chore(deps): bump jsonpatch from 1.33 to 1.36

Bumps [jsonpatch](https://github.com/stefankoegl/python-json-patch) from 1.33 to 1.36.
- [Release notes](https://github.com/stefankoegl/python-json-patch/releases)
- [Commits](https://github.com/stefankoegl/python-json-patch/compare/v1.33...v1.36)

---
updated-dependencies:
- dependency-name: jsonpatch
  dependency-version: '1.36'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/scripts/test-k3s-init-log-destination.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Assert the k3s-init log destination guard skips when unset.
+
+``roles/k3s_server/tasks/main.yml`` fetches k3s-init diagnostics only when
+``ANSIBLE_K3S_LOG_DIR`` is set. The lookup default must be an empty string:
+Jinja stringifies the boolean ``False`` to ``'False'``, which is non-empty, so
+a boolean default makes the guard pass and the role creates a directory
+literally named ``False`` in the operator's working directory on every run.
+
+This test extracts the real ``log_destination`` expression from the role and
+renders it for both the unset and set cases.
+"""
+
+from __future__ import print_function
+
+import os
+import re
+import subprocess
+
+import yaml
+from jinja2 import Environment
+
+ROLE = os.path.join("roles", "k3s_server", "tasks", "main.yml")
+
+
+def repo_root():
+    return subprocess.check_output(
+        ["git", "rev-parse", "--show-toplevel"], text=True
+    ).strip()
+
+
+def fail(message):
+    raise SystemExit("k3s-init log destination test failed: " + message)
+
+
+def find_log_task(root):
+    """Return the 'Save logs of k3s-init.service' task from the role."""
+    with open(os.path.join(root, ROLE), "r") as handle:
+        tasks = yaml.safe_load(handle)
+
+    def walk(entries):
+        for entry in entries or []:
+            if not isinstance(entry, dict):
+                continue
+            if "Save logs of k3s-init.service" in str(entry.get("name", "")):
+                return entry
+            for key in ("block", "always", "rescue"):
+                found = walk(entry.get(key))
+                if found:
+                    return found
+        return None
+
+    task = walk(tasks)
+    if task is None:
+        fail("could not find the 'Save logs of k3s-init.service' task in " + ROLE)
+    return task
+
+
+def env_lookup(name, default=None, **kwargs):
+    """Stand-in for the env lookup: unset names fall back to the default."""
+    return {"ANSIBLE_K3S_LOG_DIR": None}.get(name, default)
+
+
+def render(task, env, value):
+    """Render log_destination the way Ansible folds a '>-' scalar."""
+    expression = str(task["vars"]["log_destination"]).strip()
+    template = env.from_string(expression)
+
+    def lookup(*args, **kwargs):
+        name = args[1] if len(args) > 1 else kwargs.get("name")
+        if name != "ANSIBLE_K3S_LOG_DIR":
+            return kwargs.get("default")
+        return kwargs["default"] if value is None else value
+
+    return template.render(lookup=lookup).strip()
+
+
+def main():
+    root = repo_root()
+    task = find_log_task(root)
+    env = Environment()
+
+    unset = render(task, env, None)
+    if unset != "":
+        fail(
+            "log_destination resolved to %r when ANSIBLE_K3S_LOG_DIR is unset; "
+            "it must be an empty string so the guard skips" % unset
+        )
+    if task["when"].strip() == "":
+        fail("the guard on the log task is empty, so it would always run")
+
+    set_path = render(task, env, "/var/log/k3s-init")
+    if set_path != "/var/log/k3s-init":
+        fail(
+            "log_destination resolved to %r when ANSIBLE_K3S_LOG_DIR is set; "
+            "expected the path to be passed through unchanged" % set_path
+        )
+
+    # A stray default= would leave the boolean in place even though the
+    # expression still renders empty, so assert the source no longer carries
+    # it. This is the exact regression that produced the False/ directory.
+    if re.search(r"default\s*=\s*False", yaml.safe_dump(task)):
+        fail(
+            "log_destination still uses a boolean default; Jinja would "
+            "stringify it to 'False' and create a directory named False"
+        )
+
+    print("k3s-init log destination regression test passed")
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/test-k3s-server-bootstrap.sh

@@ -26,7 +26,7 @@ if grep -Fq -- "node-role.kubernetes.io/master=true' -o=jsonpath" "$main_tasks";
   exit 1
 fi
 
-grep -Fq -- "map('extract', hostvars, 'ansible_hostname')" "$main_tasks"
+grep -Fq -- "map('extract', hostvars, ['ansible_facts', 'hostname'])" "$main_tasks"
 grep -Fq -- 'difference(nodes.stdout.split())' "$main_tasks"
 grep -Fq -- 'crd/addons.k3s.cattle.io' "$main_tasks"
 grep -Fq -- 'crd/helmcharts.helm.cattle.io' "$main_tasks"

.github/scripts/test-kube-vip-manifest.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """Render the kube-vip DaemonSet template and assert env key correctness.
 
-kube-vip v1.2.2 reads `bgp_peers` and `vip_subnet`; it ignores the older
+kube-vip v1.2.3 reads `bgp_peers` and `vip_subnet`; it ignores the older
 `bgppeers` and `vip_cidr` names. This test proves the rendered manifest uses
 the keys the target image actually parses.
 """
@@ -74,7 +74,7 @@ def render(env, extra_vars):
             {"peer_address": "192.168.30.1", "peer_asn": "64512"},
             {"peer_address": "192.168.30.2", "peer_asn": "64513"},
         ],
-        "kube_vip_tag_version": "v1.2.2",
+        "kube_vip_tag_version": "v1.2.3",
     }
     base_vars.update(extra_vars)
     template = env.get_template("vip.yaml.j2")
@@ -105,8 +105,8 @@ def main():
         fail("rendered manifest still uses the ignored vip_cidr key")
     if "192.168.30.1:64512,192.168.30.2:64513" not in output:
         fail("bgp_peers value is not comma-separated address:ASN entries")
-    if "ghcr.io/kube-vip/kube-vip:v1.2.2" not in output:
-        fail("kube-vip image tag is not v1.2.2")
+    if "ghcr.io/kube-vip/kube-vip:v1.2.3" not in output:
+        fail("kube-vip image tag is not v1.2.3")
 
     # BGP enabled with no merged peers: single-peer fallback vars, no bgp_peers.
     output = render(

.github/scripts/test-raspberrypi-detection.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+repo_root="$(git rev-parse --show-toplevel)"
+tasks_file="$repo_root/roles/raspberrypi/tasks/main.yml"
+
+if [ ! -f "$tasks_file" ]; then
+  printf 'cannot find %s\n' "$tasks_file" >&2
+  exit 1
+fi
+
+# The role decides whether a host is a Raspberry Pi from the return code of two
+# ansible.builtin.command probes. The command module never executes under
+# --check: it returns rc 0 with "Command would have run if not in check mode".
+# Without check_mode: false on both probes every host looks like a Raspberry Pi
+# in a check run, so distro specific tasks (e.g. the Ubuntu cgroup
+# cmdline.txt edit) run against hosts that must not be touched.
+probe_count="$(grep -c -- 'check_mode: false' "$tasks_file" || true)"
+if [ "$probe_count" -lt 2 ]; then
+  printf 'raspberrypi detection probes must set check_mode: false (found %s, expected 2)\n' \
+    "$probe_count" >&2
+  exit 1
+fi
+
+# Both probes must be the detection greps, not some other task.
+for probe in \
+  'grep -E "Raspberry Pi|BCM2708|BCM2709|BCM2835|BCM2836" /proc/cpuinfo' \
+  'grep -E "Raspberry Pi" /proc/device-tree/model'; do
+  grep -Fq -- "$probe" "$tasks_file" || {
+    printf 'missing raspberry pi detection probe: %s\n' "$probe" >&2
+    exit 1
+  }
+done
+
+# The probes must stay registered under the names the gate consumes.
+for var in grep_cpuinfo_raspberrypi grep_device_tree_model_raspberrypi; do
+  grep -Fq -- "register: $var" "$tasks_file" || {
+    printf 'detection probe is not registered as %s\n' "$var" >&2
+    exit 1
+  }
+done
+
+# The gate must keep keying on rc 0 and must tolerate a missing rc so an
+# undefined result cannot be read as "this host is a Raspberry Pi".
+grep -Eq -- 'when:.*grep_cpuinfo_raspberrypi\.rc.*== 0.*grep_device_tree_model_raspberrypi\.rc.*== 0' \
+  "$tasks_file" || {
+  printf 'raspberry_pi gate no longer tests both probe return codes for 0\n' >&2
+  exit 1
+}
+
+grep -Eq -- 'grep_cpuinfo_raspberrypi\.rc \| default\(1\)' "$tasks_file" || {
+  printf 'raspberry_pi gate does not default the /proc/cpuinfo probe rc\n' >&2
+  exit 1
+}
+
+grep -Eq -- 'grep_device_tree_model_raspberrypi\.rc \| default\(1\)' "$tasks_file" || {
+  printf 'raspberry_pi gate does not default the /proc/device-tree probe rc\n' >&2
+  exit 1
+}
+
+# The distro specific include must remain gated on the detection result so a
+# non Raspberry Pi host skips setup/ and teardown/ entirely.
+grep -Eq -- 'raspberry_pi\|default\(false\)' "$tasks_file" || {
+  printf 'OS specific tasks are no longer gated on raspberry_pi\n' >&2
+  exit 1
+}
+
+printf 'Raspberry Pi detection regression test passed\n'

.github/workflows/lint.yml

@@ -68,7 +68,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 7.0.1
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@c5fc58bd0be7a4b94b73ce40250322d5b838a108 # 5.0.7
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@62574f011e0d1967d555a862bd28a7abba8684fe # 5.0.9
         with:
           allowlist: |
             aws-actions/

.pre-commit-config.yaml

@@ -23,10 +23,6 @@ repos:
         additional_dependencies: [ansible-core==2.18.0]
         language_version: python3.12
         args: [--offline]
-  - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.9.0.6
-    hooks:
-      - id: shellcheck
   - repo: https://github.com/Lucas-C/pre-commit-hooks
     rev: v1.5.4
     hooks:
@@ -38,6 +34,12 @@ repos:
       - id: fix-smartquotes
   - repo: local
     hooks:
+      - id: shellcheck
+        name: shellcheck
+        entry: shellcheck
+        language: python
+        additional_dependencies: [shellcheck-py==0.11.0.1]
+        types: [shell]
       - id: cleanup-runner-resources-test
         name: cleanup runner resources test
         entry: .github/scripts/test-cleanup-runner-resources.sh
@@ -62,6 +64,12 @@ repos:
         language: system
         pass_filenames: false
         files: ^roles/k3s_server/tasks/(main|join_master)\.yml$|^\.github/scripts/test-k3s-server-bootstrap\.sh$
+      - id: k3s-init-log-destination-test
+        name: K3s init log destination test
+        entry: .github/scripts/test-k3s-init-log-destination.py
+        language: system
+        pass_filenames: false
+        files: ^roles/k3s_server/tasks/main\.yml$|^\.github/scripts/test-k3s-init-log-destination\.py$
       - id: unique-hostname-precheck-test
         name: Unique hostname precheck test
         entry: .github/scripts/test-unique-hostname-precheck.sh
@@ -74,6 +82,12 @@ repos:
         language: system
         pass_filenames: false
         files: ^roles/prereq/(tasks/main|defaults/main)\.yml$|^\.github/scripts/test-disable-swap\.sh$
+      - id: raspberrypi-detection-test
+        name: Raspberry Pi detection test
+        entry: .github/scripts/test-raspberrypi-detection.sh
+        language: system
+        pass_filenames: false
+        files: ^roles/raspberrypi/(tasks/main|defaults/main)\.yml$|^\.github/scripts/test-raspberrypi-detection\.sh$
       - id: cilium-bgp-manifest-test
         name: Cilium BGP manifest test
         entry: python3 .github/scripts/test-cilium-bgp-manifest.py

README.md

@@ -220,7 +220,7 @@ See the commands [here](https://technotim.com/posts/k3s-etcd-ansible/#testing-yo
 | `k3s_server` | `kube_vip_bgp_peers_groups` | list | `['k3s_master']` | Not required | Inventory group in which to search for additional `kube_vip_bgp_peers` parameters to merge. |
 | `k3s_server` | `kube_vip_iface` | string | `~` | Not required | Explicitly define an interface that ALL control nodes should use to propagate the VIP, define it here. Otherwise, kube-vip will determine the right interface automatically at runtime. |
 | `k3s_server` | `kube_vip_endpoint` | string | `~` | Not required | Overrides the internal address kube-vip binds/listens on, which can differ from the announced apiserver_endpoint for complex routing/tunnels. Defaults to apiserver_endpoint. |
-| `k3s_server` | `kube_vip_tag_version` | string | `v1.2.2` | Not required | Image tag for kube-vip |
+| `k3s_server` | `kube_vip_tag_version` | string | `v1.2.3` | Not required | Image tag for kube-vip |
 | `k3s_server` | `kube_vip_cloud_provider_tag_version` | string | `v0.0.12` | Not required | Tag for kube-vip-cloud-provider manifest when enable |
 | `k3s_server` | `kube_vip_enabled` | bool | `true` | Not required | Enable kube-vip install, covering both the control-plane VIP and the service load balancer. Set false to skip kube-vip entirely (single node or external LB). |
 | `k3s_server`, `k3_server_post` | `kube_vip_lb_ip_range` | string | `~` | Not required | IP range for kube-vip load balancer |

inventory/sample/group_vars/all.yml

@@ -1,5 +1,5 @@
 ---
-k3s_version: v1.36.2+k3s1
+k3s_version: v1.36.4+k3s1
 # this is the user that has ssh access to these machines
 ansible_user: ansibleuser
 systemd_dir: /etc/systemd/system
@@ -102,7 +102,7 @@ extra_agent_args: >-
   {{ extra_args }}
 
 # image tag for kube-vip
-kube_vip_tag_version: v1.2.2
+kube_vip_tag_version: v1.2.3
 
 # enable kube-vip (covers both the control-plane VIP and service load balancing)
 # set false for a single node or when an external load balancer is used

requirements.in

@@ -1,6 +1,6 @@
-ansible-core>=2.19.12
+ansible-core>=2.19.13
 jmespath>=1.1.0
-jsonpatch>=1.33
+jsonpatch>=1.36
 kubernetes>=29.0.0
 molecule-plugins[vagrant]
 molecule>=6.0.3

requirements.txt

@@ -6,7 +6,7 @@
 #
 ansible-compat==4.1.11
     # via molecule
-ansible-core==2.19.12
+ansible-core==2.19.13
     # via
     #   -r requirements.in
     #   ansible-compat
@@ -55,9 +55,9 @@ jinja2==3.1.3
     #   molecule
 jmespath==1.1.0
     # via -r requirements.in
-jsonpatch==1.33
+jsonpatch==1.36
     # via -r requirements.in
-jsonpointer==2.4
+jsonpointer==3.4
     # via jsonpatch
 jsonschema==4.21.1
     # via

roles/k3s_server/defaults/main.yml

@@ -9,7 +9,7 @@ kube_vip_arp: true
 kube_vip_iface:
 kube_vip_endpoint:
 kube_vip_cloud_provider_tag_version: v0.0.12
-kube_vip_tag_version: v1.2.2
+kube_vip_tag_version: v1.2.3
 
 kube_vip_bgp: false
 kube_vip_bgp_routerid: 127.0.0.1
@@ -38,7 +38,7 @@ retry_count: 20
 # yamllint disable rule:line-length
 server_init_args: >-
   {% if groups[group_name_master | default('master')] | length > 1 %}
-    {% if ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname'] %}
+    {% if ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname'] %}
       --cluster-init
     {% else %}
       --server https://{{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip | split(",") | first | ansible.utils.ipwrap }}:6443

roles/k3s_server/meta/main.yml

@@ -89,7 +89,7 @@ argument_specs:
 
       kube_vip_tag_version:
         description: Image tag for kube-vip
-        default: v1.2.2
+        default: v1.2.3
 
       kube_vip_cloud_provider_tag_version:
         description: Tag for kube-vip-cloud-provider manifest when enabled

roles/k3s_server/tasks/fetch_k3s_init_logs.yml

@@ -83,7 +83,7 @@
   no_log: true
   register: k3s_input_firewall_rules
 
-- name: Ping the primary Kubernetes API address from {{ ansible_hostname }}
+- name: Ping the primary Kubernetes API address from {{ ansible_facts.hostname }}
   ansible.builtin.command:
     argv:
       - ping
@@ -97,7 +97,7 @@
   no_log: true
   register: k3s_primary_api_ping
 
-- name: Probe primary Kubernetes API from {{ ansible_hostname }}
+- name: Probe primary Kubernetes API from {{ ansible_facts.hostname }}
   ansible.builtin.wait_for:
     host: "{{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip | split(',') | first }}"
     port: 6443
@@ -122,7 +122,7 @@
   become: false
   ansible.builtin.template:
     src: content.j2
-    dest: "{{ log_destination }}/k3s-init@{{ ansible_hostname }}.log"
+    dest: "{{ log_destination }}/k3s-init@{{ ansible_facts['hostname'] }}.log"
     mode: "0644"
   vars:
     content: |
@@ -137,7 +137,7 @@
   become: false
   ansible.builtin.template:
     src: content.j2
-    dest: "{{ log_destination }}/network@{{ ansible_hostname }}.log"
+    dest: "{{ log_destination }}/network@{{ ansible_facts['hostname'] }}.log"
     mode: "0644"
   vars:
     content: |

roles/k3s_server/tasks/join_master.yml

@@ -25,7 +25,7 @@
   ansible.builtin.command:
     cmd: >-
       {{ k3s_kubectl_binary | default('k3s kubectl') }} get node
-      {{ hostvars[joining_master].ansible_hostname }}
+      {{ hostvars[joining_master].ansible_facts['hostname'] }}
   delegate_to: "{{ groups[group_name_master | default('master')][0] }}"
   register: joined_master
   until: joined_master.rc == 0

roles/k3s_server/tasks/kube-vip.yml

@@ -6,7 +6,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Download vip cloud provider manifest to first master
   ansible.builtin.get_url:
@@ -19,7 +20,8 @@
   retries: "{{ download_retries }}"
   delay: "{{ download_delay }}"
   until: kube_vip_manifest_download is succeeded
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Copy kubevip configMap manifest to first master
   ansible.builtin.template:
@@ -28,4 +30,5 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']

roles/k3s_server/tasks/main.yml

@@ -104,7 +104,7 @@
             expected_control_plane_names: >-
               {{
                 groups[group_name_master | default('master')]
-                | map('extract', hostvars, 'ansible_hostname')
+                | map('extract', hostvars, ['ansible_facts', 'hostname'])
                 | list
               }}
 
@@ -124,13 +124,18 @@
   always:
     - name: Save logs of k3s-init.service
       ansible.builtin.include_tasks: fetch_k3s_init_logs.yml
-      # ANSIBLE_K3S_LOG_DIR is a path string when set; evaluate it as a boolean
-      # so the conditional is a real boolean (ansible-core 2.19 rejects string
-      # conditionals derived from env vars).
+      # The env lookup default must be an empty string, not the boolean
+      # False. The `!= ''` comparison below always evaluates to a bool, so
+      # ansible-core 2.19 never sees a non-boolean conditional and no boolean
+      # default is needed. With a boolean default, an unset ANSIBLE_K3S_LOG_DIR
+      # leaves log_destination as the bool False, and `False != ''` is True
+      # because False == 0. The guard would then always pass, running the
+      # diagnostics on every provisioning run and creating a directory
+      # literally named 'False' in the operator's working directory.
       when: log_destination | default('') != ''
       vars:
         log_destination: >-
-          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=False) }}
+          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default='') }}
     - name: Kill the temporary service used for initialization
       ansible.builtin.systemd:
         name: k3s-init
@@ -183,24 +188,24 @@
 
 - name: Create directory .kube
   ansible.builtin.file:
-    path: "{{ ansible_user_dir }}/.kube"
+    path: "{{ ansible_facts['user_dir'] }}/.kube"
     state: directory
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: u=rwx,g=rx,o=
 
 - name: Copy config file to user home directory
   ansible.builtin.copy:
     src: /etc/rancher/k3s/k3s.yaml
-    dest: "{{ ansible_user_dir }}/.kube/config"
+    dest: "{{ ansible_facts['user_dir'] }}/.kube/config"
     remote_src: true
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: u=rw,g=,o=
 
 - name: Configure kubectl cluster to {{ endpoint_url }}
   ansible.builtin.command: >-
     {{ k3s_kubectl_binary | default('k3s kubectl') }} config set-cluster default
       --server={{ endpoint_url }}
-      --kubeconfig {{ ansible_user_dir }}/.kube/config
+      --kubeconfig {{ ansible_facts['user_dir'] }}/.kube/config
   changed_when: true
   vars:
     endpoint_url: >-

roles/k3s_server/tasks/metallb.yml

@@ -6,7 +6,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: "Download to first master: manifest for metallb-{{ metal_lb_type }}"
   ansible.builtin.get_url:
@@ -19,7 +20,8 @@
   retries: "{{ download_retries }}"
   delay: "{{ download_delay }}"
   until: metallb_manifest_download is succeeded
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Set image versions in manifest for metallb-{{ metal_lb_type }}
   ansible.builtin.replace:
@@ -31,13 +33,15 @@
       to: metallb/speaker:{{ metal_lb_speaker_tag_version }}
   loop_control:
     label: "{{ item.change }} => {{ item.to }}"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Read back MetalLB manifest from first master
   ansible.builtin.slurp:
     src: /var/lib/rancher/k3s/server/manifests/metallb-crds.yaml
   register: metallb_manifest
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Check the MetalLB speaker image reference is present
   ansible.builtin.set_fact:
@@ -46,7 +50,8 @@
         ('quay.io/metallb/speaker:' ~ metal_lb_speaker_tag_version) in
         (metallb_manifest.content | default('') | b64decode)
       }}
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Fail if MetalLB speaker tag was not applied to the manifest
   ansible.builtin.fail:
@@ -56,5 +61,6 @@
       was not found in the downloaded manifest. The upstream image
       reference may have changed.
   when:
-    - ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+    - >-
+      ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
     - not metallb_manifest_has_speaker_tag

roles/k3s_server/tasks/vip.yml

@@ -10,7 +10,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Copy kube-vip RBAC manifest to first master
   ansible.builtin.template:
@@ -19,7 +20,8 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
 
 - name: Copy vip manifest to first master
   ansible.builtin.template:
@@ -28,4 +30,5 @@
     owner: root
     group: root
     mode: "0644"
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']

roles/k3s_server_post/tasks/calico.yml

@@ -1,6 +1,7 @@
 ---
 - name: Deploy Calico to cluster
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+  when: >-
+    ansible_facts.hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']
   run_once: true
   block:
     - name: Create manifests directory on first master

roles/k3s_server_post/tasks/cilium.yml

@@ -184,7 +184,7 @@
         --helm-set loadBalancer.mode={{ bpf_lb_mode }}
         {% endif %}
       environment:
-        KUBECONFIG: "{{ ansible_user_dir }}/.kube/config"
+        KUBECONFIG: "{{ ansible_facts['user_dir'] }}/.kube/config"
       register: cilium_install_result
       changed_when: cilium_install_result.rc == 0
       # cilium install/upgrade fetches the Helm chart from helm.cilium.io, which is
@@ -227,7 +227,7 @@
     - name: Wait for Cilium status to be healthy
       ansible.builtin.command: cilium status --wait
       environment:
-        KUBECONFIG: "{{ ansible_user_dir }}/.kube/config"
+        KUBECONFIG: "{{ ansible_facts['user_dir'] }}/.kube/config"
       register: cilium_status
       changed_when: false
       until: cilium_status.rc == 0

roles/k3s_server_post/tasks/metallb.yml

@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: /tmp/k3s
     state: directory
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: "0755"
   with_items: "{{ groups[group_name_master | default('master')] }}"
   run_once: true
@@ -33,7 +33,7 @@
   ansible.builtin.template:
     src: metallb.crs.j2
     dest: /tmp/k3s/metallb-crs.yaml
-    owner: "{{ ansible_user_id }}"
+    owner: "{{ ansible_facts['user_id'] }}"
     mode: "0755"
   with_items: "{{ groups[group_name_master | default('master')] }}"
   run_once: true

roles/prereq/tasks/main.yml

@@ -29,7 +29,7 @@
 - name: Set SELinux to disabled state
   ansible.posix.selinux:
     state: disabled
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
 
 - name: Enable IPv4 forwarding
   ansible.posix.sysctl:
@@ -63,31 +63,39 @@
     executable: /bin/bash
   register: br_netfilter_exists
   changed_when: false
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
   tags: sysctl
 
 - name: Install kernel-modules-extra if br_netfilter missing
   ansible.builtin.yum:
-    name: kernel-modules-extra
+    name: "kernel-modules-extra-{{ ansible_kernel }}"
     state: present
     update_cache: true
   register: kernel_modules_installed
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts.os_family == "RedHat"
     - br_netfilter_exists.stdout | int == 0
 
+- name: Reboot node if kernel modules package was installed
+  ansible.builtin.reboot:
+    msg: "Rebooting to apply new kernel modules package"
+    reboot_timeout: 300
+  when:
+    - ansible_facts.os_family == "RedHat"
+    - kernel_modules_installed is changed
+
 - name: Add br_netfilter to /etc/modules-load.d/
   ansible.builtin.copy:
     content: br_netfilter
     dest: /etc/modules-load.d/br_netfilter.conf
     mode: u=rw,g=,o=
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
 
 - name: Load br_netfilter
   community.general.modprobe:
     name: br_netfilter
     state: present
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
 
 - name: Set bridge-nf-call-iptables (just to be sure)
   ansible.posix.sysctl:
@@ -95,7 +103,7 @@
     value: "1"
     state: present
     reload: true
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts.os_family == "RedHat"
   loop:
     - net.bridge.bridge-nf-call-iptables
     - net.bridge.bridge-nf-call-ip6tables
@@ -103,10 +111,10 @@
 
 - name: Add /usr/local/bin to sudo secure_path
   ansible.builtin.lineinfile:
-    line: Defaults    secure_path = {{ secure_path[ansible_os_family] }}
+    line: Defaults    secure_path = {{ secure_path[ansible_facts.os_family] }}
     regexp: Defaults(\s)*secure_path(\s)*=
     state: present
     insertafter: EOF
     path: /etc/sudoers
     validate: visudo -cf %s
-  when: ansible_os_family in [ "RedHat", "Suse" ]
+  when: ansible_facts.os_family in [ "RedHat", "Suse" ]

roles/raspberrypi/tasks/main.yml

@@ -1,20 +1,27 @@
 ---
+# The probes below must run in check mode as well. The command module does not
+# execute under --check, it returns rc 0 with "Command would have run if not in
+# check mode", which would otherwise mark every host as a Raspberry Pi and make
+# check runs apply the distro specific tasks. The rc values mean: 0 matched, 1 no
+# match, 2 the file is absent (no /proc/device-tree on non ARM systems).
 - name: Test for raspberry pi /proc/cpuinfo
   ansible.builtin.command: grep -E "Raspberry Pi|BCM2708|BCM2709|BCM2835|BCM2836" /proc/cpuinfo
   register: grep_cpuinfo_raspberrypi
   failed_when: false
   changed_when: false
+  check_mode: false
 
 - name: Test for raspberry pi /proc/device-tree/model
   ansible.builtin.command: grep -E "Raspberry Pi" /proc/device-tree/model
   register: grep_device_tree_model_raspberrypi
   failed_when: false
   changed_when: false
+  check_mode: false
 
 - name: Set raspberry_pi fact to true
   ansible.builtin.set_fact:
     raspberry_pi: true
-  when: grep_cpuinfo_raspberrypi.rc == 0 or grep_device_tree_model_raspberrypi.rc == 0
+  when: (grep_cpuinfo_raspberrypi.rc | default(1)) == 0 or (grep_device_tree_model_raspberrypi.rc | default(1)) == 0
 
 - name: Set detected_distribution to Raspbian (ARM64 on Raspbian, Debian Buster/Bullseye/Bookworm)
   ansible.builtin.set_fact:
@@ -49,8 +56,8 @@
   with_first_found:
     - "{{ action_ }}/{{ detected_distribution }}-{{ detected_distribution_major_version }}.yml"
     - "{{ action_ }}/{{ detected_distribution }}.yml"
-    - "{{ action_ }}/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
-    - "{{ action_ }}/{{ ansible_distribution }}.yml"
+    - "{{ action_ }}/{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_major_version'] }}.yml"
+    - "{{ action_ }}/{{ ansible_facts['distribution'] }}.yml"
     - "{{ action_ }}/default.yml"
   vars:
     action_: >-

site.yml

@@ -19,7 +19,7 @@
         cluster_hostnames: >-
           {{
             groups['k3s_cluster']
-            | map('extract', hostvars, 'ansible_hostname')
+            | map('extract', hostvars, ['ansible_facts', 'hostname'])
             | list
           }}
       run_once: true
@@ -77,9 +77,13 @@
   hosts: master
   environment: "{{ proxy_env | default({}) }}"
   tasks:
-    - name: Copying kubeconfig from {{ hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname'] }}
+    - name: >-
+        Copying kubeconfig from
+        {{ hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname'] }}
       ansible.builtin.fetch:
-        src: "{{ ansible_user_dir }}/.kube/config"
+        src: "{{ ansible_facts['user_dir'] }}/.kube/config"
         dest: ./kubeconfig
         flat: true
-      when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+      when: >-
+        ansible_facts.hostname ==
+        hostvars[groups[group_name_master | default('master')][0]]['ansible_facts']['hostname']