Add support to Ansible 2.9 (#5361)

README.md

@@ -138,8 +138,7 @@ Note: The list of validated [docker versions](https://github.com/kubernetes/kube
 ## Requirements
 
 - **Minimum required version of Kubernetes is v1.15**
-- **Ansible v2.7.8 (or newer, but [not 2.8.x](https://github.com/kubernetes-sigs/kubespray/issues/4778)) and python-netaddr is installed on the machine
-    that will run Ansible commands**
+- **Ansible v2.7.8 and python-netaddr is installed on the machine that will run Ansible commands**
 - **Jinja 2.9 (or newer) is required to run the Ansible Playbooks**
 - The target servers must have **access to the Internet** in order to pull docker images. Otherwise, additional configuration is required (See [Offline Environment](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/downloads.md#offline-environment))
 - The target servers are configured to allow **IPv4 forwarding**.

contrib/vault/roles/vault/tasks/bootstrap/ca_trust.yml

@@ -13,7 +13,7 @@
       /usr/local/share/ca-certificates/vault-ca.crt
       {%- elif ansible_os_family == "RedHat" -%}
       /etc/pki/ca-trust/source/anchors/vault-ca.crt
-      {%- elif ansible_os_family in ["CoreOS", "Container Linux by CoreOS"] -%}
+      {%- elif ansible_os_family in ["Coreos", "Container Linux by CoreOS"] -%}
       /etc/ssl/certs/vault-ca.pem
       {%- endif %}
 
@@ -25,7 +25,7 @@
 
 - name: bootstrap/ca_trust | update ca-certificates (Debian/Ubuntu/CoreOS)
   command: update-ca-certificates
-  when: vault_ca_cert.changed and ansible_os_family in ["Debian", "CoreOS", "Container Linux by CoreOS"]
+  when: vault_ca_cert.changed and ansible_os_family in ["Debian", "CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: bootstrap/ca_trust | update ca-certificates (RedHat)
   command: update-ca-trust extract

roles/container-engine/docker/tasks/main.yml

@@ -46,7 +46,7 @@
           docker requires a minimum kernel version of
           {{ docker_kernel_min_version }} on
           {{ ansible_distribution }}-{{ ansible_distribution_version }}
-  when: (not ansible_os_family in ["CoreOS", "Container Linux by CoreOS", "ClearLinux"]) and (ansible_kernel is version(docker_kernel_min_version, "<"))
+  when: (not ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "ClearLinux"]) and (ansible_kernel is version(docker_kernel_min_version, "<"))
   tags:
     - facts
 
@@ -63,7 +63,7 @@
   retries: 4
   delay: "{{ retry_stagger | d(3) }}"
   with_items: "{{ docker_repo_key_info.repo_keys }}"
-  when: not (ansible_os_family in ["CoreOS", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic)
+  when: not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic)
 
 - name: ensure docker-ce repository is enabled
   action: "{{ docker_repo_info.pkg_repo }}"
@@ -71,7 +71,7 @@
     repo: "{{ item }}"
     state: present
   with_items: "{{ docker_repo_info.repos }}"
-  when: not (ansible_os_family in ["CoreOS", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic) and (docker_repo_info.repos|length > 0)
+  when: not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic) and (docker_repo_info.repos|length > 0)
 
 - name: ensure docker-engine repository public key is installed
   action: "{{ dockerproject_repo_key_info.pkg_key }}"
@@ -85,7 +85,7 @@
   delay: "{{ retry_stagger | d(3) }}"
   with_items: "{{ dockerproject_repo_key_info.repo_keys }}"
   when:
-    - not (ansible_os_family in ["CoreOS", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic)
+    - not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic)
     - use_docker_engine is defined and use_docker_engine
 
 - name: ensure docker-engine repository is enabled
@@ -96,7 +96,7 @@
   with_items: "{{ dockerproject_repo_info.repos }}"
   when:
     - use_docker_engine is defined and use_docker_engine
-    - not (ansible_os_family in ["CoreOS", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic) and (dockerproject_repo_info.repos|length > 0)
+    - not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "RedHat", "Suse", "ClearLinux"] or is_atomic) and (dockerproject_repo_info.repos|length > 0)
 
 - name: Configure docker repository on Fedora
   template:
@@ -160,7 +160,7 @@
   delay: "{{ retry_stagger | d(3) }}"
   with_items: "{{ docker_package_info.pkgs }}"
   notify: restart docker
-  when: not (ansible_os_family in ["CoreOS", "Container Linux by CoreOS", "ClearLinux"] or is_atomic) and (docker_package_info.pkgs|length > 0)
+  when: not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "ClearLinux"] or is_atomic) and (docker_package_info.pkgs|length > 0)
   ignore_errors: true
 
 - name: Ensure docker packages are installed

roles/container-engine/docker/tasks/systemd.yml

@@ -24,7 +24,7 @@
     dest: /etc/systemd/system/docker.service
   register: docker_service_file
   notify: restart docker
-  when: not (ansible_os_family in ["CoreOS", "Container Linux by CoreOS"] or is_atomic)
+  when: not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"] or is_atomic)
 
 - name: Write docker options systemd drop-in
   template:

roles/download/tasks/download_container.yml

@@ -50,7 +50,7 @@
         - download_force_cache
         - image_is_cached
         - not download_localhost
-        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+        - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
     - name: download_container | Load image into docker
       shell: "{{ docker_bin_dir }}/docker load < {{ image_path_cached if download_localhost else image_path_final }}"
@@ -62,7 +62,7 @@
       when:
         - download_force_cache
         - image_is_cached
-        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+        - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
     - name: download_container | Prepare container download
       include_tasks: check_pull_required.yml
@@ -109,7 +109,7 @@
       when:
         - download_force_cache
         - not image_is_cached or (image_changed | default(true))
-        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+        - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
     - name: download_container | Copy image to ansible host cache
       synchronize:
@@ -123,7 +123,7 @@
         - not download_localhost
         - download_delegate == inventory_hostname
         - not image_is_cached or (image_changed | default(true))
-        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+        - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
     - name: download_container | Remove container image from cache
       file:
@@ -131,7 +131,7 @@
         path: "{{ image_path_final }}"
       when:
         - not download_keep_remote_cache
-        - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+        - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   tags:
     - download

roles/download/tasks/download_file.yml

@@ -67,7 +67,7 @@
     when:
     - download_force_cache
     - file_is_cached
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   - name: download_file | Set mode and owner
     file:
@@ -78,7 +78,7 @@
     when:
     - download_force_cache
     - file_is_cached
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   # This must always be called, to check if the checksum matches. On no-match the file is re-downloaded.
   - name: download_file | Download item
@@ -116,7 +116,7 @@
     - not file_is_cached or get_url_result.changed
     - download_delegate == inventory_hostname
     - not (download_run_once and download_delegate == 'localhost')
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   tags:
   - download

roles/download/tasks/prep_download.yml

@@ -27,7 +27,7 @@
     mode: 0755
     owner: "{{ ansible_ssh_user | default(ansible_user_id) }}"
   when:
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: prep_download | Create local cache for files and images
   file:

roles/download/tasks/sync_container.yml

@@ -18,12 +18,12 @@
     retries: 4
     delay: "{{ retry_stagger | random + 3 }}"
     when:
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   - name: sync_container | Load container image into docker
     shell: "{{ docker_bin_dir }}/docker load < {{ image_path_final }}"
     when:
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   - name: sync_container | Remove container image from cache
     file:
@@ -31,7 +31,7 @@
       path: "{{ image_path_final }}"
     when:
     - not download_keep_remote_cache
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   tags:
   - upload

roles/download/tasks/sync_file.yml

@@ -30,7 +30,7 @@
     retries: 4
     delay: "{{ retry_stagger | random + 3 }}"
     when:
-    - ansible_os_family not in ["CoreOS", "Container Linux by CoreOS"]
+    - ansible_os_family not in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
   - name: sync_file | Set mode and owner
     file:

roles/etcd/meta/main.yml

@@ -2,7 +2,7 @@
 dependencies:
   - role: adduser
     user: "{{ addusers.etcd }}"
-    when: not (ansible_os_family in ['CoreOS', 'Container Linux by CoreOS', "ClearLinux"] or is_atomic)
+    when: not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "ClearLinux"] or is_atomic)
   - role: adduser
     user: "{{ addusers.kube }}"
-    when: not (ansible_os_family in ['CoreOS', 'Container Linux by CoreOS', "ClearLinux"] or is_atomic)
+    when: not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "ClearLinux"] or is_atomic)

roles/etcd/tasks/upd_ca_trust.yml

@@ -6,7 +6,7 @@
       /usr/local/share/ca-certificates/etcd-ca.crt
       {%- elif ansible_os_family == "RedHat" -%}
       /etc/pki/ca-trust/source/anchors/etcd-ca.crt
-      {%- elif ansible_os_family in ["CoreOS", "Container Linux by CoreOS"] -%}
+      {%- elif ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"] -%}
       /etc/ssl/certs/etcd-ca.pem
       {%- elif ansible_os_family == "Suse" -%}
       /etc/pki/trust/anchors/etcd-ca.pem
@@ -25,7 +25,7 @@
 
 - name: Gen_certs | update ca-certificates (Debian/Ubuntu/SUSE/Container Linux by CoreOS)
   command: update-ca-certificates
-  when: etcd_ca_cert.changed and ansible_os_family in ["Debian", "CoreOS", "Container Linux by CoreOS", "Suse"]
+  when: etcd_ca_cert.changed and ansible_os_family in ["Debian", "CoreOS", "Coreos", "Container Linux by CoreOS", "Suse"]
 
 - name: Gen_certs | update ca-certificates (RedHat)
   command: update-ca-trust extract

roles/kubernetes-apps/cloud_controller/oci/tasks/credentials-check.yml

@@ -57,7 +57,7 @@
   fail:
     msg: "oci_subnet2_id is missing. Two subnets are required for load balancer high availability"
   when:
-    - oci_cloud_controller_version | version_compare('0.7.0', '<')
+    - oci_cloud_controller_version is version_compare('0.7.0', '<')
     - oci_subnet2_id is not defined or not oci_subnet2_id
 
 - name: "OCI Cloud Controller | Credentials Check | oci_security_list_management"

roles/kubernetes-apps/helm/tasks/main.yml

@@ -105,4 +105,4 @@
   shell: "umask 022 && {{ bin_dir }}/helm completion bash >/etc/bash_completion.d/helm.sh"
   when:
     - ((helm_container is defined and helm_container.changed) or (helm_task_result is defined and helm_task_result.changed))
-    - not ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+    - not ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]

roles/kubernetes/master/tasks/kubeadm-setup.yml

@@ -127,7 +127,7 @@
   with_items: "{{ hostvars[groups['kube-master'][0]]['kubeadm_init'].stdout_lines | default([]) }}"
   when:
     - kubeadm_certificate_key is not defined
-    - item | trim | match('.*--certificate-key.*')
+    - (item | trim) is match('.*--certificate-key.*')
 
 - name: Create hardcoded kubeadm token for joining nodes with 24h expiration (if defined)
   shell: >-

roles/kubernetes/preinstall/handlers/main.yml

@@ -9,18 +9,18 @@
     - Preinstall | restart kube-controller-manager crio/containerd
     - Preinstall | restart kube-apiserver docker
     - Preinstall | restart kube-apiserver crio/containerd
-  when: not ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: not ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: Preinstall | update resolvconf for Container Linux by CoreOS
   command: /bin/true
   notify:
     - Preinstall | apply resolvconf cloud-init
     - Preinstall | reload kubelet
-  when: ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: Preinstall | apply resolvconf cloud-init
   command: /usr/bin/coreos-cloudinit --from-file {{ resolveconf_cloud_init_conf }}
-  when: ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: Preinstall | reload kubelet
   service:

roles/kubernetes/preinstall/tasks/0020-verify-settings.yml

@@ -16,12 +16,14 @@
 
 - name: Stop if unknown OS
   assert:
-    that: ansible_os_family in ['RedHat', 'CentOS', 'Fedora', 'Ubuntu', 'Debian', 'CoreOS', 'Container Linux by CoreOS', 'Suse', 'ClearLinux', 'OracleLinux']
+    that: ansible_os_family in ['RedHat', 'CentOS', 'Fedora', 'Ubuntu', 'Debian', 'CoreOS', 'Coreos', 'Container Linux by CoreOS', 'Suse', 'ClearLinux', 'OracleLinux']
+    msg: "{{ ansible_os_family }} is not a known OS"
   ignore_errors: "{{ ignore_assert_errors }}"
 
 - name: Stop if unknown network plugin
   assert:
     that: kube_network_plugin in ['calico', 'canal', 'flannel', 'weave', 'cloud', 'cilium', 'cni', 'contiv', 'kube-ovn', 'kube-router', 'macvlan']
+    msg: "{{ kube_network_plugin }} is not supported"
   when: kube_network_plugin is defined
   ignore_errors: "{{ ignore_assert_errors }}"
 

roles/kubernetes/preinstall/tasks/0040-set_facts.yml

@@ -18,7 +18,7 @@
 - name: Force binaries directory for Container Linux by CoreOS
   set_fact:
     bin_dir: "/opt/bin"
-  when: ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
   tags:
     - facts
 
@@ -85,12 +85,12 @@
       {%- if resolvconf|bool -%}/etc/resolvconf/resolv.conf.d/base{%- endif -%}
     head: >-
       {%- if resolvconf|bool -%}/etc/resolvconf/resolv.conf.d/head{%- endif -%}
-  when: not ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: not ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: target temporary resolvconf cloud init file (Container Linux by CoreOS)
   set_fact:
     resolvconffile: /tmp/resolveconf_cloud_init_conf
-  when: ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: check if /etc/dhclient.conf exists
   stat:

roles/kubernetes/preinstall/tasks/0060-resolvconf.yml

 ---
 - name: create temporary resolveconf cloud init file
   command: cp -f /etc/resolv.conf "{{ resolvconffile }}"
-  when: ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: Add domain/search/nameservers/options to resolv.conf
   blockinfile:
@@ -47,7 +47,7 @@
 - name: get temporary resolveconf cloud init file content
   command: cat {{ resolvconffile }}
   register: cloud_config
-  when: ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
 
 - name: persist resolvconf cloud init file
   template:
@@ -56,4 +56,4 @@
     owner: root
     mode: 0644
   notify: Preinstall | update resolvconf for Container Linux by CoreOS
-  when: ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+  when: ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]

roles/kubernetes/preinstall/tasks/0070-system-packages.yml

@@ -71,7 +71,7 @@
   until: pkgs_task_result is succeeded
   retries: 4
   delay: "{{ retry_stagger | random + 3 }}"
-  when: not (ansible_os_family in ["CoreOS", "Container Linux by CoreOS", "ClearLinux"] or is_atomic)
+  when: not (ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS", "ClearLinux"] or is_atomic)
   tags:
     - bootstrap-os
 

roles/kubernetes/preinstall/tasks/0080-system-configurations.yml

@@ -28,7 +28,7 @@
     backup: yes
   when:
     - disable_ipv6_dns
-    - not ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]
+    - not ansible_os_family in ["CoreOS", "Coreos", "Container Linux by CoreOS"]
   tags:
     - bootstrap-os