update to latest 2.26.0 kubespray version and add dns zones settings to coredns

kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml

@@ -13,9 +13,9 @@
 - name: Kubeadm | Check if kubeadm has already run
   stat:
     path: "/var/lib/kubelet/config.yaml"
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
   register: kubeadm_already_run
 
 - name: Kubeadm | Backup kubeadm certs / kubeconfig
@@ -51,35 +51,35 @@
   file:
     path: "{{ audit_policy_file | dirname }}"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
 
 - name: Write api audit policy yaml
   template:
     src: apiserver-audit-policy.yaml.j2
     dest: "{{ audit_policy_file }}"
-    mode: 0640
+    mode: "0640"
   when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
 
 - name: Write api audit webhook config yaml
   template:
     src: apiserver-audit-webhook-config.yaml.j2
     dest: "{{ audit_webhook_config_file }}"
-    mode: 0640
+    mode: "0640"
   when: kubernetes_audit_webhook | default(false)
 
 - name: Create apiserver tracing config directory
   file:
     path: "{{ kube_config_dir }}/tracing"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_tracing
 
 - name: Write apiserver tracing config yaml
   template:
     src: apiserver-tracing.yaml.j2
     dest: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml"
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_tracing
 
 # Nginx LB(default), If kubeadm_config_api_fqdn is defined, use other LB by kubeadm controlPlaneEndpoint.
@@ -96,27 +96,27 @@
   template:
     src: "kubeadm-config.{{ kubeadmConfig_api_version }}.yaml.j2"
     dest: "{{ kube_config_dir }}/kubeadm-config.yaml"
-    mode: 0640
+    mode: "0640"
 
 - name: Kubeadm | Create directory to store admission control configurations
   file:
     path: "{{ kube_config_dir }}/admission-controls"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_admission_control_config_file
 
 - name: Kubeadm | Push admission control config file
   template:
     src: "admission-controls.yaml.j2"
     dest: "{{ kube_config_dir }}/admission-controls/admission-controls.yaml"
-    mode: 0640
+    mode: "0640"
   when: kube_apiserver_admission_control_config_file
 
 - name: Kubeadm | Push admission control config files
   template:
     src: "{{ item | lower }}.yaml.j2"
     dest: "{{ kube_config_dir }}/admission-controls/{{ item | lower }}.yaml"
-    mode: 0640
+    mode: "0640"
   when:
     - kube_apiserver_admission_control_config_file
     - item in kube_apiserver_admission_plugins_needs_configuration
@@ -126,7 +126,7 @@
   template:
     src: "podnodeselector.yaml.j2"
     dest: "{{ kube_config_dir }}/admission-controls/podnodeselector.yaml"
-    mode: 0640
+    mode: "0640"
   when:
     - kube_apiserver_admission_plugins_podnodeselector_default_node_selector is defined
     - kube_apiserver_admission_plugins_podnodeselector_default_node_selector | length > 0
@@ -178,7 +178,7 @@
   file:
     path: "{{ kubeadm_patches.dest_dir }}"
     state: directory
-    mode: 0640
+    mode: "0640"
   when: kubeadm_patches is defined and kubeadm_patches.enabled
 
 - name: Kubeadm | Copy kubeadm patches from inventory files
@@ -186,7 +186,7 @@
     src: "{{ kubeadm_patches.source_dir }}/"
     dest: "{{ kubeadm_patches.dest_dir }}"
     owner: "root"
-    mode: 0644
+    mode: "0644"
   when: kubeadm_patches is defined and kubeadm_patches.enabled
 
 - name: Kubeadm | Initialize first master
@@ -221,12 +221,16 @@
     {{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create {{ kubeadm_token }}
   changed_when: false
   when:
-    - inventory_hostname ==  first_kube_control_plane
+    - inventory_hostname == first_kube_control_plane
     - kubeadm_token is defined
     - kubeadm_refresh_token
   tags:
     - kubeadm_token
 
+- name: Remove binding to anonymous user
+  command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
+  when: inventory_hostname == first_kube_control_plane and remove_anonymous_access
+
 - name: Create kubeadm token for joining nodes with 24h expiration (default)
   command: "{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create"
   changed_when: false