update to latest 2.26.0 kubespray version and add dns zones settings to coredns

kubespray/project/roles/kubernetes/node/tasks/facts.yml

@@ -8,7 +8,7 @@
       executable: /bin/bash
     register: docker_cgroup_driver_result
     changed_when: false
-    check_mode: no
+    check_mode: false
 
   - name: Set kubelet_cgroup_driver_detected fact for docker
     set_fact:

kubespray/project/roles/kubernetes/node/tasks/install.yml

@@ -3,7 +3,7 @@
   copy:
     src: "{{ downloads.kubeadm.dest }}"
     dest: "{{ bin_dir }}/kubeadm"
-    mode: 0755
+    mode: "0755"
     remote_src: true
   tags:
     - kubeadm
@@ -14,7 +14,7 @@
   copy:
     src: "{{ downloads.kubelet.dest }}"
     dest: "{{ bin_dir }}/kubelet"
-    mode: 0755
+    mode: "0755"
     remote_src: true
   tags:
     - kubelet

kubespray/project/roles/kubernetes/node/tasks/kubelet.yml

@@ -11,8 +11,8 @@
     src: "kubelet.env.{{ kubeletConfig_api_version }}.j2"
     dest: "{{ kube_config_dir }}/kubelet.env"
     setype: "{{ (preinstall_selinux_state != 'disabled') | ternary('etc_t', omit) }}"
-    backup: yes
-    mode: 0600
+    backup: true
+    mode: "0600"
   notify: Node | restart kubelet
   tags:
     - kubelet
@@ -22,7 +22,7 @@
   template:
     src: "kubelet-config.{{ kubeletConfig_api_version }}.yaml.j2"
     dest: "{{ kube_config_dir }}/kubelet-config.yaml"
-    mode: 0600
+    mode: "0600"
   notify: Kubelet | restart kubelet
   tags:
     - kubelet
@@ -32,8 +32,8 @@
   template:
     src: "kubelet.service.j2"
     dest: "/etc/systemd/system/kubelet.service"
-    backup: "yes"
-    mode: 0600
+    backup: true
+    mode: "0600"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250
@@ -48,7 +48,7 @@
 - name: Enable kubelet
   service:
     name: kubelet
-    enabled: yes
+    enabled: true
     state: started
   tags:
     - kubelet

kubespray/project/roles/kubernetes/node/tasks/loadbalancer/haproxy.yml

@@ -8,7 +8,7 @@
   file:
     path: "{{ haproxy_config_dir }}"
     state: directory
-    mode: 0755
+    mode: "0755"
     owner: root
 
 - name: Haproxy | Write haproxy configuration
@@ -16,19 +16,19 @@
     src: "loadbalancer/haproxy.cfg.j2"
     dest: "{{ haproxy_config_dir }}/haproxy.cfg"
     owner: root
-    mode: 0755
-    backup: yes
+    mode: "0755"
+    backup: true
 
 - name: Haproxy | Get checksum from config
   stat:
     path: "{{ haproxy_config_dir }}/haproxy.cfg"
-    get_attributes: no
-    get_checksum: yes
-    get_mime: no
+    get_attributes: false
+    get_checksum: true
+    get_mime: false
   register: haproxy_stat
 
 - name: Haproxy | Write static pod
   template:
     src: manifests/haproxy.manifest.j2
     dest: "{{ kube_manifest_dir }}/haproxy.yml"
-    mode: 0640
+    mode: "0640"

kubespray/project/roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml

@@ -6,8 +6,34 @@
     - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
     - kube_vip_arp_enabled
 
+- name: Kube-vip | Check if super-admin.conf exists
+  stat:
+    path: "{{ kube_config_dir }}/super-admin.conf"
+  failed_when: false
+  changed_when: false
+  register: stat_kube_vip_super_admin
+
+- name: Kube-vip | Check if kubeadm has already run
+  stat:
+    path: "/var/lib/kubelet/config.yaml"
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
+  register: kubeadm_already_run
+
+- name: Kube-vip | Set admin.conf
+  set_fact:
+    kube_vip_admin_conf: admin.conf
+
+- name: Kube-vip | Set admin.conf for first Control Plane
+  set_fact:
+    kube_vip_admin_conf: super-admin.conf
+  when:
+    - inventory_hostname == groups['kube_control_plane'] | first
+    - (stat_kube_vip_super_admin.stat.exists and stat_kube_vip_super_admin.stat.isreg) or (not kubeadm_already_run.stat.exists )
+
 - name: Kube-vip | Write static pod
   template:
     src: manifests/kube-vip.manifest.j2
     dest: "{{ kube_manifest_dir }}/kube-vip.yml"
-    mode: 0640
+    mode: "0640"

kubespray/project/roles/kubernetes/node/tasks/loadbalancer/nginx-proxy.yml

@@ -8,7 +8,7 @@
   file:
     path: "{{ nginx_config_dir }}"
     state: directory
-    mode: 0700
+    mode: "0700"
     owner: root
 
 - name: Nginx-proxy | Write nginx-proxy configuration
@@ -16,19 +16,19 @@
     src: "loadbalancer/nginx.conf.j2"
     dest: "{{ nginx_config_dir }}/nginx.conf"
     owner: root
-    mode: 0755
-    backup: yes
+    mode: "0755"
+    backup: true
 
 - name: Nginx-proxy | Get checksum from config
   stat:
     path: "{{ nginx_config_dir }}/nginx.conf"
-    get_attributes: no
-    get_checksum: yes
-    get_mime: no
+    get_attributes: false
+    get_checksum: true
+    get_mime: false
   register: nginx_stat
 
 - name: Nginx-proxy | Write static pod
   template:
     src: manifests/nginx-proxy.manifest.j2
     dest: "{{ kube_manifest_dir }}/nginx-proxy.yml"
-    mode: 0640
+    mode: "0640"

kubespray/project/roles/kubernetes/node/tasks/main.yml

@@ -14,7 +14,7 @@
   file:
     path: /var/lib/cni
     state: directory
-    mode: 0755
+    mode: "0755"
 
 - name: Install kubelet binary
   import_tasks: install.yml
@@ -51,10 +51,10 @@
   ansible.posix.sysctl:
     name: net.ipv4.ip_local_reserved_ports
     value: "{{ kube_apiserver_node_port_range }}"
-    sysctl_set: yes
+    sysctl_set: true
     sysctl_file: "{{ sysctl_file_path }}"
     state: present
-    reload: yes
+    reload: true
   when: kube_apiserver_node_port_range is defined
   tags:
     - kube-proxy
@@ -66,7 +66,7 @@
   register: modinfo_br_netfilter
   failed_when: modinfo_br_netfilter.rc not in [0, 1]
   changed_when: false
-  check_mode: no
+  check_mode: false
 
 # TODO: Remove once upstream issue is fixed
 # https://github.com/ansible-collections/community.general/issues/7717
@@ -74,7 +74,7 @@
   file:
     path: "{{ item }}"
     state: directory
-    mode: 0755
+    mode: "0755"
   loop:
     - /etc/modules-load.d
     - /etc/modprobe.d
@@ -89,7 +89,7 @@
   copy:
     dest: /etc/modules-load.d/kubespray-br_netfilter.conf
     content: br_netfilter
-    mode: 0644
+    mode: "0644"
   when: modinfo_br_netfilter.rc == 0
 
 # kube-proxy needs net.bridge.bridge-nf-call-iptables enabled when found if br_netfilter is not a module
@@ -97,7 +97,7 @@
   command: "sysctl net.bridge.bridge-nf-call-iptables"
   failed_when: false
   changed_when: false
-  check_mode: no
+  check_mode: false
   register: sysctl_bridge_nf_call_iptables
 
 - name: Enable bridge-nf-call tables
@@ -106,7 +106,7 @@
     state: present
     sysctl_file: "{{ sysctl_file_path }}"
     value: "1"
-    reload: yes
+    reload: true
   when: sysctl_bridge_nf_call_iptables.rc == 0
   with_items:
     - net.bridge.bridge-nf-call-iptables
@@ -162,7 +162,7 @@
     content: "{{ openstack_cacert | b64decode if openstack_cacert_is_base64 else omit }}"
     dest: "{{ kube_config_dir }}/openstack-cacert.pem"
     group: "{{ kube_cert_group }}"
-    mode: 0640
+    mode: "0640"
   when:
     - cloud_provider is defined
     - cloud_provider == 'openstack'
@@ -176,7 +176,7 @@
     src: "cloud-configs/{{ cloud_provider }}-cloud-config.j2"
     dest: "{{ kube_config_dir }}/cloud_config"
     group: "{{ kube_cert_group }}"
-    mode: 0640
+    mode: "0640"
   when:
     - cloud_provider is defined
     - cloud_provider in [ 'openstack', 'azure', 'vsphere', 'aws', 'gce' ]

kubespray/project/roles/kubernetes/node/tasks/pre_upgrade.yml

@@ -11,7 +11,7 @@
     executable: /bin/bash
   failed_when: false
   changed_when: false
-  check_mode: no
+  check_mode: false
   register: kubelet_container_check
 
 - name: "Pre-upgrade | copy /var/lib/cni from kubelet"