Merge pull request #12 from cozystack/fix/multi-master-nodes

fix(kubeovn): derive MASTER_NODES from server group for multi-master support

Author: lexfrei

.github/workflows/test.yml

@@ -64,6 +64,49 @@ jobs:
         working-directory: ansible_collections/cozystack/installer
         run: ansible-test sanity --color
 
+  master-nodes:
+    name: Multi-master MASTER_NODES
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Install Ansible and dependencies
+        run: pip install ansible-core netaddr
+
+      - name: Install required collections
+        run: ansible-galaxy collection install ansible.utils
+
+      - name: Test auto-detection from server group (3 nodes)
+        run: >-
+          ansible-playbook tests/test-master-nodes.yml
+          --inventory tests/test-multi-master-inventory.yml
+
+      - name: Test single-node auto-detection (IP host key)
+        run: >-
+          ansible-playbook tests/test-master-nodes.yml
+          --inventory tests/test-single-master-inventory.yml
+
+      - name: Test single-node explicit override (CI inventory)
+        run: >-
+          ansible-playbook tests/test-master-nodes.yml
+          --inventory tests/ci-inventory.yml
+
+      - name: Test hostname host keys are rejected
+        run: |
+          if ansible-playbook tests/test-master-nodes.yml \
+            --inventory tests/test-hostname-inventory.yml 2>&1; then
+            echo "ERROR: Expected failure for hostname host keys, but playbook succeeded"
+            exit 1
+          else
+            echo "OK: Hostname host keys correctly rejected"
+          fi
+
   e2e:
     name: E2E
     runs-on: ubuntu-latest
@@ -76,8 +119,8 @@ jobs:
         with:
           python-version: "3.14"
 
-      - name: Install Ansible
-        run: pip install ansible-core
+      - name: Install Ansible and dependencies
+        run: pip install ansible-core netaddr
 
       - name: Build and install collection
         run: |

README.md

@@ -203,6 +203,7 @@ Runs on `server[0]` only.
 | `cozystack_pod_gateway` | `10.42.0.1` | Pod gateway |
 | `cozystack_svc_cidr` | `10.43.0.0/16` | Service CIDR |
 | `cozystack_join_cidr` | `100.64.0.0/16` | Join CIDR |
+| `cozystack_master_nodes` | `""` (auto-detect) | Comma-separated control-plane node IPs for kube-ovn RAFT. Empty = auto-detect from `server` group |
 | `cozystack_operator_wait_timeout` | `300` | Timeout for operator/CRD readiness (seconds) |
 
 ## Using with k3s
@@ -229,6 +230,31 @@ or `examples/suse/`:
 
 On cloud providers with NAT (OCI, AWS, GCP), nodes have internal IPs different from public IPs. KubeOVN validates the host IP against `NODE_IPS` and crashes if they don't match. Always use the IP visible on the node's network interface.
 
+### Multi-master setup (kube-ovn RAFT)
+
+Kube-ovn requires `MASTER_NODES` — a comma-separated list of all
+control-plane node IPs for OVN RAFT consensus. By default, the role
+auto-detects these IPs from the `server` inventory group host keys.
+
+This works when host keys are internal IPs (the recommended inventory
+pattern):
+
+```yaml
+server:
+  hosts:
+    10.0.0.10:
+      ansible_host: 203.0.113.10
+    10.0.0.11:
+      ansible_host: 203.0.113.11
+```
+
+If your inventory uses hostnames or non-IP host keys, set
+`cozystack_master_nodes` explicitly:
+
+```yaml
+cozystack_master_nodes: "10.0.0.10,10.0.0.11,10.0.0.12"
+```
+
 ### Automatic Helm installation
 
 The role installs Helm and the

examples/ubuntu/inventory.yml

@@ -3,15 +3,18 @@ cluster:
   children:
     server:
       hosts:
-        # Internal IP as host key, public IP as ansible_host
+        # Internal IP as host key, public IP as ansible_host.
+        # All server host keys are auto-collected as kube-ovn MASTER_NODES.
         10.0.0.10:
           ansible_host: 203.0.113.10
-    agent:
-      hosts:
         10.0.0.11:
           ansible_host: 203.0.113.11
         10.0.0.12:
           ansible_host: 203.0.113.12
+    agent:
+      hosts:
+        10.0.0.20:
+          ansible_host: 203.0.113.20
 
   vars:
     ansible_port: 22
@@ -26,6 +29,10 @@ cluster:
     # Cozystack configuration (REQUIRED)
     cozystack_api_server_host: "10.0.0.10"
 
+    # kube-ovn master nodes (auto-detected from 'server' group host keys).
+    # Override only if host keys are not internal IPs.
+    # cozystack_master_nodes: "10.0.0.10,10.0.0.11,10.0.0.12"
+
     # Platform Package configuration
     cozystack_root_host: "cozy.example.com"
     cozystack_platform_variant: "isp-full-generic"

galaxy.yml

@@ -16,6 +16,7 @@ homepage: https://cozystack.io
 documentation: https://cozystack.io/docs
 dependencies:
   ansible.posix: ">=1.0.0"
+  ansible.utils: ">=2.0.0"
   kubernetes.core: ">=5.0.0"
 tags:
   - infrastructure

requirements.yml

@@ -1,5 +1,6 @@
 ---
 collections:
   - name: ansible.posix
+  - name: ansible.utils
   - name: community.general
   - name: kubernetes.core

roles/cozystack/defaults/main.yml

@@ -53,6 +53,10 @@ cozystack_platform_variant: "isp-full-generic"
 # Leave empty to skip publishing config in the Platform Package
 cozystack_root_host: ""
 
+# Comma-separated control-plane node IPs for kube-ovn RAFT consensus.
+# Empty = auto-detect from 'server' inventory group host keys.
+cozystack_master_nodes: ""
+
 # Network CIDRs for the Platform Package (defaults match k3s)
 cozystack_pod_cidr: "10.42.0.0/16"
 cozystack_pod_gateway: "10.42.0.1"

roles/cozystack/tasks/compute-master-nodes.yml

@@ -0,0 +1,29 @@
+---
+# Compute and validate master node IPs for kube-ovn.
+# Included from main.yml and tests.
+- name: Compute master node IPs for kube-ovn
+  ansible.builtin.set_fact:
+    _cozystack_master_nodes: >-
+      {%- if cozystack_master_nodes | length > 0 -%}
+        {{ cozystack_master_nodes }}
+      {%- else -%}
+        {{ groups['server'] | join(',') }}
+      {%- endif -%}
+
+- name: Validate master node IPs are non-empty
+  ansible.builtin.assert:
+    that:
+      - _cozystack_master_nodes | length > 0
+    fail_msg: >-
+      Could not determine master node IPs for kube-ovn.
+      Set cozystack_master_nodes explicitly in your inventory.
+
+- name: Validate master node IPs are valid addresses
+  ansible.builtin.assert:
+    that:
+      - (item | ansible.utils.ipaddr) != false
+    fail_msg: >-
+      '{{ item }}' is not a valid IP address in MASTER_NODES.
+      Inventory host keys in the 'server' group must be IPs, not hostnames.
+      Alternatively, set cozystack_master_nodes explicitly.
+  loop: "{{ _cozystack_master_nodes.split(',') }}"

roles/cozystack/tasks/main.yml

@@ -9,6 +9,10 @@
       It must be the node's INTERNAL IP
       (visible on network interface, not public/NAT IP).
 
+- name: Compute and validate master node IPs for kube-ovn
+  ansible.builtin.include_tasks: compute-master-nodes.yml
+  when: cozystack_create_platform_package
+
 - name: Set architecture for Helm download
   ansible.builtin.set_fact:
     _cozystack_arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else 'arm64' }}"

roles/cozystack/templates/platform-package.yml.j2

@@ -16,7 +16,7 @@ spec:
             autoMount:
               enabled: true
         kube-ovn:
-          MASTER_NODES: {{ cozystack_api_server_host | to_json }}
+          MASTER_NODES: {{ _cozystack_master_nodes | to_json }}
     platform:
       values:
         networking:

tests/ci-inventory.yml

@@ -21,6 +21,7 @@ cluster:
 
     # Cozystack configuration
     cozystack_api_server_host: "127.0.0.1"
+    cozystack_master_nodes: "127.0.0.1"
     cozystack_root_host: "cozy.ci-test.local"
     cozystack_platform_variant: "isp-full-generic"