update to latest 2.26.0 kubespray version and add dns zones settings to coredns

2024-12-14 21:56:19 +03:00
parent be9c8a28fd
commit 4294f52703
368 changed files with 37761 additions and 2942 deletions
--- a/kubespray/project/ansible_version.yml
+++ b/kubespray/project/ansible_version.yml
@@ -2,10 +2,10 @@
 - name: Check Ansible version
  hosts: all
  gather_facts: false
-  become: no
+  become: false
  run_once: true
  vars:
-    minimal_ansible_version: 2.15.5  # 2.15 versions before 2.15.5 are known to be buggy for kubespray
+    minimal_ansible_version: 2.16.4
    maximal_ansible_version: 2.17.0
  tags: always
  tasks:
@@ -25,7 +25,6 @@
      tags:
        - check

-    # CentOS 7 provides too old jinja version
    - name: "Check that jinja is not too old (install via pip)"
      assert:
        msg: "Your Jinja version is too old, install via pip"
--- a/kubespray/project/boilerplate.yml
+++ b/kubespray/project/boilerplate.yml
@@ -51,7 +51,7 @@

 - name: Install bastion ssh config
  hosts: bastion[0]
-  gather_facts: False
+  gather_facts: false
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
--- a/kubespray/project/cluster.yml
+++ b/kubespray/project/cluster.yml
@@ -7,17 +7,13 @@

 - name: Prepare for etcd install
  hosts: k8s_cluster:etcd
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
    - { role: kubernetes/preinstall, tags: preinstall }
-    - {
-        role: "container-engine",
-        tags: "container-engine",
-        when: deploy_container_engine,
-      }
+    - { role: "container-engine", tags: "container-engine", when: deploy_container_engine }
    - { role: download, tags: download, when: "not skip_downloads" }

 - name: Install etcd
@@ -25,7 +21,7 @@

 - name: Install Kubernetes nodes
  hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
@@ -34,7 +30,7 @@

 - name: Install the control plane
  hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
@@ -45,12 +41,12 @@

 - name: Invoke kubeadm and install a CNI
  hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
-    - { role: kubernetes/kubeadm, tags: kubeadm }
+    - { role: kubernetes/kubeadm, tags: kubeadm}
    - { role: kubernetes/node-label, tags: node-label }
    - { role: kubernetes/node-taint, tags: node-taint }
    - { role: network_plugin, tags: network }
@@ -58,50 +54,41 @@

 - name: Install Calico Route Reflector
  hosts: calico_rr
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
-    - { role: network_plugin/calico/rr, tags: ["network", "calico_rr"] }
+    - { role: network_plugin/calico/rr, tags: ['network', 'calico_rr'] }

 - name: Patch Kubernetes for Windows
  hosts: kube_control_plane[0]
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
    - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }

- name: Install Kubernetes and Helm apps
+- name: Install Kubernetes apps
  hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
-    - {
-        role: kubernetes-apps/external_cloud_controller,
-        tags: external-cloud-controller,
-      }
+    - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller }
    - { role: kubernetes-apps/network_plugin, tags: network }
    - { role: kubernetes-apps/policy_controller, tags: policy-controller }
    - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
    - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
    - { role: kubernetes-apps, tags: apps }
-    # - { role: helm-apps, tags: helm-apps }

 - name: Apply resolv.conf changes now that cluster DNS is up
  hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
-    - {
-        role: kubernetes/preinstall,
-        when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'",
-        tags: resolvconf,
-        dns_late: true,
-      }
+    - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }
--- a/kubespray/project/facts.yml
+++ b/kubespray/project/facts.yml
@@ -15,7 +15,7 @@

 - name: Gather facts
  hosts: k8s_cluster:etcd:calico_rr
-  gather_facts: False
+  gather_facts: false
  tags: always
  tasks:
    - name: Gather minimal facts
--- a/kubespray/project/install_etcd.yml
+++ b/kubespray/project/install_etcd.yml
@@ -16,7 +16,7 @@

 - name: Install etcd
  hosts: etcd:kube_control_plane:_kubespray_needs_etcd
-  gather_facts: False
+  gather_facts: false
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
--- a/kubespray/project/remove_node.yml
+++ b/kubespray/project/remove_node.yml
@@ -4,13 +4,13 @@

 - name: Confirm node removal
  hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}"
-  gather_facts: no
+  gather_facts: false
  tasks:
    - name: Confirm Execution
      pause:
        prompt: "Are you sure you want to delete nodes state? Type 'yes' to delete nodes."
      register: pause_result
-      run_once: True
+      run_once: true
      when:
        - not (skip_confirmation | default(false) | bool)

@@ -25,7 +25,7 @@

 - name: Reset node
  hosts: "{{ node | default('kube_node') }}"
-  gather_facts: no
+  gather_facts: false
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
@@ -36,7 +36,7 @@
 # Currently cannot remove first master or etcd
 - name: Post node removal
  hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}"
-  gather_facts: no
+  gather_facts: false
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
--- a/kubespray/project/reset.yml
+++ b/kubespray/project/reset.yml
@@ -7,13 +7,13 @@

 - name: Reset cluster
  hosts: etcd:k8s_cluster:calico_rr
-  gather_facts: False
+  gather_facts: false
  pre_tasks:
    - name: Reset Confirmation
      pause:
        prompt: "Are you sure you want to reset cluster state? Type 'yes' to reset your cluster."
      register: reset_confirmation_prompt
-      run_once: True
+      run_once: true
      when:
        - not (skip_confirmation | default(false) | bool)
        - reset_confirmation is not defined
--- a/kubespray/project/roles/adduser/defaults/main.yml
+++ b/kubespray/project/roles/adduser/defaults/main.yml
@@ -7,14 +7,14 @@ addusers:
  etcd:
    name: etcd
    comment: "Etcd user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
    shell: /sbin/nologin
  kube:
    name: kube
    comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
    shell: /sbin/nologin
    group: "{{ kube_cert_group }}"

--- a/kubespray/project/roles/adduser/vars/coreos.yml
+++ b/kubespray/project/roles/adduser/vars/coreos.yml
@@ -3,6 +3,6 @@ addusers:
  - name: kube
    comment: "Kubernetes user"
    shell: /sbin/nologin
-    system: yes
+    system: true
    group: "{{ kube_cert_group }}"
-    create_home: no
+    create_home: false
--- a/kubespray/project/roles/adduser/vars/debian.yml
+++ b/kubespray/project/roles/adduser/vars/debian.yml
@@ -2,14 +2,14 @@
 addusers:
  - name: etcd
    comment: "Etcd user"
-    create_home: yes
+    create_home: true
    home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
    shell: /sbin/nologin

  - name: kube
    comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
    shell: /sbin/nologin
    group: "{{ kube_cert_group }}"
--- a/kubespray/project/roles/adduser/vars/redhat.yml
+++ b/kubespray/project/roles/adduser/vars/redhat.yml
@@ -2,14 +2,14 @@
 addusers:
  - name: etcd
    comment: "Etcd user"
-    create_home: yes
+    create_home: true
    home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
    shell: /sbin/nologin

  - name: kube
    comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
    shell: /sbin/nologin
    group: "{{ kube_cert_group }}"
--- a/kubespray/project/roles/bastion-ssh-config/molecule/default/converge.yml
+++ b/kubespray/project/roles/bastion-ssh-config/molecule/default/converge.yml
@@ -12,4 +12,4 @@
        dest: "{{ ssh_bastion_confing__name }}"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
-        mode: 0644
+        mode: "0644"
--- a/kubespray/project/roles/bastion-ssh-config/tasks/main.yml
+++ b/kubespray/project/roles/bastion-ssh-config/tasks/main.yml
@@ -19,4 +19,4 @@
  template:
    src: "{{ ssh_bastion_confing__name }}.j2"
    dest: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}"
-    mode: 0640
+    mode: "0640"
--- a/kubespray/project/roles/bootstrap-os/defaults/main.yml
+++ b/kubespray/project/roles/bootstrap-os/defaults/main.yml
@@ -11,6 +11,10 @@ coreos_locksmithd_disable: false
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true

+## Ubuntu specific variables
+# Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
+ubuntu_kernel_unattended_upgrades_disabled: false
+
 fedora_coreos_packages:
  - python
  - python3-libselinux
--- a/kubespray/project/roles/bootstrap-os/molecule/default/converge.yml
+++ b/kubespray/project/roles/bootstrap-os/molecule/default/converge.yml
@@ -1,6 +1,6 @@
 ---
 - name: Converge
  hosts: all
-  gather_facts: no
+  gather_facts: false
  roles:
    - role: bootstrap-os
--- a/kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml
+++ b/kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml
@@ -19,12 +19,6 @@ platforms:
    memory: 1024
    provider_options:
      driver: kvm
-  - name: centos7
-    box: centos/7
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
  - name: almalinux8
    box: almalinux/8
    cpus: 1
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-amazon.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-amazon.yml
@@ -1,13 +1,16 @@
 ---
+- name: Enable selinux-ng repo for Amazon Linux for container-selinux
+  command: amazon-linux-extras enable selinux-ng
+
 - name: Enable EPEL repo for Amazon Linux
  yum_repository:
    name: epel
    file: epel
    description: Extra Packages for Enterprise Linux 7 - $basearch
    baseurl: http://download.fedoraproject.org/pub/epel/7/$basearch
-    gpgcheck: yes
+    gpgcheck: true
    gpgkey: http://download.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
-    skip_if_unavailable: yes
-    enabled: yes
-    repo_gpgcheck: no
+    skip_if_unavailable: true
+    enabled: true
+    repo_gpgcheck: false
  when: epel_enabled
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-coreos.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-coreos.yml
@@ -1,37 +0,0 @@
---
-# CoreOS ships without Python installed
-
- name: Check if bootstrap is needed
-  raw: stat /opt/bin/.bootstrapped
-  register: need_bootstrap
-  failed_when: false
-  changed_when: false
-  tags:
-    - facts
-
- name: Force binaries directory for Container Linux by CoreOS and Flatcar
-  set_fact:
-    bin_dir: "/opt/bin"
-  tags:
-    - facts
-
- name: Run bootstrap.sh
-  script: bootstrap.sh
-  become: true
-  environment: "{{ proxy_env }}"
-  when:
-    - need_bootstrap.rc != 0
-
- name: Set the ansible_python_interpreter fact
-  set_fact:
-    ansible_python_interpreter: "{{ bin_dir }}/python"
-  tags:
-    - facts
-
- name: Disable auto-upgrade
-  systemd:
-    name: locksmithd.service
-    masked: true
-    state: stopped
-  when:
-    - coreos_locksmithd_disable
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-centos.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-centos.yml
@@ -12,7 +12,7 @@
    value: "{{ http_proxy | default(omit) }}"
    state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
    no_extra_spaces: true
-    mode: 0644
+    mode: "0644"
  become: true
  when: not skip_http_proxy_on_os_packages

@@ -21,7 +21,7 @@
  get_url:
    url: https://yum.oracle.com/public-yum-ol7.repo
    dest: /etc/yum.repos.d/public-yum-ol7.repo
-    mode: 0644
+    mode: "0644"
  when:
    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
@@ -34,7 +34,7 @@
    section: "{{ item }}"
    option: enabled
    value: "1"
-    mode: 0644
+    mode: "0644"
  with_items:
    - ol7_latest
    - ol7_addons
@@ -59,7 +59,7 @@
    section: "ol{{ ansible_distribution_major_version }}_addons"
    option: "{{ item.option }}"
    value: "{{ item.value }}"
-    mode: 0644
+    mode: "0644"
  with_items:
    - { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
    - { option: "enabled", value: "1" }
@@ -75,12 +75,12 @@
    section: "extras"
    option: "{{ item.option }}"
    value: "{{ item.value }}"
-    mode: 0644
+    mode: "0644"
  with_items:
    - { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" }
    - { option: "enabled", value: "1" }
    - { option: "gpgcheck", value: "0" }
-    - { option: "baseurl", value: "http://mirror.centos.org/{{ 'altarch' if (ansible_distribution_major_version | int) <= 7 and ansible_architecture == 'aarch64' else 'centos' }}/{{ ansible_distribution_major_version }}/extras/$basearch/{% if ansible_distribution_major_version | int > 7 %}os/{% endif %}" }
+    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_distribution_major_version }}/extras/$basearch/os/" }
  when:
    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
@@ -92,9 +92,9 @@
 - name: Check presence of fastestmirror.conf
  stat:
    path: /etc/yum/pluginconf.d/fastestmirror.conf
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: fastestmirror

 # the fastestmirror plugin can actually slow down Ansible deployments
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-clearlinux.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-clearlinux.yml
@@ -7,7 +7,7 @@
    state: present

 - name: Make sure docker service is enabled
-  systemd:
+  systemd_service:
    name: docker
    masked: false
    enabled: true
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-debian.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-debian.yml
@@ -55,22 +55,10 @@
  raw: apt-get update --allow-releaseinfo-change
  become: true
  when:
-    - '''ID=debian'' in os_release.stdout_lines'
-    - '''VERSION_ID="10"'' in os_release.stdout_lines or ''VERSION_ID="11"'' in os_release.stdout_lines'
+    - os_release_dict['ID'] == 'debian'
+    - os_release_dict['VERSION_ID'] in ["10", "11"]
  register: bootstrap_update_apt_result
  changed_when:
    - '"changed its" in bootstrap_update_apt_result.stdout'
    - '"value from" in bootstrap_update_apt_result.stdout'
  ignore_errors: true
-
- name: Set the ansible_python_interpreter fact
-  set_fact:
-    ansible_python_interpreter: "/usr/bin/python3"
-
-# Workaround for https://github.com/ansible/ansible/issues/25543
- name: Install dbus for the hostname module
-  package:
-    name: dbus
-    state: present
-    use: apt
-  become: true
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-fedora-coreos.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-fedora-coreos.yml
@@ -28,7 +28,7 @@
  raw: "nohup bash -c 'sleep 5s && shutdown -r now'"
  become: true
  ignore_errors: true  # noqa ignore-errors
-  ignore_unreachable: yes
+  ignore_unreachable: true
  when: need_bootstrap.rc != 0

 - name: Wait for the reboot to complete
@@ -38,9 +38,3 @@
    delay: 5
    sleep: 5
  when: need_bootstrap.rc != 0
-
- name: Store the fact if this is an fedora core os host
-  set_fact:
-    is_fedora_coreos: True
-  tags:
-    - facts
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-fedora.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-fedora.yml
@@ -17,20 +17,14 @@
    value: "{{ http_proxy | default(omit) }}"
    state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
    no_extra_spaces: true
-    mode: 0644
+    mode: "0644"
  become: true
  when: not skip_http_proxy_on_os_packages

- name: Install python3 on fedora
-  raw: "dnf install --assumeyes --quiet python3"
+# libselinux-python3 is required on SELinux enabled hosts
+# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
+- name: Install ansible requirements
+  raw: "dnf install --assumeyes python3 python3-dnf libselinux-python3"
  become: true
  when:
    - need_bootstrap.rc != 0
-
-# libselinux-python3 is required on SELinux enabled hosts
-# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
- name: Install libselinux-python3
-  package:
-    name: libselinux-python3
-    state: present
-  become: true
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-flatcar.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-flatcar.yml
@@ -9,12 +9,6 @@
  tags:
    - facts

- name: Force binaries directory for Flatcar Container Linux by Kinvolk
-  set_fact:
-    bin_dir: "/opt/bin"
-  tags:
-    - facts
-
 - name: Run bootstrap.sh
  script: bootstrap.sh
  become: true
@@ -22,14 +16,17 @@
  when:
    - need_bootstrap.rc != 0

- name: Set the ansible_python_interpreter fact
+# Workaround ansible https://github.com/ansible/ansible/pull/82821
+# We set the interpreter rather than ansible_python_interpreter to allow
+# - using virtual env with task level ansible_python_interpreter later
+# - let users specify an ansible_python_interpreter in group_vars
+
+- name: Make interpreter discovery works on Flatcar
  set_fact:
-    ansible_python_interpreter: "{{ bin_dir }}/python"
-  tags:
-    - facts
+    ansible_interpreter_python_fallback: "{{ ansible_interpreter_python_fallback + [ '/opt/bin/python' ] }}"

 - name: Disable auto-upgrade
-  systemd:
+  systemd_service:
    name: locksmithd.service
    masked: true
    state: stopped
--- a/kubespray/project/roles/bootstrap-os/tasks/main.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/main.yml
@@ -6,57 +6,39 @@
  # This command should always run, even in check mode
  check_mode: false

- name: Bootstrap CentOS
-  include_tasks: bootstrap-centos.yml
-  when: '''ID="centos"'' in os_release.stdout_lines or ''ID="ol"'' in os_release.stdout_lines or ''ID="almalinux"'' in os_release.stdout_lines or ''ID="rocky"'' in os_release.stdout_lines or ''ID="kylin"'' in os_release.stdout_lines  or ''ID="uos"'' in os_release.stdout_lines or ''ID="openEuler"'' in os_release.stdout_lines'
+- name: Include distro specifics vars and tasks
+  vars:
+    os_release_dict: "{{ os_release.stdout_lines | select('regex', '^.+=.*$') | map('regex_replace', '\"', '') |
+                         map('split', '=') | community.general.dict }}"
+  block:
+  - name: Include vars
+    include_vars: "{{ item }}"
+    tags:
+    - facts
+    with_first_found:
+    - &search
+      files:
+      - "{{ os_release_dict['ID'] }}-{{ os_release_dict['VARIANT_ID'] }}.yml"
+      - "{{ os_release_dict['ID'] }}.yml"
+      paths:
+      - vars/
+      skip: true
+  - name: Include tasks
+    include_tasks: "{{ included_tasks_file }}"
+    with_first_found:
+    - <<: *search
+      paths: []
+    loop_control:
+      loop_var: included_tasks_file

- name: Bootstrap Amazon
-  include_tasks: bootstrap-amazon.yml
-  when: '''ID="amzn"'' in os_release.stdout_lines'
-
- name: Bootstrap RedHat
-  include_tasks: bootstrap-redhat.yml
-  when: '''ID="rhel"'' in os_release.stdout_lines'
-
- name: Bootstrap Clear Linux
-  include_tasks: bootstrap-clearlinux.yml
-  when: '''ID=clear-linux-os'' in os_release.stdout_lines'
-
-# Fedora CoreOS
- name: Bootstrap Fedora CoreOS
-  include_tasks: bootstrap-fedora-coreos.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' in os_release.stdout_lines'
-
- name: Bootstrap Flatcar
-  include_tasks: bootstrap-flatcar.yml
-  when: '''ID=flatcar'' in os_release.stdout_lines'
-
- name: Bootstrap Debian
-  include_tasks: bootstrap-debian.yml
-  when: '''ID=debian'' in os_release.stdout_lines or ''ID=ubuntu'' in os_release.stdout_lines'
-
-# Fedora "classic"
- name: Boostrap Fedora
-  include_tasks: bootstrap-fedora.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' not in os_release.stdout_lines'
-
- name: Bootstrap OpenSUSE
-  include_tasks: bootstrap-opensuse.yml
-  when: '''ID="opensuse-leap"'' in os_release.stdout_lines or ''ID="opensuse-tumbleweed"'' in os_release.stdout_lines'

 - name: Create remote_tmp for it is used by another module
  file:
    path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
    state: directory
-    mode: 0700
+    mode: "0700"

-# Workaround for https://github.com/ansible/ansible/issues/42726
-# (1/3)
- name: Gather host facts to get ansible_os_family
+- name: Gather facts
  setup:
    gather_subset: '!all'
    filter: ansible_*
@@ -64,39 +46,12 @@
 - name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
  hostname:
    name: "{{ inventory_hostname }}"
-  when:
-    - override_system_hostname
-    - ansible_os_family not in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    - not ansible_distribution == "Fedora"
-    - not is_fedora_coreos
-
-# (2/3)
- name: Assign inventory name to unconfigured hostnames (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  command: "hostnamectl set-hostname {{ inventory_hostname }}"
-  register: hostname_changed
-  become: true
-  changed_when: false
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
-
-# (3/3)
- name: Update hostname fact (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  setup:
-    gather_subset: '!all'
-    filter: ansible_hostname
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
+  when: override_system_hostname

 - name: Install ceph-commmon package
  package:
    name:
-      - ceph-common
+    - ceph-common
    state: present
  when: rbd_provisioner_enabled | default(false)

@@ -106,4 +61,4 @@
    state: directory
    owner: root
    group: root
-    mode: 0755
+    mode: "0755"
--- a/kubespray/project/roles/bootstrap-os/tasks/openEuler.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/openEuler.yml
@@ -0,0 +1,3 @@
+---
+- name: Import Centos boostrap for openEuler
+  import_tasks: centos.yml
--- a/kubespray/project/roles/bootstrap-os/tasks/opensuse-leap.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/opensuse-leap.yml
@@ -0,0 +1,3 @@
+---
+- name: Import Opensuse bootstrap
+  import_tasks: opensuse.yml
--- a/kubespray/project/roles/bootstrap-os/tasks/opensuse-tumbleweed.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/opensuse-tumbleweed.yml
@@ -0,0 +1,3 @@
+---
+- name: Import Opensuse bootstrap
+  import_tasks: opensuse.yml
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-opensuse.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-opensuse.yml
@@ -8,9 +8,9 @@
 - name: Check that /etc/sysconfig/proxy file exists
  stat:
    path: /etc/sysconfig/proxy
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: stat_result

 - name: Create the /etc/sysconfig/proxy empty file
--- a/kubespray/project/roles/bootstrap-os/tasks/bootstrap-redhat.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/bootstrap-redhat.yml
@@ -12,7 +12,7 @@
    value: "{{ http_proxy | default(omit) }}"
    state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
    no_extra_spaces: true
-    mode: 0644
+    mode: "0644"
  become: true
  when: not skip_http_proxy_on_os_packages

@@ -62,17 +62,6 @@
    - rh_subscription_username is defined
    - rh_subscription_status.changed

-# container-selinux is in extras repo
- name: Enable RHEL 7 repos
-  community.general.rhsm_repository:
-    name:
-      - "rhel-7-server-rpms"
-      - "rhel-7-server-extras-rpms"
-    state: "{{ 'enabled' if (rhel_enable_repos | default(True) | bool) else 'disabled' }}"
-  when:
-    - ansible_distribution_major_version == "7"
-    - (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)
-
 # container-selinux is in appstream repo
 - name: Enable RHEL 8 repos
  community.general.rhsm_repository:
@@ -87,9 +76,9 @@
 - name: Check presence of fastestmirror.conf
  stat:
    path: /etc/yum/pluginconf.d/fastestmirror.conf
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: fastestmirror

 # the fastestmirror plugin can actually slow down Ansible deployments
--- a/kubespray/project/roles/bootstrap-os/tasks/ubuntu.yml
+++ b/kubespray/project/roles/bootstrap-os/tasks/ubuntu.yml
@@ -0,0 +1,21 @@
+---
+- name: Import Debian bootstrap
+  import_tasks: debian.yml
+
+- name: Check unattended-upgrades file exist
+  stat:
+    path: /etc/apt/apt.conf.d/50unattended-upgrades
+  register: unattended_upgrades_file_stat
+  when:
+    - ubuntu_kernel_unattended_upgrades_disabled
+
+- name: Disable kernel unattended-upgrades
+  lineinfile:
+    path: "{{ unattended_upgrades_file_stat.stat.path }}"
+    insertafter: "Unattended-Upgrade::Package-Blacklist"
+    line: '"linux-";'
+    state: present
+  become: true
+  when:
+    - ubuntu_kernel_unattended_upgrades_disabled
+    - unattended_upgrades_file_stat.stat.exists
--- a/kubespray/project/roles/bootstrap-os/vars/fedora-coreos.yml
+++ b/kubespray/project/roles/bootstrap-os/vars/fedora-coreos.yml
@@ -0,0 +1,2 @@
+---
+is_fedora_coreos: true
--- a/kubespray/project/roles/bootstrap-os/vars/flatcar.yml
+++ b/kubespray/project/roles/bootstrap-os/vars/flatcar.yml
@@ -0,0 +1,2 @@
+---
+bin_dir: "/opt/bin"
--- a/kubespray/project/roles/container-engine/containerd-common/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/containerd-common/tasks/main.yml
@@ -2,9 +2,9 @@
 - name: Containerd-common | check if fedora coreos
  stat:
    path: /run/ostree-booted
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: ostree

 - name: Containerd-common | set is_ostree
--- a/kubespray/project/roles/container-engine/containerd/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/containerd/defaults/main.yml
@@ -46,7 +46,11 @@ containerd_base_runtime_specs:
 containerd_grpc_max_recv_message_size: 16777216
 containerd_grpc_max_send_message_size: 16777216

+containerd_debug_address: ""
 containerd_debug_level: "info"
+containerd_debug_format: ""
+containerd_debug_uid: 0
+containerd_debug_gid: 0

 containerd_metrics_address: ""

@@ -66,6 +70,12 @@ containerd_enable_unprivileged_ports: false
 # If enabled it will allow non root users to use icmp sockets
 containerd_enable_unprivileged_icmp: false

+containerd_enable_selinux: false
+containerd_disable_apparmor: false
+containerd_tolerate_missing_hugetlb_controller: true
+containerd_disable_hugetlb_controller: true
+containerd_image_pull_progress_timeout: 5m
+
 containerd_cfg_dir: /etc/containerd

 # Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally
@@ -109,3 +119,11 @@ containerd_supported_distributions:

 # Enable container device interface
 enable_cdi: false
+
+# For containerd tracing configuration please check out the official documentation:
+# https://github.com/containerd/containerd/blob/main/docs/tracing.md
+containerd_tracing_enabled: false
+containerd_tracing_endpoint: "0.0.0.0:4317"
+containerd_tracing_protocol: "grpc"
+containerd_tracing_sampling_ratio: 1.0
+containerd_tracing_service_name: "containerd"
--- a/kubespray/project/roles/container-engine/containerd/handlers/main.yml
+++ b/kubespray/project/roles/container-engine/containerd/handlers/main.yml
@@ -1,11 +1,11 @@
 ---
 - name: Containerd | restart containerd
-  systemd:
+  systemd_service:
    name: containerd
    state: restarted
-    enabled: yes
-    daemon-reload: yes
-    masked: no
+    enabled: true
+    daemon-reload: true
+    masked: false
  listen: Restart containerd

 - name: Containerd | wait for containerd
--- a/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml
@@ -1,7 +1,7 @@
 ---
 - name: Prepare
  hosts: all
-  gather_facts: False
+  gather_facts: false
  become: true
  vars:
    ignore_assert_errors: true
@@ -19,7 +19,7 @@

 - name: Prepare CNI
  hosts: all
-  gather_facts: False
+  gather_facts: false
  become: true
  vars:
    ignore_assert_errors: true
--- a/kubespray/project/roles/container-engine/containerd/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/containerd/tasks/main.yml
@@ -35,8 +35,8 @@
  unarchive:
    src: "{{ downloads.containerd.dest }}"
    dest: "{{ containerd_bin_dir }}"
-    mode: 0755
-    remote_src: yes
+    mode: "0755"
+    remote_src: true
    extra_opts:
      - --strip-components=1
  notify: Restart containerd
@@ -60,7 +60,7 @@
  template:
    src: containerd.service.j2
    dest: /etc/systemd/system/containerd.service
-    mode: 0644
+    mode: "0644"
    validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:containerd.service'"
    # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
    # Remove once we drop support for systemd < 250
@@ -70,7 +70,7 @@
  file:
    dest: "{{ item }}"
    state: directory
-    mode: 0755
+    mode: "0755"
    owner: root
    group: root
  with_items:
@@ -83,7 +83,7 @@
  template:
    src: http-proxy.conf.j2
    dest: "{{ containerd_systemd_dir }}/http-proxy.conf"
-    mode: 0644
+    mode: "0644"
  notify: Restart containerd
  when: http_proxy is defined or https_proxy is defined

@@ -102,7 +102,7 @@
    content: "{{ item.value }}"
    dest: "{{ containerd_cfg_dir }}/{{ item.key }}"
    owner: "root"
-    mode: 0644
+    mode: "0644"
  with_dict: "{{ containerd_base_runtime_specs | default({}) }}"
  notify: Restart containerd

@@ -111,7 +111,7 @@
    src: config.toml.j2
    dest: "{{ containerd_cfg_dir }}/config.toml"
    owner: "root"
-    mode: 0640
+    mode: "0640"
  notify: Restart containerd

 - name: Containerd | Configure containerd registries
@@ -121,13 +121,13 @@
      file:
        path: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}"
        state: directory
-        mode: 0755
+        mode: "0755"
      loop: "{{ containerd_registries_mirrors }}"
    - name: Containerd | Write hosts.toml file
      template:
        src: hosts.toml.j2
        dest: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}/hosts.toml"
-        mode: 0640
+        mode: "0640"
      loop: "{{ containerd_registries_mirrors }}"

 # you can sometimes end up in a state where everything is installed
@@ -136,8 +136,8 @@
  meta: flush_handlers

 - name: Containerd | Ensure containerd is started and enabled
-  systemd:
+  systemd_service:
    name: containerd
-    daemon_reload: yes
-    enabled: yes
+    daemon_reload: true
+    enabled: true
    state: started
--- a/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2
+++ b/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2
@@ -3,12 +3,20 @@ root = "{{ containerd_storage_dir }}"
 state = "{{ containerd_state_dir }}"
 oom_score = {{ containerd_oom_score }}

+{% if containerd_extra_args is defined %}
+{{ containerd_extra_args }}
+{% endif %}
+
 [grpc]
  max_recv_message_size = {{ containerd_grpc_max_recv_message_size }}
  max_send_message_size = {{ containerd_grpc_max_send_message_size }}

 [debug]
+  address = "{{ containerd_debug_address }}"
  level = "{{ containerd_debug_level }}"
+  format = "{{ containerd_debug_format }}"
+  uid = {{ containerd_debug_uid }}
+  gid = {{ containerd_debug_gid }}

 [metrics]
  address = "{{ containerd_metrics_address }}"
@@ -20,6 +28,11 @@ oom_score = {{ containerd_oom_score }}
    max_container_log_line_size = {{ containerd_max_container_log_line_size }}
    enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
    enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
+    enable_selinux = {{ containerd_enable_selinux | lower }}
+    disable_apparmor = {{ containerd_disable_apparmor | lower }}
+    tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
+    disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
+    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
 {% if enable_cdi %}
    enable_cdi = true
    cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
@@ -92,6 +105,14 @@ oom_score = {{ containerd_oom_score }}
    disable = false
 {% endif %}

-{% if containerd_extra_args is defined %}
-{{ containerd_extra_args }}
+{% if containerd_tracing_enabled %}
+  [plugins."io.containerd.tracing.processor.v1.otlp"]
+    endpoint = "{{ containerd_tracing_endpoint }}"
+    protocol = "{{ containerd_tracing_protocol }}"
+{% if containerd_tracing_protocol == "grpc" %}
+    insecure = false
+{% endif %}
+  [plugins."io.containerd.internal.v1.tracing"]
+    sampling_ratio = {{ containerd_tracing_sampling_ratio }}
+    service_name = "{{ containerd_tracing_service_name }}"
 {% endif %}
--- a/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2
+++ b/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2
@@ -1,4 +1,4 @@
-server = "https://{{ item.prefix }}"
+server = "{{ item.server | default("https://" + item.prefix) }}"
 {% for mirror in item.mirrors %}
 [host."{{ mirror.host }}"]
  capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"]
--- a/kubespray/project/roles/container-engine/cri-dockerd/handlers/main.yml
+++ b/kubespray/project/roles/container-engine/cri-dockerd/handlers/main.yml
@@ -1,9 +1,9 @@
 ---
 - name: Cri-dockerd | reload systemd
-  systemd:
+  systemd_service:
    name: cri-dockerd
    daemon_reload: true
-    masked: no
+    masked: false
  listen: Restart and enable cri-dockerd

 - name: Cri-dockerd | restart docker.service
@@ -27,5 +27,5 @@
 - name: Cri-dockerd | enable cri-dockerd service
  service:
    name: cri-dockerd.service
-    enabled: yes
+    enabled: true
  listen: Restart and enable cri-dockerd
--- a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml
@@ -28,7 +28,7 @@
        src: "{{ item }}"
        dest: "/tmp/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - container.json
        - sandbox.json
@@ -37,12 +37,12 @@
        path: /etc/cni/net.d
        state: directory
        owner: "{{ kube_owner }}"
-        mode: 0755
+        mode: "0755"
    - name: Setup CNI
      copy:
        src: "{{ item }}"
        dest: "/etc/cni/net.d/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - 10-mynet.conf
--- a/kubespray/project/roles/container-engine/cri-dockerd/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/cri-dockerd/tasks/main.yml
@@ -8,7 +8,7 @@
  copy:
    src: "{{ local_release_dir }}/cri-dockerd"
    dest: "{{ bin_dir }}/cri-dockerd"
-    mode: 0755
+    mode: "0755"
    remote_src: true
  notify:
    - Restart and enable cri-dockerd
@@ -17,7 +17,7 @@
  template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
-    mode: 0644
+    mode: "0644"
    validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{ item }}'"
    # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
    # Remove once we drop support for systemd < 250
--- a/kubespray/project/roles/container-engine/cri-o/handlers/main.yml
+++ b/kubespray/project/roles/container-engine/cri-o/handlers/main.yml
@@ -1,6 +1,6 @@
 ---
 - name: CRI-O | reload systemd
-  systemd:
+  systemd_service:
    daemon_reload: true
  listen: Restart crio

@@ -8,5 +8,5 @@
  service:
    name: crio
    state: restarted
-    enabled: yes
+    enabled: true
  listen: Restart crio
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml
@@ -1,7 +1,7 @@
 ---
 - name: Prepare
  hosts: all
-  gather_facts: False
+  gather_facts: false
  become: true
  vars:
    ignore_assert_errors: true
@@ -19,7 +19,7 @@

 - name: Prepare CNI
  hosts: all
-  gather_facts: False
+  gather_facts: false
  become: true
  vars:
    ignore_assert_errors: true
@@ -33,7 +33,7 @@
        src: "{{ item }}"
        dest: "/tmp/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - container.json
        - sandbox.json
@@ -42,12 +42,12 @@
        path: /etc/cni/net.d
        state: directory
        owner: "{{ kube_owner }}"
-        mode: 0755
+        mode: "0755"
    - name: Setup CNI
      copy:
        src: "{{ item }}"
        dest: "/etc/cni/net.d/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - 10-mynet.conf
--- a/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml
@@ -5,9 +5,9 @@
 - name: Cri-o | check if fedora coreos
  stat:
    path: /run/ostree-booted
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: ostree

 - name: Cri-o | set is_ostree
@@ -56,27 +56,27 @@
  file:
    path: "{{ item }}"
    state: directory
-    mode: 0755
+    mode: "0755"

 - name: Cri-o | install cri-o config
  template:
    src: crio.conf.j2
    dest: /etc/crio/crio.conf
-    mode: 0644
+    mode: "0644"
  register: config_install

 - name: Cri-o | install config.json
  template:
    src: config.json.j2
    dest: /etc/crio/config.json
-    mode: 0644
+    mode: "0644"
  register: reg_auth_install

 - name: Cri-o | copy binaries
  copy:
    src: "{{ local_release_dir }}/cri-o/bin/{{ item }}"
    dest: "{{ bin_dir }}/{{ item }}"
-    mode: 0755
+    mode: "0755"
    remote_src: true
  with_items:
    - "{{ crio_bin_files }}"
@@ -86,10 +86,24 @@
  copy:
    src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
    dest: /etc/systemd/system/crio.service
-    mode: 0755
+    mode: "0755"
    remote_src: true
  notify: Restart crio

+- name: Cri-o | configure crio to use kube reserved cgroups
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/crio.service.d/00-slice.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      [Service]
+      Slice={{ kube_reserved_cgroups_for_service_slice }}
+  notify: Restart crio
+  when:
+    - kube_reserved is defined and kube_reserved is true
+    - kube_reserved_cgroups_for_service_slice is defined
+
 - name: Cri-o | update the bin dir for crio.service file
  replace:
    dest: /etc/systemd/system/crio.service
@@ -101,7 +115,7 @@
  copy:
    src: "{{ local_release_dir }}/cri-o/contrib/policy.json"
    dest: /etc/containers/policy.json
-    mode: 0755
+    mode: "0755"
    remote_src: true
  notify: Restart crio

@@ -109,7 +123,7 @@
  copy:
    src: mounts.conf
    dest: /etc/containers/mounts.conf
-    mode: 0644
+    mode: "0644"
  when:
    - ansible_os_family == 'RedHat'
  notify: Restart crio
@@ -119,7 +133,7 @@
    path: /etc/containers/oci/hooks.d
    state: directory
    owner: root
-    mode: 0755
+    mode: "0755"

 - name: Cri-o | set overlay driver
  community.general.ini_file:
@@ -127,7 +141,7 @@
    section: storage
    option: "{{ item.option }}"
    value: "{{ item.value }}"
-    mode: 0644
+    mode: "0644"
  with_items:
    - option: driver
      value: '"overlay"'
@@ -143,20 +157,20 @@
    section: storage.options.overlay
    option: mountopt
    value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
-    mode: 0644
+    mode: "0644"

 - name: Cri-o | create directory registries configs
  file:
    path: /etc/containers/registries.conf.d
    state: directory
    owner: root
-    mode: 0755
+    mode: "0755"

 - name: Cri-o | write registries configs
  template:
    src: registry.conf.j2
-    dest: "/etc/containers/registries.conf.d/10-{{ item.prefix | default(item.location) | regex_replace(':', '_') }}.conf"
-    mode: 0644
+    dest: "/etc/containers/registries.conf.d/10-{{ item.prefix | default(item.location) | regex_replace(':|/', '_') }}.conf"
+    mode: "0644"
  loop: "{{ crio_registries }}"
  notify: Restart crio

@@ -164,14 +178,14 @@
  template:
    src: unqualified.conf.j2
    dest: "/etc/containers/registries.conf.d/01-unqualified.conf"
-    mode: 0644
+    mode: "0644"
  notify: Restart crio

 - name: Cri-o | write cri-o proxy drop-in
  template:
    src: http-proxy.conf.j2
    dest: /etc/systemd/system/crio.service.d/http-proxy.conf
-    mode: 0644
+    mode: "0644"
  notify: Restart crio
  when: http_proxy is defined or https_proxy is defined

--- a/kubespray/project/roles/container-engine/cri-o/tasks/setup-amazon.yaml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/setup-amazon.yaml
@@ -8,7 +8,7 @@
  lineinfile:
    dest: /etc/yum.repos.d/amzn2-extras.repo
    line: "[amzn2extra-docker]"
-  check_mode: yes
+  check_mode: true
  register: amzn2_extras_docker_repo
  when:
    - amzn2_extras_file_stat.stat.exists
@@ -19,20 +19,8 @@
    section: amzn2extra-docker
    option: enabled
    value: "0"
-    backup: yes
-    mode: 0644
+    backup: true
+    mode: "0644"
  when:
    - amzn2_extras_file_stat.stat.exists
    - not amzn2_extras_docker_repo.changed
-
- name: Add container-selinux yum repo
-  yum_repository:
-    name: copr:copr.fedorainfracloud.org:lsm5:container-selinux
-    file: _copr_lsm5-container-selinux.repo
-    description: Copr repo for container-selinux owned by lsm5
-    baseurl: https://download.copr.fedorainfracloud.org/results/lsm5/container-selinux/epel-7-$basearch/
-    gpgcheck: yes
-    gpgkey: https://download.copr.fedorainfracloud.org/results/lsm5/container-selinux/pubkey.gpg
-    skip_if_unavailable: yes
-    enabled: yes
-    repo_gpgcheck: no
--- a/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml
+++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml
@@ -1,8 +1,12 @@
 ---
+crio_conmon: "{{ bin_dir }}/crio-conmon"
+
 # cri-o binary files
 crio_bin_files:
-  - conmon
-  - conmonrs
+  - crio-conmon
+  - crio-conmonrs
+  - crio-crun
+  - crio-runc
  - crio
  - pinns

--- a/kubespray/project/roles/container-engine/crictl/handlers/main.yml
+++ b/kubespray/project/roles/container-engine/crictl/handlers/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Get crictl completion
  command: "{{ bin_dir }}/crictl completion"
-  changed_when: False
+  changed_when: false
  register: cri_completion
  check_mode: false

@@ -9,4 +9,4 @@
  copy:
    dest: /etc/bash_completion.d/crictl
    content: "{{ cri_completion.stdout }}"
-    mode: 0644
+    mode: "0644"
--- a/kubespray/project/roles/container-engine/crictl/tasks/crictl.yml
+++ b/kubespray/project/roles/container-engine/crictl/tasks/crictl.yml
@@ -9,13 +9,13 @@
    src: crictl.yaml.j2
    dest: /etc/crictl.yaml
    owner: root
-    mode: 0644
+    mode: "0644"

 - name: Copy crictl binary from download dir
  copy:
    src: "{{ local_release_dir }}/crictl"
    dest: "{{ bin_dir }}/crictl"
-    mode: 0755
+    mode: "0755"
    remote_src: true
  notify:
    - Get crictl completion
--- a/kubespray/project/roles/container-engine/crun/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/crun/tasks/main.yml
@@ -8,5 +8,5 @@
  copy:
    src: "{{ downloads.crun.dest }}"
    dest: "{{ bin_dir }}/crun"
-    mode: 0755
+    mode: "0755"
    remote_src: true
--- a/kubespray/project/roles/container-engine/docker-storage/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/docker-storage/defaults/main.yml
@@ -1,19 +0,0 @@
---
-docker_container_storage_setup_repository: https://github.com/projectatomic/container-storage-setup.git
-docker_container_storage_setup_version: v0.6.0
-docker_container_storage_setup_profile_name: kubespray
-docker_container_storage_setup_storage_driver: devicemapper
-docker_container_storage_setup_container_thinpool: docker-pool
-# It must be define a disk path for docker_container_storage_setup_devs.
-# Otherwise docker-storage-setup will be executed incorrectly.
-# docker_container_storage_setup_devs: /dev/vdb
-docker_container_storage_setup_data_size: 40%FREE
-docker_container_storage_setup_min_data_size: 2G
-docker_container_storage_setup_chunk_size: 512K
-docker_container_storage_setup_growpart: "false"
-docker_container_storage_setup_auto_extend_pool: "yes"
-docker_container_storage_setup_pool_autoextend_threshold: 60
-docker_container_storage_setup_pool_autoextend_percent: 20
-docker_container_storage_setup_device_wait_timeout: 60
-docker_container_storage_setup_wipe_signatures: "false"
-docker_container_storage_setup_container_root_lv_size: 40%FREE
--- a/kubespray/project/roles/container-engine/docker-storage/files/install_container_storage_setup.sh
+++ b/kubespray/project/roles/container-engine/docker-storage/files/install_container_storage_setup.sh
@@ -1,23 +0,0 @@
-#!/bin/sh
-
-set -e
-
-repository=${1:-https://github.com/projectatomic/container-storage-setup.git}
-version=${2:-master}
-profile_name=${3:-kubespray}
-dir=`mktemp -d`
-export GIT_DIR=$dir/.git
-export GIT_WORK_TREE=$dir
-
-git init
-git fetch --depth 1 $repository $version
-git merge FETCH_HEAD
-make -C $dir install
-rm -rf /var/lib/container-storage-setup/$profile_name $dir
-
-set +e
-
-/usr/bin/container-storage-setup create $profile_name /etc/sysconfig/docker-storage-setup && /usr/bin/container-storage-setup activate $profile_name
-# FIXME: exit status can be 1 for both fatal and non fatal errors in current release,
-# could be improved by matching error strings
-exit 0
--- a/kubespray/project/roles/container-engine/docker-storage/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/docker-storage/tasks/main.yml
@@ -1,48 +0,0 @@
---
-
- name: Docker-storage-setup | install git and make
-  with_items: [git, make]
-  package:
-    pkg: "{{ item }}"
-    state: present
-
- name: Docker-storage-setup | docker-storage-setup sysconfig template
-  template:
-    src: docker-storage-setup.j2
-    dest: /etc/sysconfig/docker-storage-setup
-    mode: 0644
-
- name: Docker-storage-override-directory | docker service storage-setup override dir
-  file:
-    dest: /etc/systemd/system/docker.service.d
-    mode: 0755
-    owner: root
-    group: root
-    state: directory
-
- name: Docker-storage-override | docker service storage-setup override file
-  copy:
-    dest: /etc/systemd/system/docker.service.d/override.conf
-    content: |-
-      ### This file is managed by Ansible
-      [Service]
-      EnvironmentFile=-/etc/sysconfig/docker-storage
-
-    owner: root
-    group: root
-    mode: 0644
-
-# https://docs.docker.com/engine/installation/linux/docker-ce/centos/#install-using-the-repository
- name: Docker-storage-setup | install lvm2
-  package:
-    name: lvm2
-    state: present
-
- name: Docker-storage-setup | install and run container-storage-setup
-  become: yes
-  script: |
-    install_container_storage_setup.sh \
-      {{ docker_container_storage_setup_repository }} \
-      {{ docker_container_storage_setup_version }} \
-      {{ docker_container_storage_setup_profile_name }}
-  notify: Docker | reload systemd
--- a/kubespray/project/roles/container-engine/docker-storage/templates/docker-storage-setup.j2
+++ b/kubespray/project/roles/container-engine/docker-storage/templates/docker-storage-setup.j2
@@ -1,35 +0,0 @@
-{%if docker_container_storage_setup_storage_driver is defined%}STORAGE_DRIVER={{docker_container_storage_setup_storage_driver}}{%endif%}
-
-{%if docker_container_storage_setup_extra_storage_options is defined%}EXTRA_STORAGE_OPTIONS={{docker_container_storage_setup_extra_storage_options}}{%endif%}
-
-{%if docker_container_storage_setup_devs is defined%}DEVS={{docker_container_storage_setup_devs}}{%endif%}
-
-{%if docker_container_storage_setup_container_thinpool is defined%}CONTAINER_THINPOOL={{docker_container_storage_setup_container_thinpool}}{%endif%}
-
-{%if docker_container_storage_setup_vg is defined%}VG={{docker_container_storage_setup_vg}}{%endif%}
-
-{%if docker_container_storage_setup_root_size is defined%}ROOT_SIZE={{docker_container_storage_setup_root_size}}{%endif%}
-
-{%if docker_container_storage_setup_data_size is defined%}DATA_SIZE={{docker_container_storage_setup_data_size}}{%endif%}
-
-{%if docker_container_storage_setup_min_data_size is defined%}MIN_DATA_SIZE={{docker_container_storage_setup_min_data_size}}{%endif%}
-
-{%if docker_container_storage_setup_chunk_size is defined%}CHUNK_SIZE={{docker_container_storage_setup_chunk_size}}{%endif%}
-
-{%if docker_container_storage_setup_growpart is defined%}GROWPART={{docker_container_storage_setup_growpart}}{%endif%}
-
-{%if docker_container_storage_setup_auto_extend_pool is defined%}AUTO_EXTEND_POOL={{docker_container_storage_setup_auto_extend_pool}}{%endif%}
-
-{%if docker_container_storage_setup_pool_autoextend_threshold is defined%}POOL_AUTOEXTEND_THRESHOLD={{docker_container_storage_setup_pool_autoextend_threshold}}{%endif%}
-
-{%if docker_container_storage_setup_pool_autoextend_percent is defined%}POOL_AUTOEXTEND_PERCENT={{docker_container_storage_setup_pool_autoextend_percent}}{%endif%}
-
-{%if docker_container_storage_setup_device_wait_timeout is defined%}DEVICE_WAIT_TIMEOUT={{docker_container_storage_setup_device_wait_timeout}}{%endif%}
-
-{%if docker_container_storage_setup_wipe_signatures is defined%}WIPE_SIGNATURES={{docker_container_storage_setup_wipe_signatures}}{%endif%}
-
-{%if docker_container_storage_setup_container_root_lv_name is defined%}CONTAINER_ROOT_LV_NAME={{docker_container_storage_setup_container_root_lv_name}}{%endif%}
-
-{%if docker_container_storage_setup_container_root_lv_size is defined%}CONTAINER_ROOT_LV_SIZE={{docker_container_storage_setup_container_root_lv_size}}{%endif%}
-
-{%if docker_container_storage_setup_container_root_lv_mount_path is defined%}CONTAINER_ROOT_LV_MOUNT_PATH={{docker_container_storage_setup_container_root_lv_mount_path}}{%endif%}
--- a/kubespray/project/roles/container-engine/docker/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/docker/defaults/main.yml
@@ -1,5 +1,5 @@
 ---
-docker_version: '24.0'
+docker_version: '26.1'
 docker_cli_version: "{{ docker_version }}"

 docker_package_info:
--- a/kubespray/project/roles/container-engine/docker/handlers/main.yml
+++ b/kubespray/project/roles/container-engine/docker/handlers/main.yml
@@ -1,9 +1,9 @@
 ---
 - name: Docker | reload systemd
-  systemd:
+  systemd_service:
    name: docker
    daemon_reload: true
-    masked: no
+    masked: false
  listen: Restart docker

 - name: Docker | reload docker.socket
--- a/kubespray/project/roles/container-engine/docker/meta/main.yml
+++ b/kubespray/project/roles/container-engine/docker/meta/main.yml
@@ -1,5 +1,3 @@
 ---
 dependencies:
  - role: container-engine/containerd-common
-  - role: container-engine/docker-storage
-    when: docker_container_storage_setup and ansible_os_family == "RedHat"
--- a/kubespray/project/roles/container-engine/docker/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/docker/tasks/main.yml
@@ -2,22 +2,15 @@
 - name: Check if fedora coreos
  stat:
    path: /run/ostree-booted
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: ostree

 - name: Set is_ostree
  set_fact:
    is_ostree: "{{ ostree.stat.exists }}"

- name: Set docker_version for openEuler
-  set_fact:
-    docker_version: '19.03'
-  when: ansible_distribution == "openEuler"
-  tags:
-    - facts
-
 - name: Gather os specific variables
  include_vars: "{{ item }}"
  with_first_found:
@@ -67,6 +60,17 @@
  environment: "{{ proxy_env }}"
  when: ansible_pkg_mgr == 'apt'

+# ref to https://github.com/kubernetes-sigs/kubespray/issues/11086
+- name: Remove the archived debian apt repository
+  lineinfile:
+    path: /etc/apt/sources.list
+    regexp: 'buster-backports'
+    state: absent
+    backup: true
+  when:
+    - ansible_os_family == 'Debian'
+    - ansible_distribution_release == "buster"
+
 - name: Ensure docker-ce repository is enabled
  apt_repository:
    repo: "{{ item }}"
@@ -78,14 +82,14 @@
  template:
    src: "fedora_docker.repo.j2"
    dest: "{{ yum_repo_dir }}/docker.repo"
-    mode: 0644
+    mode: "0644"
  when: ansible_distribution == "Fedora" and not is_ostree

 - name: Configure docker repository on RedHat/CentOS/OracleLinux/AlmaLinux/KylinLinux
  template:
    src: "rh_docker.repo.j2"
    dest: "{{ yum_repo_dir }}/docker-ce.repo"
-    mode: 0644
+    mode: "0644"
  when:
    - ansible_os_family == "RedHat"
    - ansible_distribution != "Fedora"
@@ -96,7 +100,11 @@
    name: "{{ item }}"
    selection: install
  when: ansible_pkg_mgr == 'apt'
+  register: ret
  changed_when: false
+  failed_when:
+    - ret is failed
+    - ret.msg != ( "Failed to find package '" + item + "' to perform selection 'install'." )
  with_items:
    - "{{ containerd_package }}"
    - docker-ce
@@ -175,7 +183,7 @@
 - name: Ensure docker service is started and enabled
  service:
    name: "{{ item }}"
-    enabled: yes
+    enabled: true
    state: started
  with_items:
    - docker
--- a/kubespray/project/roles/container-engine/docker/tasks/reset.yml
+++ b/kubespray/project/roles/container-engine/docker/tasks/reset.yml
@@ -6,8 +6,8 @@

 - name: Docker | Find docker packages
  set_fact:
-    docker_packages_list: "{{ ansible_facts.packages.keys() | select('search', '^docker*') }}"
-    containerd_package: "{{ ansible_facts.packages.keys() | select('search', '^containerd*') }}"
+    docker_packages_list: "{{ ansible_facts.packages.keys() | select('search', '^docker+') }}"
+    containerd_package: "{{ ansible_facts.packages.keys() | select('search', '^containerd+') }}"

 - name: Docker | Stop all running container
  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -q | xargs -r {{ docker_bin_dir }}/docker kill"
@@ -102,5 +102,5 @@
  ignore_errors: true  # noqa ignore-errors

 - name: Docker | systemctl daemon-reload  # noqa no-handler
-  systemd:
+  systemd_service:
    daemon_reload: true
--- a/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml
+++ b/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml
@@ -21,9 +21,9 @@
  shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/'
  args:
    executable: /bin/bash
-  changed_when: False
+  changed_when: false
  register: system_nameservers
-  check_mode: no
+  check_mode: false

 - name: Check system search domains
  # noqa risky-shell-pipe - if resolf.conf has no search domain, grep will exit 1 which would force us to add failed_when: false
@@ -31,9 +31,9 @@
  shell: grep "^search" /etc/resolv.conf | sed -r 's/^search\s*([^#]+)\s*(#.*)?/\1/'
  args:
    executable: /bin/bash
-  changed_when: False
+  changed_when: false
  register: system_search_domains
-  check_mode: no
+  check_mode: false

 - name: Add system nameservers to docker options
  set_fact:
--- a/kubespray/project/roles/container-engine/docker/tasks/systemd.yml
+++ b/kubespray/project/roles/container-engine/docker/tasks/systemd.yml
@@ -3,31 +3,21 @@
  file:
    path: /etc/systemd/system/docker.service.d
    state: directory
-    mode: 0755
+    mode: "0755"

 - name: Write docker proxy drop-in
  template:
    src: http-proxy.conf.j2
    dest: /etc/systemd/system/docker.service.d/http-proxy.conf
-    mode: 0644
+    mode: "0644"
  notify: Restart docker
  when: http_proxy is defined or https_proxy is defined

- name: Get systemd version
-  # noqa command-instead-of-module - systemctl is called intentionally here
-  shell: set -o pipefail && systemctl --version | head -n 1 | cut -d " " -f 2
-  args:
-    executable: /bin/bash
-  register: systemd_version
-  when: not is_ostree
-  changed_when: false
-  check_mode: false
-
 - name: Write docker.service systemd file
  template:
    src: docker.service.j2
    dest: /etc/systemd/system/docker.service
-    mode: 0644
+    mode: "0644"
  register: docker_service_file
  notify: Restart docker
  when:
@@ -38,14 +28,14 @@
  template:
    src: docker-options.conf.j2
    dest: "/etc/systemd/system/docker.service.d/docker-options.conf"
-    mode: 0644
+    mode: "0644"
  notify: Restart docker

 - name: Write docker dns systemd drop-in
  template:
    src: docker-dns.conf.j2
    dest: "/etc/systemd/system/docker.service.d/docker-dns.conf"
-    mode: 0644
+    mode: "0644"
  notify: Restart docker
  when: dns_mode != 'none' and resolvconf_mode == 'docker_dns'

@@ -53,14 +43,14 @@
  copy:
    src: cleanup-docker-orphans.sh
    dest: "{{ bin_dir }}/cleanup-docker-orphans.sh"
-    mode: 0755
+    mode: "0755"
  when: docker_orphan_clean_up | bool

 - name: Write docker orphan clean up systemd drop-in
  template:
    src: docker-orphan-cleanup.conf.j2
    dest: "/etc/systemd/system/docker.service.d/docker-orphan-cleanup.conf"
-    mode: 0644
+    mode: "0644"
  notify: Restart docker
  when: docker_orphan_clean_up | bool

--- a/kubespray/project/roles/container-engine/docker/templates/docker.service.j2
+++ b/kubespray/project/roles/container-engine/docker/templates/docker.service.j2
@@ -1,19 +1,11 @@
 [Unit]
 Description=Docker Application Container Engine
 Documentation=http://docs.docker.com
-{% if ansible_os_family == "RedHat" %}
-After=network.target {{ ' docker-storage-setup.service' if docker_container_storage_setup else '' }} containerd.service
+After=network.target docker.socket containerd.service lvm2-monitor.service SuSEfirewall2.service
+{% if ansible_os_family != "Suse" %}
 BindsTo=containerd.service
-{{ 'Wants=docker-storage-setup.service' if docker_container_storage_setup else '' }}
-{% elif ansible_os_family == "Debian" %}
-After=network.target docker.socket containerd.service
-BindsTo=containerd.service
-Wants=docker.socket
-{% elif ansible_os_family == "Suse" %}
-After=network.target lvm2-monitor.service SuSEfirewall2.service
-# After=network.target containerd.service
-# BindsTo=containerd.service
 {% endif %}
+Wants=docker.socket

 [Service]
 Type=notify
@@ -31,9 +23,7 @@ ExecStart={{ docker_bin_dir }}/dockerd \
          $DOCKER_OPTS \
          $DOCKER_STORAGE_OPTIONS \
          $DOCKER_DNS_OPTIONS
-{% if not is_ostree and systemd_version.stdout|int >= 226 %}
 TasksMax=infinity
-{% endif %}
 LimitNOFILE=1048576
 LimitNPROC=1048576
 LimitCORE=infinity
--- a/kubespray/project/roles/container-engine/docker/vars/amazon.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/amazon.yml
@@ -6,6 +6,8 @@ docker_versioned_pkg:
  '18.09': docker-18.09.9ce-2.amzn2
  '19.03': docker-19.03.13ce-1.amzn2
  '20.10': docker-20.10.7-5.amzn2
+  '24.0': docker-24.0.5-1.amzn2
+  '25.0': docker-25.0.3-1.amzn2

 docker_version: "latest"

--- a/kubespray/project/roles/container-engine/docker/vars/debian.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/debian.yml
@@ -22,9 +22,11 @@ containerd_versioned_pkg:
  '1.6.15': "{{ containerd_package }}=1.6.15-1"
  '1.6.16': "{{ containerd_package }}=1.6.16-1"
  '1.6.18': "{{ containerd_package }}=1.6.18-1"
-  '1.6.28': "{{ containerd_package }}=1.6.28-1"
-  'stable': "{{ containerd_package }}=1.6.28-1"
-  'edge': "{{ containerd_package }}=1.6.28-1"
+  '1.6.28': "{{ containerd_package }}=1.6.28-2"
+  '1.6.31': "{{ containerd_package }}=1.6.31-1"
+  '1.6.32': "{{ containerd_package }}=1.6.32-1"
+  'stable': "{{ containerd_package }}=1.6.32-1"
+  'edge': "{{ containerd_package }}=1.6.32-1"

 # https://download.docker.com/linux/debian/
 docker_versioned_pkg:
@@ -34,6 +36,9 @@ docker_versioned_pkg:
  '20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
  '23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  'stable': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  'edge': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}

@@ -44,8 +49,11 @@ docker_cli_versioned_pkg:
  '20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
  '23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}

 docker_package_info:
  pkgs:
--- a/kubespray/project/roles/container-engine/docker/vars/fedora.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/fedora.yml
@@ -22,9 +22,11 @@ containerd_versioned_pkg:
  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_distribution_major_version }}"
  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_distribution_major_version }}"
  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_distribution_major_version }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"

 # https://docs.docker.com/install/linux/docker-ce/fedora/
 # https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/
@@ -34,8 +36,10 @@ docker_versioned_pkg:
  '20.10': docker-ce-20.10.20-3.fc{{ ansible_distribution_major_version }}
  '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }}
  '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -43,8 +47,10 @@ docker_cli_versioned_pkg:
  '20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_distribution_major_version }}
  '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }}
  '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}

 docker_package_info:
  enablerepo: "docker-ce"
--- a/kubespray/project/roles/container-engine/docker/vars/kylin.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/kylin.yml
@@ -1,54 +1,62 @@
 ---
+
+docker_version: 26.1
+docker_cli_version: "{{ docker_version }}"
+docker_rh_repo_base_url: 'https://download.docker.com/linux/centos/8/$basearch/stable'
+
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
  'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_distribution_major_version }}"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_distribution_major_version }}"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_distribution_major_version }}"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_distribution_major_version }}"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_distribution_major_version }}"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_distribution_major_version }}"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-
-docker_version: 19.03
-docker_cli_version: 19.03
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el8"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el8"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el8"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el8"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el8"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el8"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el8"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el8"
+  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el8"
+  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el8"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el8"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el8"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el8"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el8"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el8"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el8"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el8"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el8"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el8"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el8"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el8"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el8"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el8"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el8"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el8"

 # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
-# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
+# https://download.docker.com/linux/centos/8/x86_64/stable/Packages/
 # or do 'yum --showduplicates list docker-engine'
 docker_versioned_pkg:
  'latest': docker-ce
-  '18.09': docker-ce-3:18.09.9-3.el{{ ansible_distribution_major_version }}
-  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_distribution_major_version }}
-  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
-  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '18.09': docker-ce-3:18.09.9-3.el8
+  '19.03': docker-ce-3:19.03.15-3.el8
+  '23.0': docker-ce-3:23.0.6-1.el8
+  '24.0': docker-ce-3:24.0.9-1.el8
+  '26.0': docker-ce-26.0.2-1.el8
+  '26.1': docker-ce-26.1.2-1.el8
+  'stable': docker-ce-26.1.2-1.el8
+  'edge': docker-ce-26.1.2-1.el8

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
-  '18.09': docker-ce-cli-1:18.09.9-3.el{{ ansible_distribution_major_version }}
-  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_distribution_major_version }}
-  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
-  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '18.09': docker-ce-cli-1:18.09.9-3.el8
+  '19.03': docker-ce-cli-1:19.03.15-3.el8
+  '23.0': docker-ce-cli-1:23.0.6-1.el8
+  '24.0': docker-ce-cli-1:24.0.9-1.el8
+  '26.0': docker-ce-cli-26.0.2-1.el8
+  '26.1': docker-ce-cli-26.1.2-1.el8
+  'stable': docker-ce-cli-26.1.2-1.el8
+  'edge': docker-ce-cli-26.1.2-1.el8

 docker_package_info:
  enablerepo: "docker-ce"
--- a/kubespray/project/roles/container-engine/docker/vars/openeuler.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/openeuler.yml
@@ -0,0 +1 @@
+kylin.yml
--- a/kubespray/project/roles/container-engine/docker/vars/redhat-7.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/redhat-7.yml
@@ -23,8 +23,10 @@ containerd_versioned_pkg:
  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el7"
  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el7"
  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el7"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el7"
-  'edge': "{{ containerd_package }}-1.6.18-3.1.el7"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el7"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el7"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el7"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el7"

 # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
 # https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
@@ -36,8 +38,10 @@ docker_versioned_pkg:
  '20.10': docker-ce-20.10.20-3.el7
  '23.0': docker-ce-23.0.6-1.el7
  '24.0': docker-ce-24.0.9-1.el7
-  'stable': docker-ce-24.0.9-1.el7
-  'edge': docker-ce-24.0.9-1.el7
+  '26.0': docker-ce-26.0.2-1.el7
+  '26.1': docker-ce-26.1.2-1.el7
+  'stable': docker-ce-26.1.2-1.el7
+  'edge': docker-ce-26.1.2-1.el7

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -46,8 +50,10 @@ docker_cli_versioned_pkg:
  '20.10': docker-ce-cli-20.10.20-3.el7
  '23.0': docker-ce-cli-23.0.6-1.el7
  '24.0': docker-ce-cli-24.0.9-1.el7
-  'stable': docker-ce-cli-24.0.9-1.el7
-  'edge': docker-ce-cli-24.0.9-1.el7
+  '26.0': docker-ce-cli-26.0.2-1.el7
+  '26.1': docker-ce-cli-26.1.2-1.el7
+  'stable': docker-ce-cli-26.1.2-1.el7
+  'edge': docker-ce-cli-26.1.2-1.el7

 docker_package_info:
  enablerepo: "docker-ce"
--- a/kubespray/project/roles/container-engine/docker/vars/redhat.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/redhat.yml
@@ -23,8 +23,10 @@ containerd_versioned_pkg:
  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"

 # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
 # https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
@@ -36,8 +38,10 @@ docker_versioned_pkg:
  '20.10': docker-ce-3:20.10.20-3.el{{ ansible_distribution_major_version }}
  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -46,8 +50,10 @@ docker_cli_versioned_pkg:
  '20.10': docker-ce-cli-1:20.10.20-3.el{{ ansible_distribution_major_version }}
  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}

 docker_package_info:
  enablerepo: "docker-ce"
--- a/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml
@@ -22,9 +22,11 @@ containerd_versioned_pkg:
  '1.6.15': "{{ containerd_package }}=1.6.15-1"
  '1.6.16': "{{ containerd_package }}=1.6.16-1"
  '1.6.18': "{{ containerd_package }}=1.6.18-1"
-  '1.6.28': "{{ containerd_package }}=1.6.28-1"
-  'stable': "{{ containerd_package }}=1.6.28-1"
-  'edge': "{{ containerd_package }}=1.6.28-1"
+  '1.6.28': "{{ containerd_package }}=1.6.28-2"
+  '1.6.31': "{{ containerd_package }}=1.6.31-1"
+  '1.6.32': "{{ containerd_package }}=1.6.32-1"
+  'stable': "{{ containerd_package }}=1.6.32-1"
+  'edge': "{{ containerd_package }}=1.6.32-1"

 # https://download.docker.com/linux/ubuntu/
 docker_versioned_pkg:
@@ -34,8 +36,10 @@ docker_versioned_pkg:
  '20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
  '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
  '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -44,8 +48,10 @@ docker_cli_versioned_pkg:
  '20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
  '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
  '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}

 docker_package_info:
  pkgs:
--- a/kubespray/project/roles/container-engine/docker/vars/uniontech.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/uniontech.yml
@@ -21,8 +21,9 @@ containerd_versioned_pkg:
  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"

 docker_version: 19.03
 docker_cli_version: 19.03
--- a/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml
@@ -29,7 +29,7 @@
        src: "{{ item }}"
        dest: "/tmp/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - container.json
        - sandbox.json
@@ -38,12 +38,12 @@
        path: /etc/cni/net.d
        state: directory
        owner: root
-        mode: 0755
+        mode: "0755"
    - name: Setup CNI
      copy:
        src: "{{ item }}"
        dest: "/etc/cni/net.d/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - 10-mynet.conf
--- a/kubespray/project/roles/container-engine/gvisor/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/gvisor/tasks/main.yml
@@ -13,8 +13,8 @@
  copy:
    src: "{{ item.src }}"
    dest: "{{ bin_dir }}/{{ item.dest }}"
-    mode: 0755
-    remote_src: yes
+    mode: "0755"
+    remote_src: true
  with_items:
    - { src: "{{ downloads.gvisor_runsc.dest }}", dest: "runsc" }
    - { src: "{{ downloads.gvisor_containerd_shim.dest }}", dest: "containerd-shim-runsc-v1" }
--- a/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml
@@ -29,7 +29,7 @@
        src: "{{ item }}"
        dest: "/tmp/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - container.json
        - sandbox.json
@@ -38,12 +38,12 @@
        path: /etc/cni/net.d
        state: directory
        owner: "{{ kube_owner }}"
-        mode: 0755
+        mode: "0755"
    - name: Setup CNI
      copy:
        src: "{{ item }}"
        dest: "/etc/cni/net.d/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - 10-mynet.conf
--- a/kubespray/project/roles/container-engine/kata-containers/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/kata-containers/tasks/main.yml
@@ -8,22 +8,22 @@
  unarchive:
    src: "{{ downloads.kata_containers.dest }}"
    dest: "/"
-    mode: 0755
+    mode: "0755"
    owner: root
    group: root
-    remote_src: yes
+    remote_src: true

 - name: Kata-containers | Create config directory
  file:
    path: "{{ kata_containers_config_dir }}"
    state: directory
-    mode: 0755
+    mode: "0755"

 - name: Kata-containers | Set configuration
  template:
    src: "{{ item }}.j2"
    dest: "{{ kata_containers_config_dir }}/{{ item }}"
-    mode: 0644
+    mode: "0644"
  with_items:
    - configuration-qemu.toml

@@ -33,7 +33,7 @@
  template:
    dest: "{{ kata_containers_containerd_bin_dir }}/containerd-shim-kata-{{ item }}-v2"
    src: containerd-shim-kata-v2.j2
-    mode: 0755
+    mode: "0755"
  with_items:
    - qemu

@@ -48,7 +48,7 @@
 - name: Kata-containers | Persist vhost kernel modules
  copy:
    dest: /etc/modules-load.d/kubespray-kata-containers.conf
-    mode: 0644
+    mode: "0644"
    content: |
      vhost_vsock
      vhost_net
--- a/kubespray/project/roles/container-engine/nerdctl/handlers/main.yml
+++ b/kubespray/project/roles/container-engine/nerdctl/handlers/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Get nerdctl completion
  command: "{{ bin_dir }}/nerdctl completion bash"
-  changed_when: False
+  changed_when: false
  register: nerdctl_completion
  check_mode: false

@@ -9,4 +9,4 @@
  copy:
    dest: /etc/bash_completion.d/nerdctl
    content: "{{ nerdctl_completion.stdout }}"
-    mode: 0644
+    mode: "0644"
--- a/kubespray/project/roles/container-engine/nerdctl/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/nerdctl/tasks/main.yml
@@ -8,7 +8,7 @@
  copy:
    src: "{{ local_release_dir }}/nerdctl"
    dest: "{{ bin_dir }}/nerdctl"
-    mode: 0755
+    mode: "0755"
    remote_src: true
    owner: root
    group: root
@@ -21,7 +21,7 @@
  file:
    path: /etc/nerdctl
    state: directory
-    mode: 0755
+    mode: "0755"
    owner: root
    group: root
  become: true
@@ -30,7 +30,7 @@
  template:
    src: nerdctl.toml.j2
    dest: /etc/nerdctl/nerdctl.toml
-    mode: 0644
+    mode: "0644"
    owner: root
    group: root
  become: true
--- a/kubespray/project/roles/container-engine/runc/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/runc/tasks/main.yml
@@ -2,9 +2,9 @@
 - name: Runc | check if fedora coreos
  stat:
    path: /run/ostree-booted
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: ostree

 - name: Runc | set is_ostree
@@ -27,7 +27,7 @@
  copy:
    src: "{{ downloads.runc.dest }}"
    dest: "{{ runc_bin_dir }}/runc"
-    mode: 0755
+    mode: "0755"
    remote_src: true

 - name: Runc | Remove orphaned binary
--- a/kubespray/project/roles/container-engine/skopeo/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/skopeo/tasks/main.yml
@@ -2,9 +2,9 @@
 - name: Skopeo | check if fedora coreos
  stat:
    path: /run/ostree-booted
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: ostree

 - name: Skopeo | set is_ostree
@@ -28,5 +28,5 @@
  copy:
    src: "{{ downloads.skopeo.dest }}"
    dest: "{{ bin_dir }}/skopeo"
-    mode: 0755
+    mode: "0755"
    remote_src: true
--- a/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml
@@ -2,9 +2,9 @@
 - name: Validate-container-engine | check if fedora coreos
  stat:
    path: /run/ostree-booted
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: ostree
  tags:
    - facts
@@ -30,8 +30,8 @@
 - name: Check if containerd is installed
  find:
    file_type: file
-    recurse: yes
-    use_regex: yes
+    recurse: true
+    use_regex: true
    patterns:
      - containerd.service$
    paths:
@@ -45,8 +45,8 @@
 - name: Check if docker is installed
  find:
    file_type: file
-    recurse: yes
-    use_regex: yes
+    recurse: true
+    use_regex: true
    patterns:
      - docker.service$
    paths:
@@ -60,8 +60,8 @@
 - name: Check if crio is installed
  find:
    file_type: file
-    recurse: yes
-    use_regex: yes
+    recurse: true
+    use_regex: true
    patterns:
      - crio.service$
    paths:
--- a/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml
@@ -29,7 +29,7 @@
        src: "{{ item }}"
        dest: "/tmp/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - container.json
        - sandbox.json
@@ -38,12 +38,12 @@
        path: /etc/cni/net.d
        state: directory
        owner: root
-        mode: 0755
+        mode: "0755"
    - name: Setup CNI
      copy:
        src: "{{ item }}"
        dest: "/etc/cni/net.d/{{ item }}"
        owner: root
-        mode: 0644
+        mode: "0644"
      with_items:
        - 10-mynet.conf
--- a/kubespray/project/roles/container-engine/youki/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/youki/tasks/main.yml
@@ -8,5 +8,5 @@
  copy:
    src: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux/youki-{{ youki_version }}/youki"
    dest: "{{ youki_bin_dir }}/youki"
-    mode: 0755
+    mode: "0755"
    remote_src: true
--- a/kubespray/project/roles/download/tasks/check_pull_required.yml
+++ b/kubespray/project/roles/download/tasks/check_pull_required.yml
@@ -5,7 +5,7 @@
  shell: "{{ image_info_command }}"
  register: docker_images
  changed_when: false
-  check_mode: no
+  check_mode: false
  when: not download_always_pull

 - name: Check_pull_required | Set pull_required if the desired image is not yet loaded
--- a/kubespray/project/roles/download/tasks/download_container.yml
+++ b/kubespray/project/roles/download/tasks/download_container.yml
@@ -26,12 +26,12 @@
    - name: Download_container | Determine if image is in cache
      stat:
        path: "{{ image_path_cached }}"
-        get_attributes: no
-        get_checksum: no
-        get_mime: no
+        get_attributes: false
+        get_checksum: false
+        get_mime: false
      delegate_to: localhost
      connection: local
-      delegate_facts: no
+      delegate_facts: false
      register: cache_image
      changed_when: false
      become: false
@@ -57,7 +57,7 @@
    - name: Download_container | Download image if required
      command: "{{ image_pull_command_on_localhost if download_localhost else image_pull_command }} {{ image_reponame }}"
      delegate_to: "{{ download_delegate if download_run_once else inventory_hostname }}"
-      delegate_facts: yes
+      delegate_facts: true
      run_once: "{{ download_run_once }}"
      register: pull_task_result
      until: pull_task_result is succeeded
@@ -72,7 +72,7 @@
    - name: Download_container | Save and compress image
      shell: "{{ image_save_command_on_localhost if download_localhost else image_save_command }}"  # noqa command-instead-of-shell - image_save_command_on_localhost contains a pipe, therefore requires shell
      delegate_to: "{{ download_delegate }}"
-      delegate_facts: no
+      delegate_facts: false
      register: container_save_status
      failed_when: container_save_status.stderr
      run_once: true
@@ -99,7 +99,7 @@
        dest: "{{ image_path_final }}"
        use_ssh_args: true
        mode: push
-      delegate_facts: no
+      delegate_facts: false
      register: upload_image
      failed_when: not upload_image
      until: upload_image is succeeded
--- a/kubespray/project/roles/download/tasks/download_file.yml
+++ b/kubespray/project/roles/download/tasks/download_file.yml
@@ -22,15 +22,15 @@
    file:
      path: "{{ download.dest | dirname }}"
      owner: "{{ download.owner | default(omit) }}"
-      mode: 0755
+      mode: "0755"
      state: directory
-      recurse: yes
+      recurse: true

  - name: Download_file | Create local cache directory
    file:
      path: "{{ file_path_cached | dirname }}"
      state: directory
-      recurse: yes
+      recurse: true
    delegate_to: localhost
    connection: local
    delegate_facts: false
@@ -45,7 +45,7 @@
    file:
      path: "{{ file_path_cached | dirname }}"
      state: directory
-      recurse: yes
+      recurse: true
    delegate_to: "{{ download_delegate }}"
    delegate_facts: false
    run_once: true
--- a/kubespray/project/roles/download/tasks/extract_file.yml
+++ b/kubespray/project/roles/download/tasks/extract_file.yml
@@ -5,7 +5,7 @@
    dest: "{{ download.dest | dirname }}"
    owner: "{{ download.owner | default(omit) }}"
    mode: "{{ download.mode | default(omit) }}"
-    copy: no
+    copy: false
    extra_opts: "{{ download.unarchive_extra_opts | default(omit) }}"
  when:
    - download.unarchive | default(false)
--- a/kubespray/project/roles/download/tasks/prep_download.yml
+++ b/kubespray/project/roles/download/tasks/prep_download.yml
@@ -62,14 +62,14 @@
  register: docker_images
  failed_when: false
  changed_when: false
-  check_mode: no
+  check_mode: false
  when: download_container

 - name: Prep_download | Create staging directory on remote node
  file:
    path: "{{ local_release_dir }}/images"
    state: directory
-    mode: 0755
+    mode: "0755"
    owner: "{{ ansible_ssh_user | default(ansible_user_id) }}"
  when:
    - ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
@@ -78,10 +78,10 @@
  file:
    path: "{{ download_cache_dir }}/images"
    state: directory
-    mode: 0755
+    mode: "0755"
  delegate_to: localhost
  connection: local
-  delegate_facts: no
+  delegate_facts: false
  run_once: true
  become: false
  when:
--- a/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml
+++ b/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml
@@ -1,11 +1,4 @@
 ---
- name: Prep_kubeadm_images | Check kubeadm version matches kubernetes version
-  fail:
-    msg: "Kubeadm version {{ kubeadm_version }} do not matches kubernetes {{ kube_version }}"
-  when:
-    - not skip_downloads | default(false)
-    - not kubeadm_version == downloads.kubeadm.version
-
 - name: Prep_kubeadm_images | Download kubeadm binary
  include_tasks: "download_file.yml"
  vars:
@@ -18,7 +11,7 @@
  template:
    src: "kubeadm-images.yaml.j2"
    dest: "{{ kube_config_dir }}/kubeadm-images.yaml"
-    mode: 0644
+    mode: "0644"
  when:
    - not skip_kubeadm_images | default(false)

@@ -26,7 +19,7 @@
  copy:
    src: "{{ downloads.kubeadm.dest }}"
    dest: "{{ bin_dir }}/kubeadm"
-    mode: 0755
+    mode: "0755"
    remote_src: true

 - name: Prep_kubeadm_images | Set kubeadm binary permissions
--- a/kubespray/project/roles/etcd/defaults/main.yml
+++ b/kubespray/project/roles/etcd/defaults/main.yml
@@ -124,4 +124,7 @@ unsafe_show_logs: false
 etcd_experimental_enable_distributed_tracing: false
 etcd_experimental_distributed_tracing_sample_rate: 100
 etcd_experimental_distributed_tracing_address: "localhost:4317"
-etcd_experimental_distributed_tracing_service_name: etcd
+etcd_experimental_distributed_tracing_service_name: etcd
+
+# The interval for etcd watch progress notify events
+etcd_experimental_watch_progress_notify_interval: 5s
--- a/kubespray/project/roles/etcd/handlers/backup.yml
+++ b/kubespray/project/roles/etcd/handlers/backup.yml
@@ -16,16 +16,16 @@
    state: directory
    owner: root
    group: root
-    mode: 0600
+    mode: "0600"
  listen: Restart etcd
  when: etcd_cluster_is_healthy.rc == 0

 - name: Stat etcd v2 data directory
  stat:
    path: "{{ etcd_data_dir }}/member"
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
  register: etcd_data_dir_member
  listen: Restart etcd
  when: etcd_cluster_is_healthy.rc == 0
--- a/kubespray/project/roles/etcd/handlers/main.yml
+++ b/kubespray/project/roles/etcd/handlers/main.yml
@@ -3,7 +3,7 @@
  import_tasks: backup.yml

 - name: Etcd | reload systemd
-  systemd:
+  systemd_service:
    daemon_reload: true
  listen:
    - Restart etcd
@@ -26,7 +26,7 @@
 - name: Wait for etcd up
  uri:
    url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2379/health"
-    validate_certs: no
+    validate_certs: false
    client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
    client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
  register: result
@@ -41,7 +41,7 @@
 - name: Wait for etcd-events up
  uri:
    url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2383/health"
-    validate_certs: no
+    validate_certs: false
    client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
    client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
  register: result
--- a/kubespray/project/roles/etcd/tasks/check_certs.yml
+++ b/kubespray/project/roles/etcd/tasks/check_certs.yml
@@ -17,9 +17,9 @@
 - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
  stat:
    path: "{{ etcd_cert_dir }}/{{ item }}"
-    get_attributes: no
-    get_checksum: yes
-    get_mime: no
+    get_attributes: false
+    get_checksum: true
+    get_mime: false
  register: etcd_member_certs
  when: inventory_hostname in groups['etcd']
  with_items:
--- a/kubespray/project/roles/etcd/tasks/configure.yml
+++ b/kubespray/project/roles/etcd/tasks/configure.yml
@@ -6,8 +6,8 @@
  register: etcd_cluster_is_healthy
  failed_when: false
  changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
  when:
    - is_etcd_master
    - etcd_cluster_setup
@@ -27,8 +27,8 @@
  register: etcd_events_cluster_is_healthy
  failed_when: false
  changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
  when:
    - is_etcd_master
    - etcd_events_cluster_setup
@@ -49,8 +49,8 @@
  template:
    src: "etcd-{{ etcd_deployment_type }}.service.j2"
    dest: /etc/systemd/system/etcd.service
-    backup: yes
-    mode: 0644
+    backup: true
+    mode: "0644"
    # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
    # Remove once we drop support for systemd < 250
    validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:etcd-{{ etcd_deployment_type }}.service'"
@@ -60,15 +60,15 @@
  template:
    src: "etcd-events-{{ etcd_deployment_type }}.service.j2"
    dest: /etc/systemd/system/etcd-events.service
-    backup: yes
-    mode: 0644
+    backup: true
+    mode: "0644"
    validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:etcd-events-{{ etcd_deployment_type }}.service'"
    # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
    # Remove once we drop support for systemd < 250
  when: is_etcd_master and etcd_events_cluster_setup

 - name: Configure | reload systemd
-  systemd:
+  systemd_service:
    daemon_reload: true
  when: is_etcd_master

@@ -77,7 +77,7 @@
  service:
    name: etcd
    state: started
-    enabled: yes
+    enabled: true
  ignore_errors: "{{ etcd_cluster_is_healthy.rc == 0 }}"  # noqa ignore-errors
  when: is_etcd_master and etcd_cluster_setup

@@ -86,7 +86,7 @@
  service:
    name: etcd-events
    state: started
-    enabled: yes
+    enabled: true
  ignore_errors: "{{ etcd_events_cluster_is_healthy.rc != 0 }}"  # noqa ignore-errors
  when: is_etcd_master and etcd_events_cluster_setup

@@ -99,8 +99,8 @@
  retries: "{{ etcd_retries }}"
  delay: "{{ retry_stagger | random + 3 }}"
  changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
  when:
    - is_etcd_master
    - etcd_cluster_setup
@@ -122,8 +122,8 @@
  retries: "{{ etcd_retries }}"
  delay: "{{ retry_stagger | random + 3 }}"
  changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
  when:
    - is_etcd_master
    - etcd_events_cluster_setup
@@ -141,7 +141,7 @@
  register: etcd_member_in_cluster
  ignore_errors: true  # noqa ignore-errors
  changed_when: false
-  check_mode: no
+  check_mode: false
  when: is_etcd_master and etcd_cluster_setup
  tags:
    - facts
@@ -157,7 +157,7 @@
  register: etcd_events_member_in_cluster
  ignore_errors: true  # noqa ignore-errors
  changed_when: false
-  check_mode: no
+  check_mode: false
  when: is_etcd_master and etcd_events_cluster_setup
  tags:
    - facts
--- a/kubespray/project/roles/etcd/tasks/gen_certs_script.yml
+++ b/kubespray/project/roles/etcd/tasks/gen_certs_script.yml
@@ -6,23 +6,23 @@
    state: directory
    owner: "{{ etcd_owner }}"
    mode: "{{ etcd_cert_dir_mode }}"
-    recurse: yes
+    recurse: true

 - name: "Gen_certs | create etcd script dir (on {{ groups['etcd'][0] }})"
  file:
    path: "{{ etcd_script_dir }}"
    state: directory
    owner: root
-    mode: 0700
-  run_once: yes
+    mode: "0700"
+  run_once: true
  when: inventory_hostname == groups['etcd'][0]

 - name: Gen_certs | write openssl config
  template:
    src: "openssl.conf.j2"
    dest: "{{ etcd_config_dir }}/openssl.conf"
-    mode: 0640
-  run_once: yes
+    mode: "0640"
+  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
    - gen_certs | default(false)
@@ -32,8 +32,8 @@
  template:
    src: "make-ssl-etcd.sh.j2"
    dest: "{{ etcd_script_dir }}/make-ssl-etcd.sh"
-    mode: 0700
-  run_once: yes
+    mode: "0700"
+  run_once: true
  when:
    - gen_certs | default(false)
    - inventory_hostname == groups['etcd'][0]
@@ -43,7 +43,7 @@
  environment:
    MASTERS: "{{ groups['gen_master_certs_True'] | ansible.builtin.intersect(groups['etcd']) | join(' ') }}"
    HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['kube_control_plane']) | join(' ') }}"
-  run_once: yes
+  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
  when: gen_certs | default(false)
  notify: Set etcd_secret_changed
@@ -52,7 +52,7 @@
  command: "bash -x {{ etcd_script_dir }}/make-ssl-etcd.sh -f {{ etcd_config_dir }}/openssl.conf -d {{ etcd_cert_dir }}"
  environment:
    HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['k8s_cluster']) | join(' ') }}"
-  run_once: yes
+  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool
@@ -90,7 +90,7 @@
    content: "{{ item.content | b64decode }}"
    group: "{{ etcd_cert_group }}"
    owner: "{{ etcd_owner }}"
-    mode: 0640
+    mode: "0640"
  with_items: "{{ etcd_master_certs.results }}"
  when:
    - inventory_hostname in groups['etcd']
@@ -122,7 +122,7 @@
    content: "{{ item.content | b64decode }}"
    group: "{{ etcd_cert_group }}"
    owner: "{{ etcd_owner }}"
-    mode: 0640
+    mode: "0640"
  with_items: "{{ etcd_master_node_certs.results }}"
  when:
    - inventory_hostname in groups['etcd']
@@ -153,4 +153,4 @@
    state: directory
    owner: "{{ etcd_owner }}"
    mode: "{{ etcd_cert_dir_mode }}"
-    recurse: yes
+    recurse: true
--- a/kubespray/project/roles/etcd/tasks/gen_nodes_certs_script.yml
+++ b/kubespray/project/roles/etcd/tasks/gen_nodes_certs_script.yml
@@ -21,7 +21,7 @@
    executable: /bin/bash
  no_log: "{{ not (unsafe_show_logs | bool) }}"
  register: etcd_node_certs
-  check_mode: no
+  check_mode: false
  delegate_to: "{{ groups['etcd'][0] }}"
  changed_when: false

--- a/kubespray/project/roles/etcd/tasks/install_docker.yml
+++ b/kubespray/project/roles/etcd/tasks/install_docker.yml
@@ -28,8 +28,8 @@
    src: etcd.j2
    dest: "{{ bin_dir }}/etcd"
    owner: 'root'
-    mode: 0750
-    backup: yes
+    mode: "0750"
+    backup: true
  when: etcd_cluster_setup

 - name: Install etcd-events launch script
@@ -37,6 +37,6 @@
    src: etcd-events.j2
    dest: "{{ bin_dir }}/etcd-events"
    owner: 'root'
-    mode: 0750
-    backup: yes
+    mode: "0750"
+    backup: true
  when: etcd_events_cluster_setup
--- a/kubespray/project/roles/etcd/tasks/install_host.yml
+++ b/kubespray/project/roles/etcd/tasks/install_host.yml
@@ -24,8 +24,8 @@
  copy:
    src: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ host_architecture }}/{{ item }}"
    dest: "{{ bin_dir }}/{{ item }}"
-    mode: 0755
-    remote_src: yes
+    mode: "0755"
+    remote_src: true
  with_items:
    - etcd
  when: etcd_cluster_setup
--- a/kubespray/project/roles/etcd/tasks/join_etcd-events_member.yml
+++ b/kubespray/project/roles/etcd/tasks/join_etcd-events_member.yml
@@ -32,7 +32,7 @@
    executable: /bin/bash
  register: etcd_events_member_in_cluster
  changed_when: false
-  check_mode: no
+  check_mode: false
  tags:
    - facts
  environment:
@@ -46,4 +46,4 @@
  service:
    name: etcd-events
    state: started
-    enabled: yes
+    enabled: true
--- a/kubespray/project/roles/etcd/tasks/join_etcd_member.yml
+++ b/kubespray/project/roles/etcd/tasks/join_etcd_member.yml
@@ -33,7 +33,7 @@
    executable: /bin/bash
  register: etcd_member_in_cluster
  changed_when: false
-  check_mode: no
+  check_mode: false
  retries: "{{ etcd_retries }}"
  delay: "{{ retry_stagger | random + 3 }}"
  until: etcd_member_in_cluster.rc == 0
@@ -50,4 +50,4 @@
  service:
    name: etcd
    state: started
-    enabled: yes
+    enabled: true
--- a/Show More
+++ b/Show More