* Prepare k8s collection release 6.5.0
* update release date for the version 6.5.0
* Update changelog.yaml and changelog.rst mismatch
---------
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
ansible-builder builds fail with "No package matches 'openshift-clients'"
on UBI images because the openshift-clients RPM in bindep.txt requires
repos not available in standard UBI. This adds collection-level EE
metadata pointing to a minimal bindep file without openshift-clients,
while preserving the original bindep.txt for direct bindep usage.
Fixes#1141
(cherry picked from commit a80e2d067c)
Co-authored-by: Christopher Brown <snecklifter@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(ci): add security check to block .claude/ and .vscode/ directories
Add workflow that calls the security_check_directories action from
cloud-content-ci-automation to fail PRs containing files under .claude/
or .vscode/ directories.
Integrates with all_green_check.yaml as a required job for PRs.
Ref: ACA-6411
* fix(ci): suppress SonarCloud S7637 for reusable actions using @main
Internal reusable actions from ansible-network/github_actions and
ansible-collections/cloud-content-ci-automation use @main refs for
simpler maintenance. Suppress the 'use full commit SHA' rule for
workflow files.
* fix(ci): use correct org and pin action to commit SHA
Address review feedback:
- Change org from ansible-collections to ansible
- Pin to commit SHA 74b5fe87 instead of @main
* docs: add changelog fragment for security check workflow
* Update changelogs/fragments/1173-security-check-workflow.yml
---------
(cherry picked from commit 6bb9cce51b)
Co-authored-by: GomathiselviS <gomathiselvi@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Bianca Henderson <beeankha@gmail.com>
* feat: add plugin --keyring option
* docs: add changelog fragment
* Update changelogs/fragments/20260620-add-plugin-keyring-option.yaml
* feat: restrict helm_plugin keyring to install subcommand (#1)
Restrict the keyring option to state=present (helm plugin install),
the only implemented subcommand that supports --keyring, and fail
explicitly when it is used with other states.
* refactor(helm_plugin): warn instead of fail
* Resolve linter error
* Update plugins/modules/helm_plugin.py
---------
(cherry picked from commit 4b3e24bf02)
Co-authored-by: Kenji Gaillac <48765390+Nhqml@users.noreply.github.com>
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Co-authored-by: Bianca Henderson <bianca@redhat.com>
Co-authored-by: Bianca Henderson <beeankha@gmail.com>
* helm: use --rollback-on-failure for atomic on Helm v4
Helm v4 renamed the `--atomic` flag to `--rollback-on-failure`. The old
flag is deprecated on `helm upgrade` and removed entirely from `helm
install`, so `atomic: true` failed against Helm v4 (issue #1143).
Emit the version-appropriate flag from deploy() using the existing
is_helm_v4() helper, covering both the upgrade and the replace/install
code paths. The public `atomic` option is unchanged.
Fixes: https://github.com/ansible-collections/kubernetes.core/issues/1143
Co-Authored-By: Claude Opus 4.8
* fix wrong link in the changelog fragment
---------
(cherry picked from commit bc17b33d44)
Signed-off-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
* fix(helm): support Helm v4 force/server-side apply flags
Helm v4 deprecated --force and enables server-side apply by default, so
playbooks relying on force=true broke with "Flag --force has been
deprecated" and "cannot use server-side apply and force replace together".
Because force always meant a client-side delete/recreate replacement, the
module now reproduces that behaviour on v4 (--server-side=false
--force-replace) so existing playbooks keep working unchanged across both
Helm versions.
To let users opt into Helm v4's server-side world explicitly, add
server_side and force_conflicts options. These are mutually exclusive with
force (a client-side replacement cannot coexist with a server-side mode),
keeping the surface unambiguous and surfacing bad combinations up front
instead of as cryptic Helm errors.
AI-assisted commit with Claude Opus
* fix(linter) reformat tests/unit/modules/test_module_helm.py with black
(cherry picked from commit 3634105366)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
* Fix CI Test Collision (#1162)
* Fix CI concurrency issue
* More CI fixes
* Fix coverage job install
* Install correct test dependencies
(cherry picked from commit d211f316ad)
* Restore cancel-in-progress: true
Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (for
example chart_ref) into fully mocked helm commands, so no file is ever
created and there is no real exposure. SonarCloud's python:S5443 still
raises a security hotspot on each literal and, because it only scores new
code, drops a PR's security rating even though the same pattern already
pervades the existing test suite.
Scope the suppression to tests/** only. Production code creates temporary
files via tempfile.mkstemp / NamedTemporaryFile and remains covered by the
rule, where it carries real value.
AI-assisted commit with Claude Opus
(cherry picked from commit 0836e96c2d)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
* CI - configure precommit hook to block commit when files from .claude/ and/or .vscode/ directories are staged
* fix sanity issue - shebang
* Remove local hook and update documentation
(cherry picked from commit a4fc40732a)
Co-authored-by: Bikouo Aubin <79859644+abikouo@users.noreply.github.com>
* helm: document/test stdout for registry success messages (Helm 4.2.1)
Helm < 4.2.1 prints registry success messages (Login Succeeded, Pushed,
Pulled, Digest) to stderr (helm/helm#13464); Helm >= 4.2.1 moves them to
stdout (helm/helm#32056). The modules key on the return code, so logic is
unaffected, but the RETURN docs and integration assertions assumed stderr.
- helm_registry_auth: note the version-dependent output stream in
the RETURN documentation.
- helm_registry_auth integration tests: assert success messages against the
stdout+stderr union so they pass on both old and new Helm.
Fixes: #1146
Co-Authored-By: Claude Opus 4.8
* ci: empty commit to re-trigger ci
(cherry picked from commit ae90b60fd6)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Ansible module argument_spec is conventionally defined with the dict(...)
constructor rather than {...} literals, for readability and consistency
across the collection. SonarCloud's python:S7498 ("Literal syntax should
be preferred...") flags this as a false positive and re-fires on every
new module argument. Ignore the rule project-wide via sonar-project.properties.
Fixes#1151
(cherry picked from commit 1c20b53bdc)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
* Manual backport of SonarQube configuration to stable-6 branch
* Add CI.md and align README with collection standards (#1124)
Include CI.md from #1124 and update README.md to match the Red Hat
Ansible Certified Collection layout from main, with stable-6 branch
references for repository links.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Revert changes to some README links
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
The docs/ansible_turbo_mode.rst file was accidentally removed in PR#988,
breaking the link referenced in README.md. Restore it so users following
that link get the full Turbo mode documentation rather than a 404.
Additionally, document the ansible-core version compatibility issue for
cloud.common (see ansible-collections/cloud.common@5e3430d and
kubernetes.core PR #1109): Turbo mode is incompatible with ansible-core
>= 2.19 because cloud.common no longer supports it. Without this
clarification users on newer ansible-core versions encounter silent or
confusing failures when ENABLE_TURBO_MODE=1 is set.
Update README.md with the same warning so the incompatibility is visible
before users follow the link to the full docs.
Addresses: #927
(cherry picked from commit 248e0d7db9)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kiev.ua>
* Update pod deletion conditions for local storage used in a daemon set pod
Refactor pod deletion logic to handle local storage in daemon set pods correctly.
* Add bugfix for k8s_drain handling local storage pods
Fix logic for handling pods with local storage in k8s_drain.
* Refactor filter_pods function for clarity and efficiency
* Fix sanity and linter errors
---------
(cherry picked from commit b58b2ca70e)
Co-authored-by: Juan Morete <morete@gmail.com>
Co-authored-by: Bianca Henderson <bianca@redhat.com>
Helm normalizes repository URLs internally, so a URL supplied with a
trailing slash and the same URL without one are treated as different
entries. This causes the module to fail every run when the user
provides a trailing slash, even though the repository is already
correctly registered.
Strip the trailing slash from repo_url before comparing against the
existing repository list so repeated runs with the same input are
idempotent.
Fixes#480
(cherry picked from commit 8a58d3b6de)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kiev.ua>
The cloud.common collection is incompatible with ansible-core >= 2.19.0.
With the current testing matrix using Python 3.12 and the ansible
milestone (currently 2.22), this incompatibility causes integration
tests to fail.
Instead of completely removing turbo mode from the testing matrix, this
commit adds ansible-core 2.18 to the matrix and excludes the combination
of the ansible milestone and turbo mode. The checkout and installation
of the cloud.common collection are now conditionally executed only when
turbo mode is enabled.
(cherry picked from commit 11f619b69e)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kiev.ua>
SUMMARY
Name of the Helm plays in the integration test framework test updated to reflect the actual version of Helm (addressed comments #1090 (review))
Updated documentation for the modules updated in the PR with the https://github.com/ansible-network/collection_prep, as per CONTRIBUTING.md
ISSUE TYPE
Docs Pull Request
COMPONENT NAME
tests/integration/targets/helm_v3_*/play.yaml
docs/kubernetes.core.helm*.rst
ADDITIONAL INFORMATION
Only cosmetic changes in this PR, so the label skip-changelog is suggested
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
(cherry picked from commit 16e92a20e8)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
The `devel` and `milestone` branches for ansible-core have been bumped to
`2.22.0.dev0` as the `stable-2.21` branch was created. Testing against `devel`
and `milestone` now uses 2.22, which requires creation of the
`tests/sanity/ignore-2.22.txt` file in all maintained collection branches.
# Please enter the commit message for your changes. Lines starting
# with '#' will be ignored, and an empty message aborts the commit.
#
# On branch ignore-2.22
# Changes to be committed:
# new file: tests/sanity/ignore-2.22.txt
#
(cherry picked from commit 58f8f2e6e9)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kiev.ua>
This is a backport of PR #1090 as merged into main (e6076e5).
SUMMARY
Ensure compatibility with Helm v4 for modules helm_plugin and helm_plugin_info
Partially addresses #1038
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
helm_plugin
helm_plugin_info
helm_info
helm_pull
helm_registry_auth
helm
helm_template
Reviewed-by: Bikouo Aubin
Reviewed-by: Matthew Johnson
This is a backport of PR #1034 as merged into main (42acb4f).
SUMMARY
Adds support for the take_ownership for initial release installation operations.
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
plugins/modules/helm.py
ADDITIONAL INFORMATION
I recently had to migrate a namespace k8s from flat manifest installation into helm a release.
I was so glad to see the take_ownership feature but realized that it work only after first installation of the release.
Seeing no reason to denied this use case i suggest this very simple changes.
To reproduce it:
Create a new namespace in any cluster.
Create a secret
Install any helm chart that deploy the same secret using take_ownership: true.
This is a backport of PR #1086 as merged into main (d239adb).
SUMMARY
Closes#1037
added support for check_mode
Converted warnings into informational display when user has explicitly requested to delete daemontset-managed pods, unmanaged pods or pods with local storage
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
k8s_drain
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1055 as merged into main (34beacf).
SUMMARY
This PR implements idempotency for the helm_pull module, addressing issue #889.
New force parameter with defaults to False.
implemented chart_exists() function
checks chart existence before downloading, returns changed=False when chart exists
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
helm_pull
ADDITIONAL INFORMATION
Force parameter added for backward compatibility and edge cases.
Implemented with the partial support of GitHub Copilot with Claude Sonnet 4.5 model
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1077 as merged into main (23b6cec).
SUMMARY
The error message emitted for incorrect helm version has changed since the merge of #1039. This PR updates the related assertion in the helm_pull integration test
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1062 as merged into main (987c029).
SUMMARY
Currently, the patchback bot creates PRs with cherry-picks of PRs that are labeled with stable-* label, and this PR (as any new PR) gets labeled as needs_triage. This is unnecessary as it intentional PR created by the CI job.
This pull request introduces a small update to ensure that the workflow only runs if the pull request is not created by the patchback[bot] user to avoid unnecessary labels.
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
.github/workflows/label-new-prs.yaml
ADDITIONAL INFORMATION
No changelog is required
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1033 as merged into main (3e32c12).
SUMMARY
Using exit_json or fail_json for warnings is deprecated in ansible-core>=2.19.0 and will be removed in ansible-core>=2.23.0
Tested with ansible-core 2.19.3 as the latest released version at the time of the start of this PR and with 2.16.0 as the lowest version supported by kubernetes.core 6.x
Resolves: #1031
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
k8s_drain
k8s_rollback
k8s_scale
ADDITIONAL INFORMATION
The initial version of this PR covers only the module k8s_drain, with the following commits extended to k8s_rollback
k8s_scale
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
Reviewed-by: Mike Graves <mgraves@redhat.com>
This is a backport of PR #1039 as merged into main (13791ec).
SUMMARY
Helm v4 is a major version with backward-incompatible changes, including to the flags and output of the Helm CLI and to the SDK. This version is currently not supported in the kubernetes.core. This PR is related to #1038 and is a short-term solution to mark compatibility explicitly
ISSUE TYPE
Bugfix Pull Request
Docs Pull Request
COMPONENT NAME
helm
helm_template
helm_info
helm_repository
helm_pull
helm_registry_auth
helm_plugin
helm_plugin_info
ADDITIONAL INFORMATION
Added `validate_helm_version()`` method to AnsibleHelmModule that enforces version constraint >=3.0.0,<4.0.0.
Fails fast with clear error message: "Helm version must be >=3.0.0,<4.0.0, current version is {version}"
Some modules (i.e. helm_registry_auth) technically is compatible with Helm v4, but validation was added to all helm modules.
Partially coauthored by GitHub Copilot with Claude Sonnet 4 model.
Addresses issue #1038
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
Reviewed-by: Mike Graves <mgraves@redhat.com>
This is a backport of PR #1053 as merged into main (452fb3d).
SUMMARY
Importing from ansible.module_utils._text is deprecated in ansible-core 2.20 and removed in 2.24. All imports of to_bytes, to_native, and to_text now use ansible.module_utils.common.text.converters.
Before:
from ansible.module_utils._text import to_bytes, to_native, to_text
After:
from ansible.module_utils.common.text.converters import to_bytes, to_native, to_text
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
plugins/module_utils/common.py
plugins/action/k8s_info.py
plugins/connection/kubectl.py
plugins/module_utils/{copy.py, k8s/runner.py}
plugins/modules/{k8s_cp.py, k8s_drain.py, k8s_exec.py, k8s_json_patch.py, k8s_scale.py, k8s_taint.py}
ADDITIONAL INFORMATION
It's not an actual Bugfix, more a lifecycle management to ensure compatibility with future Ansible versions.
Tested with ansible-core 2.20 to ensure no deprecation warnings are raised and with ansible-core 2.16 to ensure backward compatibility.
Patrially coauthored-by: GitHub Copilot with Claude Code 4.5 model.
Addresses issue #1052.
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1049 as merged into main (12abc9b).
SUMMARY
Fixed a bug where setting K8S_AUTH_VERIFY_SSL=true (or any string value) caused the value to be treated as a separate kubectl command argument instead of being properly converted to a boolean.
The option key name is validate_certs, which does NOT end with "verify_ssl", so the original condition key.endswith("verify_ssl") at line 327 failed. This caused the code to fall through to the else block which added the value as separate
arguments: ["--insecure-skip-tls-verify", "true"], making "true" appear as a kubectl command.
Fixes#1021
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
kubernetes.core.kubectl
ADDITIONAL INFORMATION
Changes Made
Changed condition from key.endswith("verify_ssl") to key == "validate_certs"
Added import of boolean function from ansible.module_utils.parsing.convert_bool
Added proper boolean conversion using boolean(self.get_option(key), strict=False)
Partially used LLM (GitHub Copilot with Claude Sonnet 4).
Before Fix
K8S_AUTH_VERIFY_SSL=true
Command: ['/usr/bin/kubectl', '--insecure-skip-tls-verify', 'true', 'exec', ...]
^^^^^ treated as kubectl command (BUG!)
After Fix
K8S_AUTH_VERIFY_SSL=true
Command: ['/usr/bin/kubectl', '--insecure-skip-tls-verify=false', 'exec', ...]
^^^^^ properly converted (FIXED!)
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1059 as merged into main (6c00f7c).
SUMMARY
This trivial documentation-only pull request correcting a few errors in README.md.
Documentation corrections:
Fixed a broken Markdown link for the GitHub repository in the support request section.
Corrected the reference from LICENCE to LICENSE to match the actual file name.
ISSUE TYPE
Docs Pull Request
COMPONENT NAME
README.md
ADDITIONAL INFORMATION
Trivial documentation-only change, no changelog is required.
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1056 as merged into main (bd1cacc).
SUMMARY
helm/helm_info - Deprecate some parameters and add new ones to resolve sanity issues.
k8s - the return block doc is not aligned with what the module returns
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
helm, helm_info, k8s
Fixes: #1046
Reviewed-by: Bikouo Aubin
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1045 as merged into main (9cfa903).
SUMMARY
This pr adds a new workflow for labeling new and reopened prs that are not marked as draft. The needs_triage label will be removed if the pr is marked as draft during development and re-added once the pr is marked as ready for review.
After consulting with the team, we decided to label prs in a new workflow to allow for the prs and issues to have different labels in the future.
ACA-2362
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
github workflow
Reported CI Issues
Sanity tests: #1046
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #992 as merged into main (798f549).
SUMMARY
Add all k8s_* modules to the action group in order to esaily set kubeconfig parameter
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
meta
ADDITIONAL INFORMATION
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #1018 as merged into main (ae624cf).
SUMMARY
Added documentation for no_proxy, proxy, and proxy_headers parameters that were missing from the k8s lookup plugin. These parameters are already implemented in the codebase but were not documented.
no_proxy: Comma separated list of hosts that shouldn't use proxy
proxy: HTTP proxy URL for connections
proxy_headers: Dictionary of proxy headers with suboptions for proxy_basic_auth, basic_auth, and user_agent
Fixes#775
ISSUE TYPE
Docs Pull Request
COMPONENT NAME
k8s lookup
Additional comment
This is a reissue of #993, which was lost during the latest release due to me PR incorrectly from my fork's main branch. Linter errors on the previous PR should already be resolved.
This had the backport-5, backport-6 and skip-changelog labels.
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
This is a backport of PR #786 as merged into main (87344b9).
SUMMARY
kustomize doesn't support an environment that makes it impossible to use HTTP_PROXY or provide some templatized parameters.
This PR is the result of the issue #783
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
kubernetes.core.kustomize lookup plugin
Reviewed-by: Bikouo Aubin
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
