add ability to log to file, update to v2.28.1 and fix 'first upgrade' issue

internal/resources/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2

@@ -502,6 +502,12 @@ apply:
 {% endif %}
   imagePullPolicy: {{ k8s_image_pull_policy }}
   imagePullSerial: {{ kubeadm_image_pull_serial | lower }}
+{% for skip_phase in kubeadm_upgrade_node_phases_skip %}
+{% if loop.first %}
+  skipPhases:
+{% endif %}
+  - "{{ skip_phase }}"
+{% endfor %}
 node:
   certificateRenewal: {{ kubeadm_upgrade_auto_cert_renewal | lower }}
   etcdUpgrade: {{ (etcd_deployment_type == "kubeadm") | lower }}
@@ -517,6 +523,12 @@ node:
 {% endif %}
   imagePullPolicy: {{ k8s_image_pull_policy }}
   imagePullSerial: {{ kubeadm_image_pull_serial | lower }}
+{% for skip_phase in kubeadm_init_phases_skip %}
+{% if loop.first %}
+  skipPhases:
+{% endif %}
+  - "{{ skip_phase }}"
+{% endfor %}
 ---
 apiVersion: kubeproxy.config.k8s.io/v1alpha1
 kind: KubeProxyConfiguration

internal/resources/kubespray/project/roles/kubernetes/control-plane/templates/podsecurity.yaml.j2

@@ -1,6 +1,6 @@
-{% if kube_pod_security_use_default %}
 apiVersion: pod-security.admission.config.k8s.io/v1
 kind: PodSecurityConfiguration
+{% if kube_pod_security_use_default %}
 defaults:
   enforce: "{{ kube_pod_security_default_enforce }}"
   enforce-version: "{{ kube_pod_security_default_enforce_version }}"