH-ubuntu-26.04/202606.01.0/amd64/virtualbox"
 mock_vbox_root="$mock_home/VirtualBox VMs"
 mock_master_root="$mock_home/.cache/k3s-ci/vagrant-masters"
 lock_file="$fixture/vagrant-boxes.lock"
 mkdir -p -- "$mock_bin" "$mock_state" "$mock_box_dir" "$mock_vbox_root"
-printf '%s\n' 'generic/ubuntu2204 4.3.12 amd64' > "$lock_file"
+printf '%s\n' 'bento/ubuntu-26.04 202606.01.0 amd64' > "$lock_file"
 ln -s "$repo_root/.github/scripts/test-fixtures/mock-vboxmanage" "$mock_bin/VBoxManage"
 ln -s "$repo_root/.github/scripts/test-fixtures/mock-vagrant" "$mock_bin/vagrant"
 ln -s "$repo_root/.github/scripts/test-fixtures/mock-flock" "$mock_bin/flock"
@@ -45,8 +45,6 @@ second_output="$fixture/second-output"
 third_output="$fixture/third-output"
 
 "$script" > "$first_output"
-grep -Fq 'config.ssh.username = "vagrant"' "$MOCK_VAGRANTFILE_CAPTURE"
-grep -Fq 'config.ssh.password = "vagrant"' "$MOCK_VAGRANTFILE_CAPTURE"
 if grep -Fq 'config.ssh.insert_key' "$MOCK_VAGRANTFILE_CAPTURE"; then
   printf 'prewarm Vagrantfile unexpectedly overrides Vagrant SSH key insertion\n' >&2
   exit 1
@@ -54,7 +52,7 @@ fi
 grep -Fq 'virtualbox.memory = 1024' "$MOCK_VAGRANTFILE_CAPTURE"
 grep -Fq 'virtualbox.cpus = 2' "$MOCK_VAGRANTFILE_CAPTURE"
 grep -Fq 'config.vm.boot_timeout = 600' "$MOCK_VAGRANTFILE_CAPTURE"
-mapping_file="$mock_master_root/generic_ubuntu2204-4.3.12-amd64.uuid"
+mapping_file="$mock_master_root/bento_ubuntu-26.04-202606.01.0-amd64.uuid"
 test -s "$mapping_file"
 cmp -s "$mapping_file" "$mock_box_dir/master_id"
 grep -Fq 'Created and recorded owned master' "$first_output"

.github/test-download-boxes.sh

@@ -17,23 +17,29 @@ trap 'rm -rf "$test_root"' EXIT
 printf '%s\n' \
     '#!/usr/bin/env bash' \
     'set -Eeuo pipefail' \
-    'printf "%s\n" generic/debian12 generic/rocky9 generic/ubuntu2204' \
+    'printf "%s\n" bento/debian-13 bento/rockylinux-10.1 bento/ubuntu-26.04' \
     >"$fake_bin/yq"
 
 printf '%s\n' \
     '#!/usr/bin/env bash' \
     'set -Eeuo pipefail' \
     'emit_box() {' \
+    '    case "$1" in' \
+    '        bento/debian-13) version=202510.26.0 ;;' \
+    '        bento/rockylinux-10.1) version=202512.01.0 ;;' \
+    '        bento/ubuntu-26.04) version=202606.01.0 ;;' \
+    '        *) printf "Unexpected box: %s\n" "$1" >&2; exit 1 ;;' \
+    '    esac' \
     '    printf "0,,box-name,%s\n" "$1"' \
     '    printf "0,,box-provider,virtualbox\n"' \
-    '    printf "0,,box-version,4.3.12\n"' \
+    '    printf "0,,box-version,%s\n" "$version"' \
     '    printf "0,,box-architecture,amd64\n"' \
     '}' \
     'if [[ "${1:-}" == box && "${2:-}" == list ]]; then' \
-    '    emit_box generic/debian12' \
-    '    emit_box generic/rocky9' \
+    '    emit_box bento/debian-13' \
+    '    emit_box bento/rockylinux-10.1' \
     '    if [[ "${FAKE_PRESENT_MODE:-all}" == all ]]; then' \
-    '        emit_box generic/ubuntu2204' \
+    '        emit_box bento/ubuntu-26.04' \
     '    fi' \
     'elif [[ "${1:-}" == box && "${2:-}" == add ]]; then' \
     '    printf "%s\n" "$*" >>"${FAKE_VAGRANT_LOG:?}"' \
@@ -55,13 +61,13 @@ PATH="$fake_bin:$PATH" \
     FAKE_VAGRANT_LOG="$fake_log" \
     "$repo_root/.github/download-boxes.sh" >"$output"
 grep -Fxq \
-    'box add --provider virtualbox --box-version 4.3.12 --architecture amd64 generic/ubuntu2204' \
+    'box add --provider virtualbox --box-version 202606.01.0 --architecture amd64 bento/ubuntu-26.04' \
     "$fake_log"
 
 incomplete_lock="$test_root/incomplete.lock"
 printf '%s\n' \
-    'generic/debian12 4.3.12 amd64' \
-    'generic/rocky9 4.3.12 amd64' \
+    'bento/debian-13 202510.26.0 amd64' \
+    'bento/rockylinux-10.1 202512.01.0 amd64' \
     >"$incomplete_lock"
 if PATH="$fake_bin:$PATH" \
     VAGRANT_BOX_LOCK_FILE="$incomplete_lock" \
@@ -71,14 +77,14 @@ if PATH="$fake_bin:$PATH" \
     exit 1
 fi
 grep -Fq 'Scenario boxes missing from the lock file:' "$output"
-grep -Fq 'generic/ubuntu2204' "$output"
+grep -Fq 'bento/ubuntu-26.04' "$output"
 
 duplicate_lock="$test_root/duplicate.lock"
 printf '%s\n' \
-    'generic/debian12 4.3.12 amd64' \
-    'generic/debian12 4.3.11 amd64' \
-    'generic/rocky9 4.3.12 amd64' \
-    'generic/ubuntu2204 4.3.12 amd64' \
+    'bento/debian-13 202510.26.0 amd64' \
+    'bento/debian-13 202508.10.0 amd64' \
+    'bento/rockylinux-10.1 202512.01.0 amd64' \
+    'bento/ubuntu-26.04 202606.01.0 amd64' \
     >"$duplicate_lock"
 if PATH="$fake_bin:$PATH" \
     VAGRANT_BOX_LOCK_FILE="$duplicate_lock" \

.github/vagrant-boxes.lock

@@ -1,4 +1,4 @@
 # box version architecture
-generic/debian12 4.3.12 amd64
-generic/rocky9 4.3.12 amd64
-generic/ubuntu2204 4.3.12 amd64
+bento/debian-13 202510.26.0 amd64
+bento/rockylinux-10.1 202512.01.0 amd64
+bento/ubuntu-26.04 202606.01.0 amd64

.github/workflows/ci.yml

@@ -2,6 +2,8 @@
 name: "CI"
 on:
   pull_request:
+    branches:
+      - master
     types:
       - opened
       - synchronize

README.md

@@ -16,9 +16,9 @@ If you want more context on how this works, see:
 
 Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a HA Kubernetes cluster on machines running:
 
-- [x] Debian (tested on version 11)
-- [x] Ubuntu (tested on version 22.04)
-- [x] Rocky (tested on version 9)
+- [x] Debian (tested on version 13)
+- [x] Ubuntu (tested on version 26.04 LTS)
+- [x] Rocky (tested on version 10)
 
 on processor architecture:
 

molecule/calico/molecule.yml

@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master

molecule/calico/overrides.yml

@@ -1,13 +1,14 @@
 ---
 - name: Apply overrides
   hosts: all
+  serial: 1
   tasks:
     - name: Override host variables
       ansible.builtin.set_fact:
         # See:
         # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        calico_iface: eth1
-        kube_vip_iface: eth1
+        calico_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
+        kube_vip_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
 
         # The test VMs might be a bit slow, so we give them more time to join the cluster:
         retry_count: 45

molecule/cilium/molecule.yml

@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master

molecule/cilium/overrides.yml

@@ -1,13 +1,14 @@
 ---
 - name: Apply overrides
   hosts: all
+  serial: 1
   tasks:
     - name: Override host variables
       ansible.builtin.set_fact:
         # See:
         # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        cilium_iface: eth1
-        kube_vip_iface: eth1
+        cilium_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
+        kube_vip_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
 
         # The test VMs might be a bit slow, so we give them more time to join the cluster:
         retry_count: 45

molecule/default/create.yml

@@ -18,12 +18,7 @@
           - create_batches | map('length') | max <= 2
         fail_msg: Bounded create batches do not match the configured default platforms.
 
-    - name: Check for existing Vagrant machine state
-      ansible.builtin.stat:
-        path: "{{ molecule_ephemeral_directory }}/.vagrant/machines"
-      register: vagrant_machine_state
-
-    - name: Generate the complete Vagrant configuration for a clean create # noqa fqcn[action]
+    - name: Generate the complete Vagrant configuration # noqa fqcn[action]
       vagrant:
         instances: "{{ molecule_yml.platforms }}"
         default_box: "{{ molecule_yml.driver.default_box | default('generic/alpine316') }}"
@@ -32,20 +27,18 @@
         cachier: "{{ molecule_yml.driver.cachier | default(omit) }}"
         parallel: false
         state: halt
-      when: not vagrant_machine_state.stat.exists
       changed_when: false
 
     - name: Start clean Vagrant guests in bounded batches
       ansible.builtin.command:
         argv: >-
           {{
-            [molecule_project_directory + '/.github/scripts/vagrant-up-timed.sh',
+            [playbook_dir + '/../../.github/scripts/vagrant-up-timed.sh',
              molecule_ephemeral_directory] + item
           }}
       loop: "{{ create_batches }}"
       loop_control:
         label: "{{ item | join(', ') }}"
-      when: not vagrant_machine_state.stat.exists
       changed_when: true
 
     - name: Reconcile all instances and collect their connection configuration # noqa fqcn[action]

molecule/default/molecule.yml

@@ -8,7 +8,7 @@ driver:
   parallel: false
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -21,14 +21,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: 192.168.30.38
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: control2
-    box: generic/debian12
+    box: bento/debian-13
     memory: 1024
     cpus: 2
     groups:
@@ -41,7 +36,7 @@ platforms:
         ip: 192.168.30.39
 
   - name: control3
-    box: generic/rocky9
+    box: bento/rockylinux-10.1
     memory: 1024
     cpus: 2
     groups:
@@ -54,7 +49,7 @@ platforms:
         ip: 192.168.30.40
 
   - name: node1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -65,14 +60,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: 192.168.30.41
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: node2
-    box: generic/rocky9
+    box: bento/rockylinux-10.1
     memory: 1024
     cpus: 2
     groups:

molecule/default/overrides.yml

@@ -1,15 +1,16 @@
 ---
 - name: Apply overrides
   hosts: all
+  serial: 1
   tasks:
     - name: Override host variables
       ansible.builtin.set_fact:
         # See:
         # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        flannel_iface: eth1
+        flannel_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
         # kube-vip cannot infer the cluster interface in these multi-NIC
         # Vagrant guests because the default route is on eth0.
-        kube_vip_iface: eth1
+        kube_vip_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
 
         # The test VMs might be a bit slow, so we give them more time to join the cluster:
         retry_count: 45

molecule/ipv6/molecule.yml

@@ -5,7 +5,7 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -14,14 +14,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:11
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: control2
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -30,14 +25,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:12
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: node1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -46,11 +36,6 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:21
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 provisioner:
   name: ansible
   env:

molecule/ipv6/overrides.yml

@@ -1,17 +1,18 @@
 ---
 - name: Apply overrides
   hosts: all
+  serial: 1
   tasks:
     - name: Override host variables (1/2)
       ansible.builtin.set_fact:
         # See:
         # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        flannel_iface: eth1
+        flannel_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
 
         # In this scenario, we have multiple interfaces that the VIP could be
         # broadcasted on. Since we have assigned a dedicated private network
         # here, let's make sure that it is used.
-        kube_vip_iface: eth1
+        kube_vip_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
 
         # The test VMs might be a bit slow, so we give them more time to join the cluster:
         retry_count: 45

molecule/kube-vip/molecule.yml

@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master

molecule/kube-vip/overrides.yml

@@ -1,13 +1,14 @@
 ---
 - name: Apply overrides
   hosts: all
+  serial: 1
   tasks:
     - name: Override host variables
       ansible.builtin.set_fact:
         # See:
         # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        flannel_iface: eth1
-        kube_vip_iface: eth1
+        flannel_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
+        kube_vip_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
 
         # The test VMs might be a bit slow, so we give them more time to join the cluster:
         retry_count: 45

molecule/single_node/molecule.yml

@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master

molecule/single_node/overrides.yml

@@ -1,13 +1,14 @@
 ---
 - name: Apply overrides
   hosts: all
+  serial: 1
   tasks:
     - name: Override host variables
       ansible.builtin.set_fact:
         # See:
         # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        flannel_iface: eth1
-        kube_vip_iface: eth1
+        flannel_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
+        kube_vip_iface: "{{ 'eth1' if 'eth1' in ansible_facts.interfaces else 'enp0s8' }}"
 
         # The test VMs might be a bit slow, so we give them more time to join the cluster:
         retry_count: 45