SYS-687 final updates for Ubuntu 26.04

Author: instantlinux

ansible/roles/fileserver/defaults/main.yml

@@ -31,8 +31,11 @@ ubuntu_packages:
   - unison
   - vsftpd
 
-virtualbox_defaults:
+# Virtualization technology: QEMU (default) and/or VirtualBox
+qemu:
   enabled: true
+virtualbox_defaults:
+  enabled: false
   apt_repo:
     url: http://download.virtualbox.org/virtualbox/debian
     key_urls:

ansible/roles/fileserver/handlers/main.yml

@@ -4,6 +4,13 @@
     name: smbd
     state: restarted
 
+- name: Reload udev rules
+  ansible.builtin.command: "{{ item }}"
+  loop:
+    - udevadm control --reload-rules
+    - udevadm trigger
+  become: yes
+
 - name: Restart vsftpd
   service:
     name: vsftpd

ansible/roles/fileserver/tasks/main.yml

@@ -51,6 +51,9 @@
     enabled: no
   when: not samba.enabled
 
+- import_tasks: qemu.yml
+  when: qemu.enabled
+
 - import_tasks: virtualbox.yml
   when: virtualbox.enabled
 

ansible/roles/fileserver/tasks/qemu.yml

@@ -0,0 +1,16 @@
+---
+- name: QEMU virt-manager package
+  ansbile.builtin.package:
+    name: virt-manager
+
+- name: DBUS package to support virt-manager dconf under X11
+  ansible.builtin.package:
+    name: dbus-x11
+
+- name: Set up udev permissions for libvirt group members
+  ansible.builtin.copy:
+    content: |
+      # Managed by ansible
+      ENV{DM_VG_NAME}=="virt", OWNER="libvirt-qemu", GROUP="libvirt", MODE="0660"
+    dest: /etc/udev/rules.d/65-libvirt.rules
+  notify: Reload udev rules

ansible/roles/kubernetes/tasks/cplane.yml

@@ -9,6 +9,19 @@
     src: kubeadm-config-cplane.j2
     dest: /etc/kubernetes/kubeadm-config.yaml
 
+- name: Directory for locally defined k8s objects
+  ansible.builtin.file:
+    mode: 0700
+    path: /etc/kubernetes/local
+    state: directory
+
+- name: Set up encryption config in path available to kube-apiserver
+  ansible.builtin.template:
+    src: api-crypt.conf.j2
+    dest: /etc/kubernetes/local/api-crypt.conf
+    mode: 0600
+  when: "'encryption_key' in vault_k8s"
+
 # TODO: run_once is not supported with strategy: free
 - name: Init cluster if needed
   include_tasks: cplane_init.yml
@@ -65,18 +78,6 @@
       CPUAccounting=true
       MemoryAccounting=true
 
-- name: Set up encryption config in path available to kube-apiserver
-  ansible.builtin.template:
-    src: secrets.conf.j2
-    dest: /etc/kubernetes/pki/secrets.conf
-    mode: 0600
-
-- name: Adjust kube-apiserver config - encrypt etcd values
-  ansible.builtin.lineinfile:
-    path: /etc/kubernetes/manifests/kube-apiserver.yaml
-    insertafter: etcd-servers=https://127.0.0.1:2379
-    line: '    - --encryption-provider-config=/etc/kubernetes/pki/secrets.conf'
-
 - name: Create / restrict directory for etcd backups
   ansible.builtin.file:
     dest: /var/backup/k8s

…les/kubernetes/templates/secrets.conf.j2 …s/kubernetes/templates/api-crypt.conf.j2ansible/roles/kubernetes/templates/secrets.conf.j2 renamed to ansible/roles/kubernetes/templates/api-crypt.conf.j2 ansible/roles/kubernetes/templates/secrets.conf.j2 renamed to ansible/roles/kubernetes/templates/api-crypt.conf.j2

@@ -12,7 +12,7 @@ bootstrapTokens:
   groups:
   - system:bootstrappers:kubeadm:default-node-token
 localAPIEndpoint:
-  advertiseAddress: {{ k8s.cplane_vip }}
+  advertiseAddress: {{ k8s.cplane_hostip }}
   bindPort: 6443
 nodeRegistration:
   criSocket: {{ k8s.cri_socket }}
@@ -41,7 +41,7 @@ apiServer:
   - {{ k8s.cplane_vip }}
   extraArgs:
   - name: encryption-provider-config
-    value: /etc/kubernetes/pki/secrets.conf
+    value: /etc/kubernetes/local/api-crypt.conf
   - name: oidc-issuer-url
     value: {{ oidc.issuer_url }}
   - name: oidc-client-id
@@ -54,6 +54,15 @@ apiServer:
     value: {{ oidc.username_prefix }}
   - name: oidc-groups-prefix
     value: {{ oidc.group_prefix }}
+  - name: oidc-ca-file
+    value: {{ oidc.ca-file }}
+  extraVolumes:
+  - name: local-config
+    hostPath: "/etc/kubernetes/local"
+    mountPath: "/etc/kubernetes/local"
+    readOnly: true
+    pathType: DirectoryOrCreate
+controlPlaneEndpoint: "{{ k8s.cplane_vip }}:6443"
 dns:
   # Workaround for bug 112131; never got fixed as of k8s 1.31:
   # https://github.com/kubernetes/kubernetes/issues/112131

ansible/roles/kubernetes/templates/kubeadm-config-cplane.j2

@@ -129,13 +129,15 @@ def check_smart(drive, error_items, warn_temp, crit_temp, warn_spare):
 
     if not dot_get(smart, 'smart_status.passed'):
         return STATUS_CRIT, 'CRIT: serial=%s smart_status not OK' % serial_num
-    if temperature > crit_temp:
-        return STATUS_CRIT, 'CRIT: %s serial=%s temp=%d exceeds threshold' % (
-            drive, serial_num, temperature)
-    elif temperature > warn_temp:
-        status = STATUS_WARN
-        message = 'WARN: %s serial=%s, temp=%d exceeds threshold' % (
-            drive, serial_num, temperature)
+    if temperature:
+        if temperature > crit_temp:
+            return STATUS_CRIT, \
+                'CRIT: %s serial=%s temp=%d exceeds threshold' % (
+                    drive, serial_num, temperature)
+        elif temperature > warn_temp:
+            status = STATUS_WARN
+            message = 'WARN: %s serial=%s, temp=%d exceeds threshold' % (
+                drive, serial_num, temperature)
     if nvme_log:
         spare_threshold = max(nvme_log.get('available_spare_threshold', 0),
                               warn_spare)
@@ -158,8 +160,9 @@ def check_smart(drive, error_items, warn_temp, crit_temp, warn_spare):
                     'CRIT' if status == STATUS_CRIT else 'WARN',
                     drive, serial_num, key, item['val'])
     if status == STATUS_OK:
-        message = '%s OK: temp=%d serial=%s cap=%.3fT' % (
-            drive, temperature, serial_num, capacity / 1e12)
+        message = '%s OK:%s serial=%s cap=%.3fT' % (
+            drive, ' temp=%s' % temperature if temperature else '', serial_num,
+            capacity / 1e12)
     return status, message
 
 

ansible/roles/monitoring_agent/files/plugins/check_drive_health.py

@@ -27,3 +27,8 @@
     mode: 0600
     owner: mythtv
     src: config.xml.j2
+
+- name: MythTV command-line settings (fix for 4K resolution)
+  ansible.builtin.template:
+    dest: /etc/mythtv/session-settings
+    src: session-settings.j2

ansible/roles/mythfrontend/tasks/setup.yml

@@ -0,0 +1,3 @@
+{{ ansible_managed | comment }}
+# Fix playback resolution when running on a 4K display under Wayland
+MYTHFRONTEND_OPTS="-platform xcb"