ansible-builder builds fail with "No package matches 'openshift-clients'"
on UBI images because the openshift-clients RPM in bindep.txt requires
repos not available in standard UBI. This adds collection-level EE
metadata pointing to a minimal bindep file without openshift-clients,
while preserving the original bindep.txt for direct bindep usage.
Fixes#1141
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(ci): add security check to block .claude/ and .vscode/ directories
Add workflow that calls the security_check_directories action from
cloud-content-ci-automation to fail PRs containing files under .claude/
or .vscode/ directories.
Integrates with all_green_check.yaml as a required job for PRs.
Ref: ACA-6411
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(ci): suppress SonarCloud S7637 for reusable actions using @main
Internal reusable actions from ansible-network/github_actions and
ansible-collections/cloud-content-ci-automation use @main refs for
simpler maintenance. Suppress the 'use full commit SHA' rule for
workflow files.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(ci): use correct org and pin action to commit SHA
Address review feedback:
- Change org from ansible-collections to ansible
- Pin to commit SHA 74b5fe87 instead of @main
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* docs: add changelog fragment for security check workflow
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Update changelogs/fragments/1173-security-check-workflow.yml
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Bianca Henderson <beeankha@gmail.com>
* helm: use --rollback-on-failure for atomic on Helm v4
Helm v4 renamed the `--atomic` flag to `--rollback-on-failure`. The old
flag is deprecated on `helm upgrade` and removed entirely from `helm
install`, so `atomic: true` failed against Helm v4 (issue #1143).
Emit the version-appropriate flag from deploy() using the existing
is_helm_v4() helper, covering both the upgrade and the replace/install
code paths. The public `atomic` option is unchanged.
Fixes: https://github.com/ansible-collections/kubernetes.core/issues/1143
Co-Authored-By: Claude Opus 4.8
* fix wrong link in the changelog fragment
Signed-off-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
---------
Signed-off-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
* fix(helm): support Helm v4 force/server-side apply flags
Helm v4 deprecated --force and enables server-side apply by default, so
playbooks relying on force=true broke with "Flag --force has been
deprecated" and "cannot use server-side apply and force replace together".
Because force always meant a client-side delete/recreate replacement, the
module now reproduces that behaviour on v4 (--server-side=false
--force-replace) so existing playbooks keep working unchanged across both
Helm versions.
To let users opt into Helm v4's server-side world explicitly, add
server_side and force_conflicts options. These are mutually exclusive with
force (a client-side replacement cannot coexist with a server-side mode),
keeping the surface unambiguous and surfacing bad combinations up front
instead of as cryptic Helm errors.
AI-assisted commit with Claude Opus
* fix(linter) reformat tests/unit/modules/test_module_helm.py with black
* CI - configure precommit hook to block commit when files from .claude/ and/or .vscode/ directories are staged
* fix sanity issue - shebang
* Remove local hook and update documentation
Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (for
example chart_ref) into fully mocked helm commands, so no file is ever
created and there is no real exposure. SonarCloud's python:S5443 still
raises a security hotspot on each literal and, because it only scores new
code, drops a PR's security rating even though the same pattern already
pervades the existing test suite.
Scope the suppression to tests/** only. Production code creates temporary
files via tempfile.mkstemp / NamedTemporaryFile and remains covered by the
rule, where it carries real value.
AI-assisted commit with Claude Opus
* helm: document/test stdout for registry success messages (Helm 4.2.1)
Helm < 4.2.1 prints registry success messages (Login Succeeded, Pushed,
Pulled, Digest) to stderr (helm/helm#13464); Helm >= 4.2.1 moves them to
stdout (helm/helm#32056). The modules key on the return code, so logic is
unaffected, but the RETURN docs and integration assertions assumed stderr.
- helm_registry_auth: note the version-dependent output stream in
the RETURN documentation.
- helm_registry_auth integration tests: assert success messages against the
stdout+stderr union so they pass on both old and new Helm.
Fixes: #1146
Co-Authored-By: Claude Opus 4.8
* ci: empty commit to re-trigger ci
Ansible module argument_spec is conventionally defined with the dict(...)
constructor rather than {...} literals, for readability and consistency
across the collection. SonarCloud's python:S7498 ("Literal syntax should
be preferred...") flags this as a false positive and re-fires on every
new module argument. Ignore the rule project-wide via sonar-project.properties.
Fixes#1151
The docs/ansible_turbo_mode.rst file was accidentally removed in PR#988,
breaking the link referenced in README.md. Restore it so users following
that link get the full Turbo mode documentation rather than a 404.
Additionally, document the ansible-core version compatibility issue for
cloud.common (see ansible-collections/cloud.common@5e3430d and
kubernetes.core PR #1109): Turbo mode is incompatible with ansible-core
>= 2.19 because cloud.common no longer supports it. Without this
clarification users on newer ansible-core versions encounter silent or
confusing failures when ENABLE_TURBO_MODE=1 is set.
Update README.md with the same warning so the incompatibility is visible
before users follow the link to the full docs.
Addresses: #927
* Update pod deletion conditions for local storage used in a daemon set pod
Refactor pod deletion logic to handle local storage in daemon set pods correctly.
* Add bugfix for k8s_drain handling local storage pods
Fix logic for handling pods with local storage in k8s_drain.
* Refactor filter_pods function for clarity and efficiency
* Fix sanity and linter errors
---------
Co-authored-by: Bianca Henderson <bianca@redhat.com>
Helm normalizes repository URLs internally, so a URL supplied with a
trailing slash and the same URL without one are treated as different
entries. This causes the module to fail every run when the user
provides a trailing slash, even though the repository is already
correctly registered.
Strip the trailing slash from repo_url before comparing against the
existing repository list so repeated runs with the same input are
idempotent.
Fixes#480
The cloud.common collection is incompatible with ansible-core >= 2.19.0.
With the current testing matrix using Python 3.12 and the ansible
milestone (currently 2.22), this incompatibility causes integration
tests to fail.
Instead of completely removing turbo mode from the testing matrix, this
commit adds ansible-core 2.18 to the matrix and excludes the combination
of the ansible milestone and turbo mode. The checkout and installation
of the cloud.common collection are now conditionally executed only when
turbo mode is enabled.
SUMMARY
Name of the Helm plays in the integration test framework test updated to reflect the actual version of Helm (addressed comments #1090 (review))
Updated documentation for the modules updated in the PR with the https://github.com/ansible-network/collection_prep, as per CONTRIBUTING.md
ISSUE TYPE
Docs Pull Request
COMPONENT NAME
tests/integration/targets/helm_v3_*/play.yaml
docs/kubernetes.core.helm*.rst
ADDITIONAL INFORMATION
Only cosmetic changes in this PR, so the label skip-changelog is suggested
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
The `devel` and `milestone` branches for ansible-core have been bumped to
`2.22.0.dev0` as the `stable-2.21` branch was created. Testing against `devel`
and `milestone` now uses 2.22, which requires creation of the
`tests/sanity/ignore-2.22.txt` file in all maintained collection branches.
# Please enter the commit message for your changes. Lines starting
# with '#' will be ignored, and an empty message aborts the commit.
#
# On branch ignore-2.22
# Changes to be committed:
# new file: tests/sanity/ignore-2.22.txt
#
SUMMARY
Added a CI file to outline the testing strategy in more detail
ISSUE TYPE
Docs Pull Request
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
Reviewed-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Reviewed-by: Matthew Johnson
SUMMARY
Closes#1037
added support for check_mode
Converted warnings into informational display when user has explicitly requested to delete daemontset-managed pods, unmanaged pods or pods with local storage
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
k8s_drain
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
SUMMARY
The error message emitted for incorrect helm version has changed since the merge of #1039. This PR updates the related assertion in the helm_pull integration test
Reviewed-by: Chyna Sanders
Reviewed-by: Mike Graves <mgraves@redhat.com>
SUMMARY
This PR implements idempotency for the helm_pull module, addressing issue #889.
New force parameter with defaults to False.
implemented chart_exists() function
checks chart existence before downloading, returns changed=False when chart exists
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
helm_pull
ADDITIONAL INFORMATION
Force parameter added for backward compatibility and edge cases.
Implemented with the partial support of GitHub Copilot with Claude Sonnet 4.5 model
Reviewed-by: Bikouo Aubin
Reviewed-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
Reviewed-by: Alina Buzachis
SUMMARY
Using exit_json or fail_json for warnings is deprecated in ansible-core>=2.19.0 and will be removed in ansible-core>=2.23.0
Tested with ansible-core 2.19.3 as the latest released version at the time of the start of this PR and with 2.16.0 as the lowest version supported by kubernetes.core 6.x
Resolves: #1031
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
k8s_drain
k8s_rollback
k8s_scale
ADDITIONAL INFORMATION
The initial version of this PR covers only the module k8s_drain, with the following commits extended to k8s_rollback
k8s_scale
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
Reviewed-by: Mike Graves <mgraves@redhat.com>
Reviewed-by: Alina Buzachis
SUMMARY
Helm v4 is a major version with backward-incompatible changes, including to the flags and output of the Helm CLI and to the SDK. This version is currently not supported in the kubernetes.core. This PR is related to #1038 and is a short-term solution to mark compatibility explicitly
ISSUE TYPE
Bugfix Pull Request
Docs Pull Request
COMPONENT NAME
helm
helm_template
helm_info
helm_repository
helm_pull
helm_registry_auth
helm_plugin
helm_plugin_info
ADDITIONAL INFORMATION
Added `validate_helm_version()`` method to AnsibleHelmModule that enforces version constraint >=3.0.0,<4.0.0.
Fails fast with clear error message: "Helm version must be >=3.0.0,<4.0.0, current version is {version}"
Some modules (i.e. helm_registry_auth) technically is compatible with Helm v4, but validation was added to all helm modules.
Partially coauthored by GitHub Copilot with Claude Sonnet 4 model.
Addresses issue #1038
Reviewed-by: GomathiselviS <gomathiselvi@gmail.com>
Reviewed-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Reviewed-by: Mike Graves <mgraves@redhat.com>
Reviewed-by: Alina Buzachis
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
SUMMARY
Importing from ansible.module_utils._text is deprecated in ansible-core 2.20 and removed in 2.24. All imports of to_bytes, to_native, and to_text now use ansible.module_utils.common.text.converters.
Before:
from ansible.module_utils._text import to_bytes, to_native, to_text
After:
from ansible.module_utils.common.text.converters import to_bytes, to_native, to_text
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
plugins/module_utils/common.py
plugins/action/k8s_info.py
plugins/connection/kubectl.py
plugins/module_utils/{copy.py, k8s/runner.py}
plugins/modules/{k8s_cp.py, k8s_drain.py, k8s_exec.py, k8s_json_patch.py, k8s_scale.py, k8s_taint.py}
ADDITIONAL INFORMATION
It's not an actual Bugfix, more a lifecycle management to ensure compatibility with future Ansible versions.
Tested with ansible-core 2.20 to ensure no deprecation warnings are raised and with ansible-core 2.16 to ensure backward compatibility.
Patrially coauthored-by: GitHub Copilot with Claude Code 4.5 model.
Addresses issue #1052.
Reviewed-by: Bikouo Aubin
Reviewed-by: Alina Buzachis
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
SUMMARY
Fixed a bug where setting K8S_AUTH_VERIFY_SSL=true (or any string value) caused the value to be treated as a separate kubectl command argument instead of being properly converted to a boolean.
The option key name is validate_certs, which does NOT end with "verify_ssl", so the original condition key.endswith("verify_ssl") at line 327 failed. This caused the code to fall through to the else block which added the value as separate
arguments: ["--insecure-skip-tls-verify", "true"], making "true" appear as a kubectl command.
Fixes#1021
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
kubernetes.core.kubectl
ADDITIONAL INFORMATION
Changes Made
Changed condition from key.endswith("verify_ssl") to key == "validate_certs"
Added import of boolean function from ansible.module_utils.parsing.convert_bool
Added proper boolean conversion using boolean(self.get_option(key), strict=False)
Partially used LLM (GitHub Copilot with Claude Sonnet 4).
Before Fix
K8S_AUTH_VERIFY_SSL=true
Command: ['/usr/bin/kubectl', '--insecure-skip-tls-verify', 'true', 'exec', ...]
^^^^^ treated as kubectl command (BUG!)
After Fix
K8S_AUTH_VERIFY_SSL=true
Command: ['/usr/bin/kubectl', '--insecure-skip-tls-verify=false', 'exec', ...]
^^^^^ properly converted (FIXED!)
Reviewed-by: Bikouo Aubin
Reviewed-by: Alina Buzachis
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
SUMMARY
This trivial documentation-only pull request correcting a few errors in README.md.
Documentation corrections:
Fixed a broken Markdown link for the GitHub repository in the support request section.
Corrected the reference from LICENCE to LICENSE to match the actual file name.
ISSUE TYPE
Docs Pull Request
COMPONENT NAME
README.md
ADDITIONAL INFORMATION
Trivial documentation-only change, no changelog is required.
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
Reviewed-by: Alina Buzachis
SUMMARY
helm/helm_info - Deprecate some parameters and add new ones to resolve sanity issues.
k8s - the return block doc is not aligned with what the module returns
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
helm, helm_info, k8s
Fixes: #1046
Reviewed-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
SUMMARY
Add all k8s_* modules to the action group in order to esaily set kubeconfig parameter
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
meta
ADDITIONAL INFORMATION
Reviewed-by: Bikouo Aubin
Reviewed-by: Bianca Henderson <beeankha@gmail.com>
