fix: install ipvsadm for kube-vip load balancing with nftables proxy

[isumitsolanki]

What type of PR is this?
/kind bug

What this PR does / why we need it:

ipvsadm and IPVS kernel modules were only installed when kube_proxy_mode was ipvs. When using kube_proxy_mode: nftables with kube-vip control plane load balancing enabled, ipvsadm was not installed even though kube-vip uses IPVS for local forwarding on control plane nodes.

This PR introduces a shared ipvs_required variable and uses it consistently for:

• ipvsadm package installation (system_packages)
• IPVS kernel module loading (kubernetes/node)
• IPVS table cleanup during reset (reset)

ipvs_required is true when:

• kube-proxy uses IPVS (kube_proxy_mode: ipvs and kube_proxy_remove: false), or
• kube-vip control plane load balancing is enabled (kube_vip_enabled and kube_vip_lb_enable) with a non-masquerade forwarding method (kube_vip_lb_fwdmethod != masquerade)

kube_vip_lb_enable is also added to kubespray_defaults so it is available during bootstrap when system_packages runs.

Which issue(s) this PR fixes:

Fixes #13321

Special notes for your reviewer:

Per triage on the issue, IPVS packages are gated on kube_vip_lb_enable, not just kube_vip_enabled. Users need both kube_vip_enabled: true and kube_vip_lb_enable: true for ipvsadm to be installed when kube_proxy_mode is nftables. With kube_vip_lb_fwdmethod: masquerade, ipvsadm is intentionally not installed since that mode uses iptables.

Does this PR introduce a user-facing change?:

NONE

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: isumitsolanki
Once this PR has been reviewed and has the lgtm label, please assign mzaian for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubernetes-prow]

Hi @isumitsolanki. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yankay]

/ok-to-test

[Copilot]

Pull request overview

This PR fixes missing IPVS tooling setup when using kube-vip control plane load balancing together with kube_proxy_mode: nftables, by introducing a shared ipvs_required toggle and using it across package install, kernel module loading, and reset cleanup paths.

Changes:

• Add ipvs_required to central defaults and use it to gate IPVS-related behavior.
• Install ipvsadm based on ipvs_required instead of only kube_proxy_mode: ipvs.
• Use ipvs_required to control IPVS module loading and IPVS table cleanup during reset.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
roles/system_packages/vars/main.yml	Gates ipvsadm installation on the new shared ipvs_required variable.
roles/reset/tasks/main.yml	Gates IPVS table cleanup during reset on ipvs_required.
roles/kubespray_defaults/defaults/main/main.yml	Introduces ipvs_required logic and adds a default for kube_vip_lb_enable.
roles/kubernetes/node/tasks/main.yml	Gates IPVS-related kernel module loading on ipvs_required.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tico88612]

Do we really need to add ipvs_required var? What's the reason for making this change?

[tico88612]

BTW this should not release-note-none, please write the release note.