Repository navigation
Master node IP check runs on variants without Kube-OVN #80
Description
The role checks the kube-ovn master node IPs on every platform variant, including ones that don't run Kube-OVN.
roles/cozystack/tasks/main.yml includes compute-master-nodes.yml whenever cozystack_create_platform_package is set, with no condition on cozystack_platform_variant. That file asserts that every host key in the server group is an IP address, and fails with "not a valid IP address in MASTER_NODES". On isp-hosted the networking Package is noop and Kube-OVN is never installed, so an inventory keyed by hostnames fails the play for a value the chart never uses.
The slim variants from cozystack/cozystack#4595 have the same problem: isp-slim-generic and isp-hosted-slim don't install Kube-OVN either.
A fix is to skip the include, or at least the IP assert, on variants without Kube-OVN, with a case in tests/test-master-nodes.yml for a hostname-keyed inventory on such a variant.
Activity
lexfrei commentedon Sep 29, 2026
The value doesn't reach the chart on any variant, not only the Kube-OVN-less ones.
roles/cozystack/templates/platform-package.yml.j2putsMASTER_NODES(and the ciliumk8sServiceHost,k8sServicePort,cgroup.autoMount) underspec.components.networking. Thecozystack.cozystack-platformPackageSource has a single component,platform, and the operator looks overrides up by component name (internal/operator/package_reconciler.go:216in cozystack), so thenetworkingkey is dropped. The platform chart readsnetworking.kubeovn.MASTER_NODESfrom theplatformvalues, which the role never sets. So the IP assert guards a value that is always thrown away, and the fix is either to move it undercomponents.platform.values.networking.kubeovnor to drop it. Not checked yet: whether the cilium override was covering a generic install with an emptycozystack_root_host, wherepublishing.apiServerEndpointis not set.lexfrei commentedon Sep 29, 2026
One more effect of the same dead block: the README lists the Talos variants
isp-fullandisp-slim, but the role only builds k3s clusters. On those variants the platform chart points Cilium at KubePrism (k8sServiceHost: localhost,k8sServicePort: 7445), which k3s doesn't have, and the role's cilium override can't correct it because it never reaches the chart. So picking a Talos variant through this role leaves Cilium unable to reach the API server. Either the role should refuse Talos variants or the override has to move undercomponents.platform.lexfrei commentedon Sep 29, 2026
Same topic, docs side:
README.mdsays--disable=servicelbis replaced by MetalLB and describes the networking as Cilium + Kube-OVN. On the slim variants from cozystack/cozystack#4595 there is no MetalLB and no Kube-OVN; LoadBalancer Services need a Cilium LB IPAM pool and an L2 announcement policy that the admin creates, orcozystack_external_ips.