update to latest 2.26.0 kubespray version and add dns zones settings to coredns

kubespray/project/roles/kubernetes/control-plane/tasks/define-first-kube-control.yml

@@ -3,16 +3,16 @@
 - name: Check which kube-control nodes are already members of the cluster
   command: "{{ bin_dir }}/kubectl get nodes --selector=node-role.kubernetes.io/control-plane -o json"
   register: kube_control_planes_raw
-  ignore_errors: yes
+  ignore_errors: true
   changed_when: false
 
 - name: Set fact joined_control_planes
   set_fact:
     joined_control_planes: "{{ ((kube_control_planes_raw.stdout | from_json)['items']) | default([]) | map(attribute='metadata') | map(attribute='name') | list }}"
-  delegate_to: item
+  delegate_to: "{{ item }}"
   loop: "{{ groups['kube_control_plane'] }}"
   when: kube_control_planes_raw is succeeded
-  run_once: yes
+  run_once: true
 
 - name: Set fact first_kube_control_plane
   set_fact:

kubespray/project/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml

@@ -2,9 +2,9 @@
 - name: Check if secret for encrypting data at rest already exist
   stat:
     path: "{{ kube_cert_dir }}/secrets_encryption.yaml"
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
   register: secrets_encryption_file
 
 - name: Slurp secrets_encryption file if it exists
@@ -37,4 +37,4 @@
     dest: "{{ kube_cert_dir }}/secrets_encryption.yaml"
     owner: root
     group: "{{ kube_cert_group }}"
-    mode: 0640
+    mode: "0640"

kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-backup.yml

@@ -4,7 +4,7 @@
     src: "{{ kube_cert_dir }}/{{ item }}"
     dest: "{{ kube_cert_dir }}/{{ item }}.old"
     mode: preserve
-    remote_src: yes
+    remote_src: true
   with_items:
     - apiserver.crt
     - apiserver.key
@@ -19,7 +19,7 @@
     src: "{{ kube_config_dir }}/{{ item }}"
     dest: "{{ kube_config_dir }}/{{ item }}.old"
     mode: preserve
-    remote_src: yes
+    remote_src: true
   with_items:
     - admin.conf
     - controller-manager.conf

kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-etcd.yml

@@ -25,5 +25,5 @@
     path: "{{ etcd_data_dir }}"
     owner: "{{ etcd_owner }}"
     group: "{{ etcd_owner }}"
-    mode: 0700
+    mode: "0700"
   when: etcd_deployment_type == "kubeadm"

kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-fix-apiserver.yml

@@ -5,7 +5,7 @@
     dest: "{{ kube_config_dir }}/{{ item }}"
     regexp: '^    server: https'
     line: '    server: {{ kube_apiserver_endpoint }}'
-    backup: yes
+    backup: true
   with_items:
     - admin.conf
     - controller-manager.conf

kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml

@@ -25,7 +25,7 @@
 - name: Parse certificate key if not set
   set_fact:
     kubeadm_certificate_key: "{{ hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
-  run_once: yes
+  run_once: true
   when:
     - hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is defined
     - hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is not skipped
@@ -34,8 +34,8 @@
   template:
     src: "kubeadm-controlplane.{{ kubeadmConfig_api_version }}.yaml.j2"
     dest: "{{ kube_config_dir }}/kubeadm-controlplane.yaml"
-    mode: 0640
-    backup: yes
+    mode: "0640"
+    backup: true
   when:
     - inventory_hostname != first_kube_control_plane
     - not kubeadm_already_run.stat.exists
@@ -63,6 +63,26 @@
     - kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
     - not kube_external_ca_mode
 
+- name: Get kubeconfig for join discovery process
+  command: "{{ kubectl }} -n kube-public get cm cluster-info -o jsonpath='{.data.kubeconfig}'"
+  register: kubeconfig_file_discovery
+  run_once: true
+  delegate_to: "{{ groups['kube_control_plane'] | first }}"
+  when:
+    - kubeadm_use_file_discovery
+    - kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
+
+- name: Copy discovery kubeconfig
+  copy:
+    dest: "{{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml"
+    content: "{{ kubeconfig_file_discovery.stdout }}"
+    owner: "root"
+    mode: "0644"
+  when:
+    - inventory_hostname != first_kube_control_plane
+    - kubeadm_use_file_discovery
+    - kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
+
 - name: Joining control plane node to the cluster.
   command: >-
     {{ bin_dir }}/kubeadm join

kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml

@@ -13,9 +13,9 @@
 - name: Kubeadm | Check if kubeadm has already run
   stat:
     path: "/var/lib/kubelet/config.yaml"
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
   register: kubeadm_already_run
 
 - name: Kubeadm | Backup kubeadm certs / kubeconfig
@@ -51,35 +51,35 @@
   file:
     path: "{{ audit_policy_file | dirname }}"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
 
 - name: Write api audit policy yaml
   template:
     src: apiserver-audit-policy.yaml.j2
     dest: "{{ audit_policy_file }}"
-    mode: 0640
+    mode: "0640"
   when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
 
 - name: Write api audit webhook config yaml
   template:
     src: apiserver-audit-webhook-config.yaml.j2
     dest: "{{ audit_webhook_config_file }}"
-    mode: 0640
+    mode: "0640"
   when: kubernetes_audit_webhook | default(false)
 
 - name: Create apiserver tracing config directory
   file:
     path: "{{ kube_config_dir }}/tracing"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_tracing
 
 - name: Write apiserver tracing config yaml
   template:
     src: apiserver-tracing.yaml.j2
     dest: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml"
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_tracing
 
 # Nginx LB(default), If kubeadm_config_api_fqdn is defined, use other LB by kubeadm controlPlaneEndpoint.
@@ -96,27 +96,27 @@
   template:
     src: "kubeadm-config.{{ kubeadmConfig_api_version }}.yaml.j2"
     dest: "{{ kube_config_dir }}/kubeadm-config.yaml"
-    mode: 0640
+    mode: "0640"
 
 - name: Kubeadm | Create directory to store admission control configurations
   file:
     path: "{{ kube_config_dir }}/admission-controls"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_admission_control_config_file
 
 - name: Kubeadm | Push admission control config file
   template:
     src: "admission-controls.yaml.j2"
     dest: "{{ kube_config_dir }}/admission-controls/admission-controls.yaml"
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_admission_control_config_file
 
 - name: Kubeadm | Push admission control config files
   template:
     src: "{{ item | lower }}.yaml.j2"
     dest: "{{ kube_config_dir }}/admission-controls/{{ item | lower }}.yaml"
-    mode: 0640
+    mode: "0640"
   when:
     - kube_apiserver_admission_control_config_file
     - item in kube_apiserver_admission_plugins_needs_configuration
@@ -126,7 +126,7 @@
   template:
     src: "podnodeselector.yaml.j2"
     dest: "{{ kube_config_dir }}/admission-controls/podnodeselector.yaml"
-    mode: 0640
+    mode: "0640"
   when:
     - kube_apiserver_admission_plugins_podnodeselector_default_node_selector is defined
     - kube_apiserver_admission_plugins_podnodeselector_default_node_selector | length > 0
@@ -178,7 +178,7 @@
   file:
     path: "{{ kubeadm_patches.dest_dir }}"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kubeadm_patches is defined and kubeadm_patches.enabled
 
 - name: Kubeadm | Copy kubeadm patches from inventory files
@@ -186,7 +186,7 @@
     src: "{{ kubeadm_patches.source_dir }}/"
     dest: "{{ kubeadm_patches.dest_dir }}"
     owner: "root"
-    mode: 0644
+    mode: "0644"
   when: kubeadm_patches is defined and kubeadm_patches.enabled
 
 - name: Kubeadm | Initialize first master
@@ -221,12 +221,16 @@
     {{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create {{ kubeadm_token }}
   changed_when: false
   when:
-    - inventory_hostname ==  first_kube_control_plane
+    - inventory_hostname == first_kube_control_plane
     - kubeadm_token is defined
     - kubeadm_refresh_token
   tags:
     - kubeadm_token
 
+- name: Remove binding to anonymous user
+  command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
+  when: inventory_hostname == first_kube_control_plane and remove_anonymous_access
+
 - name: Create kubeadm token for joining nodes with 24h expiration (default)
   command: "{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create"
   changed_when: false

kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml

@@ -15,7 +15,6 @@
     {{ bin_dir }}/kubeadm
     upgrade apply -y {{ kube_version }}
     --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
-    --config={{ kube_config_dir }}/kubeadm-config.yaml
     --ignore-preflight-errors=all
     --allow-experimental-upgrades
     --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }}
@@ -37,7 +36,6 @@
     {{ bin_dir }}/kubeadm
     upgrade apply -y {{ kube_version }}
     --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
-    --config={{ kube_config_dir }}/kubeadm-config.yaml
     --ignore-preflight-errors=all
     --allow-experimental-upgrades
     --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }}
@@ -53,6 +51,10 @@
     PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
   notify: Master | restart kubelet
 
+- name: Kubeadm | Remove binding to anonymous user
+  command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
+  when: remove_anonymous_access
+
 - name: Kubeadm | clean kubectl cache to refresh api types
   file:
     path: "{{ item }}"

kubespray/project/roles/kubernetes/control-plane/tasks/kubelet-fix-client-cert-rotation.yml

@@ -4,7 +4,7 @@
     path: "{{ kube_config_dir }}/kubelet.conf"
     regexp: '^    client-certificate-data: '
     line: '    client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem'
-    backup: yes
+    backup: true
   notify:
     - "Master | reload kubelet"
 
@@ -13,6 +13,6 @@
     path: "{{ kube_config_dir }}/kubelet.conf"
     regexp: '^    client-key-data: '
     line: '    client-key: /var/lib/kubelet/pki/kubelet-client-current.pem'
-    backup: yes
+    backup: true
   notify:
     - "Master | reload kubelet"

kubespray/project/roles/kubernetes/control-plane/tasks/main.yml

@@ -8,21 +8,21 @@
   template:
     src: webhook-token-auth-config.yaml.j2
     dest: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
-    mode: 0640
+    mode: "0640"
   when: kube_webhook_token_auth | default(false)
 
 - name: Create webhook authorization config
   template:
     src: webhook-authorization-config.yaml.j2
     dest: "{{ kube_config_dir }}/webhook-authorization-config.yaml"
-    mode: 0640
+    mode: "0640"
   when: kube_webhook_authorization | default(false)
 
 - name: Create kube-scheduler config
   template:
     src: kubescheduler-config.yaml.j2
     dest: "{{ kube_config_dir }}/kubescheduler-config.yaml"
-    mode: 0644
+    mode: "0644"
 
 - name: Apply Kubernetes encrypt at rest config
   import_tasks: encrypt-at-rest.yml
@@ -35,7 +35,7 @@
   copy:
     src: "{{ downloads.kubectl.dest }}"
     dest: "{{ bin_dir }}/kubectl"
-    mode: 0755
+    mode: "0755"
     remote_src: true
   tags:
     - kubectl
@@ -53,7 +53,7 @@
     path: /etc/bash_completion.d/kubectl.sh
     owner: root
     group: root
-    mode: 0755
+    mode: "0755"
   when: ansible_os_family in ["Debian","RedHat"]
   tags:
     - kubectl
@@ -101,13 +101,13 @@
   template:
     src: k8s-certs-renew.sh.j2
     dest: "{{ bin_dir }}/k8s-certs-renew.sh"
-    mode: 0755
+    mode: "0755"
 
 - name: Renew K8S control plane certificates monthly 1/2
   template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
-    mode: 0644
+    mode: "0644"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{item}}'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250
@@ -118,9 +118,9 @@
   when: auto_renew_certificates
 
 - name: Renew K8S control plane certificates monthly 2/2
-  systemd:
+  systemd_service:
     name: k8s-certs-renew.timer
-    enabled: yes
+    enabled: true
     state: started
     daemon_reload: "{{ k8s_certs_units is changed }}"
   when: auto_renew_certificates