feat: update kube-vip ansible playbook for k0s and k3s - ipv6 config changes (#1234)

* feat: update kube-vip ansible playbook for k0s and k3s

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: update renovate

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: move ipv6 to advanced options

Signed-off-by: Devin Buhl <devin@buhl.casa>

* feat: kube-vip manifests to partials

Signed-off-by: Devin Buhl <devin@buhl.casa>

* feat: kube vip samesies

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: update config sample

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/templates/partials/cilium-values-full.partial.yaml.j2

@@ -8,9 +8,9 @@ cluster:
   id: 1
 containerRuntime:
   integration: containerd
-  #% if bootstrap_distribution == "k3s" %#
+  #% if bootstrap_distribution in ['k3s'] %#
   socketPath: /var/run/k3s/containerd/containerd.sock
-  #% elif bootstrap_distribution == "k0s" %#
+  #% elif bootstrap_distribution in ['k0s'] %#
   socketPath: /var/run/k0s/containerd.sock
   #% endif %#
 endpointRoutes:
@@ -59,25 +59,26 @@ hubble:
 ipam:
   mode: kubernetes
 ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-#% if bootstrap_ipv6_enabled %#
+#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
 ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
 ipv6:
   enabled: true
 #% endif %#
-#% if bootstrap_distribution == "k3s" %#
+#% if bootstrap_distribution in ['k3s'] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-#% elif bootstrap_distribution == "k0s"  %#
+#% elif bootstrap_distribution in ['k0s'] %#
 k8sServiceHost: localhost
 k8sServicePort: 7443
-#% elif bootstrap_distribution == "talos"  %#
+#% elif bootstrap_distribution in ['talos'] %#
 k8sServiceHost: localhost
 k8sServicePort: 7445
 #% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  #% if bootstrap_ipv6_enabled %#
+  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  # https://github.com/cilium/cilium/issues/28985
   enabled: false
   #% else %#
   enabled: true

bootstrap/templates/partials/cilium-values-init.partial.yaml.j2

@@ -8,9 +8,9 @@ cluster:
   id: 1
 containerRuntime:
   integration: containerd
-  #% if bootstrap_distribution == "k3s" %#
+  #% if bootstrap_distribution in ['k3s'] %#
   socketPath: /var/run/k3s/containerd/containerd.sock
-  #% elif bootstrap_distribution == "k0s" %#
+  #% elif bootstrap_distribution in ['k0s'] %#
   socketPath: /var/run/k0s/containerd.sock
   #% endif %#
 endpointRoutes:
@@ -20,25 +20,26 @@ hubble:
 ipam:
   mode: kubernetes
 ipv4NativeRoutingCIDR: "#{ bootstrap_cluster_cidr }#"
-#% if bootstrap_ipv6_enabled %#
+#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
 ipv6NativeRoutingCIDR: "#{ bootstrap_cluster_cidr_v6 }#"
 ipv6:
   enabled: true
 #% endif %#
-#% if bootstrap_distribution == "k3s" %#
+#% if bootstrap_distribution in ['k3s'] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-#% elif bootstrap_distribution == "k0s"  %#
+#% elif bootstrap_distribution in ['k0s'] %#
 k8sServiceHost: localhost
 k8sServicePort: 7443
-#% elif bootstrap_distribution == "talos"  %#
+#% elif bootstrap_distribution in ['talos'] %#
 k8sServiceHost: localhost
 k8sServicePort: 7445
 #% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  #% if bootstrap_ipv6_enabled %#
+  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  # https://github.com/cilium/cilium/issues/28985
   enabled: false
   #% else %#
   enabled: true

bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2

@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: kube-vip
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: kube-vip
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kube-vip
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kube-vip
+    spec:
+      containers:
+        - name: kube-vip
+          image: ghcr.io/kube-vip/kube-vip:v0.6.4
+          imagePullPolicy: IfNotPresent
+          args: ["manager"]
+          env:
+            - name: address
+              value: "#{ bootstrap_kube_api_addr }#"
+            - name: vip_arp
+              value: "true"
+            - name: lb_enable
+              value: "true"
+            - name: port
+              value: "6443"
+            - name: vip_cidr
+              value: "32"
+            - name: cp_enable
+              value: "true"
+            - name: cp_namespace
+              value: kube-system
+            - name: vip_ddns
+              value: "false"
+            - name: svc_enable
+              value: "false"
+            - name: vip_leaderelection
+              value: "true"
+            - name: vip_leaseduration
+              value: "15"
+            - name: vip_renewdeadline
+              value: "10"
+            - name: vip_retryperiod
+              value: "2"
+            - name: prometheus_server
+              value: :2112
+          securityContext:
+            capabilities:
+              add: ["NET_ADMIN", "NET_RAW", "SYS_TIME"]
+      hostAliases:
+        - hostnames:
+            - kubernetes
+          ip: 127.0.0.1
+      hostNetwork: true
+      serviceAccountName: kube-vip
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: Exists
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: Exists
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists

bootstrap/templates/partials/kube-vip-rbac.partial.yaml.j2

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kube-vip
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  name: system:kube-vip-role
+rules:
+  - apiGroups: [""]
+    resources: ["services/status"]
+    verbs: ["update"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["list","get","watch", "update"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["list","get","watch", "update", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["list", "get", "watch", "update", "create"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["list","get","watch", "update"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: system:kube-vip-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:kube-vip-role
+subjects:
+- kind: ServiceAccount
+  name: kube-vip
+  namespace: kube-system