Merge pull request #1031 from mesosphere/dkoshkin/fix-ubuntu-release-2.2

[release-2.2] fix: ubuntu builds

ansible/group_vars/all/defaults.yaml

@@ -6,6 +6,7 @@ python_path: ""
 #
 # IMPORTANT When you update kubernetes_version, also update crictl_version.
 kubernetes_version: "1.25.4"
+kubernetes_major_minor: "{{ (kubernetes_version.split('.') | map('trim'))[:2] | join('.') }}"
 kubernetes_semver: "v{{ kubernetes_version }}"
 
 kubernetes_cni_version: "0.9.1"
@@ -14,19 +15,20 @@ kubernetes_cni_version: "0.9.1"
 # The project release closely follows the Kubernetes release cycle, and uses a
 # nearly identical version scheme.
 # IMPORTANT When you update crictl_version, also update crictl_sha256.
-crictl_version: "1.25.0"
+crictl_version: "{{ kubernetes_major_minor }}.0"
 
 # On flatcar Linux, we install crictl from a release artifact, not a system package.
 # The url points to the linux/amd64 release artifact.
 crictl_url: https://github.com/kubernetes-sigs/cri-tools/releases/download/v{{ crictl_version }}/crictl-v{{ crictl_version }}-linux-amd64.tar.gz
-# The sha256 sum verifies the integrity of the release artifact.
+# The sha256 sum verifies the integrity of the release artifact. Obtained from a
+# table in the release notes, https://github.com/kubernetes-sigs/cri-tools/releases/tag/<crictl_version>
 crictl_sha256: 86ab210c007f521ac4cdcbcf0ae3fb2e10923e65f16de83e0e1db191a07f0235
 
 
 # The critools deb and rpm package versions. While the version derives directly from
 # the crictl verson, the package revision can change independently.
 # The initial revision is 00.
-critools_deb: "{{ crictl_version }}-00"
+critools_deb: "{{ crictl_version }}-1.1"
 # The initial revision 0.
 critools_rpm: "{{ crictl_version }}-0"
 
@@ -45,7 +47,7 @@ package_versions:
   enable_repository_installation: "{{ (spec.osPackages.enableAdditionalRepositories if spec.osPackages is defined else true)|default(true)|bool }}"
   # the version may contain d2iq specific suffix, remove it when downloading packages
   kubernetes_rpm: "{{ kubernetes_version }}-0"
-  kubernetes_deb: "{{ kubernetes_version }}-00"
+  kubernetes_deb: "{{ kubernetes_version }}-1.1"
   kubenode: "{{ kubernetes_version }}"
 
 # variable used for seeding images
@@ -107,3 +109,5 @@ nvidia_driver_version: "470.82.01"
 nvidia_runfile_installer: "NVIDIA-Linux-x86_64-{{ nvidia_driver_version }}.run"
 nvidia_runfile_installer_url: "https://download.nvidia.com/XFree86/Linux-x86_64/{{ nvidia_driver_version }}/{{ nvidia_runfile_installer }}"
 suse_packagehub_product: PackageHub/{{ ansible_distribution_version }}/{{ ansible_architecture }}
+
+pinned_debs: []

ansible/group_vars/all/system.yaml

@@ -7,9 +7,9 @@ kubernetes_rpm_repository_url: "https://packages.d2iq.com/konvoy/stable/linux/re
 kubernetes_rpm_gpg_key_url: "https://packages.d2iq.com/konvoy/stable/linux/repos/d2iq-sign-authority-gpg-public-key"
 
 ## Debian
-kubernetes_deb_repository_url: "https://packages.cloud.google.com/apt/"
-kubernetes_deb_gpg_key_url: "https://packages.cloud.google.com/apt/doc/apt-key.gpg"
-kubernetes_deb_release_name: "kubernetes-xenial"
+kubernetes_deb_repository_url: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_major_minor }}/deb/"
+kubernetes_deb_gpg_key_url: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_major_minor }}/deb/Release.key"
+kubernetes_deb_release_name: "/"
 
 # containerd package
 # Appstream is enabled by default in rhel8, so install the package from local repositories in that case

ansible/roles/packages/tasks/debian.yaml

@@ -31,6 +31,19 @@
   retries: 3
   delay: 3
 
+- name: install pinned debs
+  apt:
+    force_apt_get: True
+    name: "{{ item }}"
+    state: present
+    force: yes
+  register: apt_lock_status
+  until: apt_lock_status is not failed
+  retries: 5
+  delay: 10
+  with_items: "{{ pinned_debs }}"
+  when: ansible_os_family == "Debian"
+
 - name: remove version hold for kubelet and kubectl packages
   command: apt-mark unhold {{ item }}
   with_items:

ansible/roles/repo/tasks/debian.yaml

@@ -11,6 +11,6 @@
 
   - name: add Kubernetes deb repository
     apt_repository:
-      repo: 'deb {{ kubernetes_deb_repository_url }} {{ kubernetes_deb_release_name }} main'
+      repo: 'deb {{ kubernetes_deb_repository_url }} {{ kubernetes_deb_release_name }}'
     retries: 3
     delay: 3

images/ami/ubuntu-2004.yaml

@@ -12,3 +12,8 @@ packer:
 build_name: "ubuntu-20"
 packer_builder_type: "amazon"
 python_path: ""
+# The latest cloud-init version '23.3.1-0ubuntu1~20.04.1 is unable to run #boothook created by CAPA
+# https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/0bf78b04b305a77aec37a68c107102231faa7a16/pkg/cloud/services/secretsmanager/secret_fetch_script.go#L20
+# This is a workaround to downgrade to older cloud-init version.
+# TODO: remove it when base ubuntu AMI has fixed version of cloud-init available. https://d2iq.atlassian.net/browse/D2IQ-99637
+pinned_debs: ["cloud-init=23.1.2-0ubuntu0~20.04.2"]