update to latest 2.26.0 kubespray version and add dns zones settings to coredns

kubespray/project/roles/network_plugin/calico/templates/calico-apiserver.yml.j2

@@ -72,6 +72,15 @@ spec:
           initialDelaySeconds: 90
           periodSeconds: 10
         name: calico-apiserver
+{% if calico_version is version('v3.28.0', '>=') %}
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 5443
+            scheme: HTTPS
+          timeoutSeconds: 5
+          periodSeconds: 60
+{% else %}
         readinessProbe:
           exec:
             command:
@@ -79,6 +88,7 @@ spec:
           failureThreshold: 5
           initialDelaySeconds: 5
           periodSeconds: 10
+{% endif %}
         securityContext:
           privileged: false
           runAsUser: 0
@@ -157,6 +167,7 @@ rules:
   - networksets
   - bgpconfigurations
   - bgppeers
+  - bgpfilters
   - felixconfigurations
   - kubecontrollersconfigurations
   - ippools
@@ -172,7 +183,16 @@ rules:
   - create
   - update
   - delete
-
+{% if calico_version is version('v3.28.0', '>=') %}
+- apiGroups:
+  - policy
+  resourceNames:
+  - calico-apiserver
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+{% endif %}
 ---
 
 apiVersion: rbac.authorization.k8s.io/v1

kubespray/project/roles/network_plugin/calico/templates/calico-config.yml.j2

@@ -102,4 +102,3 @@ data:
         }
       ]
     }
-

kubespray/project/roles/network_plugin/calico/templates/calico-cr.yml.j2

@@ -16,6 +16,11 @@ rules:
       - pods/status
     verbs:
       - patch
+  - apiGroups: [""]
+    resources:
+      - nodes/status
+    verbs:
+      - update
   - apiGroups: ["crd.projectcalico.org"]
     resources:
       - blockaffinities

kubespray/project/roles/network_plugin/calico/templates/calico-node.yml.j2

@@ -38,7 +38,7 @@ spec:
       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
       terminationGracePeriodSeconds: 0
       initContainers:
-{% if calico_datastore == "kdd" %}
+{% if calico_datastore == "kdd" and not calico_ipam_host_local %}
         # This container performs upgrade from host-local IPAM to calico-ipam.
         # It can be deleted if this is a fresh installation, or if you have already
         # upgraded to use calico-ipam.
@@ -310,6 +310,10 @@ spec:
               value: "{{ calico_node_ignorelooserpf }}"
             - name: CALICO_MANAGE_CNI
               value: "true"
+{% if calico_ipam_host_local %}
+            - name: USE_POD_CIDR
+              value: "true"
+{% endif %}
 {% if calico_node_extra_envs is defined %}
 {% for key in calico_node_extra_envs %}
             - name: {{ key }}
@@ -407,9 +411,11 @@ spec:
         - name: var-run-calico
           hostPath:
             path: /var/run/calico
+            type: DirectoryOrCreate
         - name: var-lib-calico
           hostPath:
             path: /var/lib/calico
+            type: DirectoryOrCreate
         # Used to install CNI.
         - name: cni-net-dir
           hostPath:
@@ -417,6 +423,7 @@ spec:
         - name: cni-bin-dir
           hostPath:
             path: /opt/cni/bin
+            type: DirectoryOrCreate
 {% if calico_datastore == "etcd" %}
         # Mount in the etcd TLS secrets.
         - name: etcd-certs
@@ -428,7 +435,7 @@ spec:
           hostPath:
             path: /run/xtables.lock
             type: FileOrCreate
-{% if calico_datastore == "kdd" %}
+{% if calico_datastore == "kdd" and not calico_ipam_host_local %}
         # Mount in the directory for host-local IPAM allocations. This is
         # used when upgrading from host-local to calico-ipam, and can be removed
         # if not using the upgrade-ipam init container.

kubespray/project/roles/network_plugin/calico/templates/calico-typha.yml.j2

@@ -136,11 +136,10 @@ spec:
             name: cacert
             readOnly: true
 {% endif %}
-          # Needed for version >=3.7 when the 'host-local' ipam is used
-          # Should never happen given templates/cni-calico.conflist.j2
-          # Configure route aggregation based on pod CIDR.
-          # - name: USE_POD_CIDR
-          #   value: "true"
+{% if calico_ipam_host_local %}
+          - name: USE_POD_CIDR
+            value: "true"
+{% endif %}
         livenessProbe:
           httpGet:
             path: /liveness