cozystack
diff --git a/‎.github/workflows/test.yml‎
Lines changed: 96 additions & 0 deletions b/‎.github/workflows/test.yml‎
Lines changed: 96 additions & 0 deletions
diff --git a/‎CHANGELOG.rst‎
Lines changed: 77 additions & 32 deletions b/‎CHANGELOG.rst‎
Lines changed: 77 additions & 32 deletions
diff --git a/‎README.md‎
Lines changed: 5 additions & 3 deletions b/‎README.md‎
Lines changed: 5 additions & 3 deletions
diff --git a/‎examples/ubuntu/prepare-sudo.yml‎
Lines changed: 61 additions & 0 deletions b/‎examples/ubuntu/prepare-sudo.yml‎
Lines changed: 61 additions & 0 deletions
diff --git a/‎examples/ubuntu/prepare-ubuntu.yml‎
Lines changed: 14 additions & 1 deletion b/‎examples/ubuntu/prepare-ubuntu.yml‎
Lines changed: 14 additions & 1 deletion
diff --git a/‎examples/ubuntu/site.yml‎
Lines changed: 6 additions & 0 deletions b/‎examples/ubuntu/site.yml‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎roles/cozystack/defaults/main.yml‎
Lines changed: 4 additions & 4 deletions b/‎roles/cozystack/defaults/main.yml‎
Lines changed: 4 additions & 4 deletions
@@ -37,6 +37,9 @@ jobs:
       - name: Syntax check Ubuntu example
         run: ansible-playbook examples/ubuntu/prepare-ubuntu.yml --syntax-check
 
+      - name: Syntax check Ubuntu sudo workaround
+        run: ansible-playbook examples/ubuntu/prepare-sudo.yml --syntax-check
+
       - name: Syntax check SUSE example
         run: ansible-playbook examples/suse/prepare-suse.yml --syntax-check
 
@@ -230,3 +233,96 @@ jobs:
         run: >-
           sudo env "PATH=$PATH" "HOME=$HOME" ansible-playbook examples/ubuntu/site.yml
           --inventory tests/ci-inventory.yml
+
+      # Namespace adoption regression test. Reproduces the failure
+      # mode: the cozy-installer chart templates Namespace
+      # cozy-system, and a `helm install` against an existing
+      # namespace without helm ownership metadata fails with
+      #   Namespace "cozy-system" exists and cannot be imported into
+      #   the current release: invalid ownership metadata
+      # Strip both the helm release storage Secret (so helm forgets
+      # the release entirely) and the namespace's helm labels and
+      # annotations (so the next install sees an orphan namespace).
+      # This simulates a manual `kubectl create ns` or a remnant
+      # from a previous failed install.
+      - name: Simulate orphan cozy-system namespace
+        run: |
+          set -eux
+          KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+          sudo kubectl --kubeconfig $KUBECONFIG \
+            label namespace cozy-system app.kubernetes.io/managed-by-
+          sudo kubectl --kubeconfig $KUBECONFIG \
+            annotate namespace cozy-system \
+              meta.helm.sh/release-name- \
+              meta.helm.sh/release-namespace-
+          sudo kubectl --kubeconfig $KUBECONFIG \
+            delete secret --namespace kube-system \
+              --selector=owner=helm,name=cozy-installer
+
+      - name: Test namespace adoption (re-install over orphan namespace)
+        run: >-
+          sudo env "PATH=$PATH" "HOME=$HOME" ansible-playbook examples/ubuntu/site.yml
+          --inventory tests/ci-inventory.yml
+
+      - name: Verify cozy-system namespace was re-adopted
+        run: |
+          set -eux
+          KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+          managed_by="$(sudo kubectl --kubeconfig $KUBECONFIG \
+            get namespace cozy-system \
+            --output jsonpath='{.metadata.labels.app\.kubernetes\.io/managed-by}')"
+          release_name="$(sudo kubectl --kubeconfig $KUBECONFIG \
+            get namespace cozy-system \
+            --output jsonpath='{.metadata.annotations.meta\.helm\.sh/release-name}')"
+          if [ "$managed_by" != "Helm" ] || [ "$release_name" != "cozy-installer" ]; then
+            echo "ERROR: namespace adoption failed"
+            echo "  managed-by label:    '$managed_by' (expected 'Helm')"
+            echo "  release-name annot.: '$release_name' (expected 'cozy-installer')"
+            exit 1
+          fi
+          echo "OK: cozy-system namespace adopted into helm release"
+
+      # Foreign-owner refusal: re-stamp cozy-system as owned by a
+      # different fake helm release and assert the role fails
+      # rather than silently hijacking ownership.
+      - name: Stamp cozy-system as owned by a different helm release
+        run: |
+          set -eux
+          KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+          sudo kubectl --kubeconfig $KUBECONFIG \
+            annotate namespace cozy-system --overwrite \
+              meta.helm.sh/release-name=some-other-release \
+              meta.helm.sh/release-namespace=elsewhere
+
+      - name: Test that foreign-owner namespace is NOT overwritten
+        run: |
+          set +e
+          output="$(sudo env "PATH=$PATH" "HOME=$HOME" \
+            ansible-playbook examples/ubuntu/site.yml \
+            --inventory tests/ci-inventory.yml 2>&1)"
+          status=$?
+          set -e
+
+          if [ "$status" -eq 0 ]; then
+            echo "ERROR: role silently re-adopted a foreign-owned namespace."
+            echo "Expected refusal because cozy-system is owned by 'some-other-release'."
+            echo "$output" | tail -50
+            exit 1
+          fi
+
+          if ! grep -q "owned by helm release 'some-other-release'" <<< "$output"; then
+            echo "ERROR: role failed but not for the expected reason."
+            echo "$output" | tail -50
+            exit 1
+          fi
+
+          echo "OK: role correctly refused to overwrite foreign helm ownership."
+
+      - name: Restore cozy-system ownership for cleanup
+        run: |
+          set -eux
+          KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+          sudo kubectl --kubeconfig $KUBECONFIG \
+            annotate namespace cozy-system --overwrite \
+              meta.helm.sh/release-name=cozy-installer \
+              meta.helm.sh/release-namespace=kube-system
@@ -2,42 +2,54 @@
 cozystack.installer Release Notes
 =================================
 
-v1.2.3
-======
-
-- Drop ``ansible.utils`` collection dependency and ``netaddr`` Python
-  package requirement. Master node IP validation now uses a bundled
-  ``cozystack.installer.is_ip_address`` Jinja2 test backed by the
-  Python standard library ``ipaddress`` module.
-- Add IPv6 inventory fixture and CI coverage for IPv6 host keys.
-
-v1.2.2
-======
-
-Synced with Cozystack v1.2.2.
-
-- Bump ``cozystack_chart_version`` to ``1.2.2``
-
-v1.2.1
-======
-
-Synced with Cozystack v1.2.1.
-
-- Bump ``cozystack_chart_version`` to ``1.2.1``
-- Derive ``MASTER_NODES`` for kube-ovn from the ``server`` inventory
-  group; add ``cozystack_master_nodes`` override for multi-master setups
-- Validate master node entries are valid IP addresses, not hostnames
-
-v1.1.3
-======
-
-Synced with Cozystack v1.1.3.
-
-- Bump ``cozystack_chart_version`` to ``1.1.3``
 
 Unreleased
 ==========
 
+Ubuntu 26.04 LTS support and namespace adoption.
+
+- ``examples/ubuntu/`` now boots end-to-end on Ubuntu 26.04 LTS. Two
+  changes were needed:
+
+  - New playbook ``examples/ubuntu/prepare-sudo.yml`` switches the
+    ``sudo`` alternative from ``sudo-rs`` (Rust rewrite, default on
+    26.04) back to classical sudo at ``/usr/bin/sudo.ws``. ``sudo-rs``
+    does not honour ansible's privilege-escalation pseudo-tty and
+    every subsequent ``become: true`` task hangs with
+    ``Timeout (12s) waiting for privilege escalation prompt``. The
+    play uses ``raw`` so it runs before any become-dependent task and
+    is a no-op on releases that do not ship ``sudo-rs``.
+    ``examples/ubuntu/site.yml`` imports it first.
+  - ``Install Ubuntu-only extra kernel modules`` now skips when
+    ``cozystack_ubuntu_extra_packages`` is empty. Ubuntu 26.04 ships
+    ``openvswitch`` and ``vport-geneve`` in the main
+    ``linux-image-generic`` and has no ``linux-modules-extra-*`` for
+    kernel 7.x. Override the variable to ``[]`` in inventory on those
+    hosts; earlier releases keep the existing default.
+
+- The role now adopts the ``cozy-system`` namespace into the
+  cozy-installer helm release on first run if it already exists
+  out-of-band. Without this pre-task, ``helm install`` fails with
+  ``Namespace "cozy-system" exists and cannot be imported into the
+  current release: invalid ownership metadata`` whenever the
+  namespace was created manually, by a previous failed install, or
+  by a different chart that shares the namespace name. The pre-task
+  is a no-op when the namespace is absent or already carries matching
+  helm metadata, and refuses to proceed (rather than silently
+  hijacking) when the namespace is owned by a *different* helm
+  release.
+
+- **Breaking, but rarely set in practice**: the ``cozystack_namespace``
+  variable was removed from the role's defaults. The cozy-installer
+  chart hardcodes ``name: cozy-system`` in
+  ``templates/cozystack-operator.yaml`` and provides no values key
+  to override it; the variable was effectively a phantom that
+  silently broke the role's wait/patch tasks if changed. The role
+  now asserts at validation time that the variable is *unset* — any
+  inventory still defining it (even at the old default
+  ``cozy-system``) must remove the line. Replace any references in
+  custom playbooks with the literal ``cozy-system``.
+
 - New variable ``cozystack_external_ips`` (list, default ``[]``): external
   IP addresses for ingress-nginx Service ``externalIPs``. Required on
   ``isp-full-generic`` platform variant when nodes lack a native load
@@ -100,6 +112,39 @@ Node prerequisites: comprehensive audit and install in examples.
   ``prepare-rhel.yml`` fails fast with a clear message until an entry is
   added to ``cozystack_zfs_release_rpm_by_major``.
 
+v1.2.3
+======
+
+- Drop ``ansible.utils`` collection dependency and ``netaddr`` Python
+  package requirement. Master node IP validation now uses a bundled
+  ``cozystack.installer.is_ip_address`` Jinja2 test backed by the
+  Python standard library ``ipaddress`` module.
+- Add IPv6 inventory fixture and CI coverage for IPv6 host keys.
+
+v1.2.2
+======
+
+Synced with Cozystack v1.2.2.
+
+- Bump ``cozystack_chart_version`` to ``1.2.2``
+
+v1.2.1
+======
+
+Synced with Cozystack v1.2.1.
+
+- Bump ``cozystack_chart_version`` to ``1.2.1``
+- Derive ``MASTER_NODES`` for kube-ovn from the ``server`` inventory
+  group; add ``cozystack_master_nodes`` override for multi-master setups
+- Validate master node entries are valid IP addresses, not hostnames
+
+v1.1.3
+======
+
+Synced with Cozystack v1.1.3.
+
+- Bump ``cozystack_chart_version`` to ``1.1.3``
+
 v1.1.2
 ======
 
 
@@ -6,7 +6,7 @@ Supported targets:
 
 | Example playbook | Distributions | Validated end-to-end |
 | --- | --- | --- |
-| `examples/ubuntu/` | Ubuntu 22.04, Ubuntu 24.04, Debian 12 | Ubuntu 22.04, Ubuntu 24.04, Debian 12 on OCI: 3-node multi-master, 87/87 HelmReleases Ready |
+| `examples/ubuntu/` | Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Debian 12 | Ubuntu 22.04, Ubuntu 24.04, Debian 12 on OCI: 3-node multi-master, 87/87 HelmReleases Ready. Ubuntu 26.04: best-effort — see Known limitations for the sudo-rs and `linux-modules-extra` notes |
 | `examples/rhel/` | RHEL 8+, CentOS Stream 8+, Rocky 9/10, Alma 9/10 | Rocky 10 on OCI: 3-node multi-master, 87/87 HelmReleases Ready (`cozystack_enable_zfs: false` required — see Known limitations) |
 | `examples/suse/` | openSUSE Leap 15.6+, openSUSE Tumbleweed, SLES 15 | — |
 
@@ -167,6 +167,9 @@ informational notice:
 
 Other subsystem notes:
 
+- **Ubuntu 26.04 LTS:** two changes to be aware of.
+  1. *Auto-applied by `examples/ubuntu/site.yml`*: `sudo-rs` ships as the default `/usr/bin/sudo` alternative and does not honour ansible's `become_method: sudo` privilege-escalation pseudo-tty — every `become: true` task hangs with `Timeout (12s) waiting for privilege escalation prompt`. The classical sudo binary is co-installed at `/usr/bin/sudo.ws`. `site.yml` imports `prepare-sudo.yml` first, which switches the `sudo` alternative back via `update-alternatives` using a `raw` command (so it works even when become is broken). The play is a no-op on releases without sudo-rs. If you bypass `site.yml` and call the prepare playbooks directly, run `prepare-sudo.yml` before any task with `become: true` on 26.04 hosts.
+  2. *Manual inventory setting on 26.04 hosts*: the playbook auto-skips `linux-modules-extra-*` on Ubuntu 26.04+ because the package no longer exists for kernel 7.x — `openvswitch` and `vport-geneve` are bundled into `linux-image-generic`. The auto-skip relies on `ansible_distribution_version`; on hosts where that fact is unreliable, set `cozystack_ubuntu_extra_packages: []` in inventory to skip the apt install explicitly.
 - **Cloud providers (Ubuntu on OCI, AWS, GCP):** stock Ubuntu cloud images ship an iptables INPUT chain that ends with `REJECT icmp-host-prohibited`, which blocks k3s ports 2380/6443 between nodes. Set `cozystack_flush_iptables: true` in your inventory so the prepare playbook flushes the INPUT chain before k3s installs. Oracle Linux images on OCI do not have this restriction out of the box.
 - **Rocky 10 / Alma 10 (and other RHEL 10 rebuilds):** the `iptables` userspace binary is not installed by default. `examples/rhel/prepare-rhel.yml` installs `iptables-nft` so the `cozystack_flush_iptables` task and k3s kube-proxy replacement have a working `iptables` wrapper over nftables.
 - **ARM64 (aarch64):** OpenZFS does not publish aarch64 RPMs for RHEL-family distributions via `zfsonlinux.org/epel`. Cozystack itself targets x86_64.
@@ -310,9 +313,8 @@ Runs on `server[0]` only.
 | Variable | Default | Description |
 | --- | --- | --- |
 | `cozystack_chart_ref` | `oci://ghcr.io/cozystack/cozystack/cozy-installer` | Helm chart OCI reference |
-| `cozystack_chart_version` | `1.2.2` | Helm chart version |
+| `cozystack_chart_version` | `1.3.1` | Helm chart version |
 | `cozystack_release_name` | `cozy-installer` | Helm release name |
-| `cozystack_namespace` | `cozy-system` | Namespace for operator and resources |
 | `cozystack_release_namespace` | `kube-system` | Namespace for Helm release secret |
 | `cozystack_operator_variant` | `generic` | Operator variant: generic, talos, hosted |
 | `cozystack_api_server_port` | `6443` | API server port |
 
@@ -0,0 +1,61 @@
+---
+# Switch sudo alternative to classical sudo on Ubuntu 26.04+.
+#
+# Ubuntu 26.04 LTS ships sudo-rs (Rust rewrite) as the default
+# /usr/bin/sudo alternative. sudo-rs does not read passwords from
+# ansible's privilege-escalation pseudo-tty, so every task with
+# `become: true` and a password-protected user hangs and fails with
+#   Timeout (12s) waiting for privilege escalation prompt.
+#
+# The classical sudo binary is co-installed at /usr/bin/sudo.ws on
+# 26.04 hosts. This playbook switches the `sudo` alternative to it
+# before any other play runs `become: true` tasks, then becomes a
+# no-op on subsequent runs and on releases without sudo-rs.
+#
+# Run before prepare-ubuntu.yml on Ubuntu 26.04+ inventories. Earlier
+# Ubuntu releases and Debian skip every task here — safe to keep in
+# site.yml unconditionally.
+#
+# Connection model: this play uses the `raw` module with no `become`,
+# so it works even when standard ansible become is broken by sudo-rs.
+# Privilege escalation goes through `/usr/bin/sudo.ws` directly so
+# we never depend on whatever flag surface sudo-rs exposes:
+#   - If the connecting user has passwordless sudo, leave
+#     ansible_become_password unset; sudo.ws --non-interactive runs
+#     without prompting.
+#   - If the user requires a password, set ansible_become_password
+#     in inventory or pass it via --ask-become-pass. The password is
+#     piped to sudo.ws --stdin which reads only the first line, so a
+#     password containing a literal newline is unsupported.
+
+- name: Switch sudo alternative to classical sudo (Ubuntu 26.04+)
+  hosts: cluster
+  gather_facts: false
+  become: false
+  tasks:
+    - name: Detect current sudo alternative target
+      ansible.builtin.raw: |
+        readlink -f /etc/alternatives/sudo 2>/dev/null || true
+      register: _cozystack_sudo_current
+      changed_when: false
+      failed_when: false
+
+    # Calls /usr/bin/sudo.ws directly (the classical sudo binary
+    # co-installed on 26.04). Skipping the `sudo` symlink avoids any
+    # dependency on sudo-rs' subset of the classical CLI. no_log
+    # prevents ansible_become_password from leaking into task output
+    # if the raw command fails.
+    - name: Switch sudo alternative to /usr/bin/sudo.ws
+      ansible.builtin.raw: |
+        {% if ansible_become_password is defined %}
+        printf '%s\n' {{ ansible_become_password | quote }} | /usr/bin/sudo.ws --stdin --prompt='' update-alternatives --set sudo /usr/bin/sudo.ws
+        {% else %}
+        /usr/bin/sudo.ws --non-interactive update-alternatives --set sudo /usr/bin/sudo.ws
+        {% endif %}
+      register: _cozystack_sudo_switch
+      changed_when: _cozystack_sudo_switch.rc == 0
+      no_log: true
+      when:
+        - _cozystack_sudo_current.stdout is defined
+        - "'sudo-rs' in _cozystack_sudo_current.stdout"
+        - "'/usr/bin/sudo.ws' not in _cozystack_sudo_current.stdout"
@@ -33,6 +33,13 @@
     # Ubuntu-only: linux-modules-extra-* ships openvswitch and geneve
     # on cloud/minimal kernels. Debian includes these in its base
     # kernel image and has no such split package.
+    #
+    # Ubuntu 26.04 LTS bundles openvswitch and vport-geneve into the
+    # main linux-image-generic and ships no linux-modules-extra-*
+    # package for kernel 7.x. The task below auto-skips on 26.04+,
+    # but if `ansible_distribution_version` is unreliable on a host
+    # (custom builds, derivatives), force-skip from inventory:
+    #   cozystack_ubuntu_extra_packages: []
     cozystack_ubuntu_extra_packages:
       - "linux-modules-extra-{{ ansible_kernel }}"
 
@@ -127,11 +134,17 @@
         state: present
         update_cache: true
 
+    # Auto-skip on Ubuntu 26.04+ (no linux-modules-extra-* for kernel
+    # 7.x, modules ship in linux-image-generic) and when the list is
+    # explicitly empty (inventory force-skip).
     - name: Install Ubuntu-only extra kernel modules
       ansible.builtin.apt:
         name: "{{ cozystack_ubuntu_extra_packages }}"
         state: present
-      when: ansible_distribution == 'Ubuntu'
+      when:
+        - ansible_distribution == 'Ubuntu'
+        - ansible_distribution_version is version('26.04', '<')
+        - cozystack_ubuntu_extra_packages | length > 0
 
     - name: Try loading optional kernel modules (may be built-in or missing)
       community.general.modprobe:
 
@@ -7,6 +7,12 @@
 # Usage:
 #   ansible-playbook site.yml
 
+# Ubuntu 26.04 ships sudo-rs as the default sudo alternative; ansible
+# `become_method: sudo` hangs against it. This play switches the
+# alternative back to classical sudo and is a no-op everywhere else.
+- name: Switch sudo alternative to classical sudo (Ubuntu 26.04+)
+  ansible.builtin.import_playbook: prepare-sudo.yml
+
 - name: Prepare Ubuntu/Debian nodes for Cozystack
   ansible.builtin.import_playbook: prepare-ubuntu.yml
 
 
@@ -15,11 +15,11 @@ cozystack_chart_version: "1.3.1"
 # Helm release name
 cozystack_release_name: "cozy-installer"
 
-# Kubernetes namespace where Cozystack operator and resources live
-cozystack_namespace: "cozy-system"
-
 # Namespace for the Helm release secret (the chart creates cozy-system
-# via its own template, so the release must live in a pre-existing namespace)
+# via its own template, so the release must live in a pre-existing namespace).
+# The operator namespace itself is fixed at `cozy-system` by the chart
+# (templates/cozystack-operator.yaml hardcodes the literal); there is no
+# values key to override it, so this role no longer exposes a variable.
 cozystack_release_namespace: "kube-system"
 
 # Operator deployment variant: generic, talos, hosted