update to latest 2.26.0 kubespray version and add dns zones settings to coredns

kubespray/project/roles/container-engine/containerd/defaults/main.yml

@@ -46,7 +46,11 @@ containerd_base_runtime_specs:
 containerd_grpc_max_recv_message_size: 16777216
 containerd_grpc_max_send_message_size: 16777216
 
+containerd_debug_address: ""
 containerd_debug_level: "info"
+containerd_debug_format: ""
+containerd_debug_uid: 0
+containerd_debug_gid: 0
 
 containerd_metrics_address: ""
 
@@ -66,6 +70,12 @@ containerd_enable_unprivileged_ports: false
 # If enabled it will allow non root users to use icmp sockets
 containerd_enable_unprivileged_icmp: false
 
+containerd_enable_selinux: false
+containerd_disable_apparmor: false
+containerd_tolerate_missing_hugetlb_controller: true
+containerd_disable_hugetlb_controller: true
+containerd_image_pull_progress_timeout: 5m
+
 containerd_cfg_dir: /etc/containerd
 
 # Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally
@@ -109,3 +119,11 @@ containerd_supported_distributions:
 
 # Enable container device interface
 enable_cdi: false
+
+# For containerd tracing configuration please check out the official documentation:
+# https://github.com/containerd/containerd/blob/main/docs/tracing.md
+containerd_tracing_enabled: false
+containerd_tracing_endpoint: "0.0.0.0:4317"
+containerd_tracing_protocol: "grpc"
+containerd_tracing_sampling_ratio: 1.0
+containerd_tracing_service_name: "containerd"

kubespray/project/roles/container-engine/containerd/handlers/main.yml

@@ -1,11 +1,11 @@
 ---
 - name: Containerd | restart containerd
-  systemd:
+  systemd_service:
     name: containerd
     state: restarted
-    enabled: yes
-    daemon-reload: yes
-    masked: no
+    enabled: true
+    daemon-reload: true
+    masked: false
   listen: Restart containerd
 
 - name: Containerd | wait for containerd

kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml

@@ -1,7 +1,7 @@
 ---
 - name: Prepare
   hosts: all
-  gather_facts: False
+  gather_facts: false
   become: true
   vars:
     ignore_assert_errors: true
@@ -19,7 +19,7 @@
 
 - name: Prepare CNI
   hosts: all
-  gather_facts: False
+  gather_facts: false
   become: true
   vars:
     ignore_assert_errors: true

kubespray/project/roles/container-engine/containerd/tasks/main.yml

@@ -35,8 +35,8 @@
   unarchive:
     src: "{{ downloads.containerd.dest }}"
     dest: "{{ containerd_bin_dir }}"
-    mode: 0755
-    remote_src: yes
+    mode: "0755"
+    remote_src: true
     extra_opts:
       - --strip-components=1
   notify: Restart containerd
@@ -60,7 +60,7 @@
   template:
     src: containerd.service.j2
     dest: /etc/systemd/system/containerd.service
-    mode: 0644
+    mode: "0644"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:containerd.service'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250
@@ -70,7 +70,7 @@
   file:
     dest: "{{ item }}"
     state: directory
-    mode: 0755
+    mode: "0755"
     owner: root
     group: root
   with_items:
@@ -83,7 +83,7 @@
   template:
     src: http-proxy.conf.j2
     dest: "{{ containerd_systemd_dir }}/http-proxy.conf"
-    mode: 0644
+    mode: "0644"
   notify: Restart containerd
   when: http_proxy is defined or https_proxy is defined
 
@@ -102,7 +102,7 @@
     content: "{{ item.value }}"
     dest: "{{ containerd_cfg_dir }}/{{ item.key }}"
     owner: "root"
-    mode: 0644
+    mode: "0644"
   with_dict: "{{ containerd_base_runtime_specs | default({}) }}"
   notify: Restart containerd
 
@@ -111,7 +111,7 @@
     src: config.toml.j2
     dest: "{{ containerd_cfg_dir }}/config.toml"
     owner: "root"
-    mode: 0640
+    mode: "0640"
   notify: Restart containerd
 
 - name: Containerd | Configure containerd registries
@@ -121,13 +121,13 @@
       file:
         path: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}"
         state: directory
-        mode: 0755
+        mode: "0755"
       loop: "{{ containerd_registries_mirrors }}"
     - name: Containerd | Write hosts.toml file
       template:
         src: hosts.toml.j2
         dest: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}/hosts.toml"
-        mode: 0640
+        mode: "0640"
       loop: "{{ containerd_registries_mirrors }}"
 
 # you can sometimes end up in a state where everything is installed
@@ -136,8 +136,8 @@
   meta: flush_handlers
 
 - name: Containerd | Ensure containerd is started and enabled
-  systemd:
+  systemd_service:
     name: containerd
-    daemon_reload: yes
-    enabled: yes
+    daemon_reload: true
+    enabled: true
     state: started

kubespray/project/roles/container-engine/containerd/templates/config.toml.j2

@@ -3,12 +3,20 @@ root = "{{ containerd_storage_dir }}"
 state = "{{ containerd_state_dir }}"
 oom_score = {{ containerd_oom_score }}
 
+{% if containerd_extra_args is defined %}
+{{ containerd_extra_args }}
+{% endif %}
+
 [grpc]
   max_recv_message_size = {{ containerd_grpc_max_recv_message_size }}
   max_send_message_size = {{ containerd_grpc_max_send_message_size }}
 
 [debug]
+  address = "{{ containerd_debug_address }}"
   level = "{{ containerd_debug_level }}"
+  format = "{{ containerd_debug_format }}"
+  uid = {{ containerd_debug_uid }}
+  gid = {{ containerd_debug_gid }}
 
 [metrics]
   address = "{{ containerd_metrics_address }}"
@@ -20,6 +28,11 @@ oom_score = {{ containerd_oom_score }}
     max_container_log_line_size = {{ containerd_max_container_log_line_size }}
     enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
     enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
+    enable_selinux = {{ containerd_enable_selinux | lower }}
+    disable_apparmor = {{ containerd_disable_apparmor | lower }}
+    tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
+    disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
+    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
 {% if enable_cdi %}
     enable_cdi = true
     cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
@@ -92,6 +105,14 @@ oom_score = {{ containerd_oom_score }}
     disable = false
 {% endif %}
 
-{% if containerd_extra_args is defined %}
-{{ containerd_extra_args }}
+{% if containerd_tracing_enabled %}
+  [plugins."io.containerd.tracing.processor.v1.otlp"]
+    endpoint = "{{ containerd_tracing_endpoint }}"
+    protocol = "{{ containerd_tracing_protocol }}"
+{% if containerd_tracing_protocol == "grpc" %}
+    insecure = false
+{% endif %}
+  [plugins."io.containerd.internal.v1.tracing"]
+    sampling_ratio = {{ containerd_tracing_sampling_ratio }}
+    service_name = "{{ containerd_tracing_service_name }}"
 {% endif %}

kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2

@@ -1,4 +1,4 @@
-server = "https://{{ item.prefix }}"
+server = "{{ item.server | default("https://" + item.prefix) }}"
 {% for mirror in item.mirrors %}
 [host."{{ mirror.host }}"]
   capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"]