Document Ansible-built management cluster (plan step 4)

Phase-1 Step 2 rewritten around ansible/mgmt.yml and cluster-api-operator,
version pins for operator/cert-manager/cloud image, decisions #12-14,
execution log and changelog. Phase-1 Step 2 checked off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-09-27 10:41:03 +02:00
co-authored by Claude Opus 5.5
parent aaa1ed64e2
commit d8efa3b961
9 changed files with 121 additions and 30 deletions
+10 -1
View File
@@ -1,6 +1,7 @@
# Versions
Verified 2026-09-24 (phase 1) and 2026-09-26 (phase 2/3 candidates) from the Go module proxy,
Verified 2026-09-24 (phase 1), 2026-09-26 (phase 2/3 candidates) and 2026-09-27 (management
cluster add-ons) from the Go module proxy,
`dl.k8s.io`, `registry.k8s.io`, upstream Helm indexes and git tags. Re-verify before every deploy.
## Phase 1 — pinned
@@ -12,6 +13,9 @@ Verified 2026-09-24 (phase 1) and 2026-09-26 (phase 2/3 candidates) from the Go
| IPAM provider in-cluster | **v1.1.1** | v1.1.1 | CAPMOX v0.9 requires ≥ 1.1.0 |
| Workload Kubernetes | **v1.35.9** | v1.37.1 | CAPI 1.12 supports workload clusters up to 1.35 |
| Management cluster (k3s) | **v1.35.8+k3s1** | v1.37.0+k3s1 | CAPI 1.12 supports management clusters 1.31–1.35 |
| cluster-api-operator (Helm chart) | **0.28.0** | 0.29.0 | installs the providers instead of `clusterctl init`; 0.28.0 is built against CAPI v1.12.10, 0.29.0 against v1.13.5 |
| cert-manager (Helm chart) | **v1.21.2** | v1.21.2 | required by the operator and all providers (webhook certs); supports k8s 1.33–1.36 |
| Management VM image | Ubuntu cloud image `noble/20260926` (24.04.5) | — | sha256 `6a81c375…5bb4d2`; `current/` is a rolling pointer, pin the dated serial |
| cluster-autoscaler | **v1.35.2** | v1.36.1 | CA minor must match workload Kubernetes minor |
| cluster-autoscaler Helm chart | **9.59.0** | 9.59.0 | default appVersion 1.35.0 → override `image.tag` |
| Cilium | **1.20.2** | 1.20.2 | |
@@ -27,6 +31,11 @@ Verified 2026-09-24 (phase 1) and 2026-09-26 (phase 2/3 candidates) from the Go
When CAPMOX adds CAPI 1.13/1.14 to its compatibility table: bump CAPI core → k3s mgmt to 1.36+ →
rebuild template with Kubernetes 1.36/1.37 → cluster-autoscaler to the matching minor.
All management-cluster pins live in `ansible/group_vars/all.yml`. Provider upgrades are a
`spec.version` bump there + `ansible-playbook mgmt.yml --tags capi`, one provider per run (the
operator blocks minor downgrades). Bump cluster-api-operator only to a release built against the
target CAPI minor.
## Phase 2 / 3 — candidates (not pinned yet)
| Component | Latest | Built against CAPI | Notes |