Merge 1d26a37bbf into 3888a29bb1

.ansible-lint

@@ -18,4 +18,3 @@ exclude_paths:
 
 skip_list:
   - 'fqcn-builtins'
-  - var-naming[no-role-prefix]

.github/ISSUE_TEMPLATE.md

@@ -51,9 +51,6 @@ extra_agent_args: ""
 
 kube_vip_tag_version: ""
 
-kube_vip_cloud_provider_tag_version: ""
-kube_vip_lb_ip_range: ""
-
 metal_lb_speaker_tag_version: ""
 metal_lb_controller_tag_version: ""
 

.github/workflows/cache.yml

@@ -11,12 +11,12 @@ jobs:
 
     steps:
       - name: Check out the codebase
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 4.1.1
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # 5.0.0
+        uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip' # caching pip dependencies

.github/workflows/ci.yml

@@ -6,16 +6,7 @@ on:
       - opened
       - synchronize
     paths-ignore:
-      - '**/.gitignore'
+      - '**/README.md'
-      - '**/FUNDING.yml'
-      - '**/host.ini'
-      - '**/*.md'
-      - '**/.editorconfig'
-      - '**/ansible.example.cfg'
-      - '**/deploy.sh'
-      - '**/LICENSE'
-      - '**/reboot.sh'
-      - '**/reset.sh'
 jobs:
   pre:
     uses: ./.github/workflows/cache.yml

.github/workflows/lint.yml

@@ -11,12 +11,12 @@ jobs:
 
     steps:
       - name: Check out the codebase
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 4.1.1
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # 5.0.0
+        uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip' # caching pip dependencies
@@ -45,9 +45,9 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 4.1.1
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ba37328d4ea95eaf8b3bd6c6cef308f709a5f2ec # 3.0.3
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@af2eb3226618e2494e3d9084f515ad6dcf16e229 # 2.0.1
         with:
           allowlist: |
             aws-actions/

.github/workflows/test.yml

@@ -13,15 +13,13 @@ jobs:
           - ipv6
           - single_node
           - calico
-          - cilium
-          - kube-vip
       fail-fast: false
     env:
       PYTHON_VERSION: "3.11"
 
     steps:
       - name: Check out the codebase
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 4.1.1
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -59,7 +57,7 @@ jobs:
           EOF
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # 5.0.0
+        uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip' # caching pip dependencies
@@ -118,9 +116,8 @@ jobs:
 
       - name: Upload log files
         if: always() # do this even if a step before has failed
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # 4.3.0
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # 3.1.1
         with:
           name: logs
           path: |
             ${{ runner.temp }}/logs
-          overwrite: true

.gitignore

@@ -1,4 +1,6 @@
 .env/
 *.log
 ansible.cfg
-kubeconfig
+
+__pycache__/
+*.py[cod]

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: f71fa2c1f9cf5cb705f73dffe4b21f7c61470ba9  # frozen: v4.4.0
     hooks:
       - id: requirements-txt-fixer
       - id: sort-simple-yaml
@@ -12,24 +12,24 @@ repos:
       - id: trailing-whitespace
         args: [--markdown-linebreak-ext=md]
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.33.0
+    rev: b05e028c5881819161d11cb543fd96a30c06cceb  # frozen: v1.32.0
     hooks:
       - id: yamllint
         args: [-c=.yamllint]
   - repo: https://github.com/ansible-community/ansible-lint.git
-    rev: v6.22.2
+    rev: 3293b64b939c0de16ef8cb81dd49255e475bf89a  # frozen: v6.17.2
     hooks:
       - id: ansible-lint
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.9.0.6
+    rev: 375289a39f5708101b1f916eb729e8d6da96993f  # frozen: v0.9.0.5
     hooks:
       - id: shellcheck
   - repo: https://github.com/Lucas-C/pre-commit-hooks
-    rev: v1.5.4
+    rev: 12885e376b93dc4536ad68d156065601e4433665  # frozen: v1.5.1
     hooks:
       - id: remove-crlf
       - id: remove-tabs
   - repo: https://github.com/sirosen/texthooks
-    rev: 0.6.4
+    rev: c4ffd3e31669dd4fa4d31a23436cc13839730084  # frozen: 0.5.0
     hooks:
       - id: fix-smartquotes

README.md

@@ -73,6 +73,21 @@ This requires at least k3s version `1.19.1` however the version is configurable
 
 If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match your environment.
 
+#### verify routing prefixes and ip addresses in all.yml
+Ensure that the ip routing prefix matches the the one from the flannel_iface (`eth0` by default) for each host.
+Example `192.168.30` is the default routing prefix, and it is used in the following variables:
+- apiserver_endpoint
+- metal_lb_bgp_peer_address (commented by default)
+- metal_lb_ip_range
+Also Ensure that the apiserver_endpoint is not in the metal_lb_ip_range
+
+For your convience The playbook site.yml verifies the above elements of the config are valid.
+* Optionally to skip these verifications set, in all.yml `verify_config: false`  
+* Optionally to just verify the config Run
+    `ansible-playbook -i inventory/my-cluster/hosts.ini verify_config.yml`
+* Optionally manually recover ip routing prefix based on inet and netmask from
+    `ansible -i inventory/my-cluster/hosts.ini --become -m shell -a 'ifconfig eth0 | grep "inet "' all`
+
 ### ☸️ Create Cluster
 
 Start provisioning of the cluster using the following command:

inventory/sample/group_vars/all.yml

@@ -13,27 +13,9 @@ flannel_iface: "eth0"
 # uncomment calico_iface to use tigera operator/calico cni instead of flannel https://docs.tigera.io/calico/latest/about
 # calico_iface: "eth0"
 calico_ebpf: false           # use eBPF dataplane instead of iptables
+calico_cidr: "10.52.0.0/16"  # calico cluster pod cidr pool
 calico_tag: "v3.27.0"        # calico version tag
 
-# uncomment cilium_iface to use cilium cni instead of flannel or calico
-# ensure v4.19.57, v5.1.16, v5.2.0 or more recent kernel
-# cilium_iface: "eth0"
-cilium_mode: "native"        # native when nodes on same subnet or using bgp, else set routed
-cilium_tag: "v1.14.6"        # cilium version tag
-cilium_hubble: true          # enable hubble observability relay and ui
-
-# if using calico or cilium, you may specify the cluster pod cidr pool
-cluster_cidr: "10.52.0.0/16"
-
-# enable cilium bgp control plane for lb services and pod cidrs. disables metallb.
-cilium_bgp: false
-
-# bgp parameters for cilium cni. only active when cilium_iface is defined and cilium_bgp is true.
-cilium_bgp_my_asn: "64513"
-cilium_bgp_peer_asn: "64512"
-cilium_bgp_peer_address: "192.168.30.1"
-cilium_bgp_lb_cidr: "192.168.31.0/24"   # cidr for cilium loadbalancer ipam
-
 # apiserver_endpoint is virtual ip-address which will be configured on each master
 apiserver_endpoint: "192.168.30.222"
 
@@ -44,25 +26,25 @@ k3s_token: "some-SUPER-DEDEUPER-secret-password"
 # The IP on which the node is reachable in the cluster.
 # Here, a sensible default is provided, you can still override
 # it for each of your hosts, though.
-k3s_node_ip: "{{ ansible_facts[(cilium_iface | default(calico_iface | default(flannel_iface)))]['ipv4']['address'] }}"
+k3s_node_ip: "{{ ansible_facts[(calico_iface | default(flannel_iface))]['ipv4']['address'] }}"
 
 # Disable the taint manually by setting: k3s_master_taint = false
 k3s_master_taint: "{{ true if groups['node'] | default([]) | length >= 1 else false }}"
 
 # these arguments are recommended for servers as well as agents:
 extra_args: >-
-  {{ '--flannel-iface=' + flannel_iface if calico_iface is not defined and cilium_iface is not defined else '' }}
+  {{ '--flannel-iface=' + flannel_iface if calico_iface is not defined else '' }}
   --node-ip={{ k3s_node_ip }}
 
 # change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
-# the contents of the if block is also required if using calico or cilium
+# the contents of the if block is also required if using calico
 extra_server_args: >-
   {{ extra_args }}
   {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
-  {% if calico_iface is defined or cilium_iface is defined %}
+  {% if calico_iface is defined %}
   --flannel-backend=none
   --disable-network-policy
-  --cluster-cidr={{ cluster_cidr | default('10.52.0.0/16') }}
+  --cluster-cidr={{ calico_cidr | default('10.52.0.0/16') }}
   {% endif %}
   --tls-san {{ apiserver_endpoint }}
   --disable servicelb
@@ -74,13 +56,6 @@ extra_agent_args: >-
 # image tag for kube-vip
 kube_vip_tag_version: "v0.6.4"
 
-# tag for kube-vip-cloud-provider manifest
-# kube_vip_cloud_provider_tag_version: "main"
-
-# kube-vip ip range for load balancer
-# (uncomment to use kube-vip for services instead of MetalLB)
-# kube_vip_lb_ip_range: "192.168.30.80-192.168.30.90"
-
 # metallb type frr or native
 metal_lb_type: "native"
 
@@ -165,3 +140,5 @@ custom_registries_yaml: |
 #   HTTP_PROXY: "http://proxy.domain.local:3128"
 #   HTTPS_PROXY: "http://proxy.domain.local:3128"
 #   NO_PROXY: "*.domain.local,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+
+verify_config: true

molecule/README.md

@@ -15,10 +15,6 @@ We have these scenarios:
   Very similar to the default scenario, but uses only a single node for all cluster functionality.
 - **calico**:
   The same as single node, but uses calico cni instead of flannel.
-- **cilium**:
-  The same as single node, but uses cilium cni instead of flannel.
-- **kube-vip**
-  The same as single node, but uses kube-vip as service loadbalancer instead of MetalLB
 
 ## How to execute
 

molecule/cilium/molecule.yml

@@ -1,49 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: vagrant
-platforms:
-  - name: control1
-    box: generic/ubuntu2204
-    memory: 4096
-    cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: "vagrant"
-      ssh.password: "vagrant"
-    groups:
-      - k3s_cluster
-      - master
-    interfaces:
-      - network_name: private_network
-        ip: 192.168.30.63
-provisioner:
-  name: ansible
-  env:
-    ANSIBLE_VERBOSITY: 1
-  playbooks:
-    converge: ../resources/converge.yml
-    side_effect: ../resources/reset.yml
-    verify: ../resources/verify.yml
-  inventory:
-    links:
-      group_vars: ../../inventory/sample/group_vars
-scenario:
-  test_sequence:
-    - dependency
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    # idempotence is not possible with the playbook in its current form.
-    - verify
-    # We are repurposing side_effect here to test the reset playbook.
-    # This is why we do not run it before verify (which tests the cluster),
-    # but after the verify step.
-    - side_effect
-    - cleanup
-    - destroy

molecule/cilium/overrides.yml

@@ -1,16 +0,0 @@
----
-- name: Apply overrides
-  hosts: all
-  tasks:
-    - name: Override host variables
-      ansible.builtin.set_fact:
-        # See:
-        # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        cilium_iface: eth1
-
-        # The test VMs might be a bit slow, so we give them more time to join the cluster:
-        retry_count: 45
-
-        # Make sure that our IP ranges do not collide with those of the other scenarios
-        apiserver_endpoint: "192.168.30.225"
-        metal_lb_ip_range: "192.168.30.110-192.168.30.119"

molecule/kube-vip/molecule.yml

@@ -1,49 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: vagrant
-platforms:
-  - name: control1
-    box: generic/ubuntu2204
-    memory: 4096
-    cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: "vagrant"
-      ssh.password: "vagrant"
-    groups:
-      - k3s_cluster
-      - master
-    interfaces:
-      - network_name: private_network
-        ip: 192.168.30.62
-provisioner:
-  name: ansible
-  env:
-    ANSIBLE_VERBOSITY: 1
-  playbooks:
-    converge: ../resources/converge.yml
-    side_effect: ../resources/reset.yml
-    verify: ../resources/verify.yml
-  inventory:
-    links:
-      group_vars: ../../inventory/sample/group_vars
-scenario:
-  test_sequence:
-    - dependency
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    # idempotence is not possible with the playbook in its current form.
-    - verify
-    # We are repurposing side_effect here to test the reset playbook.
-    # This is why we do not run it before verify (which tests the cluster),
-    # but after the verify step.
-    - side_effect
-    - cleanup
-    - destroy

molecule/kube-vip/overrides.yml

@@ -1,17 +0,0 @@
----
-- name: Apply overrides
-  hosts: all
-  tasks:
-    - name: Override host variables
-      ansible.builtin.set_fact:
-        # See:
-        # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
-        flannel_iface: eth1
-
-        # The test VMs might be a bit slow, so we give them more time to join the cluster:
-        retry_count: 45
-
-        # Make sure that our IP ranges do not collide with those of the other scenarios
-        apiserver_endpoint: "192.168.30.225"
-        # Use kube-vip instead of MetalLB
-        kube_vip_lb_ip_range: "192.168.30.110-192.168.30.119"

requirements.txt

@@ -6,7 +6,7 @@
 #
 ansible-compat==4.1.11
     # via molecule
-ansible-core==2.16.3
+ansible-core==2.16.2
     # via
     #   -r requirements.in
     #   ansible-compat

roles/k3s_server/tasks/kube-vip.yml

@@ -1,27 +0,0 @@
----
-- name: Create manifests directory on first master
-  file:
-    path: /var/lib/rancher/k3s/server/manifests
-    state: directory
-    owner: root
-    group: root
-    mode: 0644
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
-
-- name: Download vip cloud provider manifest to first master
-  ansible.builtin.get_url:
-    url: "https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provider/{{ kube_vip_cloud_provider_tag_version | default('main') }}/manifest/kube-vip-cloud-controller.yaml"  # noqa yaml[line-length]
-    dest: "/var/lib/rancher/k3s/server/manifests/kube-vip-cloud-controller.yaml"
-    owner: root
-    group: root
-    mode: 0644
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
-
-- name: Copy kubevip configMap manifest to first master
-  template:
-    src: "kubevip.yaml.j2"
-    dest: "/var/lib/rancher/k3s/server/manifests/kubevip.yaml"
-    owner: root
-    group: root
-    mode: 0644
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']

roles/k3s_server/tasks/main.yml

@@ -29,12 +29,6 @@
 - name: Deploy metallb manifest
   include_tasks: metallb.yml
   tags: metallb
-  when: kube_vip_lb_ip_range is not defined and (not cilium_bgp or cilium_iface is not defined)
-
-- name: Deploy kube-vip manifest
-  include_tasks: kube-vip.yml
-  tags: kubevip
-  when: kube_vip_lb_ip_range is defined
 
 - name: Init cluster inside the transient k3s-init service
   command:

roles/k3s_server/templates/kubevip.yaml.j2

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kubevip
-  namespace: kube-system
-data:
-{% if kube_vip_lb_ip_range is string %}
-{# kube_vip_lb_ip_range was used in the legacy way: single string instead of a list #}
-{#   => transform to list with single element #}
-{% set kube_vip_lb_ip_range = [kube_vip_lb_ip_range] %}
-{% endif %}
-  range-global: {{ kube_vip_lb_ip_range | join(',') }}

roles/k3s_server/templates/vip.yaml.j2

@@ -43,7 +43,7 @@ spec:
         - name: vip_ddns
           value: "false"
         - name: svc_enable
-          value: "{{ 'true' if kube_vip_lb_ip_range is defined else 'false' }}"
+          value: "false"
         - name: vip_leaderelection
           value: "true"
         - name: vip_leaseduration

roles/k3s_server_post/tasks/cilium.yml

@@ -1,253 +0,0 @@
----
-- name: Prepare Cilium CLI on first master and deploy CNI
-  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
-  run_once: true
-  block:
-    - name: Create tmp directory on first master
-      file:
-        path: /tmp/k3s
-        state: directory
-        owner: root
-        group: root
-        mode: 0755
-
-    - name: Check if Cilium CLI is installed
-      ansible.builtin.command: cilium version
-      register: cilium_cli_installed
-      failed_when: false
-      changed_when: false
-      ignore_errors: true
-
-    - name: Check for Cilium CLI version in command output
-      set_fact:
-        installed_cli_version: >-
-          {{
-            cilium_cli_installed.stdout_lines
-            | join(' ')
-            | regex_findall('cilium-cli: (v\d+\.\d+\.\d+)')
-            | first
-            | default('unknown')
-          }}
-      when: cilium_cli_installed.rc == 0
-
-    - name: Get latest stable Cilium CLI version file
-      ansible.builtin.get_url:
-        url: "https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt"
-        dest: "/tmp/k3s/cilium-cli-stable.txt"
-        owner: root
-        group: root
-        mode: 0755
-
-    - name: Read Cilium CLI stable version from file
-      ansible.builtin.command: cat /tmp/k3s/cilium-cli-stable.txt
-      register: cli_ver
-      changed_when: false
-
-    - name: Log installed Cilium CLI version
-      ansible.builtin.debug:
-        msg: "Installed Cilium CLI version: {{ installed_cli_version | default('Not installed') }}"
-
-    - name: Log latest stable Cilium CLI version
-      ansible.builtin.debug:
-        msg: "Latest Cilium CLI version: {{ cli_ver.stdout }}"
-
-    - name: Determine if Cilium CLI needs installation or update
-      set_fact:
-        cilium_cli_needs_update: >-
-          {{
-            cilium_cli_installed.rc != 0 or
-            (cilium_cli_installed.rc == 0 and
-            installed_cli_version != cli_ver.stdout)
-          }}
-
-    - name: Install or update Cilium CLI
-      when: cilium_cli_needs_update
-      block:
-        - name: Set architecture variable
-          ansible.builtin.set_fact:
-            cli_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
-
-        - name: Download Cilium CLI and checksum
-          ansible.builtin.get_url:
-            url: "{{ cilium_base_url }}/cilium-linux-{{ cli_arch }}{{ item }}"
-            dest: "/tmp/k3s/cilium-linux-{{ cli_arch }}{{ item }}"
-            owner: root
-            group: root
-            mode: 0755
-          loop:
-            - ".tar.gz"
-            - ".tar.gz.sha256sum"
-          vars:
-            cilium_base_url: "https://github.com/cilium/cilium-cli/releases/download/{{ cli_ver.stdout }}"
-
-        - name: Verify the downloaded tarball
-          ansible.builtin.shell: |
-            cd /tmp/k3s && sha256sum --check cilium-linux-{{ cli_arch }}.tar.gz.sha256sum
-          args:
-            executable: /bin/bash
-          changed_when: false
-
-        - name: Extract Cilium CLI to /usr/local/bin
-          ansible.builtin.unarchive:
-            src: "/tmp/k3s/cilium-linux-{{ cli_arch }}.tar.gz"
-            dest: /usr/local/bin
-            remote_src: true
-
-        - name: Remove downloaded tarball and checksum file
-          ansible.builtin.file:
-            path: "{{ item }}"
-            state: absent
-          loop:
-            - "/tmp/k3s/cilium-linux-{{ cli_arch }}.tar.gz"
-            - "/tmp/k3s/cilium-linux-{{ cli_arch }}.tar.gz.sha256sum"
-
-    - name: Wait for connectivity to kube VIP
-      ansible.builtin.command: ping -c 1 {{ apiserver_endpoint }}
-      register: ping_result
-      until: ping_result.rc == 0
-      retries: 21
-      delay: 1
-      ignore_errors: true
-      changed_when: false
-
-    - name: Fail if kube VIP not reachable
-      ansible.builtin.fail:
-        msg: "API endpoint {{ apiserver_endpoint }} is not reachable"
-      when: ping_result.rc != 0
-
-    - name: Test for existing Cilium install
-      ansible.builtin.command: k3s kubectl -n kube-system get daemonsets cilium
-      register: cilium_installed
-      failed_when: false
-      changed_when: false
-      ignore_errors: true
-
-    - name: Check existing Cilium install
-      when: cilium_installed.rc == 0
-      block:
-
-        - name: Check Cilium version
-          ansible.builtin.command: cilium version
-          register: cilium_version
-          failed_when: false
-          changed_when: false
-          ignore_errors: true
-
-        - name: Parse installed Cilium version
-          set_fact:
-            installed_cilium_version: >-
-              {{
-                cilium_version.stdout_lines
-                | join(' ')
-                | regex_findall('cilium image.+(\d+\.\d+\.\d+)')
-                | first
-                | default('unknown')
-              }}
-
-        - name: Determine if Cilium needs update
-          set_fact:
-            cilium_needs_update: >-
-              {{ 'v' + installed_cilium_version != cilium_tag }}
-
-        - name: Log result
-          ansible.builtin.debug:
-            msg: >
-              Installed Cilium version: {{ installed_cilium_version }},
-              Target Cilium version: {{ cilium_tag }},
-              Update needed: {{ cilium_needs_update }}
-
-    - name: Install Cilium
-      ansible.builtin.command: >-
-        {% if cilium_installed.rc != 0 %}
-        cilium install
-        {% else %}
-        cilium upgrade
-        {% endif %}
-        --version "{{ cilium_tag }}"
-        --helm-set operator.replicas="1"
-        {{ '--helm-set devices=' + cilium_iface if cilium_iface != 'auto' else '' }}
-        --helm-set ipam.operator.clusterPoolIPv4PodCIDRList={{ cluster_cidr }}
-        {% if cilium_mode == "native" or (cilium_bgp and cilium_exportPodCIDR != 'false') %}
-        --helm-set ipv4NativeRoutingCIDR={{ cluster_cidr }}
-        {% endif %}
-        --helm-set k8sServiceHost={{ apiserver_endpoint }}
-        --helm-set k8sServicePort="6443"
-        --helm-set routingMode={{ cilium_mode | default("native") }}
-        --helm-set autoDirectNodeRoutes={{ "true" if cilium_mode == "native" else "false" }}
-        --helm-set kubeProxyReplacement={{ kube_proxy_replacement | default("true") }}
-        --helm-set bpf.masquerade={{ enable_bpf_masquerade | default("true") }}
-        --helm-set bgpControlPlane.enabled={{ cilium_bgp | default("false") }}
-        --helm-set hubble.enabled={{ "true" if cilium_hubble else "false" }}
-        --helm-set hubble.relay.enabled={{ "true" if cilium_hubble else "false" }}
-        --helm-set hubble.ui.enabled={{ "true" if cilium_hubble else "false" }}
-        {% if kube_proxy_replacement is not false %}
-        --helm-set bpf.loadBalancer.algorithm={{ bpf_lb_algorithm | default("maglev") }}
-        --helm-set bpf.loadBalancer.mode={{ bpf_lb_mode | default("hybrid") }}
-        {% endif %}
-      environment:
-        KUBECONFIG: /home/{{ ansible_user }}/.kube/config
-      register: cilium_install_result
-      changed_when: cilium_install_result.rc == 0
-      when: cilium_installed.rc != 0 or cilium_needs_update
-
-    - name: Wait for Cilium resources
-      command: >-
-        {% if item.type == 'daemonset' %}
-        k3s kubectl wait pods
-        --namespace=kube-system
-        --selector='k8s-app=cilium'
-        --for=condition=Ready
-        {% else %}
-        k3s kubectl wait {{ item.type }}/{{ item.name }}
-        --namespace=kube-system
-        --for=condition=Available
-        {% endif %}
-        --timeout=7s
-      register: cr_result
-      changed_when: false
-      until: cr_result is succeeded
-      retries: 30
-      delay: 7
-      with_items:
-        - {name: cilium-operator, type: deployment}
-        - {name: cilium, type: daemonset, selector: 'k8s-app=cilium'}
-        - {name: hubble-relay, type: deployment, check_hubble: true}
-        - {name: hubble-ui, type: deployment, check_hubble: true}
-      loop_control:
-        label: "{{ item.type }}/{{ item.name }}"
-      when: >-
-        not item.check_hubble | default(false) or (item.check_hubble | default(false) and cilium_hubble)
-
-    - name: Configure Cilium BGP
-      when: cilium_bgp
-      block:
-
-        - name: Copy BGP manifests to first master
-          ansible.builtin.template:
-            src: "cilium.crs.j2"
-            dest: /tmp/k3s/cilium-bgp.yaml
-            owner: root
-            group: root
-            mode: 0755
-
-        - name: Apply BGP manifests
-          ansible.builtin.command:
-            cmd: kubectl apply -f /tmp/k3s/cilium-bgp.yaml
-          register: apply_cr
-          changed_when: "'configured' in apply_cr.stdout or 'created' in apply_cr.stdout"
-          failed_when: "'is invalid' in apply_cr.stderr"
-          ignore_errors: true
-
-        - name: Print error message if BGP manifests application fails
-          ansible.builtin.debug:
-            msg: "{{ apply_cr.stderr }}"
-          when: "'is invalid' in apply_cr.stderr"
-
-        - name: Test for BGP config resources
-          ansible.builtin.command: "{{ item }}"
-          loop:
-            - k3s kubectl get CiliumBGPPeeringPolicy.cilium.io
-            - k3s kubectl get CiliumLoadBalancerIPPool.cilium.io
-          changed_when: false
-          loop_control:
-            label: "{{ item }}"

roles/k3s_server_post/tasks/main.yml

@@ -2,17 +2,11 @@
 - name: Deploy calico
   include_tasks: calico.yml
   tags: calico
-  when: calico_iface is defined and cilium_iface is not defined
+  when: calico_iface is defined
-
-- name: Deploy cilium
-  include_tasks: cilium.yml
-  tags: cilium
-  when: cilium_iface is defined
 
 - name: Deploy metallb pool
   include_tasks: metallb.yml
   tags: metallb
-  when: kube_vip_lb_ip_range is not defined and (not cilium_bgp or cilium_iface is not defined)
 
 - name: Remove tmp directory used for manifests
   file:

roles/k3s_server_post/tasks/metallb.yml

@@ -8,27 +8,6 @@
   with_items: "{{ groups[group_name_master | default('master')] }}"
   run_once: true
 
-- name: Delete outdated metallb replicas
-  shell: |-
-    set -o pipefail
-
-    REPLICAS=$(k3s kubectl --namespace='metallb-system' get replicasets \
-      -l 'component=controller,app=metallb' \
-      -o jsonpath='{.items[0].spec.template.spec.containers[0].image}, {.items[0].metadata.name}' 2>/dev/null || true)
-    REPLICAS_SETS=$(echo ${REPLICAS} | grep -v '{{ metal_lb_controller_tag_version }}' | sed -e "s/^.*\s//g")
-    if [ -n "${REPLICAS_SETS}" ] ; then
-      for REPLICAS in "${REPLICAS_SETS}"
-      do
-        k3s kubectl --namespace='metallb-system' \
-          delete rs "${REPLICAS}"
-      done
-    fi
-  args:
-    executable: /bin/bash
-  changed_when: false
-  run_once: true
-  with_items: "{{ groups[group_name_master | default('master')] }}"
-
 - name: Copy metallb CRs manifest to first master
   template:
     src: "metallb.crs.j2"

roles/k3s_server_post/templates/calico.crs.j2

@@ -10,7 +10,7 @@ spec:
     # Note: The ipPools section cannot be modified post-install.
     ipPools:
     - blockSize: {{ calico_blockSize | default('26') }}
-      cidr: {{ cluster_cidr | default('10.52.0.0/16') }}
+      cidr: {{ calico_cidr | default('10.52.0.0/16') }}
       encapsulation: {{ calico_encapsulation | default('VXLANCrossSubnet') }}
       natOutgoing: {{ calico_natOutgoing | default('Enabled') }}
       nodeSelector: {{ calico_nodeSelector | default('all()') }}

roles/k3s_server_post/templates/cilium.crs.j2

@@ -1,29 +0,0 @@
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumBGPPeeringPolicy
-metadata:
- name: 01-bgp-peering-policy
-spec: # CiliumBGPPeeringPolicySpec
- virtualRouters: # []CiliumBGPVirtualRouter
- - localASN: {{ cilium_bgp_my_asn }}
-   exportPodCIDR: {{ cilium_exportPodCIDR | default('true') }}
-   neighbors: # []CiliumBGPNeighbor
-    - peerAddress: '{{ cilium_bgp_peer_address + "/32"}}'
-      peerASN: {{ cilium_bgp_peer_asn }}
-      eBGPMultihopTTL: 10
-      connectRetryTimeSeconds: 120
-      holdTimeSeconds: 90
-      keepAliveTimeSeconds: 30
-      gracefulRestart:
-        enabled: true
-        restartTimeSeconds: 120
-   serviceSelector:
-      matchExpressions:
-         - {key: somekey, operator: NotIn, values: ['never-used-value']}
----
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: "01-lb-pool"
-spec:
-  cidrs:
-  - cidr: "{{ cilium_bgp_lb_cidr }}"

roles/verify_config/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+# To be ran on localhost after verify_config_gather role.
+# Verifies gatherd facts.
+- name: Collect all routing4_prefixes into a list
+  set_fact:
+    all_routing4_prefixes: "{{ groups['all'] | map('extract', hostvars, 'routing4_prefix') | list }}"
+    routing4_prefix: "{{ groups['all'] | map('extract', hostvars, 'routing4_prefix') | list | first }}"
+
+- name: Ensure all hosts have the same routing4_prefix
+  assert:
+    that: all_routing4_prefixes | unique | length == 1
+    fail_msg: "Not all hosts have the same routing4_prefix."
+    success_msg: "Using verified routing prefix {{ routing4_prefix }} across all hosts"

roles/verify_config_gather/filter_plugins/range_to_ips.py

@@ -0,0 +1,53 @@
+import netaddr
+
+''' returns True if ip is in range
+    examples:
+    - see test functions below
+'''
+def test(ip, range, expected):
+    assert netaddr_ip_in_dash_range(ip, range) == expected
+
+def test_netaddr_ip_in_dash_range():
+    # ipv4
+    test('192.168.1.1', '192.168.1.1-192.168.1.2', True)
+    test('192.168.1.1', '192.168.1.1', True)
+    test('192.168.1.1', '192.168.1.2-192.168.1.3', False)
+    test('192.168.1.1', '192.168.1.2', False)
+
+    # ipv6 style
+    test('::ffff:192.168.1.1', '::ffff:192.168.1.1-::ffff:192.168.1.8', True)
+    test('::ffff:192.168.1.1', '::ffff:192.168.1.1', True)
+    test('::ffff:192.168.1.1', '::ffff:192.168.1.2-::ffff:192.168.1.8', False)
+    test('::ffff:192.168.1.1', '::ffff:192.168.1.2', False)
+
+    # Note I expedted true but apperently the netaddr library does not support this?? or I don't understand ipv6 :)
+    test('::2:1', '::2:1-::2:2', False)
+    '''
+    todo: ?
+    - netaddr_ip_in_dash_range('192.168.1.1',  '192.168.1.0/24')             => True (TODO: test, implement)
+    - netaddr_ip_in_dash_range('192.168.99.1', '192.168.1.0/24')            => False (TODO: test, implement)
+    '''
+
+def netaddr_ip_in_dash_range(ip, range):
+    # return False early if range is invalid
+    if '-' not in range:
+        ip_start = range
+        ip_end = range
+    else:
+        ip_start = range.split('-')[0]
+        ip_end = range.split('-')[1]
+    return ip in [str(ip) for ip in netaddr.iter_iprange(ip_start, ip_end)]
+
+
+class FilterModule(object):
+        ''' Ansible filters. Interface to custom netaddr methods.
+            https://pypi.org/project/netaddr/
+        '''
+
+        def filters(self):
+            return {
+                'netaddr_ip_in_dash_range' : netaddr_ip_in_dash_range
+                }
+
+if __name__ == '__main__':
+    test_netaddr_ip_in_dash_range()

roles/verify_config_gather/tasks/main.yml

@@ -0,0 +1,117 @@
+---
+# To be ran on all hosts before role verify_config.
+# Gathers facts and ensures they are set
+
+- name: Set routing4_prefix from regex
+  set_fact:
+    routing4_prefix: "{{ hostvars[inventory_hostname]['ansible_' ~ flannel_iface]['ipv4']['broadcast']
+      | regex_replace('\\.?255', '') }}"
+    routing6_cidr: "{{ hostvars[inventory_hostname]['ansible_' ~ flannel_iface]['ipv6'][0]['address'] }}/{{
+      hostvars[inventory_hostname]['ansible_' ~ flannel_iface]['ipv6'][0]['prefix'] }}"
+
+- name: Check if fact routing4_prefix exists and is not empty
+  assert:
+    that:
+      - routing4_prefix is defined
+      - routing4_prefix is not none
+      - routing4_prefix != ''
+    fail_msg: >-
+      The fact 'routing_4prefix' is not defined, is null, or is empty
+      (based on flannel_iface: {{ flannel_iface }} ipv4 broadcast).
+
+# metal_lb_bgp_peer_address
+- name: Assert that metal_lb_bgp_peer_address starts with routing4_prefix, or is ipv6
+  assert:
+    that:
+      - >
+        metal_lb_bgp_peer_address.startswith(routing4_prefix)
+        or metal_lb_bgp_peer_address.matches('.*:.*')
+    fail_msg: >
+      The fact 'metal_lb_bgp_peer_address' <{{ metal_lb_bgp_peer_address }}>
+      doesn't start with the routing prefix <{{ routing4_prefix }}>
+  when: metal_lb_bgp_peer_address is defined
+
+# metal_lb_ip_range
+- name: >
+    Assert that metal_lb_ip_range (when string) contains <ipv4>-<ipv4>
+    and both ips start with routing4_prefix, skip any containing ':' (ipv6)
+  assert:
+    that:
+      - metal_lb_ip_range | regex_search('^{{ routing4_prefix }}\.[0-9]{1,3}-{{ routing4_prefix }}\.[0-9]{1,3}$|.*:.*')
+    fail_msg: >
+      metal_lb_ip_range <{{ metal_lb_ip_range }}> has one or more ipv4s
+      that don't start with the routing prefix <{{ routing4_prefix }}>
+  when: metal_lb_ip_range is string
+
+- name: Assert that metal_lb_ip_ranges (when list) has only strings that match the regexes in the task above
+  assert:
+    that:
+      - >
+        ( metal_lb_ip_range
+        | select('match', '^{{ routing4_prefix }}\.[0-9]{1,3}-{{ routing4_prefix }}\.[0-9]{1,3}$|.*:.*')
+        | list | length
+        )
+        ==
+        (metal_lb_ip_range
+        | length
+        )
+    fail_msg: >
+      metal_lb_ip_range <{{ metal_lb_ip_range }}> has one or more values with ipv4s
+      that don't start with the routing prefix <{{ routing4_prefix }}>
+  when: metal_lb_ip_range is not string and metal_lb_ip_range is not mapping and metal_lb_ip_range is iterable
+
+# apiserver_endpoint
+- name: Assert that apiserver_endpoint is not in metal_lb_ip_range (when string) using network_in_usable
+  # For /<mask> ranges
+  assert:
+    that:
+      - not ( metal_lb_ip_range | ansible.utils.network_in_usable( apiserver_endpoint ))
+    fail_msg: "apiserver_endpoint {{ apiserver_endpoint }} cannot be in the metal_lb_ip_range {{ metal_lb_ip_range }}"
+    success_msg: >
+      apiserver_endpoint {{ apiserver_endpoint }} is *probably* not in the metal_lb_ip_range {{ metal_lb_ip_range }}
+  when: metal_lb_ip_range is string
+
+- name: >
+    Assert that apiserver_endpoint is not in metal_lb_ip_range (when string)
+    using custom filter netaddr_ip_in_dash_range
+  # For <ip>-<ip> ranges. Not sure this works for ipv6
+  assert:
+    that:
+      - not (apiserver_endpoint | netaddr_ip_in_dash_range(metal_lb_ip_range))
+    fail_msg: "apiserver_endpoint {{ apiserver_endpoint }} cannot be in the metal_lb_ip_range {{ metal_lb_ip_range }}"
+    success_msg: >
+      apiserver_endpoint {{ apiserver_endpoint }} is *probably* not in the metal_lb_ip_range {{ metal_lb_ip_range }}
+  when: metal_lb_ip_range is string
+  # *probably* in the success_msg sections of the prior two tasks because not all cases may work
+
+- name: Assert that apiserver_endpoint is not in metal_lb_ip_ranges (when list) using logic of the task above
+  assert:
+    that:
+      - not (apiserver_endpoint | netaddr_ip_in_dash_range(item))
+    # this probably fails on an ipv6 range ''::1-::2', and on <ipv4or6>/<mask> ranges
+    fail_msg: "apiserver_endpoint {{ apiserver_endpoint }} cannot be in the metal_lb_ip_range item {{ item }}"
+    success_msg: >
+      apiserver_endpoint {{ apiserver_endpoint }} is *probably* not in the metal_lb_ip_range item {{ item }}
+  loop: "{{ metal_lb_ip_range | list }}"
+  when: metal_lb_ip_range is not string   and metal_lb_ip_range is not mapping   and metal_lb_ip_range is iterable
+  # these (when string, when list tasks) smell funny.
+  # It seems there should be a way in one task to handle an object that is a string or a list
+  #    and loop on {{ [metal_lb_ip_range] }}  or {{ metal_lb_ip_range }} respectively
+  # when it is a string it skips each char :(
+  # I tried the select pattern like in the task
+  #    'assert that metal_lb_ip_ranges (when list) has only strings that match the regexes in the task above'
+  #  but it didn't work
+
+- name: Assert that apiserver_endpoint, is ipv4 and starts with routing4_prefix, or is ipv6 and is in routing6_cidr
+  assert:
+    that:
+      - apiserver_endpoint is defined
+      - apiserver_endpoint is not none
+      - >-
+        ( apiserver_endpoint | ansible.utils.ipv4 and apiserver_endpoint.startswith(routing4_prefix) )
+        or
+        ( apiserver_endpoint | ansible.utils.ipv6 and apiserver_endpoint | ansible.utils.ipaddr(routing6_cidr))
+    fail_msg: >
+      The fact 'apiserver_endpoint' <{{ apiserver_endpoint }}>
+      doesn't start with the routing prefix <{{ routing4_prefix }}>
+      or is not in the routing6_cidr <{{ routing6_cidr }}>

site.yml

@@ -1,4 +1,7 @@
 ---
+- name: Import verify_config playbook
+  ansible.builtin.import_playbook: verify_config.yml
+
 - name: Prepare Proxmox cluster
   hosts: proxmox
   gather_facts: true
@@ -46,14 +49,3 @@
   roles:
     - role: k3s_server_post
       become: true
-
-- name: Storing kubeconfig in the playbook directory
-  hosts: master
-  environment: "{{ proxy_env | default({}) }}"
-  tasks:
-    - name: Copying kubeconfig from {{ hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname'] }}
-      ansible.builtin.fetch:
-        src: "{{ ansible_user_dir }}/.kube/config"
-        dest: ./kubeconfig
-        flat: true
-      when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']

verify_config.yml

@@ -0,0 +1,14 @@
+---
+- name: Gather config for verify
+  hosts: all
+  gather_facts: true
+  roles:
+    - role: verify_config_gather
+      when: verify_config is not defined or verify_config
+
+- name: Verify config
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - role: verify_config
+      when: verify_config is not defined or verify_config