update to latest 2.26.0 kubespray version and add dns zones settings to coredns

config.sample.yaml

@@ -5,7 +5,7 @@ credentials:
 
 hosts:
   - hostname: t1-disk-lt-k8s-test-master-01
-    ip: "10.100.20.49"
+    ip: "10.100.20.47"
     roles: [control_plane, etcd]
 
   - hostname: t1-disk-lt-k8s-test-slave-01
@@ -13,24 +13,45 @@ hosts:
     roles: [node]
 
   - hostname: t1-disk-lt-k8s-test-slave-02
-    ip: "10.100.20.47"
+    ip: "10.100.20.49"
     roles: [node]
 
 orchestrator:
-  version: v1.29.0
+  version: v1.30.3
   cluster_name: cluster.local
-  kubelet_dir: "/var/lib/kubelet"
+  kubelet_dir: "/app/k8s/kubelet"
   container_engine:
     install: true
     type: "containerd"
-    data_dir: "/var/lib/containerd"
+    data_dir: "/app/containerd"
-    state_dir: "/run/containerd"
+    state_dir: "/app/containerd-state"
   dns:
     servers:
       - 8.8.8.8
       - 8.8.4.4
       - 1.1.1.1
     disable_host_nameservers: false
+    coredns_external_zones:
+      []
+      # - zones:
+      #     - example.com
+      #     - example.io:1053
+      #   nameservers:
+      #     - 1.1.1.1
+      #     - 2.2.2.2
+      #   cache: 5
+      # - zones:
+      #     - https://mycompany.local:4453
+      #   nameservers:
+      #     - 192.168.0.53
+      #   cache: 0
+      # - zones:
+      #     - mydomain.tld
+      #   nameservers:
+      #     - 10.233.0.3
+      #   cache: 5
+      #   rewrite:
+      #     - name website.tld website.namespace.svc.cluster.local
   ping_access_ip: true
   auto_renew_certificates: true
   pod_security_policy_enabled: true
@@ -41,6 +62,20 @@ orchestrator:
       skip_verify: false
 
 modules:
+  admin_password: changeit
+
+  observability:
+    enabled: false
+
+  cicd:
+    enabled: false
+
+  secrets_storage:
+    enabled: false
+
+  registry:
+    enabled: false
+
   additional:
     cert_manager:
       enabled: true

internal/config/orchestrator.go

@@ -3,6 +3,7 @@ package config
 type Dns struct {
 	Servers                []string      `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"`
 	DisableHostNameservers bool          `yaml:"disable_host_nameservers"`
+	CoreDNSExternalZones   []interface{} `yaml:"coredns_external_zones"`
 }
 
 type RegistryMirror struct {

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl

@@ -183,7 +183,10 @@ nodelocaldns_health_port: 9254
 nodelocaldns_second_health_port: 9256
 nodelocaldns_bind_metrics_host_ip: false
 nodelocaldns_secondary_skew_seconds: 5
-# nodelocaldns_external_zones:
+{{- if .Orchestrator.Dns.CoreDNSExternalZones }}
+coredns_external_zones:
+  {{- .Orchestrator.Dns.CoreDNSExternalZones | toYaml | nindent 2 }}
+{{- end }}
 # - zones:
 #   - example.com
 #   - example.io:1053

kubespray/env/cmdline

@@ -1 +0,0 @@
--b -v --become

kubespray/env/extravars

@@ -1,2 +0,0 @@
----
-ansible_sudo_pass: nF5S8nuKi87Dh42Jnjik

kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml

@@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
 kube_api_anonymous_auth: true
 
 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.29.0
+kube_version: v1.30.3
 
 # Where the binaries will be downloaded.
 # Note: ensure that you've enough disk space (about 1G)
@@ -179,7 +179,6 @@ nodelocaldns_health_port: 9254
 nodelocaldns_second_health_port: 9256
 nodelocaldns_bind_metrics_host_ip: false
 nodelocaldns_secondary_skew_seconds: 5
-# nodelocaldns_external_zones:
 # - zones:
 #   - example.com
 #   - example.io:1053

kubespray/inventory/hosts

@@ -1,31 +1,17 @@
 
-t1-disk-lt-k8s-master-01 ansible_host=10.100.20.43 ip=10.100.20.43  
+t1-disk-lt-k8s-test-master-01 ansible_host=10.100.20.47 ip=10.100.20.47  
-t1-disk-lt-k8s-master-02 ansible_host=10.100.20.38 ip=10.100.20.38  
+t1-disk-lt-k8s-test-slave-01 ansible_host=10.100.20.48 ip=10.100.20.48  
-t1-disk-lt-k8s-master-03 ansible_host=10.100.20.42 ip=10.100.20.42  
+t1-disk-lt-k8s-test-slave-02 ansible_host=10.100.20.49 ip=10.100.20.49  
-t1-disk-lt-k8s-slave-01 ansible_host=10.100.20.40 ip=10.100.20.40  
-t1-disk-lt-k8s-slave-02 ansible_host=10.100.20.41 ip=10.100.20.41  
-t1-disk-lt-k8s-slave-03 ansible_host=10.100.20.39 ip=10.100.20.39  
-t1-disk-lt-k8s-slave-04 ansible_host=10.100.20.45 ip=10.100.20.45  
-t1-disk-lt-k8s-slave-05 ansible_host=10.100.20.44 ip=10.100.20.44  
-t1-disk-lt-k8s-slave-06 ansible_host=10.100.20.50 ip=10.100.20.50  
 
 [kube_control_plane]
-t1-disk-lt-k8s-master-01
+t1-disk-lt-k8s-test-master-01
-t1-disk-lt-k8s-master-02
-t1-disk-lt-k8s-master-03
 
 [etcd]
-t1-disk-lt-k8s-master-01
+t1-disk-lt-k8s-test-master-01
-t1-disk-lt-k8s-master-02
-t1-disk-lt-k8s-master-03
 
 [kube_node]
-t1-disk-lt-k8s-slave-01
+t1-disk-lt-k8s-test-slave-01
-t1-disk-lt-k8s-slave-02
+t1-disk-lt-k8s-test-slave-02
-t1-disk-lt-k8s-slave-03
-t1-disk-lt-k8s-slave-04
-t1-disk-lt-k8s-slave-05
-t1-disk-lt-k8s-slave-06
 
 [k8s_cluster:children]
 kube_control_plane

kubespray/project/ansible_version.yml

@@ -2,10 +2,10 @@
 - name: Check Ansible version
   hosts: all
   gather_facts: false
-  become: no
+  become: false
   run_once: true
   vars:
-    minimal_ansible_version: 2.15.5  # 2.15 versions before 2.15.5 are known to be buggy for kubespray
+    minimal_ansible_version: 2.16.4
     maximal_ansible_version: 2.17.0
   tags: always
   tasks:
@@ -25,7 +25,6 @@
       tags:
         - check
 
-    # CentOS 7 provides too old jinja version
     - name: "Check that jinja is not too old (install via pip)"
       assert:
         msg: "Your Jinja version is too old, install via pip"

kubespray/project/boilerplate.yml

@@ -51,7 +51,7 @@
 
 - name: Install bastion ssh config
   hosts: bastion[0]
-  gather_facts: False
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults }

kubespray/project/cluster.yml

@@ -7,17 +7,13 @@
 
 - name: Prepare for etcd install
   hosts: k8s_cluster:etcd
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults }
     - { role: kubernetes/preinstall, tags: preinstall }
-    - {
+    - { role: "container-engine", tags: "container-engine", when: deploy_container_engine }
-        role: "container-engine",
-        tags: "container-engine",
-        when: deploy_container_engine,
-      }
     - { role: download, tags: download, when: "not skip_downloads" }
 
 - name: Install etcd
@@ -25,7 +21,7 @@
 
 - name: Install Kubernetes nodes
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
@@ -34,7 +30,7 @@
 
 - name: Install the control plane
   hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
@@ -45,7 +41,7 @@
 
 - name: Invoke kubeadm and install a CNI
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
@@ -58,50 +54,41 @@
 
 - name: Install Calico Route Reflector
   hosts: calico_rr
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults }
-    - { role: network_plugin/calico/rr, tags: ["network", "calico_rr"] }
+    - { role: network_plugin/calico/rr, tags: ['network', 'calico_rr'] }
 
 - name: Patch Kubernetes for Windows
   hosts: kube_control_plane[0]
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults }
     - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }
 
-- name: Install Kubernetes and Helm apps
+- name: Install Kubernetes apps
   hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults }
-    - {
+    - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller }
-        role: kubernetes-apps/external_cloud_controller,
-        tags: external-cloud-controller,
-      }
     - { role: kubernetes-apps/network_plugin, tags: network }
     - { role: kubernetes-apps/policy_controller, tags: policy-controller }
     - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
     - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
     - { role: kubernetes-apps, tags: apps }
-    # - { role: helm-apps, tags: helm-apps }
 
 - name: Apply resolv.conf changes now that cluster DNS is up
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults }
-    - {
+    - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }
-        role: kubernetes/preinstall,
-        when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'",
-        tags: resolvconf,
-        dns_late: true,
-      }

kubespray/project/facts.yml

@@ -15,7 +15,7 @@
 
 - name: Gather facts
   hosts: k8s_cluster:etcd:calico_rr
-  gather_facts: False
+  gather_facts: false
   tags: always
   tasks:
     - name: Gather minimal facts

kubespray/project/install_etcd.yml

@@ -16,7 +16,7 @@
 
 - name: Install etcd
   hosts: etcd:kube_control_plane:_kubespray_needs_etcd
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:

kubespray/project/remove_node.yml

@@ -4,13 +4,13 @@
 
 - name: Confirm node removal
   hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}"
-  gather_facts: no
+  gather_facts: false
   tasks:
     - name: Confirm Execution
       pause:
         prompt: "Are you sure you want to delete nodes state? Type 'yes' to delete nodes."
       register: pause_result
-      run_once: True
+      run_once: true
       when:
         - not (skip_confirmation | default(false) | bool)
 
@@ -25,7 +25,7 @@
 
 - name: Reset node
   hosts: "{{ node | default('kube_node') }}"
-  gather_facts: no
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
@@ -36,7 +36,7 @@
 # Currently cannot remove first master or etcd
 - name: Post node removal
   hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}"
-  gather_facts: no
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
     - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }

kubespray/project/reset.yml

@@ -7,13 +7,13 @@
 
 - name: Reset cluster
   hosts: etcd:k8s_cluster:calico_rr
-  gather_facts: False
+  gather_facts: false
   pre_tasks:
     - name: Reset Confirmation
       pause:
         prompt: "Are you sure you want to reset cluster state? Type 'yes' to reset your cluster."
       register: reset_confirmation_prompt
-      run_once: True
+      run_once: true
       when:
         - not (skip_confirmation | default(false) | bool)
         - reset_confirmation is not defined

kubespray/project/roles/adduser/defaults/main.yml

@@ -7,14 +7,14 @@ addusers:
   etcd:
     name: etcd
     comment: "Etcd user"
-    create_home: no
+    create_home: false
-    system: yes
+    system: true
     shell: /sbin/nologin
   kube:
     name: kube
     comment: "Kubernetes user"
-    create_home: no
+    create_home: false
-    system: yes
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"
 

kubespray/project/roles/adduser/vars/coreos.yml

@@ -3,6 +3,6 @@ addusers:
   - name: kube
     comment: "Kubernetes user"
     shell: /sbin/nologin
-    system: yes
+    system: true
     group: "{{ kube_cert_group }}"
-    create_home: no
+    create_home: false

kubespray/project/roles/adduser/vars/debian.yml

@@ -2,14 +2,14 @@
 addusers:
   - name: etcd
     comment: "Etcd user"
-    create_home: yes
+    create_home: true
     home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
     shell: /sbin/nologin
 
   - name: kube
     comment: "Kubernetes user"
-    create_home: no
+    create_home: false
-    system: yes
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"

kubespray/project/roles/adduser/vars/redhat.yml

@@ -2,14 +2,14 @@
 addusers:
   - name: etcd
     comment: "Etcd user"
-    create_home: yes
+    create_home: true
     home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
     shell: /sbin/nologin
 
   - name: kube
     comment: "Kubernetes user"
-    create_home: no
+    create_home: false
-    system: yes
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"

kubespray/project/roles/bastion-ssh-config/molecule/default/converge.yml

@@ -12,4 +12,4 @@
         dest: "{{ ssh_bastion_confing__name }}"
         owner: "{{ ansible_user }}"
         group: "{{ ansible_user }}"
-        mode: 0644
+        mode: "0644"

kubespray/project/roles/bastion-ssh-config/tasks/main.yml

@@ -19,4 +19,4 @@
   template:
     src: "{{ ssh_bastion_confing__name }}.j2"
     dest: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}"
-    mode: 0640
+    mode: "0640"

kubespray/project/roles/bootstrap-os/defaults/main.yml

@@ -11,6 +11,10 @@ coreos_locksmithd_disable: false
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true
 
+## Ubuntu specific variables
+# Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
+ubuntu_kernel_unattended_upgrades_disabled: false
+
 fedora_coreos_packages:
   - python
   - python3-libselinux

kubespray/project/roles/bootstrap-os/molecule/default/converge.yml

@@ -1,6 +1,6 @@
 ---
 - name: Converge
   hosts: all
-  gather_facts: no
+  gather_facts: false
   roles:
     - role: bootstrap-os

kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml

@@ -19,12 +19,6 @@ platforms:
     memory: 1024
     provider_options:
       driver: kvm
-  - name: centos7
-    box: centos/7
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
   - name: almalinux8
     box: almalinux/8
     cpus: 1

kubespray/project/roles/bootstrap-os/tasks/amzn.yml

@@ -1,13 +1,16 @@
 ---
+- name: Enable selinux-ng repo for Amazon Linux for container-selinux
+  command: amazon-linux-extras enable selinux-ng
+
 - name: Enable EPEL repo for Amazon Linux
   yum_repository:
     name: epel
     file: epel
     description: Extra Packages for Enterprise Linux 7 - $basearch
     baseurl: http://download.fedoraproject.org/pub/epel/7/$basearch
-    gpgcheck: yes
+    gpgcheck: true
     gpgkey: http://download.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
-    skip_if_unavailable: yes
+    skip_if_unavailable: true
-    enabled: yes
+    enabled: true
-    repo_gpgcheck: no
+    repo_gpgcheck: false
   when: epel_enabled

kubespray/project/roles/bootstrap-os/tasks/bootstrap-coreos.yml

@@ -1,37 +0,0 @@
----
-# CoreOS ships without Python installed
-
-- name: Check if bootstrap is needed
-  raw: stat /opt/bin/.bootstrapped
-  register: need_bootstrap
-  failed_when: false
-  changed_when: false
-  tags:
-    - facts
-
-- name: Force binaries directory for Container Linux by CoreOS and Flatcar
-  set_fact:
-    bin_dir: "/opt/bin"
-  tags:
-    - facts
-
-- name: Run bootstrap.sh
-  script: bootstrap.sh
-  become: true
-  environment: "{{ proxy_env }}"
-  when:
-    - need_bootstrap.rc != 0
-
-- name: Set the ansible_python_interpreter fact
-  set_fact:
-    ansible_python_interpreter: "{{ bin_dir }}/python"
-  tags:
-    - facts
-
-- name: Disable auto-upgrade
-  systemd:
-    name: locksmithd.service
-    masked: true
-    state: stopped
-  when:
-    - coreos_locksmithd_disable

kubespray/project/roles/bootstrap-os/tasks/centos.yml

@@ -12,7 +12,7 @@
     value: "{{ http_proxy | default(omit) }}"
     state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
     no_extra_spaces: true
-    mode: 0644
+    mode: "0644"
   become: true
   when: not skip_http_proxy_on_os_packages
 
@@ -21,7 +21,7 @@
   get_url:
     url: https://yum.oracle.com/public-yum-ol7.repo
     dest: /etc/yum.repos.d/public-yum-ol7.repo
-    mode: 0644
+    mode: "0644"
   when:
     - use_oracle_public_repo | default(true)
     - '''ID="ol"'' in os_release.stdout_lines'
@@ -34,7 +34,7 @@
     section: "{{ item }}"
     option: enabled
     value: "1"
-    mode: 0644
+    mode: "0644"
   with_items:
     - ol7_latest
     - ol7_addons
@@ -59,7 +59,7 @@
     section: "ol{{ ansible_distribution_major_version }}_addons"
     option: "{{ item.option }}"
     value: "{{ item.value }}"
-    mode: 0644
+    mode: "0644"
   with_items:
     - { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
     - { option: "enabled", value: "1" }
@@ -75,12 +75,12 @@
     section: "extras"
     option: "{{ item.option }}"
     value: "{{ item.value }}"
-    mode: 0644
+    mode: "0644"
   with_items:
     - { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" }
     - { option: "enabled", value: "1" }
     - { option: "gpgcheck", value: "0" }
-    - { option: "baseurl", value: "http://mirror.centos.org/{{ 'altarch' if (ansible_distribution_major_version | int) <= 7 and ansible_architecture == 'aarch64' else 'centos' }}/{{ ansible_distribution_major_version }}/extras/$basearch/{% if ansible_distribution_major_version | int > 7 %}os/{% endif %}" }
+    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_distribution_major_version }}/extras/$basearch/os/" }
   when:
     - use_oracle_public_repo | default(true)
     - '''ID="ol"'' in os_release.stdout_lines'
@@ -92,9 +92,9 @@
 - name: Check presence of fastestmirror.conf
   stat:
     path: /etc/yum/pluginconf.d/fastestmirror.conf
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: fastestmirror
 
 # the fastestmirror plugin can actually slow down Ansible deployments

kubespray/project/roles/bootstrap-os/tasks/clearlinux.yml

@@ -7,7 +7,7 @@
     state: present
 
 - name: Make sure docker service is enabled
-  systemd:
+  systemd_service:
     name: docker
     masked: false
     enabled: true

kubespray/project/roles/bootstrap-os/tasks/debian.yml

@@ -55,22 +55,10 @@
   raw: apt-get update --allow-releaseinfo-change
   become: true
   when:
-    - '''ID=debian'' in os_release.stdout_lines'
+    - os_release_dict['ID'] == 'debian'
-    - '''VERSION_ID="10"'' in os_release.stdout_lines or ''VERSION_ID="11"'' in os_release.stdout_lines'
+    - os_release_dict['VERSION_ID'] in ["10", "11"]
   register: bootstrap_update_apt_result
   changed_when:
     - '"changed its" in bootstrap_update_apt_result.stdout'
     - '"value from" in bootstrap_update_apt_result.stdout'
   ignore_errors: true
-
-- name: Set the ansible_python_interpreter fact
-  set_fact:
-    ansible_python_interpreter: "/usr/bin/python3"
-
-# Workaround for https://github.com/ansible/ansible/issues/25543
-- name: Install dbus for the hostname module
-  package:
-    name: dbus
-    state: present
-    use: apt
-  become: true

kubespray/project/roles/bootstrap-os/tasks/fedora-coreos.yml

@@ -28,7 +28,7 @@
   raw: "nohup bash -c 'sleep 5s && shutdown -r now'"
   become: true
   ignore_errors: true  # noqa ignore-errors
-  ignore_unreachable: yes
+  ignore_unreachable: true
   when: need_bootstrap.rc != 0
 
 - name: Wait for the reboot to complete
@@ -38,9 +38,3 @@
     delay: 5
     sleep: 5
   when: need_bootstrap.rc != 0
-
-- name: Store the fact if this is an fedora core os host
-  set_fact:
-    is_fedora_coreos: True
-  tags:
-    - facts

kubespray/project/roles/bootstrap-os/tasks/fedora.yml

@@ -17,20 +17,14 @@
     value: "{{ http_proxy | default(omit) }}"
     state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
     no_extra_spaces: true
-    mode: 0644
+    mode: "0644"
   become: true
   when: not skip_http_proxy_on_os_packages
 
-- name: Install python3 on fedora
+# libselinux-python3 is required on SELinux enabled hosts
-  raw: "dnf install --assumeyes --quiet python3"
+# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
+- name: Install ansible requirements
+  raw: "dnf install --assumeyes python3 python3-dnf libselinux-python3"
   become: true
   when:
     - need_bootstrap.rc != 0
-
-# libselinux-python3 is required on SELinux enabled hosts
-# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
-- name: Install libselinux-python3
-  package:
-    name: libselinux-python3
-    state: present
-  become: true

kubespray/project/roles/bootstrap-os/tasks/flatcar.yml

@@ -9,12 +9,6 @@
   tags:
     - facts
 
-- name: Force binaries directory for Flatcar Container Linux by Kinvolk
-  set_fact:
-    bin_dir: "/opt/bin"
-  tags:
-    - facts
-
 - name: Run bootstrap.sh
   script: bootstrap.sh
   become: true
@@ -22,14 +16,17 @@
   when:
     - need_bootstrap.rc != 0
 
-- name: Set the ansible_python_interpreter fact
+# Workaround ansible https://github.com/ansible/ansible/pull/82821
+# We set the interpreter rather than ansible_python_interpreter to allow
+# - using virtual env with task level ansible_python_interpreter later
+# - let users specify an ansible_python_interpreter in group_vars
+
+- name: Make interpreter discovery works on Flatcar
   set_fact:
-    ansible_python_interpreter: "{{ bin_dir }}/python"
+    ansible_interpreter_python_fallback: "{{ ansible_interpreter_python_fallback + [ '/opt/bin/python' ] }}"
-  tags:
-    - facts
 
 - name: Disable auto-upgrade
-  systemd:
+  systemd_service:
     name: locksmithd.service
     masked: true
     state: stopped

kubespray/project/roles/bootstrap-os/tasks/main.yml

@@ -6,57 +6,39 @@
   # This command should always run, even in check mode
   check_mode: false
 
-- name: Bootstrap CentOS
+- name: Include distro specifics vars and tasks
-  include_tasks: bootstrap-centos.yml
+  vars:
-  when: '''ID="centos"'' in os_release.stdout_lines or ''ID="ol"'' in os_release.stdout_lines or ''ID="almalinux"'' in os_release.stdout_lines or ''ID="rocky"'' in os_release.stdout_lines or ''ID="kylin"'' in os_release.stdout_lines  or ''ID="uos"'' in os_release.stdout_lines or ''ID="openEuler"'' in os_release.stdout_lines'
+    os_release_dict: "{{ os_release.stdout_lines | select('regex', '^.+=.*$') | map('regex_replace', '\"', '') |
+                         map('split', '=') | community.general.dict }}"
+  block:
+  - name: Include vars
+    include_vars: "{{ item }}"
+    tags:
+    - facts
+    with_first_found:
+    - &search
+      files:
+      - "{{ os_release_dict['ID'] }}-{{ os_release_dict['VARIANT_ID'] }}.yml"
+      - "{{ os_release_dict['ID'] }}.yml"
+      paths:
+      - vars/
+      skip: true
+  - name: Include tasks
+    include_tasks: "{{ included_tasks_file }}"
+    with_first_found:
+    - <<: *search
+      paths: []
+    loop_control:
+      loop_var: included_tasks_file
 
-- name: Bootstrap Amazon
-  include_tasks: bootstrap-amazon.yml
-  when: '''ID="amzn"'' in os_release.stdout_lines'
-
-- name: Bootstrap RedHat
-  include_tasks: bootstrap-redhat.yml
-  when: '''ID="rhel"'' in os_release.stdout_lines'
-
-- name: Bootstrap Clear Linux
-  include_tasks: bootstrap-clearlinux.yml
-  when: '''ID=clear-linux-os'' in os_release.stdout_lines'
-
-# Fedora CoreOS
-- name: Bootstrap Fedora CoreOS
-  include_tasks: bootstrap-fedora-coreos.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' in os_release.stdout_lines'
-
-- name: Bootstrap Flatcar
-  include_tasks: bootstrap-flatcar.yml
-  when: '''ID=flatcar'' in os_release.stdout_lines'
-
-- name: Bootstrap Debian
-  include_tasks: bootstrap-debian.yml
-  when: '''ID=debian'' in os_release.stdout_lines or ''ID=ubuntu'' in os_release.stdout_lines'
-
-# Fedora "classic"
-- name: Boostrap Fedora
-  include_tasks: bootstrap-fedora.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' not in os_release.stdout_lines'
-
-- name: Bootstrap OpenSUSE
-  include_tasks: bootstrap-opensuse.yml
-  when: '''ID="opensuse-leap"'' in os_release.stdout_lines or ''ID="opensuse-tumbleweed"'' in os_release.stdout_lines'
 
 - name: Create remote_tmp for it is used by another module
   file:
     path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
     state: directory
-    mode: 0700
+    mode: "0700"
 
-# Workaround for https://github.com/ansible/ansible/issues/42726
+- name: Gather facts
-# (1/3)
-- name: Gather host facts to get ansible_os_family
   setup:
     gather_subset: '!all'
     filter: ansible_*
@@ -64,34 +46,7 @@
 - name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
   hostname:
     name: "{{ inventory_hostname }}"
-  when:
+  when: override_system_hostname
-    - override_system_hostname
-    - ansible_os_family not in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    - not ansible_distribution == "Fedora"
-    - not is_fedora_coreos
-
-# (2/3)
-- name: Assign inventory name to unconfigured hostnames (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  command: "hostnamectl set-hostname {{ inventory_hostname }}"
-  register: hostname_changed
-  become: true
-  changed_when: false
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
-
-# (3/3)
-- name: Update hostname fact (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  setup:
-    gather_subset: '!all'
-    filter: ansible_hostname
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
 
 - name: Install ceph-commmon package
   package:
@@ -106,4 +61,4 @@
     state: directory
     owner: root
     group: root
-    mode: 0755
+    mode: "0755"

kubespray/project/roles/bootstrap-os/tasks/openEuler.yml

@@ -0,0 +1,3 @@
+---
+- name: Import Centos boostrap for openEuler
+  import_tasks: centos.yml

kubespray/project/roles/bootstrap-os/tasks/opensuse-leap.yml

@@ -0,0 +1,3 @@
+---
+- name: Import Opensuse bootstrap
+  import_tasks: opensuse.yml

kubespray/project/roles/bootstrap-os/tasks/opensuse-tumbleweed.yml

@@ -0,0 +1,3 @@
+---
+- name: Import Opensuse bootstrap
+  import_tasks: opensuse.yml

kubespray/project/roles/bootstrap-os/tasks/opensuse.yml

@@ -8,9 +8,9 @@
 - name: Check that /etc/sysconfig/proxy file exists
   stat:
     path: /etc/sysconfig/proxy
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: stat_result
 
 - name: Create the /etc/sysconfig/proxy empty file

kubespray/project/roles/bootstrap-os/tasks/redhat.yml

@@ -12,7 +12,7 @@
     value: "{{ http_proxy | default(omit) }}"
     state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
     no_extra_spaces: true
-    mode: 0644
+    mode: "0644"
   become: true
   when: not skip_http_proxy_on_os_packages
 
@@ -62,17 +62,6 @@
     - rh_subscription_username is defined
     - rh_subscription_status.changed
 
-# container-selinux is in extras repo
-- name: Enable RHEL 7 repos
-  community.general.rhsm_repository:
-    name:
-      - "rhel-7-server-rpms"
-      - "rhel-7-server-extras-rpms"
-    state: "{{ 'enabled' if (rhel_enable_repos | default(True) | bool) else 'disabled' }}"
-  when:
-    - ansible_distribution_major_version == "7"
-    - (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)
-
 # container-selinux is in appstream repo
 - name: Enable RHEL 8 repos
   community.general.rhsm_repository:
@@ -87,9 +76,9 @@
 - name: Check presence of fastestmirror.conf
   stat:
     path: /etc/yum/pluginconf.d/fastestmirror.conf
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: fastestmirror
 
 # the fastestmirror plugin can actually slow down Ansible deployments

kubespray/project/roles/bootstrap-os/tasks/ubuntu.yml

@@ -0,0 +1,21 @@
+---
+- name: Import Debian bootstrap
+  import_tasks: debian.yml
+
+- name: Check unattended-upgrades file exist
+  stat:
+    path: /etc/apt/apt.conf.d/50unattended-upgrades
+  register: unattended_upgrades_file_stat
+  when:
+    - ubuntu_kernel_unattended_upgrades_disabled
+
+- name: Disable kernel unattended-upgrades
+  lineinfile:
+    path: "{{ unattended_upgrades_file_stat.stat.path }}"
+    insertafter: "Unattended-Upgrade::Package-Blacklist"
+    line: '"linux-";'
+    state: present
+  become: true
+  when:
+    - ubuntu_kernel_unattended_upgrades_disabled
+    - unattended_upgrades_file_stat.stat.exists

kubespray/project/roles/bootstrap-os/vars/fedora-coreos.yml

@@ -0,0 +1,2 @@
+---
+is_fedora_coreos: true

kubespray/project/roles/bootstrap-os/vars/flatcar.yml

@@ -0,0 +1,2 @@
+---
+bin_dir: "/opt/bin"

kubespray/project/roles/container-engine/containerd-common/tasks/main.yml

@@ -2,9 +2,9 @@
 - name: Containerd-common | check if fedora coreos
   stat:
     path: /run/ostree-booted
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: ostree
 
 - name: Containerd-common | set is_ostree

kubespray/project/roles/container-engine/containerd/defaults/main.yml

@@ -46,7 +46,11 @@ containerd_base_runtime_specs:
 containerd_grpc_max_recv_message_size: 16777216
 containerd_grpc_max_send_message_size: 16777216
 
+containerd_debug_address: ""
 containerd_debug_level: "info"
+containerd_debug_format: ""
+containerd_debug_uid: 0
+containerd_debug_gid: 0
 
 containerd_metrics_address: ""
 
@@ -66,6 +70,12 @@ containerd_enable_unprivileged_ports: false
 # If enabled it will allow non root users to use icmp sockets
 containerd_enable_unprivileged_icmp: false
 
+containerd_enable_selinux: false
+containerd_disable_apparmor: false
+containerd_tolerate_missing_hugetlb_controller: true
+containerd_disable_hugetlb_controller: true
+containerd_image_pull_progress_timeout: 5m
+
 containerd_cfg_dir: /etc/containerd
 
 # Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally
@@ -109,3 +119,11 @@ containerd_supported_distributions:
 
 # Enable container device interface
 enable_cdi: false
+
+# For containerd tracing configuration please check out the official documentation:
+# https://github.com/containerd/containerd/blob/main/docs/tracing.md
+containerd_tracing_enabled: false
+containerd_tracing_endpoint: "0.0.0.0:4317"
+containerd_tracing_protocol: "grpc"
+containerd_tracing_sampling_ratio: 1.0
+containerd_tracing_service_name: "containerd"

kubespray/project/roles/container-engine/containerd/handlers/main.yml

@@ -1,11 +1,11 @@
 ---
 - name: Containerd | restart containerd
-  systemd:
+  systemd_service:
     name: containerd
     state: restarted
-    enabled: yes
+    enabled: true
-    daemon-reload: yes
+    daemon-reload: true
-    masked: no
+    masked: false
   listen: Restart containerd
 
 - name: Containerd | wait for containerd

kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml

@@ -1,7 +1,7 @@
 ---
 - name: Prepare
   hosts: all
-  gather_facts: False
+  gather_facts: false
   become: true
   vars:
     ignore_assert_errors: true
@@ -19,7 +19,7 @@
 
 - name: Prepare CNI
   hosts: all
-  gather_facts: False
+  gather_facts: false
   become: true
   vars:
     ignore_assert_errors: true

kubespray/project/roles/container-engine/containerd/tasks/main.yml

@@ -35,8 +35,8 @@
   unarchive:
     src: "{{ downloads.containerd.dest }}"
     dest: "{{ containerd_bin_dir }}"
-    mode: 0755
+    mode: "0755"
-    remote_src: yes
+    remote_src: true
     extra_opts:
       - --strip-components=1
   notify: Restart containerd
@@ -60,7 +60,7 @@
   template:
     src: containerd.service.j2
     dest: /etc/systemd/system/containerd.service
-    mode: 0644
+    mode: "0644"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:containerd.service'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250
@@ -70,7 +70,7 @@
   file:
     dest: "{{ item }}"
     state: directory
-    mode: 0755
+    mode: "0755"
     owner: root
     group: root
   with_items:
@@ -83,7 +83,7 @@
   template:
     src: http-proxy.conf.j2
     dest: "{{ containerd_systemd_dir }}/http-proxy.conf"
-    mode: 0644
+    mode: "0644"
   notify: Restart containerd
   when: http_proxy is defined or https_proxy is defined
 
@@ -102,7 +102,7 @@
     content: "{{ item.value }}"
     dest: "{{ containerd_cfg_dir }}/{{ item.key }}"
     owner: "root"
-    mode: 0644
+    mode: "0644"
   with_dict: "{{ containerd_base_runtime_specs | default({}) }}"
   notify: Restart containerd
 
@@ -111,7 +111,7 @@
     src: config.toml.j2
     dest: "{{ containerd_cfg_dir }}/config.toml"
     owner: "root"
-    mode: 0640
+    mode: "0640"
   notify: Restart containerd
 
 - name: Containerd | Configure containerd registries
@@ -121,13 +121,13 @@
       file:
         path: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}"
         state: directory
-        mode: 0755
+        mode: "0755"
       loop: "{{ containerd_registries_mirrors }}"
     - name: Containerd | Write hosts.toml file
       template:
         src: hosts.toml.j2
         dest: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}/hosts.toml"
-        mode: 0640
+        mode: "0640"
       loop: "{{ containerd_registries_mirrors }}"
 
 # you can sometimes end up in a state where everything is installed
@@ -136,8 +136,8 @@
   meta: flush_handlers
 
 - name: Containerd | Ensure containerd is started and enabled
-  systemd:
+  systemd_service:
     name: containerd
-    daemon_reload: yes
+    daemon_reload: true
-    enabled: yes
+    enabled: true
     state: started

kubespray/project/roles/container-engine/containerd/templates/config.toml.j2

@@ -3,12 +3,20 @@ root = "{{ containerd_storage_dir }}"
 state = "{{ containerd_state_dir }}"
 oom_score = {{ containerd_oom_score }}
 
+{% if containerd_extra_args is defined %}
+{{ containerd_extra_args }}
+{% endif %}
+
 [grpc]
   max_recv_message_size = {{ containerd_grpc_max_recv_message_size }}
   max_send_message_size = {{ containerd_grpc_max_send_message_size }}
 
 [debug]
+  address = "{{ containerd_debug_address }}"
   level = "{{ containerd_debug_level }}"
+  format = "{{ containerd_debug_format }}"
+  uid = {{ containerd_debug_uid }}
+  gid = {{ containerd_debug_gid }}
 
 [metrics]
   address = "{{ containerd_metrics_address }}"
@@ -20,6 +28,11 @@ oom_score = {{ containerd_oom_score }}
     max_container_log_line_size = {{ containerd_max_container_log_line_size }}
     enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
     enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
+    enable_selinux = {{ containerd_enable_selinux | lower }}
+    disable_apparmor = {{ containerd_disable_apparmor | lower }}
+    tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
+    disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
+    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
 {% if enable_cdi %}
     enable_cdi = true
     cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
@@ -92,6 +105,14 @@ oom_score = {{ containerd_oom_score }}
     disable = false
 {% endif %}
 
-{% if containerd_extra_args is defined %}
+{% if containerd_tracing_enabled %}
-{{ containerd_extra_args }}
+  [plugins."io.containerd.tracing.processor.v1.otlp"]
+    endpoint = "{{ containerd_tracing_endpoint }}"
+    protocol = "{{ containerd_tracing_protocol }}"
+{% if containerd_tracing_protocol == "grpc" %}
+    insecure = false
+{% endif %}
+  [plugins."io.containerd.internal.v1.tracing"]
+    sampling_ratio = {{ containerd_tracing_sampling_ratio }}
+    service_name = "{{ containerd_tracing_service_name }}"
 {% endif %}

kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2

@@ -1,4 +1,4 @@
-server = "https://{{ item.prefix }}"
+server = "{{ item.server | default("https://" + item.prefix) }}"
 {% for mirror in item.mirrors %}
 [host."{{ mirror.host }}"]
   capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"]

kubespray/project/roles/container-engine/cri-dockerd/handlers/main.yml

@@ -1,9 +1,9 @@
 ---
 - name: Cri-dockerd | reload systemd
-  systemd:
+  systemd_service:
     name: cri-dockerd
     daemon_reload: true
-    masked: no
+    masked: false
   listen: Restart and enable cri-dockerd
 
 - name: Cri-dockerd | restart docker.service
@@ -27,5 +27,5 @@
 - name: Cri-dockerd | enable cri-dockerd service
   service:
     name: cri-dockerd.service
-    enabled: yes
+    enabled: true
   listen: Restart and enable cri-dockerd

kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml

@@ -28,7 +28,7 @@
         src: "{{ item }}"
         dest: "/tmp/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - container.json
         - sandbox.json
@@ -37,12 +37,12 @@
         path: /etc/cni/net.d
         state: directory
         owner: "{{ kube_owner }}"
-        mode: 0755
+        mode: "0755"
     - name: Setup CNI
       copy:
         src: "{{ item }}"
         dest: "/etc/cni/net.d/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - 10-mynet.conf

kubespray/project/roles/container-engine/cri-dockerd/tasks/main.yml

@@ -8,7 +8,7 @@
   copy:
     src: "{{ local_release_dir }}/cri-dockerd"
     dest: "{{ bin_dir }}/cri-dockerd"
-    mode: 0755
+    mode: "0755"
     remote_src: true
   notify:
     - Restart and enable cri-dockerd
@@ -17,7 +17,7 @@
   template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
-    mode: 0644
+    mode: "0644"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{ item }}'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250

kubespray/project/roles/container-engine/cri-o/handlers/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: CRI-O | reload systemd
-  systemd:
+  systemd_service:
     daemon_reload: true
   listen: Restart crio
 
@@ -8,5 +8,5 @@
   service:
     name: crio
     state: restarted
-    enabled: yes
+    enabled: true
   listen: Restart crio

kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml

@@ -1,7 +1,7 @@
 ---
 - name: Prepare
   hosts: all
-  gather_facts: False
+  gather_facts: false
   become: true
   vars:
     ignore_assert_errors: true
@@ -19,7 +19,7 @@
 
 - name: Prepare CNI
   hosts: all
-  gather_facts: False
+  gather_facts: false
   become: true
   vars:
     ignore_assert_errors: true
@@ -33,7 +33,7 @@
         src: "{{ item }}"
         dest: "/tmp/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - container.json
         - sandbox.json
@@ -42,12 +42,12 @@
         path: /etc/cni/net.d
         state: directory
         owner: "{{ kube_owner }}"
-        mode: 0755
+        mode: "0755"
     - name: Setup CNI
       copy:
         src: "{{ item }}"
         dest: "/etc/cni/net.d/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - 10-mynet.conf

kubespray/project/roles/container-engine/cri-o/tasks/main.yaml

@@ -5,9 +5,9 @@
 - name: Cri-o | check if fedora coreos
   stat:
     path: /run/ostree-booted
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: ostree
 
 - name: Cri-o | set is_ostree
@@ -56,27 +56,27 @@
   file:
     path: "{{ item }}"
     state: directory
-    mode: 0755
+    mode: "0755"
 
 - name: Cri-o | install cri-o config
   template:
     src: crio.conf.j2
     dest: /etc/crio/crio.conf
-    mode: 0644
+    mode: "0644"
   register: config_install
 
 - name: Cri-o | install config.json
   template:
     src: config.json.j2
     dest: /etc/crio/config.json
-    mode: 0644
+    mode: "0644"
   register: reg_auth_install
 
 - name: Cri-o | copy binaries
   copy:
     src: "{{ local_release_dir }}/cri-o/bin/{{ item }}"
     dest: "{{ bin_dir }}/{{ item }}"
-    mode: 0755
+    mode: "0755"
     remote_src: true
   with_items:
     - "{{ crio_bin_files }}"
@@ -86,10 +86,24 @@
   copy:
     src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
     dest: /etc/systemd/system/crio.service
-    mode: 0755
+    mode: "0755"
     remote_src: true
   notify: Restart crio
 
+- name: Cri-o | configure crio to use kube reserved cgroups
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/crio.service.d/00-slice.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      [Service]
+      Slice={{ kube_reserved_cgroups_for_service_slice }}
+  notify: Restart crio
+  when:
+    - kube_reserved is defined and kube_reserved is true
+    - kube_reserved_cgroups_for_service_slice is defined
+
 - name: Cri-o | update the bin dir for crio.service file
   replace:
     dest: /etc/systemd/system/crio.service
@@ -101,7 +115,7 @@
   copy:
     src: "{{ local_release_dir }}/cri-o/contrib/policy.json"
     dest: /etc/containers/policy.json
-    mode: 0755
+    mode: "0755"
     remote_src: true
   notify: Restart crio
 
@@ -109,7 +123,7 @@
   copy:
     src: mounts.conf
     dest: /etc/containers/mounts.conf
-    mode: 0644
+    mode: "0644"
   when:
     - ansible_os_family == 'RedHat'
   notify: Restart crio
@@ -119,7 +133,7 @@
     path: /etc/containers/oci/hooks.d
     state: directory
     owner: root
-    mode: 0755
+    mode: "0755"
 
 - name: Cri-o | set overlay driver
   community.general.ini_file:
@@ -127,7 +141,7 @@
     section: storage
     option: "{{ item.option }}"
     value: "{{ item.value }}"
-    mode: 0644
+    mode: "0644"
   with_items:
     - option: driver
       value: '"overlay"'
@@ -143,20 +157,20 @@
     section: storage.options.overlay
     option: mountopt
     value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
-    mode: 0644
+    mode: "0644"
 
 - name: Cri-o | create directory registries configs
   file:
     path: /etc/containers/registries.conf.d
     state: directory
     owner: root
-    mode: 0755
+    mode: "0755"
 
 - name: Cri-o | write registries configs
   template:
     src: registry.conf.j2
-    dest: "/etc/containers/registries.conf.d/10-{{ item.prefix | default(item.location) | regex_replace(':', '_') }}.conf"
+    dest: "/etc/containers/registries.conf.d/10-{{ item.prefix | default(item.location) | regex_replace(':|/', '_') }}.conf"
-    mode: 0644
+    mode: "0644"
   loop: "{{ crio_registries }}"
   notify: Restart crio
 
@@ -164,14 +178,14 @@
   template:
     src: unqualified.conf.j2
     dest: "/etc/containers/registries.conf.d/01-unqualified.conf"
-    mode: 0644
+    mode: "0644"
   notify: Restart crio
 
 - name: Cri-o | write cri-o proxy drop-in
   template:
     src: http-proxy.conf.j2
     dest: /etc/systemd/system/crio.service.d/http-proxy.conf
-    mode: 0644
+    mode: "0644"
   notify: Restart crio
   when: http_proxy is defined or https_proxy is defined
 

kubespray/project/roles/container-engine/cri-o/tasks/setup-amazon.yaml

@@ -8,7 +8,7 @@
   lineinfile:
     dest: /etc/yum.repos.d/amzn2-extras.repo
     line: "[amzn2extra-docker]"
-  check_mode: yes
+  check_mode: true
   register: amzn2_extras_docker_repo
   when:
     - amzn2_extras_file_stat.stat.exists
@@ -19,20 +19,8 @@
     section: amzn2extra-docker
     option: enabled
     value: "0"
-    backup: yes
+    backup: true
-    mode: 0644
+    mode: "0644"
   when:
     - amzn2_extras_file_stat.stat.exists
     - not amzn2_extras_docker_repo.changed
-
-- name: Add container-selinux yum repo
-  yum_repository:
-    name: copr:copr.fedorainfracloud.org:lsm5:container-selinux
-    file: _copr_lsm5-container-selinux.repo
-    description: Copr repo for container-selinux owned by lsm5
-    baseurl: https://download.copr.fedorainfracloud.org/results/lsm5/container-selinux/epel-7-$basearch/
-    gpgcheck: yes
-    gpgkey: https://download.copr.fedorainfracloud.org/results/lsm5/container-selinux/pubkey.gpg
-    skip_if_unavailable: yes
-    enabled: yes
-    repo_gpgcheck: no

kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml

@@ -1,8 +1,12 @@
 ---
+crio_conmon: "{{ bin_dir }}/crio-conmon"
+
 # cri-o binary files
 crio_bin_files:
-  - conmon
+  - crio-conmon
-  - conmonrs
+  - crio-conmonrs
+  - crio-crun
+  - crio-runc
   - crio
   - pinns
 

kubespray/project/roles/container-engine/crictl/handlers/main.yml

@@ -1,7 +1,7 @@
 ---
 - name: Get crictl completion
   command: "{{ bin_dir }}/crictl completion"
-  changed_when: False
+  changed_when: false
   register: cri_completion
   check_mode: false
 
@@ -9,4 +9,4 @@
   copy:
     dest: /etc/bash_completion.d/crictl
     content: "{{ cri_completion.stdout }}"
-    mode: 0644
+    mode: "0644"

kubespray/project/roles/container-engine/crictl/tasks/crictl.yml

@@ -9,13 +9,13 @@
     src: crictl.yaml.j2
     dest: /etc/crictl.yaml
     owner: root
-    mode: 0644
+    mode: "0644"
 
 - name: Copy crictl binary from download dir
   copy:
     src: "{{ local_release_dir }}/crictl"
     dest: "{{ bin_dir }}/crictl"
-    mode: 0755
+    mode: "0755"
     remote_src: true
   notify:
     - Get crictl completion

kubespray/project/roles/container-engine/crun/tasks/main.yml

@@ -8,5 +8,5 @@
   copy:
     src: "{{ downloads.crun.dest }}"
     dest: "{{ bin_dir }}/crun"
-    mode: 0755
+    mode: "0755"
     remote_src: true

kubespray/project/roles/container-engine/docker-storage/defaults/main.yml

@@ -1,19 +0,0 @@
----
-docker_container_storage_setup_repository: https://github.com/projectatomic/container-storage-setup.git
-docker_container_storage_setup_version: v0.6.0
-docker_container_storage_setup_profile_name: kubespray
-docker_container_storage_setup_storage_driver: devicemapper
-docker_container_storage_setup_container_thinpool: docker-pool
-# It must be define a disk path for docker_container_storage_setup_devs.
-# Otherwise docker-storage-setup will be executed incorrectly.
-# docker_container_storage_setup_devs: /dev/vdb
-docker_container_storage_setup_data_size: 40%FREE
-docker_container_storage_setup_min_data_size: 2G
-docker_container_storage_setup_chunk_size: 512K
-docker_container_storage_setup_growpart: "false"
-docker_container_storage_setup_auto_extend_pool: "yes"
-docker_container_storage_setup_pool_autoextend_threshold: 60
-docker_container_storage_setup_pool_autoextend_percent: 20
-docker_container_storage_setup_device_wait_timeout: 60
-docker_container_storage_setup_wipe_signatures: "false"
-docker_container_storage_setup_container_root_lv_size: 40%FREE

kubespray/project/roles/container-engine/docker-storage/files/install_container_storage_setup.sh

@@ -1,23 +0,0 @@
-#!/bin/sh
-
-set -e
-
-repository=${1:-https://github.com/projectatomic/container-storage-setup.git}
-version=${2:-master}
-profile_name=${3:-kubespray}
-dir=`mktemp -d`
-export GIT_DIR=$dir/.git
-export GIT_WORK_TREE=$dir
-
-git init
-git fetch --depth 1 $repository $version
-git merge FETCH_HEAD
-make -C $dir install
-rm -rf /var/lib/container-storage-setup/$profile_name $dir
-
-set +e
-
-/usr/bin/container-storage-setup create $profile_name /etc/sysconfig/docker-storage-setup && /usr/bin/container-storage-setup activate $profile_name
-# FIXME: exit status can be 1 for both fatal and non fatal errors in current release,
-# could be improved by matching error strings
-exit 0

kubespray/project/roles/container-engine/docker-storage/tasks/main.yml

@@ -1,48 +0,0 @@
----
-
-- name: Docker-storage-setup | install git and make
-  with_items: [git, make]
-  package:
-    pkg: "{{ item }}"
-    state: present
-
-- name: Docker-storage-setup | docker-storage-setup sysconfig template
-  template:
-    src: docker-storage-setup.j2
-    dest: /etc/sysconfig/docker-storage-setup
-    mode: 0644
-
-- name: Docker-storage-override-directory | docker service storage-setup override dir
-  file:
-    dest: /etc/systemd/system/docker.service.d
-    mode: 0755
-    owner: root
-    group: root
-    state: directory
-
-- name: Docker-storage-override | docker service storage-setup override file
-  copy:
-    dest: /etc/systemd/system/docker.service.d/override.conf
-    content: |-
-      ### This file is managed by Ansible
-      [Service]
-      EnvironmentFile=-/etc/sysconfig/docker-storage
-
-    owner: root
-    group: root
-    mode: 0644
-
-# https://docs.docker.com/engine/installation/linux/docker-ce/centos/#install-using-the-repository
-- name: Docker-storage-setup | install lvm2
-  package:
-    name: lvm2
-    state: present
-
-- name: Docker-storage-setup | install and run container-storage-setup
-  become: yes
-  script: |
-    install_container_storage_setup.sh \
-      {{ docker_container_storage_setup_repository }} \
-      {{ docker_container_storage_setup_version }} \
-      {{ docker_container_storage_setup_profile_name }}
-  notify: Docker | reload systemd

kubespray/project/roles/container-engine/docker-storage/templates/docker-storage-setup.j2

@@ -1,35 +0,0 @@
-{%if docker_container_storage_setup_storage_driver is defined%}STORAGE_DRIVER={{docker_container_storage_setup_storage_driver}}{%endif%}
-
-{%if docker_container_storage_setup_extra_storage_options is defined%}EXTRA_STORAGE_OPTIONS={{docker_container_storage_setup_extra_storage_options}}{%endif%}
-
-{%if docker_container_storage_setup_devs is defined%}DEVS={{docker_container_storage_setup_devs}}{%endif%}
-
-{%if docker_container_storage_setup_container_thinpool is defined%}CONTAINER_THINPOOL={{docker_container_storage_setup_container_thinpool}}{%endif%}
-
-{%if docker_container_storage_setup_vg is defined%}VG={{docker_container_storage_setup_vg}}{%endif%}
-
-{%if docker_container_storage_setup_root_size is defined%}ROOT_SIZE={{docker_container_storage_setup_root_size}}{%endif%}
-
-{%if docker_container_storage_setup_data_size is defined%}DATA_SIZE={{docker_container_storage_setup_data_size}}{%endif%}
-
-{%if docker_container_storage_setup_min_data_size is defined%}MIN_DATA_SIZE={{docker_container_storage_setup_min_data_size}}{%endif%}
-
-{%if docker_container_storage_setup_chunk_size is defined%}CHUNK_SIZE={{docker_container_storage_setup_chunk_size}}{%endif%}
-
-{%if docker_container_storage_setup_growpart is defined%}GROWPART={{docker_container_storage_setup_growpart}}{%endif%}
-
-{%if docker_container_storage_setup_auto_extend_pool is defined%}AUTO_EXTEND_POOL={{docker_container_storage_setup_auto_extend_pool}}{%endif%}
-
-{%if docker_container_storage_setup_pool_autoextend_threshold is defined%}POOL_AUTOEXTEND_THRESHOLD={{docker_container_storage_setup_pool_autoextend_threshold}}{%endif%}
-
-{%if docker_container_storage_setup_pool_autoextend_percent is defined%}POOL_AUTOEXTEND_PERCENT={{docker_container_storage_setup_pool_autoextend_percent}}{%endif%}
-
-{%if docker_container_storage_setup_device_wait_timeout is defined%}DEVICE_WAIT_TIMEOUT={{docker_container_storage_setup_device_wait_timeout}}{%endif%}
-
-{%if docker_container_storage_setup_wipe_signatures is defined%}WIPE_SIGNATURES={{docker_container_storage_setup_wipe_signatures}}{%endif%}
-
-{%if docker_container_storage_setup_container_root_lv_name is defined%}CONTAINER_ROOT_LV_NAME={{docker_container_storage_setup_container_root_lv_name}}{%endif%}
-
-{%if docker_container_storage_setup_container_root_lv_size is defined%}CONTAINER_ROOT_LV_SIZE={{docker_container_storage_setup_container_root_lv_size}}{%endif%}
-
-{%if docker_container_storage_setup_container_root_lv_mount_path is defined%}CONTAINER_ROOT_LV_MOUNT_PATH={{docker_container_storage_setup_container_root_lv_mount_path}}{%endif%}

kubespray/project/roles/container-engine/docker/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-docker_version: '24.0'
+docker_version: '26.1'
 docker_cli_version: "{{ docker_version }}"
 
 docker_package_info:

kubespray/project/roles/container-engine/docker/handlers/main.yml

@@ -1,9 +1,9 @@
 ---
 - name: Docker | reload systemd
-  systemd:
+  systemd_service:
     name: docker
     daemon_reload: true
-    masked: no
+    masked: false
   listen: Restart docker
 
 - name: Docker | reload docker.socket

kubespray/project/roles/container-engine/docker/meta/main.yml

@@ -1,5 +1,3 @@
 ---
 dependencies:
   - role: container-engine/containerd-common
-  - role: container-engine/docker-storage
-    when: docker_container_storage_setup and ansible_os_family == "RedHat"

kubespray/project/roles/container-engine/docker/tasks/main.yml

@@ -2,22 +2,15 @@
 - name: Check if fedora coreos
   stat:
     path: /run/ostree-booted
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: ostree
 
 - name: Set is_ostree
   set_fact:
     is_ostree: "{{ ostree.stat.exists }}"
 
-- name: Set docker_version for openEuler
-  set_fact:
-    docker_version: '19.03'
-  when: ansible_distribution == "openEuler"
-  tags:
-    - facts
-
 - name: Gather os specific variables
   include_vars: "{{ item }}"
   with_first_found:
@@ -67,6 +60,17 @@
   environment: "{{ proxy_env }}"
   when: ansible_pkg_mgr == 'apt'
 
+# ref to https://github.com/kubernetes-sigs/kubespray/issues/11086
+- name: Remove the archived debian apt repository
+  lineinfile:
+    path: /etc/apt/sources.list
+    regexp: 'buster-backports'
+    state: absent
+    backup: true
+  when:
+    - ansible_os_family == 'Debian'
+    - ansible_distribution_release == "buster"
+
 - name: Ensure docker-ce repository is enabled
   apt_repository:
     repo: "{{ item }}"
@@ -78,14 +82,14 @@
   template:
     src: "fedora_docker.repo.j2"
     dest: "{{ yum_repo_dir }}/docker.repo"
-    mode: 0644
+    mode: "0644"
   when: ansible_distribution == "Fedora" and not is_ostree
 
 - name: Configure docker repository on RedHat/CentOS/OracleLinux/AlmaLinux/KylinLinux
   template:
     src: "rh_docker.repo.j2"
     dest: "{{ yum_repo_dir }}/docker-ce.repo"
-    mode: 0644
+    mode: "0644"
   when:
     - ansible_os_family == "RedHat"
     - ansible_distribution != "Fedora"
@@ -96,7 +100,11 @@
     name: "{{ item }}"
     selection: install
   when: ansible_pkg_mgr == 'apt'
+  register: ret
   changed_when: false
+  failed_when:
+    - ret is failed
+    - ret.msg != ( "Failed to find package '" + item + "' to perform selection 'install'." )
   with_items:
     - "{{ containerd_package }}"
     - docker-ce
@@ -175,7 +183,7 @@
 - name: Ensure docker service is started and enabled
   service:
     name: "{{ item }}"
-    enabled: yes
+    enabled: true
     state: started
   with_items:
     - docker

kubespray/project/roles/container-engine/docker/tasks/reset.yml

@@ -6,8 +6,8 @@
 
 - name: Docker | Find docker packages
   set_fact:
-    docker_packages_list: "{{ ansible_facts.packages.keys() | select('search', '^docker*') }}"
+    docker_packages_list: "{{ ansible_facts.packages.keys() | select('search', '^docker+') }}"
-    containerd_package: "{{ ansible_facts.packages.keys() | select('search', '^containerd*') }}"
+    containerd_package: "{{ ansible_facts.packages.keys() | select('search', '^containerd+') }}"
 
 - name: Docker | Stop all running container
   shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -q | xargs -r {{ docker_bin_dir }}/docker kill"
@@ -102,5 +102,5 @@
   ignore_errors: true  # noqa ignore-errors
 
 - name: Docker | systemctl daemon-reload  # noqa no-handler
-  systemd:
+  systemd_service:
     daemon_reload: true

kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml

@@ -21,9 +21,9 @@
   shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/'
   args:
     executable: /bin/bash
-  changed_when: False
+  changed_when: false
   register: system_nameservers
-  check_mode: no
+  check_mode: false
 
 - name: Check system search domains
   # noqa risky-shell-pipe - if resolf.conf has no search domain, grep will exit 1 which would force us to add failed_when: false
@@ -31,9 +31,9 @@
   shell: grep "^search" /etc/resolv.conf | sed -r 's/^search\s*([^#]+)\s*(#.*)?/\1/'
   args:
     executable: /bin/bash
-  changed_when: False
+  changed_when: false
   register: system_search_domains
-  check_mode: no
+  check_mode: false
 
 - name: Add system nameservers to docker options
   set_fact:

kubespray/project/roles/container-engine/docker/tasks/systemd.yml

@@ -3,31 +3,21 @@
   file:
     path: /etc/systemd/system/docker.service.d
     state: directory
-    mode: 0755
+    mode: "0755"
 
 - name: Write docker proxy drop-in
   template:
     src: http-proxy.conf.j2
     dest: /etc/systemd/system/docker.service.d/http-proxy.conf
-    mode: 0644
+    mode: "0644"
   notify: Restart docker
   when: http_proxy is defined or https_proxy is defined
 
-- name: Get systemd version
-  # noqa command-instead-of-module - systemctl is called intentionally here
-  shell: set -o pipefail && systemctl --version | head -n 1 | cut -d " " -f 2
-  args:
-    executable: /bin/bash
-  register: systemd_version
-  when: not is_ostree
-  changed_when: false
-  check_mode: false
-
 - name: Write docker.service systemd file
   template:
     src: docker.service.j2
     dest: /etc/systemd/system/docker.service
-    mode: 0644
+    mode: "0644"
   register: docker_service_file
   notify: Restart docker
   when:
@@ -38,14 +28,14 @@
   template:
     src: docker-options.conf.j2
     dest: "/etc/systemd/system/docker.service.d/docker-options.conf"
-    mode: 0644
+    mode: "0644"
   notify: Restart docker
 
 - name: Write docker dns systemd drop-in
   template:
     src: docker-dns.conf.j2
     dest: "/etc/systemd/system/docker.service.d/docker-dns.conf"
-    mode: 0644
+    mode: "0644"
   notify: Restart docker
   when: dns_mode != 'none' and resolvconf_mode == 'docker_dns'
 
@@ -53,14 +43,14 @@
   copy:
     src: cleanup-docker-orphans.sh
     dest: "{{ bin_dir }}/cleanup-docker-orphans.sh"
-    mode: 0755
+    mode: "0755"
   when: docker_orphan_clean_up | bool
 
 - name: Write docker orphan clean up systemd drop-in
   template:
     src: docker-orphan-cleanup.conf.j2
     dest: "/etc/systemd/system/docker.service.d/docker-orphan-cleanup.conf"
-    mode: 0644
+    mode: "0644"
   notify: Restart docker
   when: docker_orphan_clean_up | bool
 

kubespray/project/roles/container-engine/docker/templates/docker.service.j2

@@ -1,19 +1,11 @@
 [Unit]
 Description=Docker Application Container Engine
 Documentation=http://docs.docker.com
-{% if ansible_os_family == "RedHat" %}
+After=network.target docker.socket containerd.service lvm2-monitor.service SuSEfirewall2.service
-After=network.target {{ ' docker-storage-setup.service' if docker_container_storage_setup else '' }} containerd.service
+{% if ansible_os_family != "Suse" %}
 BindsTo=containerd.service
-{{ 'Wants=docker-storage-setup.service' if docker_container_storage_setup else '' }}
-{% elif ansible_os_family == "Debian" %}
-After=network.target docker.socket containerd.service
-BindsTo=containerd.service
-Wants=docker.socket
-{% elif ansible_os_family == "Suse" %}
-After=network.target lvm2-monitor.service SuSEfirewall2.service
-# After=network.target containerd.service
-# BindsTo=containerd.service
 {% endif %}
+Wants=docker.socket
 
 [Service]
 Type=notify
@@ -31,9 +23,7 @@ ExecStart={{ docker_bin_dir }}/dockerd \
           $DOCKER_OPTS \
           $DOCKER_STORAGE_OPTIONS \
           $DOCKER_DNS_OPTIONS
-{% if not is_ostree and systemd_version.stdout|int >= 226 %}
 TasksMax=infinity
-{% endif %}
 LimitNOFILE=1048576
 LimitNPROC=1048576
 LimitCORE=infinity

kubespray/project/roles/container-engine/docker/vars/amazon.yml

@@ -6,6 +6,8 @@ docker_versioned_pkg:
   '18.09': docker-18.09.9ce-2.amzn2
   '19.03': docker-19.03.13ce-1.amzn2
   '20.10': docker-20.10.7-5.amzn2
+  '24.0': docker-24.0.5-1.amzn2
+  '25.0': docker-25.0.3-1.amzn2
 
 docker_version: "latest"
 

kubespray/project/roles/container-engine/docker/vars/debian.yml

@@ -22,9 +22,11 @@ containerd_versioned_pkg:
   '1.6.15': "{{ containerd_package }}=1.6.15-1"
   '1.6.16': "{{ containerd_package }}=1.6.16-1"
   '1.6.18': "{{ containerd_package }}=1.6.18-1"
-  '1.6.28': "{{ containerd_package }}=1.6.28-1"
+  '1.6.28': "{{ containerd_package }}=1.6.28-2"
-  'stable': "{{ containerd_package }}=1.6.28-1"
+  '1.6.31': "{{ containerd_package }}=1.6.31-1"
-  'edge': "{{ containerd_package }}=1.6.28-1"
+  '1.6.32': "{{ containerd_package }}=1.6.32-1"
+  'stable': "{{ containerd_package }}=1.6.32-1"
+  'edge': "{{ containerd_package }}=1.6.32-1"
 
 # https://download.docker.com/linux/debian/
 docker_versioned_pkg:
@@ -34,6 +36,9 @@ docker_versioned_pkg:
   '20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
   '23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   'stable': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   'edge': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
 
@@ -44,8 +49,11 @@ docker_cli_versioned_pkg:
   '20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
   '23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
 
 docker_package_info:
   pkgs:

kubespray/project/roles/container-engine/docker/vars/fedora.yml

@@ -22,9 +22,11 @@ containerd_versioned_pkg:
   '1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_distribution_major_version }}"
   '1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_distribution_major_version }}"
   '1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_distribution_major_version }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
 
 # https://docs.docker.com/install/linux/docker-ce/fedora/
 # https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/
@@ -34,8 +36,10 @@ docker_versioned_pkg:
   '20.10': docker-ce-20.10.20-3.fc{{ ansible_distribution_major_version }}
   '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }}
   '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -43,8 +47,10 @@ docker_cli_versioned_pkg:
   '20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_distribution_major_version }}
   '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }}
   '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
 
 docker_package_info:
   enablerepo: "docker-ce"

kubespray/project/roles/container-engine/docker/vars/kylin.yml

@@ -1,54 +1,62 @@
 ---
+
+docker_version: 26.1
+docker_cli_version: "{{ docker_version }}"
+docker_rh_repo_base_url: 'https://download.docker.com/linux/centos/8/$basearch/stable'
+
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
   'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el8"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el8"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_distribution_major_version }}"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el8"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el8"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el8"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el8"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el8"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el8"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el8"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el8"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el8"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el8"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el8"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el8"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el8"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el8"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el8"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el8"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el8"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el8"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el8"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el8"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el8"
-
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el8"
-docker_version: 19.03
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el8"
-docker_cli_version: 19.03
 
 # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
-# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
+# https://download.docker.com/linux/centos/8/x86_64/stable/Packages/
 # or do 'yum --showduplicates list docker-engine'
 docker_versioned_pkg:
   'latest': docker-ce
-  '18.09': docker-ce-3:18.09.9-3.el{{ ansible_distribution_major_version }}
+  '18.09': docker-ce-3:18.09.9-3.el8
-  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-3:19.03.15-3.el8
-  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-3:23.0.6-1.el8
-  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-3:24.0.9-1.el8
-  'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-26.0.2-1.el8
-  'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-26.1.2-1.el8
+  'stable': docker-ce-26.1.2-1.el8
+  'edge': docker-ce-26.1.2-1.el8
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
-  '18.09': docker-ce-cli-1:18.09.9-3.el{{ ansible_distribution_major_version }}
+  '18.09': docker-ce-cli-1:18.09.9-3.el8
-  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-cli-1:19.03.15-3.el8
-  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-cli-1:23.0.6-1.el8
-  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-cli-1:24.0.9-1.el8
-  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-26.0.2-1.el8
-  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-26.1.2-1.el8
+  'stable': docker-ce-cli-26.1.2-1.el8
+  'edge': docker-ce-cli-26.1.2-1.el8
 
 docker_package_info:
   enablerepo: "docker-ce"

kubespray/project/roles/container-engine/docker/vars/openeuler.yml

@@ -0,0 +1 @@
+kylin.yml

kubespray/project/roles/container-engine/docker/vars/redhat-7.yml

@@ -23,8 +23,10 @@ containerd_versioned_pkg:
   '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el7"
   '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el7"
   '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el7"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el7"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el7"
-  'edge': "{{ containerd_package }}-1.6.18-3.1.el7"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el7"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el7"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el7"
 
 # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
 # https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
@@ -36,8 +38,10 @@ docker_versioned_pkg:
   '20.10': docker-ce-20.10.20-3.el7
   '23.0': docker-ce-23.0.6-1.el7
   '24.0': docker-ce-24.0.9-1.el7
-  'stable': docker-ce-24.0.9-1.el7
+  '26.0': docker-ce-26.0.2-1.el7
-  'edge': docker-ce-24.0.9-1.el7
+  '26.1': docker-ce-26.1.2-1.el7
+  'stable': docker-ce-26.1.2-1.el7
+  'edge': docker-ce-26.1.2-1.el7
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -46,8 +50,10 @@ docker_cli_versioned_pkg:
   '20.10': docker-ce-cli-20.10.20-3.el7
   '23.0': docker-ce-cli-23.0.6-1.el7
   '24.0': docker-ce-cli-24.0.9-1.el7
-  'stable': docker-ce-cli-24.0.9-1.el7
+  '26.0': docker-ce-cli-26.0.2-1.el7
-  'edge': docker-ce-cli-24.0.9-1.el7
+  '26.1': docker-ce-cli-26.1.2-1.el7
+  'stable': docker-ce-cli-26.1.2-1.el7
+  'edge': docker-ce-cli-26.1.2-1.el7
 
 docker_package_info:
   enablerepo: "docker-ce"

kubespray/project/roles/container-engine/docker/vars/redhat.yml

@@ -23,8 +23,10 @@ containerd_versioned_pkg:
   '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
   '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
   '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
 
 # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
 # https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
@@ -36,8 +38,10 @@ docker_versioned_pkg:
   '20.10': docker-ce-3:20.10.20-3.el{{ ansible_distribution_major_version }}
   '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
   '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -46,8 +50,10 @@ docker_cli_versioned_pkg:
   '20.10': docker-ce-cli-1:20.10.20-3.el{{ ansible_distribution_major_version }}
   '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
   '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
 
 docker_package_info:
   enablerepo: "docker-ce"

kubespray/project/roles/container-engine/docker/vars/ubuntu.yml

@@ -22,9 +22,11 @@ containerd_versioned_pkg:
   '1.6.15': "{{ containerd_package }}=1.6.15-1"
   '1.6.16': "{{ containerd_package }}=1.6.16-1"
   '1.6.18': "{{ containerd_package }}=1.6.18-1"
-  '1.6.28': "{{ containerd_package }}=1.6.28-1"
+  '1.6.28': "{{ containerd_package }}=1.6.28-2"
-  'stable': "{{ containerd_package }}=1.6.28-1"
+  '1.6.31': "{{ containerd_package }}=1.6.31-1"
-  'edge': "{{ containerd_package }}=1.6.28-1"
+  '1.6.32': "{{ containerd_package }}=1.6.32-1"
+  'stable': "{{ containerd_package }}=1.6.32-1"
+  'edge': "{{ containerd_package }}=1.6.32-1"
 
 # https://download.docker.com/linux/ubuntu/
 docker_versioned_pkg:
@@ -34,8 +36,10 @@ docker_versioned_pkg:
   '20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
   '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
   '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -44,8 +48,10 @@ docker_cli_versioned_pkg:
   '20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
   '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
   '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
 
 docker_package_info:
   pkgs:

kubespray/project/roles/container-engine/docker/vars/uniontech.yml

@@ -21,8 +21,9 @@ containerd_versioned_pkg:
   '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
   '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
   '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
 
 docker_version: 19.03
 docker_cli_version: 19.03

kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml

@@ -29,7 +29,7 @@
         src: "{{ item }}"
         dest: "/tmp/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - container.json
         - sandbox.json
@@ -38,12 +38,12 @@
         path: /etc/cni/net.d
         state: directory
         owner: root
-        mode: 0755
+        mode: "0755"
     - name: Setup CNI
       copy:
         src: "{{ item }}"
         dest: "/etc/cni/net.d/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - 10-mynet.conf

kubespray/project/roles/container-engine/gvisor/tasks/main.yml

@@ -13,8 +13,8 @@
   copy:
     src: "{{ item.src }}"
     dest: "{{ bin_dir }}/{{ item.dest }}"
-    mode: 0755
+    mode: "0755"
-    remote_src: yes
+    remote_src: true
   with_items:
     - { src: "{{ downloads.gvisor_runsc.dest }}", dest: "runsc" }
     - { src: "{{ downloads.gvisor_containerd_shim.dest }}", dest: "containerd-shim-runsc-v1" }

kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml

@@ -29,7 +29,7 @@
         src: "{{ item }}"
         dest: "/tmp/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - container.json
         - sandbox.json
@@ -38,12 +38,12 @@
         path: /etc/cni/net.d
         state: directory
         owner: "{{ kube_owner }}"
-        mode: 0755
+        mode: "0755"
     - name: Setup CNI
       copy:
         src: "{{ item }}"
         dest: "/etc/cni/net.d/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - 10-mynet.conf

kubespray/project/roles/container-engine/kata-containers/tasks/main.yml

@@ -8,22 +8,22 @@
   unarchive:
     src: "{{ downloads.kata_containers.dest }}"
     dest: "/"
-    mode: 0755
+    mode: "0755"
     owner: root
     group: root
-    remote_src: yes
+    remote_src: true
 
 - name: Kata-containers | Create config directory
   file:
     path: "{{ kata_containers_config_dir }}"
     state: directory
-    mode: 0755
+    mode: "0755"
 
 - name: Kata-containers | Set configuration
   template:
     src: "{{ item }}.j2"
     dest: "{{ kata_containers_config_dir }}/{{ item }}"
-    mode: 0644
+    mode: "0644"
   with_items:
     - configuration-qemu.toml
 
@@ -33,7 +33,7 @@
   template:
     dest: "{{ kata_containers_containerd_bin_dir }}/containerd-shim-kata-{{ item }}-v2"
     src: containerd-shim-kata-v2.j2
-    mode: 0755
+    mode: "0755"
   with_items:
     - qemu
 
@@ -48,7 +48,7 @@
 - name: Kata-containers | Persist vhost kernel modules
   copy:
     dest: /etc/modules-load.d/kubespray-kata-containers.conf
-    mode: 0644
+    mode: "0644"
     content: |
       vhost_vsock
       vhost_net

kubespray/project/roles/container-engine/nerdctl/handlers/main.yml

@@ -1,7 +1,7 @@
 ---
 - name: Get nerdctl completion
   command: "{{ bin_dir }}/nerdctl completion bash"
-  changed_when: False
+  changed_when: false
   register: nerdctl_completion
   check_mode: false
 
@@ -9,4 +9,4 @@
   copy:
     dest: /etc/bash_completion.d/nerdctl
     content: "{{ nerdctl_completion.stdout }}"
-    mode: 0644
+    mode: "0644"

kubespray/project/roles/container-engine/nerdctl/tasks/main.yml

@@ -8,7 +8,7 @@
   copy:
     src: "{{ local_release_dir }}/nerdctl"
     dest: "{{ bin_dir }}/nerdctl"
-    mode: 0755
+    mode: "0755"
     remote_src: true
     owner: root
     group: root
@@ -21,7 +21,7 @@
   file:
     path: /etc/nerdctl
     state: directory
-    mode: 0755
+    mode: "0755"
     owner: root
     group: root
   become: true
@@ -30,7 +30,7 @@
   template:
     src: nerdctl.toml.j2
     dest: /etc/nerdctl/nerdctl.toml
-    mode: 0644
+    mode: "0644"
     owner: root
     group: root
   become: true

kubespray/project/roles/container-engine/runc/tasks/main.yml

@@ -2,9 +2,9 @@
 - name: Runc | check if fedora coreos
   stat:
     path: /run/ostree-booted
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: ostree
 
 - name: Runc | set is_ostree
@@ -27,7 +27,7 @@
   copy:
     src: "{{ downloads.runc.dest }}"
     dest: "{{ runc_bin_dir }}/runc"
-    mode: 0755
+    mode: "0755"
     remote_src: true
 
 - name: Runc | Remove orphaned binary

kubespray/project/roles/container-engine/skopeo/tasks/main.yml

@@ -2,9 +2,9 @@
 - name: Skopeo | check if fedora coreos
   stat:
     path: /run/ostree-booted
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: ostree
 
 - name: Skopeo | set is_ostree
@@ -28,5 +28,5 @@
   copy:
     src: "{{ downloads.skopeo.dest }}"
     dest: "{{ bin_dir }}/skopeo"
-    mode: 0755
+    mode: "0755"
     remote_src: true

kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml

@@ -2,9 +2,9 @@
 - name: Validate-container-engine | check if fedora coreos
   stat:
     path: /run/ostree-booted
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: ostree
   tags:
     - facts
@@ -30,8 +30,8 @@
 - name: Check if containerd is installed
   find:
     file_type: file
-    recurse: yes
+    recurse: true
-    use_regex: yes
+    use_regex: true
     patterns:
       - containerd.service$
     paths:
@@ -45,8 +45,8 @@
 - name: Check if docker is installed
   find:
     file_type: file
-    recurse: yes
+    recurse: true
-    use_regex: yes
+    use_regex: true
     patterns:
       - docker.service$
     paths:
@@ -60,8 +60,8 @@
 - name: Check if crio is installed
   find:
     file_type: file
-    recurse: yes
+    recurse: true
-    use_regex: yes
+    use_regex: true
     patterns:
       - crio.service$
     paths:

kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml

@@ -29,7 +29,7 @@
         src: "{{ item }}"
         dest: "/tmp/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - container.json
         - sandbox.json
@@ -38,12 +38,12 @@
         path: /etc/cni/net.d
         state: directory
         owner: root
-        mode: 0755
+        mode: "0755"
     - name: Setup CNI
       copy:
         src: "{{ item }}"
         dest: "/etc/cni/net.d/{{ item }}"
         owner: root
-        mode: 0644
+        mode: "0644"
       with_items:
         - 10-mynet.conf

kubespray/project/roles/container-engine/youki/tasks/main.yml

@@ -8,5 +8,5 @@
   copy:
     src: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux/youki-{{ youki_version }}/youki"
     dest: "{{ youki_bin_dir }}/youki"
-    mode: 0755
+    mode: "0755"
     remote_src: true

kubespray/project/roles/download/tasks/check_pull_required.yml

@@ -5,7 +5,7 @@
   shell: "{{ image_info_command }}"
   register: docker_images
   changed_when: false
-  check_mode: no
+  check_mode: false
   when: not download_always_pull
 
 - name: Check_pull_required | Set pull_required if the desired image is not yet loaded

kubespray/project/roles/download/tasks/download_container.yml

@@ -26,12 +26,12 @@
     - name: Download_container | Determine if image is in cache
       stat:
         path: "{{ image_path_cached }}"
-        get_attributes: no
+        get_attributes: false
-        get_checksum: no
+        get_checksum: false
-        get_mime: no
+        get_mime: false
       delegate_to: localhost
       connection: local
-      delegate_facts: no
+      delegate_facts: false
       register: cache_image
       changed_when: false
       become: false
@@ -57,7 +57,7 @@
     - name: Download_container | Download image if required
       command: "{{ image_pull_command_on_localhost if download_localhost else image_pull_command }} {{ image_reponame }}"
       delegate_to: "{{ download_delegate if download_run_once else inventory_hostname }}"
-      delegate_facts: yes
+      delegate_facts: true
       run_once: "{{ download_run_once }}"
       register: pull_task_result
       until: pull_task_result is succeeded
@@ -72,7 +72,7 @@
     - name: Download_container | Save and compress image
       shell: "{{ image_save_command_on_localhost if download_localhost else image_save_command }}"  # noqa command-instead-of-shell - image_save_command_on_localhost contains a pipe, therefore requires shell
       delegate_to: "{{ download_delegate }}"
-      delegate_facts: no
+      delegate_facts: false
       register: container_save_status
       failed_when: container_save_status.stderr
       run_once: true
@@ -99,7 +99,7 @@
         dest: "{{ image_path_final }}"
         use_ssh_args: true
         mode: push
-      delegate_facts: no
+      delegate_facts: false
       register: upload_image
       failed_when: not upload_image
       until: upload_image is succeeded

kubespray/project/roles/download/tasks/download_file.yml

@@ -22,15 +22,15 @@
     file:
       path: "{{ download.dest | dirname }}"
       owner: "{{ download.owner | default(omit) }}"
-      mode: 0755
+      mode: "0755"
       state: directory
-      recurse: yes
+      recurse: true
 
   - name: Download_file | Create local cache directory
     file:
       path: "{{ file_path_cached | dirname }}"
       state: directory
-      recurse: yes
+      recurse: true
     delegate_to: localhost
     connection: local
     delegate_facts: false
@@ -45,7 +45,7 @@
     file:
       path: "{{ file_path_cached | dirname }}"
       state: directory
-      recurse: yes
+      recurse: true
     delegate_to: "{{ download_delegate }}"
     delegate_facts: false
     run_once: true

kubespray/project/roles/download/tasks/extract_file.yml

@@ -5,7 +5,7 @@
     dest: "{{ download.dest | dirname }}"
     owner: "{{ download.owner | default(omit) }}"
     mode: "{{ download.mode | default(omit) }}"
-    copy: no
+    copy: false
     extra_opts: "{{ download.unarchive_extra_opts | default(omit) }}"
   when:
     - download.unarchive | default(false)

kubespray/project/roles/download/tasks/prep_download.yml

@@ -62,14 +62,14 @@
   register: docker_images
   failed_when: false
   changed_when: false
-  check_mode: no
+  check_mode: false
   when: download_container
 
 - name: Prep_download | Create staging directory on remote node
   file:
     path: "{{ local_release_dir }}/images"
     state: directory
-    mode: 0755
+    mode: "0755"
     owner: "{{ ansible_ssh_user | default(ansible_user_id) }}"
   when:
     - ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
@@ -78,10 +78,10 @@
   file:
     path: "{{ download_cache_dir }}/images"
     state: directory
-    mode: 0755
+    mode: "0755"
   delegate_to: localhost
   connection: local
-  delegate_facts: no
+  delegate_facts: false
   run_once: true
   become: false
   when:

kubespray/project/roles/download/tasks/prep_kubeadm_images.yml

@@ -1,11 +1,4 @@
 ---
-- name: Prep_kubeadm_images | Check kubeadm version matches kubernetes version
-  fail:
-    msg: "Kubeadm version {{ kubeadm_version }} do not matches kubernetes {{ kube_version }}"
-  when:
-    - not skip_downloads | default(false)
-    - not kubeadm_version == downloads.kubeadm.version
-
 - name: Prep_kubeadm_images | Download kubeadm binary
   include_tasks: "download_file.yml"
   vars:
@@ -18,7 +11,7 @@
   template:
     src: "kubeadm-images.yaml.j2"
     dest: "{{ kube_config_dir }}/kubeadm-images.yaml"
-    mode: 0644
+    mode: "0644"
   when:
     - not skip_kubeadm_images | default(false)
 
@@ -26,7 +19,7 @@
   copy:
     src: "{{ downloads.kubeadm.dest }}"
     dest: "{{ bin_dir }}/kubeadm"
-    mode: 0755
+    mode: "0755"
     remote_src: true
 
 - name: Prep_kubeadm_images | Set kubeadm binary permissions

kubespray/project/roles/etcd/defaults/main.yml

@@ -125,3 +125,6 @@ etcd_experimental_enable_distributed_tracing: false
 etcd_experimental_distributed_tracing_sample_rate: 100
 etcd_experimental_distributed_tracing_address: "localhost:4317"
 etcd_experimental_distributed_tracing_service_name: etcd
+
+# The interval for etcd watch progress notify events
+etcd_experimental_watch_progress_notify_interval: 5s

kubespray/project/roles/etcd/handlers/backup.yml

@@ -16,16 +16,16 @@
     state: directory
     owner: root
     group: root
-    mode: 0600
+    mode: "0600"
   listen: Restart etcd
   when: etcd_cluster_is_healthy.rc == 0
 
 - name: Stat etcd v2 data directory
   stat:
     path: "{{ etcd_data_dir }}/member"
-    get_attributes: no
+    get_attributes: false
-    get_checksum: no
+    get_checksum: false
-    get_mime: no
+    get_mime: false
   register: etcd_data_dir_member
   listen: Restart etcd
   when: etcd_cluster_is_healthy.rc == 0

kubespray/project/roles/etcd/handlers/main.yml

@@ -3,7 +3,7 @@
   import_tasks: backup.yml
 
 - name: Etcd | reload systemd
-  systemd:
+  systemd_service:
     daemon_reload: true
   listen:
     - Restart etcd
@@ -26,7 +26,7 @@
 - name: Wait for etcd up
   uri:
     url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2379/health"
-    validate_certs: no
+    validate_certs: false
     client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
     client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
   register: result
@@ -41,7 +41,7 @@
 - name: Wait for etcd-events up
   uri:
     url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2383/health"
-    validate_certs: no
+    validate_certs: false
     client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
     client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
   register: result

kubespray/project/roles/etcd/tasks/check_certs.yml

@@ -17,9 +17,9 @@
 - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
   stat:
     path: "{{ etcd_cert_dir }}/{{ item }}"
-    get_attributes: no
+    get_attributes: false
-    get_checksum: yes
+    get_checksum: true
-    get_mime: no
+    get_mime: false
   register: etcd_member_certs
   when: inventory_hostname in groups['etcd']
   with_items: