actualized for kubespray version 2.28.0

2025-06-15 20:25:45 +03:00
parent c819d4f51f
commit c2df2abc78
366 changed files with 9939 additions and 40388 deletions
--- a/kubespray/project/roles/container-engine/containerd-common/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/containerd-common/defaults/main.yml
@@ -3,15 +3,3 @@
 # manager controlled installs to direct download ones.
 containerd_package: 'containerd.io'
 yum_repo_dir: /etc/yum.repos.d
-
-# Keep minimal repo information around for cleanup
-containerd_repo_info:
-  repos:
-
-# Ubuntu docker-ce repo
-containerd_ubuntu_repo_base_url: "https://download.docker.com/linux/ubuntu"
-containerd_ubuntu_repo_component: "stable"
-
-# Debian docker-ce repo
-containerd_debian_repo_base_url: "https://download.docker.com/linux/debian"
-containerd_debian_repo_component: "stable"
--- a/kubespray/project/roles/container-engine/containerd/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/containerd/defaults/main.yml
@@ -17,8 +17,8 @@ containerd_runc_runtime:
  root: ""
  base_runtime_spec: cri-base.json
  options:
-    systemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}"
-    binaryName: "{{ bin_dir }}/runc"
+    SystemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}"
+    BinaryName: "{{ bin_dir }}/runc"

 containerd_additional_runtimes: []
 # Example for Kata Containers as additional runtime:
@@ -62,8 +62,10 @@ containerd_registries_mirrors:
      - host: https://registry-1.docker.io
        capabilities: ["pull", "resolve"]
        skip_verify: false
+#        ca: ["/etc/certs/mirror.pem"]
+#        client: [["/etc/certs/client.pem", ""],["/etc/certs/client.cert", "/etc/certs/client.key"]]

-containerd_max_container_log_line_size: -1
+containerd_max_container_log_line_size: 16384

 # If enabled it will allow non root users to use port numbers <1024
 containerd_enable_unprivileged_ports: false
@@ -90,12 +92,9 @@ containerd_registry_auth: []
 # Configure containerd service
 containerd_limit_proc_num: "infinity"
 containerd_limit_core: "infinity"
-containerd_limit_open_file_num: "infinity"
+containerd_limit_open_file_num: 1048576
 containerd_limit_mem_lock: "infinity"

-# If enabled it will use config_path and config to be put in {{ containerd_cfg_dir }}/certs.d/
-containerd_use_config_path: false
-
 # OS distributions that already support containerd
 containerd_supported_distributions:
  - "CentOS"
@@ -123,7 +122,7 @@ enable_cdi: false
 # For containerd tracing configuration please check out the official documentation:
 # https://github.com/containerd/containerd/blob/main/docs/tracing.md
 containerd_tracing_enabled: false
-containerd_tracing_endpoint: "0.0.0.0:4317"
+containerd_tracing_endpoint: "[::]:4317"
 containerd_tracing_protocol: "grpc"
 containerd_tracing_sampling_ratio: 1.0
 containerd_tracing_service_name: "containerd"
--- a/kubespray/project/roles/container-engine/containerd/molecule/default/converge.yml
+++ b/kubespray/project/roles/container-engine/containerd/molecule/default/converge.yml
@@ -5,5 +5,5 @@
  vars:
    container_manager: containerd
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: container-engine/containerd
--- a/kubespray/project/roles/container-engine/containerd/molecule/default/molecule.yml
+++ b/kubespray/project/roles/container-engine/containerd/molecule/default/molecule.yml
@@ -1,40 +1,30 @@
 ---
 role_name_check: 1
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
-  - name: ubuntu20
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 1024
-    groups:
+  - cloud_image: ubuntu-2004
+    name: ubuntu20
+    vm_cpu_cores: 1
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
-  - name: debian11
-    box: generic/debian11
-    cpus: 1
-    memory: 1024
-    groups:
+  - cloud_image: debian-11
+    name: debian11
+    vm_cpu_cores: 1
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
-    cpus: 1
-    memory: 1024
-    groups:
+  - cloud_image: almalinux-9
+    name: almalinux9
+    vm_cpu_cores: 1
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
 provisioner:
  name: ansible
  env:
@@ -43,5 +33,7 @@ provisioner:
    defaults:
      callbacks_enabled: profile_tasks
      timeout: 120
+  playbooks:
+    create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
  name: testinfra
--- a/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml
@@ -6,8 +6,9 @@
  vars:
    ignore_assert_errors: true
  roles:
-    - role: kubespray-defaults
-    - role: bootstrap-os
+    - role: kubespray_defaults
+    - role: bootstrap_os
+    - role: network_facts
    - role: kubernetes/preinstall
    - role: adduser
      user: "{{ addusers.kube }}"
@@ -25,5 +26,5 @@
    ignore_assert_errors: true
    kube_network_plugin: cni
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: network_plugin/cni
--- a/kubespray/project/roles/container-engine/containerd/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/containerd/tasks/main.yml
@@ -1,31 +1,4 @@
 ---
- name: Fail containerd setup if distribution is not supported
-  fail:
-    msg: "{{ ansible_distribution }} is not supported by containerd."
-  when:
-    - not (allow_unsupported_distribution_setup | default(false)) and (ansible_distribution not in containerd_supported_distributions)
-
- name: Containerd | Remove any package manager controlled containerd package
-  package:
-    name: "{{ containerd_package }}"
-    state: absent
-  when:
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
-
- name: Containerd | Remove containerd repository
-  file:
-    path: "{{ yum_repo_dir }}/containerd.repo"
-    state: absent
-  when:
-    - ansible_os_family in ['RedHat']
-
- name: Containerd | Remove containerd repository
-  apt_repository:
-    repo: "{{ item }}"
-    state: absent
-  with_items: "{{ containerd_repo_info.repos }}"
-  when: ansible_pkg_mgr == 'apt'
-
 - name: Containerd | Download containerd
  include_tasks: "../../../download/tasks/download_file.yml"
  vars:
@@ -41,21 +14,6 @@
      - --strip-components=1
  notify: Restart containerd

- name: Containerd | Remove orphaned binary
-  file:
-    path: "/usr/bin/{{ item }}"
-    state: absent
-  when:
-    - containerd_bin_dir != "/usr/bin"
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
-  ignore_errors: true  # noqa ignore-errors
-  with_items:
-    - containerd
-    - containerd-shim
-    - containerd-shim-runc-v1
-    - containerd-shim-runc-v2
-    - ctr
-
 - name: Containerd | Generate systemd service for containerd
  template:
    src: containerd.service.j2
@@ -108,14 +66,13 @@

 - name: Containerd | Copy containerd config file
  template:
-    src: config.toml.j2
+    src: "{{ 'config.toml.j2' if containerd_version is version('2.0.0', '>=') else 'config-v1.toml.j2' }}"
    dest: "{{ containerd_cfg_dir }}/config.toml"
    owner: "root"
    mode: "0640"
  notify: Restart containerd

 - name: Containerd | Configure containerd registries
-  when: containerd_registries_mirrors is defined
  block:
    - name: Containerd | Create registry directories
      file:
--- a/kubespray/project/roles/container-engine/containerd/tasks/reset.yml
+++ b/kubespray/project/roles/container-engine/containerd/tasks/reset.yml
@@ -1,22 +1,4 @@
 ---
- name: Containerd | Remove containerd repository for RedHat os family
-  file:
-    path: "{{ yum_repo_dir }}/containerd.repo"
-    state: absent
-  when:
-    - ansible_os_family in ['RedHat']
-  tags:
-    - reset_containerd
-
- name: Containerd | Remove containerd repository for Debian os family
-  apt_repository:
-    repo: "{{ item }}"
-    state: absent
-  with_items: "{{ containerd_repo_info.repos }}"
-  when: ansible_pkg_mgr == 'apt'
-  tags:
-    - reset_containerd
-
 - name: Containerd | Stop containerd service
  service:
    name: containerd
--- a/kubespray/project/roles/container-engine/containerd/templates/config-v1.toml.j2
+++ b/kubespray/project/roles/container-engine/containerd/templates/config-v1.toml.j2
@@ -0,0 +1,102 @@
+# This is for containerd v1 for compatibility
+version = 2
+
+root = "{{ containerd_storage_dir }}"
+state = "{{ containerd_state_dir }}"
+oom_score = {{ containerd_oom_score }}
+
+{% if containerd_extra_args is defined %}
+{{ containerd_extra_args }}
+{% endif %}
+
+[grpc]
+  max_recv_message_size = {{ containerd_grpc_max_recv_message_size }}
+  max_send_message_size = {{ containerd_grpc_max_send_message_size }}
+
+[debug]
+  address = "{{ containerd_debug_address }}"
+  level = "{{ containerd_debug_level }}"
+  format = "{{ containerd_debug_format }}"
+  uid = {{ containerd_debug_uid }}
+  gid = {{ containerd_debug_gid }}
+
+[metrics]
+  address = "{{ containerd_metrics_address }}"
+  grpc_histogram = {{ containerd_metrics_grpc_histogram | lower }}
+
+[plugins]
+  [plugins."io.containerd.grpc.v1.cri"]
+    sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
+    max_container_log_line_size = {{ containerd_max_container_log_line_size }}
+    enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
+    enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
+    enable_selinux = {{ containerd_enable_selinux | lower }}
+    disable_apparmor = {{ containerd_disable_apparmor | lower }}
+    tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
+    disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
+    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
+{% if enable_cdi %}
+    enable_cdi = true
+    cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
+{% endif %}
+    [plugins."io.containerd.grpc.v1.cri".containerd]
+      default_runtime_name = "{{ containerd_default_runtime }}"
+      snapshotter = "{{ containerd_snapshotter }}"
+      discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
+{% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %}
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}]
+          runtime_type = "{{ runtime.type }}"
+          runtime_engine = "{{ runtime.engine }}"
+          runtime_root = "{{ runtime.root }}"
+{% if runtime.base_runtime_spec is defined %}
+          base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}"
+{% endif %}
+
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}.options]
+{% for key, value in runtime.options.items() %}
+{% if value | string != "true" and value | string != "false" %}
+            {{ key }} = "{{ value }}"
+{% else %}
+            {{ key }} = {{ value }}
+{% endif %}
+{% endfor %}
+{% endfor %}
+{% if kata_containers_enabled %}
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu]
+          runtime_type = "io.containerd.kata-qemu.v2"
+{% endif %}
+{% if gvisor_enabled %}
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
+          runtime_type = "io.containerd.runsc.v1"
+{% endif %}
+    [plugins."io.containerd.grpc.v1.cri".registry]
+      config_path = "{{ containerd_cfg_dir }}/certs.d"
+{% for registry in containerd_registry_auth if registry['registry'] is defined %}
+{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %}
+      [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth]
+{% if registry['username'] is defined and registry['password'] is defined %}
+        password = "{{ registry['password'] }}"
+        username = "{{ registry['username'] }}"
+{% else %}
+        auth = "{{ registry['auth'] }}"
+{% endif %}
+{% endif %}
+{% endfor %}
+
+{% if nri_enabled and containerd_version is version('1.7.0', '>=') %}
+  [plugins."io.containerd.nri.v1.nri"]
+    disable = false
+{% endif %}
+
+{% if containerd_tracing_enabled %}
+  [plugins."io.containerd.tracing.processor.v1.otlp"]
+    endpoint = "{{ containerd_tracing_endpoint }}"
+    protocol = "{{ containerd_tracing_protocol }}"
+{% if containerd_tracing_protocol == "grpc" %}
+    insecure = false
+{% endif %}
+  [plugins."io.containerd.internal.v1.tracing"]
+    sampling_ratio = {{ containerd_tracing_sampling_ratio }}
+    service_name = "{{ containerd_tracing_service_name }}"
+{% endif %}
--- a/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2
+++ b/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2
@@ -1,4 +1,5 @@
-version = 2
+version = 3
+
 root = "{{ containerd_storage_dir }}"
 state = "{{ containerd_state_dir }}"
 oom_score = {{ containerd_oom_score }}
@@ -23,8 +24,7 @@ oom_score = {{ containerd_oom_score }}
  grpc_histogram = {{ containerd_metrics_grpc_histogram | lower }}

 [plugins]
-  [plugins."io.containerd.grpc.v1.cri"]
-    sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
+  [plugins."io.containerd.cri.v1.runtime"]
    max_container_log_line_size = {{ containerd_max_container_log_line_size }}
    enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
    enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
@@ -32,78 +32,52 @@ oom_score = {{ containerd_oom_score }}
    disable_apparmor = {{ containerd_disable_apparmor | lower }}
    tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
    disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
-    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
 {% if enable_cdi %}
    enable_cdi = true
    cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
 {% endif %}
-    [plugins."io.containerd.grpc.v1.cri".containerd]
-      default_runtime_name = "{{ containerd_default_runtime }}"
-      snapshotter = "{{ containerd_snapshotter }}"
-      discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
-      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
+
+   [plugins."io.containerd.cri.v1.runtime".containerd]
+     default_runtime_name = "{{ containerd_default_runtime }}"
+     [plugins."io.containerd.cri.v1.runtime".containerd.runtimes]
 {% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %}
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}]
-          runtime_type = "{{ runtime.type }}"
-          runtime_engine = "{{ runtime.engine }}"
-          runtime_root = "{{ runtime.root }}"
+       [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.{{ runtime.name }}]
+         runtime_type = "{{ runtime.type }}"
+         runtime_engine = "{{ runtime.engine }}"
+         runtime_root = "{{ runtime.root }}"
 {% if runtime.base_runtime_spec is defined %}
-          base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}"
+         base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}"
 {% endif %}

-          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}.options]
+         [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.{{ runtime.name }}.options]
 {% for key, value in runtime.options.items() %}
 {% if value | string != "true" and value | string != "false" %}
-            {{ key }} = "{{ value }}"
+           {{ key }} = "{{ value }}"
 {% else %}
-            {{ key }} = {{ value }}
+           {{ key }} = {{ value }}
 {% endif %}
 {% endfor %}
 {% endfor %}
 {% if kata_containers_enabled %}
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu]
-          runtime_type = "io.containerd.kata-qemu.v2"
+       [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata-qemu]
+         runtime_type = "io.containerd.kata-qemu.v2"
 {% endif %}
 {% if gvisor_enabled %}
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
-          runtime_type = "io.containerd.runsc.v1"
+       [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runsc]
+         runtime_type = "io.containerd.runsc.v1"
 {% endif %}
-    [plugins."io.containerd.grpc.v1.cri".registry]
-{% if containerd_use_config_path is defined and containerd_use_config_path|bool %}
-      config_path = "{{ containerd_cfg_dir }}/certs.d"
-{% else %}
-      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
-{% set insecure_registries_addr = [] %}
-{% for registry in containerd_registries_mirrors %}
-        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."{{ registry.prefix }}"]
-{% set endpoint = [] %}
-{% for mirror in registry.mirrors %}
-{% if endpoint.append(mirror.host) %}{% endif %}
-{% if mirror.skip_verify is defined and mirror.skip_verify|bool %}{% if insecure_registries_addr.append(mirror.host | urlsplit('netloc')) %}{% endif %}{% endif %}
-{% endfor %}
-          endpoint = ["{{ ( endpoint | unique ) | join('","') }}"]
-{% endfor %}
-{% for addr in insecure_registries_addr | unique %}
-        [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ addr }}".tls]
-          insecure_skip_verify = true
-{% endfor %}
-{% endif %}
-{% for registry in containerd_registry_auth if registry['registry'] is defined %}
-{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %}
-      [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth]
-{% if registry['username'] is defined and registry['password'] is defined %}
-        password = "{{ registry['password'] }}"
-        username = "{{ registry['username'] }}"
-{% else %}
-        auth = "{{ registry['auth'] }}"
-{% endif %}
-{% endif %}
-{% endfor %}

-{% if nri_enabled and containerd_version is version('1.7.0', '>=') %}
+  [plugins."io.containerd.cri.v1.images"]
+    snapshotter = "{{ containerd_snapshotter }}"
+    discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
+    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
+  [plugins."io.containerd.cri.v1.images".pinned_images]
+    sandbox = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
+  [plugins."io.containerd.cri.v1.images".registry]
+    config_path = "{{ containerd_cfg_dir }}/certs.d"
+
  [plugins."io.containerd.nri.v1.nri"]
-    disable = false
-{% endif %}
+    disable = {{ 'false' if nri_enabled else 'true' }}

 {% if containerd_tracing_enabled %}
  [plugins."io.containerd.tracing.processor.v1.otlp"]
--- a/kubespray/project/roles/container-engine/containerd/templates/containerd.service.j2
+++ b/kubespray/project/roles/container-engine/containerd/templates/containerd.service.j2
@@ -15,7 +15,7 @@
 [Unit]
 Description=containerd container runtime
 Documentation=https://containerd.io
-After=network.target local-fs.target
+After=network.target local-fs.target dbus.service

 [Service]
 ExecStartPre=-/sbin/modprobe overlay
--- a/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2
+++ b/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2
@@ -4,4 +4,10 @@ server = "{{ item.server | default("https://" + item.prefix) }}"
  capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"]
  skip_verify = {{ mirror.skip_verify | default('false') | string | lower }}
  override_path = {{ mirror.override_path | default('false') | string | lower }}
+{% if mirror.ca is defined %}
+  ca = ["{{ ([ mirror.ca ] | flatten ) | join('","') }}"]
+{% endif %}
+{% if mirror.client is defined %}
+  client = [{% for pair in mirror.client %}["{{ pair[0] }}", "{{ pair[1] }}"]{% if not loop.last %},{% endif %}{% endfor %}]
+{% endif %}
 {% endfor %}
--- a/kubespray/project/roles/container-engine/containerd/vars/debian.yml
+++ b/kubespray/project/roles/container-engine/containerd/vars/debian.yml
@@ -1,7 +0,0 @@
---
-containerd_repo_info:
-  repos:
-    - >
-      deb {{ containerd_debian_repo_base_url }}
-      {{ ansible_distribution_release | lower }}
-      {{ containerd_debian_repo_component }}
--- a/kubespray/project/roles/container-engine/containerd/vars/ubuntu.yml
+++ b/kubespray/project/roles/container-engine/containerd/vars/ubuntu.yml
@@ -1,7 +0,0 @@
---
-containerd_repo_info:
-  repos:
-    - >
-      deb {{ containerd_ubuntu_repo_base_url }}
-      {{ ansible_distribution_release | lower }}
-      {{ containerd_ubuntu_repo_component }}
--- a/kubespray/project/roles/container-engine/cri-dockerd/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/cri-dockerd/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+# Default is "info" (like if not provided). Possible values are any log level string parseable by logrus
+cri_dockerd_log_level: "info"
--- a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/converge.yml
+++ b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/converge.yml
@@ -5,5 +5,5 @@
  vars:
    container_manager: docker
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: container-engine/cri-dockerd
--- a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/molecule.yml
+++ b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/molecule.yml
@@ -1,28 +1,18 @@
 ---
 role_name_check: 1
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
-  - name: almalinux8
-    box: almalinux/8
-    cpus: 1
-    memory: 1024
-    nested: true
-    groups:
+  - name: almalinux9
+    cloud_image: almalinux-9
+    vm_cpu_cores: 1
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
-    provider_options:
-      driver: kvm
  - name: ubuntu20
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 1024
-    nested: true
-    groups:
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 1
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
-    provider_options:
-      driver: kvm
 provisioner:
  name: ansible
  env:
@@ -35,5 +25,7 @@ provisioner:
    group_vars:
      all:
        become: true
+  playbooks:
+    create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
  name: testinfra
--- a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml
@@ -3,8 +3,8 @@
  hosts: all
  become: true
  roles:
-    - role: kubespray-defaults
-    - role: bootstrap-os
+    - role: kubespray_defaults
+    - role: bootstrap_os
    - role: adduser
      user: "{{ addusers.kube }}"
  tasks:
@@ -20,7 +20,7 @@
    container_manager: containerd
    kube_network_plugin: cni
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: network_plugin/cni
  tasks:
    - name: Copy test container files
--- a/kubespray/project/roles/container-engine/cri-dockerd/templates/cri-dockerd.service.j2
+++ b/kubespray/project/roles/container-engine/cri-dockerd/templates/cri-dockerd.service.j2
@@ -7,7 +7,7 @@ Requires=cri-dockerd.socket

 [Service]
 Type=notify
-ExecStart={{ bin_dir }}/cri-dockerd --container-runtime-endpoint {{ cri_socket }} --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin --network-plugin=cni --pod-cidr={{ kube_pods_subnet }} --pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_version }} {% if enable_dual_stack_networks %}--ipv6-dual-stack=True{% endif %}
+ExecStart={{ bin_dir }}/cri-dockerd --container-runtime-endpoint {{ cri_socket }} --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin --network-plugin=cni --pod-cidr={{ kube_pods_subnets }} --pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_version }} --log-level {{ cri_dockerd_log_level }} {% if ipv6_stack %}--ipv6-dual-stack=True{% endif %}

 ExecReload=/bin/kill -s HUP $MAINPID
 TimeoutSec=0
--- a/kubespray/project/roles/container-engine/cri-o/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/cri-o/defaults/main.yml
@@ -2,6 +2,8 @@

 crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}"
 crio_conmon: "{{ bin_dir }}/conmon"
+crio_default_runtime: "crun"
+crio_libexec_dir: "/usr/libexec/crio"
 crio_enable_metrics: false
 crio_log_level: "info"
 crio_metrics_port: "9090"
@@ -35,14 +37,16 @@ crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/def

 crio_stream_port: "10010"

-crio_required_version: "{{ kube_version | regex_replace('^v(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
+crio_required_version: "{{ kube_version | regex_replace('^(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
+
+crio_root: "/var/lib/containers/storage"

 # The crio_runtimes variable defines a list of OCI compatible runtimes.
 crio_runtimes:
-  - name: runc
-    path: "{{ bin_dir }}/runc"
+  - name: crun
+    path: "{{ crio_runtime_bin_dir }}/crun"
    type: oci
-    root: /run/runc
+    root: /run/crun

 # Kata Containers is an OCI runtime, where containers are run inside lightweight
 # VMs. Kata provides additional isolation towards the host, minimizing the host attack
@@ -55,10 +59,16 @@ kata_runtimes:
    root: /run/kata-containers
    privileged_without_host_devices: true

+runc_runtime:
+  name: runc
+  path: "{{ crio_runtime_bin_dir }}/runc"
+  type: oci
+  root: /run/runc
+
 # crun is a fast and low-memory footprint OCI Container Runtime fully written in C.
 crun_runtime:
  name: crun
-  path: "{{ bin_dir }}/crun"
+  path: "{{ crio_runtime_bin_dir }}/crun"
  type: oci
  root: /run/crun

@@ -89,3 +99,15 @@ crio_man_files:

 # If set to true, it will enable the CRIU support in cri-o
 crio_criu_support_enabled: false
+
+# Configure default_capabilities in crio.conf
+crio_default_capabilities:
+  - CHOWN
+  - DAC_OVERRIDE
+  - FSETID
+  - FOWNER
+  - SETGID
+  - SETUID
+  - SETPCAP
+  - NET_BIND_SERVICE
+  - KILL
--- a/kubespray/project/roles/container-engine/cri-o/meta/main.yml
+++ b/kubespray/project/roles/container-engine/cri-o/meta/main.yml
@@ -1,5 +1,5 @@
 ---
 dependencies:
-  - role: container-engine/runc
+  - role: container-engine/crun
  - role: container-engine/crictl
  - role: container-engine/skopeo
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml
@@ -5,5 +5,5 @@
  vars:
    container_manager: crio
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: container-engine/cri-o
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml
@@ -1,50 +1,38 @@
 ---
 role_name_check: 1
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
  - name: ubuntu20
-    box: generic/ubuntu2004
-    cpus: 2
-    memory: 1024
-    groups:
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
-    cpus: 2
-    memory: 1024
-    groups:
+  - name: almalinux9
+    cloud_image: almalinux-9
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
  - name: fedora
-    box: fedora/38-cloud-base
-    cpus: 2
-    memory: 2048
-    groups:
+    cloud_image: fedora-39
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
-  - name: debian10
-    box: generic/debian10
-    cpus: 2
-    memory: 1024
-    groups:
+  - name: debian12
+    cloud_image: debian-12
+    vm_cpu_cores: 2
+    vm_memory: 1024
+    node_groups:
      - kube_control_plane
      - kube_node
      - k8s_cluster
-    provider_options:
-      driver: kvm
 provisioner:
  name: ansible
  env:
@@ -53,5 +41,7 @@ provisioner:
    defaults:
      callbacks_enabled: profile_tasks
      timeout: 120
+  playbooks:
+    create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
  name: testinfra
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml
@@ -6,8 +6,9 @@
  vars:
    ignore_assert_errors: true
  roles:
-    - role: kubespray-defaults
-    - role: bootstrap-os
+    - role: kubespray_defaults
+    - role: bootstrap_os
+    - role: network_facts
    - role: kubernetes/preinstall
    - role: adduser
      user: "{{ addusers.kube }}"
@@ -25,7 +26,7 @@
    ignore_assert_errors: true
    kube_network_plugin: cni
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: network_plugin/cni
  tasks:
    - name: Copy test container files
--- a/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py
+++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py
@@ -21,7 +21,7 @@ def test_run(host):
    assert "RuntimeName:  cri-o" in cmd.stdout

 def test_run_pod(host):
-    runtime = "runc"
+    runtime = "crun"

    run_command = "/usr/local/bin/crictl run --with-pull --runtime {} /tmp/container.json /tmp/sandbox.json".format(runtime)
    with host.sudo():
--- a/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml
@@ -1,8 +1,8 @@
 ---
- name: Cri-o | include vars/v1.28.yml
-  include_vars: v1.28.yml
-  when: crio_version is version("v1.29.0", operator="<")
-
 - name: Cri-o | include vars/v1.29.yml
  include_vars: v1.29.yml
-  when: crio_version is version("v1.29.0", operator=">=")
+  when: crio_version is version("1.29.0", operator=">=")
+
+- name: Cri-o | include vars/v1.31.yml
+  include_vars: v1.31.yml
+  when: crio_version is version("1.31.0", operator=">=")
--- a/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml
@@ -36,11 +36,18 @@
  when:
    - kata_containers_enabled

- name: Cri-o | build a list of crio runtimes with crun runtime
+## After CRI-O v1.31, crun is default runtime.
+# - name: Cri-o | build a list of crio runtimes with crun runtime
+#   set_fact:
+#     crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}"
+#   when:
+#     - crun_enabled
+
+- name: Cri-o | build a list of crio runtimes with runc runtime
  set_fact:
-    crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}"
+    crio_runtimes: "{{ crio_runtimes + [runc_runtime] }}"
  when:
-    - crun_enabled
+    - runc_enabled

 - name: Cri-o | build a list of crio runtimes with youki runtime
  set_fact:
@@ -82,6 +89,23 @@
    - "{{ crio_bin_files }}"
  notify: Restart crio

+- name: Cri-o | create directory for libexec
+  file:
+    path: "{{ crio_libexec_dir }}"
+    state: directory
+    owner: root
+    mode: "0755"
+
+- name: Cri-o | copy libexec
+  copy:
+    src: "{{ local_release_dir }}/cri-o/bin/{{ item }}"
+    dest: "{{ crio_libexec_dir }}/{{ item }}"
+    mode: "0755"
+    remote_src: true
+  with_items:
+    - "{{ crio_libexec_files }}"
+  notify: Restart crio
+
 - name: Cri-o | copy service file
  copy:
    src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
@@ -156,7 +180,7 @@
    dest: /etc/containers/storage.conf
    section: storage.options.overlay
    option: mountopt
-    value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
+    value: '{{ ''"nodev"'' if ansible_kernel is version(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
    mode: "0644"

 - name: Cri-o | create directory registries configs
--- a/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml
+++ b/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml
@@ -19,7 +19,7 @@

 - name: CRI-O | Remove cri-o apt repo
  apt_repository:
-    repo: "deb {{ crio_download_crio }}{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /"
+    repo: "deb {{ crio_download_crio }}v{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /"
    state: absent
    filename: devel-kubic-libcontainers-stable-cri-o
  when: crio_kubic_debian_repo_name is defined
@@ -36,7 +36,7 @@

 - name: CRI-O | Remove CRI-O kubic yum repo
  yum_repository:
-    name: "devel_kubic_libcontainers_stable_cri-o_{{ crio_version }}"
+    name: "devel_kubic_libcontainers_stable_cri-o_v{{ crio_version }}"
    state: absent
  when:
    - ansible_os_family == "RedHat"
@@ -88,3 +88,11 @@
  with_items: "{{ crio_bin_files }}"
  tags:
    - reset_crio
+
+- name: CRI-O | Remove CRI-O libexec
+  file:
+    name: "{{ item }}"
+    state: absent
+  with_items: "{{ crio_libexec_files }}"
+  tags:
+    - reset_crio
--- a/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2
+++ b/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2
@@ -17,7 +17,7 @@

 # Path to the "root directory". CRI-O stores all of its data, including
 # containers images, in this directory.
-root = "/var/lib/containers/storage"
+root = "{{ crio_root }}"

 # Path to the "run directory". CRI-O stores all of its state in this directory.
 # Read from /etc/containers/storage.conf first so unnecessary here
@@ -97,7 +97,7 @@ grpc_max_recv_msg_size = 16777216

 # default_runtime is the _name_ of the OCI runtime to be used as the default.
 # The name is matched against the runtimes map below.
-default_runtime = "runc"
+default_runtime = "{{ crio_default_runtime }}"

 # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
 no_pivot = false
@@ -155,17 +155,9 @@ cgroup_manager = "{{ crio_cgroup_manager }}"
 # only the capabilities defined in the containers json file by the user/kube
 # will be added.
 default_capabilities = [
-	"CHOWN",
-	"DAC_OVERRIDE",
-	"FSETID",
-	"FOWNER",
-	"NET_RAW",
-	"SETGID",
-	"SETUID",
-	"SETPCAP",
-	"NET_BIND_SERVICE",
-	"SYS_CHROOT",
-	"KILL",
+{%- for item in crio_default_capabilities %}
+        "{{ item }}",
+{%- endfor %}
 ]

 # List of default sysctls. If it is empty or commented out, only the sysctls
@@ -382,7 +374,7 @@ enable_metrics = {{ crio_enable_metrics | bool | lower }}
 # The port on which the metrics server will listen.
 metrics_port = {{ crio_metrics_port }}

-{% if nri_enabled and crio_version is version('v1.26.0', operator='>=') %}
+{% if nri_enabled and crio_version is version('1.26.0', operator='>=') %}
 [crio.nri]

 enable_nri=true
--- a/kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml
+++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml
@@ -1,9 +0,0 @@
---
-# cri-o binary files
-crio_bin_files:
-  - conmon
-  - crio
-  - crio-status
-  - pinns
-
-crio_status_command: crio-status
--- a/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml
+++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml
@@ -1,5 +1,6 @@
 ---
 crio_conmon: "{{ bin_dir }}/crio-conmon"
+crio_runtime_bin_dir: "{{ bin_dir }}"

 # cri-o binary files
 crio_bin_files:
--- a/kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml
+++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml
@@ -0,0 +1,16 @@
+---
+crio_conmon: "{{ crio_libexec_dir }}/conmon"
+crio_runtime_bin_dir: "{{ crio_libexec_dir }}"
+
+# cri-o binary files
+crio_bin_files:
+  - crio
+  - pinns
+
+crio_libexec_files:
+  - conmon
+  - conmonrs
+  - crun
+  - runc
+
+crio_status_command: crio status
--- a/kubespray/project/roles/container-engine/docker/defaults/main.yml
+++ b/kubespray/project/roles/container-engine/docker/defaults/main.yml
@@ -1,5 +1,5 @@
 ---
-docker_version: '26.1'
+docker_version: '28.0'
 docker_cli_version: "{{ docker_version }}"

 docker_package_info:
@@ -53,8 +53,8 @@ docker_fedora_repo_base_url: 'https://download.docker.com/linux/fedora/{{ ansibl
 docker_fedora_repo_gpgkey: 'https://download.docker.com/linux/fedora/gpg'

 # CentOS/RedHat docker-ce repo
-docker_rh_repo_base_url: 'https://download.docker.com/linux/centos/{{ ansible_distribution_major_version }}/$basearch/stable'
-docker_rh_repo_gpgkey: 'https://download.docker.com/linux/centos/gpg'
+docker_rh_repo_base_url: 'https://download.docker.com/linux/rhel/{{ ansible_distribution_major_version }}/$basearch/stable'
+docker_rh_repo_gpgkey: 'https://download.docker.com/linux/rhel/gpg'

 # Ubuntu docker-ce repo
 docker_ubuntu_repo_base_url: "https://download.docker.com/linux/ubuntu"
--- a/kubespray/project/roles/container-engine/docker/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/docker/tasks/main.yml
@@ -50,7 +50,7 @@
  apt_key:
    id: "{{ item }}"
    url: "{{ docker_repo_key_info.url }}"
-    keyring: "{{ docker_repo_key_keyring|default(omit) }}"
+    keyring: "{{ docker_repo_key_keyring | default(omit) }}"
    state: present
  register: keyserver_task_result
  until: keyserver_task_result is succeeded
--- a/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml
+++ b/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml
@@ -10,12 +10,12 @@

 - name: Add upstream dns servers
  set_fact:
-    docker_dns_servers: "{{ docker_dns_servers + upstream_dns_servers | default([]) }}"
+    docker_dns_servers: "{{ docker_dns_servers + upstream_dns_servers }}"
  when: dns_mode in ['coredns', 'coredns_dual']

 - name: Add global searchdomains
  set_fact:
-    docker_dns_search_domains: "{{ docker_dns_search_domains + searchdomains | default([]) }}"
+    docker_dns_search_domains: "{{ docker_dns_search_domains + searchdomains }}"

 - name: Check system nameservers
  shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/'
--- a/kubespray/project/roles/container-engine/docker/vars/debian.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/debian.yml
@@ -25,8 +25,17 @@ containerd_versioned_pkg:
  '1.6.28': "{{ containerd_package }}=1.6.28-2"
  '1.6.31': "{{ containerd_package }}=1.6.31-1"
  '1.6.32': "{{ containerd_package }}=1.6.32-1"
-  'stable': "{{ containerd_package }}=1.6.32-1"
-  'edge': "{{ containerd_package }}=1.6.32-1"
+  '1.6.33': "{{ containerd_package }}=1.6.33-1"
+  '1.7.18': "{{ containerd_package }}=1.7.18-1"
+  '1.7.19': "{{ containerd_package }}=1.7.19-1"
+  '1.7.20': "{{ containerd_package }}=1.7.20-1"
+  '1.7.21': "{{ containerd_package }}=1.7.21-1"
+  '1.7.22': "{{ containerd_package }}=1.7.22-1"
+  '1.7.23': "{{ containerd_package }}=1.7.23-1"
+  '1.7.24': "{{ containerd_package }}=1.7.24-1"
+  '1.7.25': "{{ containerd_package }}=1.7.25-1"
+  'stable': "{{ containerd_package }}=1.7.25-1"
+  'edge': "{{ containerd_package }}=1.7.25-1"

 # https://download.docker.com/linux/debian/
 docker_versioned_pkg:
@@ -38,9 +47,16 @@ docker_versioned_pkg:
  '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -51,9 +67,16 @@ docker_cli_versioned_pkg:
  '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
  '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}

 docker_package_info:
  pkgs:
--- a/kubespray/project/roles/container-engine/docker/vars/fedora.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/fedora.yml
@@ -25,8 +25,17 @@ containerd_versioned_pkg:
  '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}"
  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}"
  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"

 # https://docs.docker.com/install/linux/docker-ce/fedora/
 # https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/
@@ -37,9 +46,16 @@ docker_versioned_pkg:
  '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }}
  '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
  '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -48,9 +64,16 @@ docker_cli_versioned_pkg:
  '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }}
  '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
  '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }}

 docker_package_info:
  enablerepo: "docker-ce"
--- a/kubespray/project/roles/container-engine/docker/vars/redhat-7.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/redhat-7.yml
@@ -1,63 +0,0 @@
---
-# containerd versions are only relevant for docker
-containerd_versioned_pkg:
-  'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el7"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el7"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el7"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el7"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el7"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el7"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el7"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el7"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el7"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el7"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el7"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el7"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el7"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el7"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el7"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el7"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el7"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el7"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el7"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el7"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el7"
-  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el7"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el7"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.el7"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.el7"
-
-# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
-# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
-# or do 'yum --showduplicates list docker-engine'
-docker_versioned_pkg:
-  'latest': docker-ce
-  '18.09': docker-ce-18.09.9-3.el7
-  '19.03': docker-ce-19.03.15-3.el7
-  '20.10': docker-ce-20.10.20-3.el7
-  '23.0': docker-ce-23.0.6-1.el7
-  '24.0': docker-ce-24.0.9-1.el7
-  '26.0': docker-ce-26.0.2-1.el7
-  '26.1': docker-ce-26.1.2-1.el7
-  'stable': docker-ce-26.1.2-1.el7
-  'edge': docker-ce-26.1.2-1.el7
-
-docker_cli_versioned_pkg:
-  'latest': docker-ce-cli
-  '18.09': docker-ce-cli-18.09.9-3.el7
-  '19.03': docker-ce-cli-19.03.15-3.el7
-  '20.10': docker-ce-cli-20.10.20-3.el7
-  '23.0': docker-ce-cli-23.0.6-1.el7
-  '24.0': docker-ce-cli-24.0.9-1.el7
-  '26.0': docker-ce-cli-26.0.2-1.el7
-  '26.1': docker-ce-cli-26.1.2-1.el7
-  'stable': docker-ce-cli-26.1.2-1.el7
-  'edge': docker-ce-cli-26.1.2-1.el7
-
-docker_package_info:
-  enablerepo: "docker-ce"
-  pkgs:
-    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
-    - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
-    - "{{ docker_versioned_pkg[docker_version | string] }}"
--- a/kubespray/project/roles/container-engine/docker/vars/redhat.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/redhat.yml
@@ -25,11 +25,20 @@ containerd_versioned_pkg:
  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}"
  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"

-# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
-# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
+# https://docs.docker.com/engine/installation/linux/rhel/#install-from-a-package
+# https://download.docker.com/linux/rhel/<rhel_version>>/x86_64/stable/Packages/
 # or do 'yum --showduplicates list docker-engine'
 docker_versioned_pkg:
  'latest': docker-ce
@@ -39,9 +48,16 @@ docker_versioned_pkg:
  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
  '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.3-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.3-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.3-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.3-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.3-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -51,9 +67,16 @@ docker_cli_versioned_pkg:
  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
  '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.3-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.3-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.3-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.3-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.3-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }}

 docker_package_info:
  enablerepo: "docker-ce"
--- a/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml
+++ b/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml
@@ -2,13 +2,6 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
  'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}=1.3.7-1"
-  '1.3.9': "{{ containerd_package }}=1.3.9-1"
-  '1.4.3': "{{ containerd_package }}=1.4.3-2"
-  '1.4.4': "{{ containerd_package }}=1.4.4-1"
-  '1.4.6': "{{ containerd_package }}=1.4.6-1"
-  '1.4.9': "{{ containerd_package }}=1.4.9-1"
-  '1.4.12': "{{ containerd_package }}=1.4.12-1"
  '1.6.4': "{{ containerd_package }}=1.6.4-1"
  '1.6.6': "{{ containerd_package }}=1.6.6-1"
  '1.6.7': "{{ containerd_package }}=1.6.7-1"
@@ -25,8 +18,17 @@ containerd_versioned_pkg:
  '1.6.28': "{{ containerd_package }}=1.6.28-2"
  '1.6.31': "{{ containerd_package }}=1.6.31-1"
  '1.6.32': "{{ containerd_package }}=1.6.32-1"
-  'stable': "{{ containerd_package }}=1.6.32-1"
-  'edge': "{{ containerd_package }}=1.6.32-1"
+  '1.6.33': "{{ containerd_package }}=1.6.33-1"
+  '1.7.18': "{{ containerd_package }}=1.7.18-1"
+  '1.7.19': "{{ containerd_package }}=1.7.19-1"
+  '1.7.20': "{{ containerd_package }}=1.7.20-1"
+  '1.7.21': "{{ containerd_package }}=1.7.21-1"
+  '1.7.22': "{{ containerd_package }}=1.7.22-1"
+  '1.7.23': "{{ containerd_package }}=1.7.23-1"
+  '1.7.24': "{{ containerd_package }}=1.7.24-1"
+  '1.7.25': "{{ containerd_package }}=1.7.25-1"
+  'stable': "{{ containerd_package }}=1.7.25-1"
+  'edge': "{{ containerd_package }}=1.7.25-1"

 # https://download.docker.com/linux/ubuntu/
 docker_versioned_pkg:
@@ -37,9 +39,16 @@ docker_versioned_pkg:
  '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
  '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
  '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
@@ -49,9 +58,16 @@ docker_cli_versioned_pkg:
  '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
  '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
  '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}

 docker_package_info:
  pkgs:
--- a/kubespray/project/roles/container-engine/gvisor/molecule/default/converge.yml
+++ b/kubespray/project/roles/container-engine/gvisor/molecule/default/converge.yml
@@ -6,6 +6,6 @@
    gvisor_enabled: true
    container_manager: containerd
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: container-engine/containerd
    - role: container-engine/gvisor
--- a/kubespray/project/roles/container-engine/gvisor/molecule/default/molecule.yml
+++ b/kubespray/project/roles/container-engine/gvisor/molecule/default/molecule.yml
@@ -14,8 +14,8 @@ platforms:
      - kube_control_plane
    provider_options:
      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
+  - name: almalinux9
+    box: almalinux/9
    cpus: 1
    memory: 1024
    nested: true
--- a/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml
@@ -3,8 +3,8 @@
  hosts: all
  become: true
  roles:
-    - role: kubespray-defaults
-    - role: bootstrap-os
+    - role: kubespray_defaults
+    - role: bootstrap_os
    - role: adduser
      user: "{{ addusers.kube }}"
  tasks:
@@ -20,7 +20,7 @@
    container_manager: containerd
    kube_network_plugin: cni
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: network_plugin/cni
    - role: container-engine/crictl
  tasks:
--- a/kubespray/project/roles/container-engine/kata-containers/OWNERS
+++ b/kubespray/project/roles/container-engine/kata-containers/OWNERS
@@ -1,6 +0,0 @@
-# See the OWNERS docs at https://go.k8s.io/owners
-
-approvers:
-  - pasqualet
-reviewers:
-  - pasqualet
--- a/kubespray/project/roles/container-engine/kata-containers/molecule/default/converge.yml
+++ b/kubespray/project/roles/container-engine/kata-containers/molecule/default/converge.yml
@@ -6,6 +6,6 @@
    kata_containers_enabled: true
    container_manager: containerd
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: container-engine/containerd
    - role: container-engine/kata-containers
--- a/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml
@@ -3,8 +3,8 @@
  hosts: all
  become: true
  roles:
-    - role: kubespray-defaults
-    - role: bootstrap-os
+    - role: kubespray_defaults
+    - role: bootstrap_os
    - role: adduser
      user: "{{ addusers.kube }}"
  tasks:
@@ -20,7 +20,7 @@
    container_manager: containerd
    kube_network_plugin: cni
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: network_plugin/cni
    - role: container-engine/crictl
  tasks:
--- a/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml
@@ -84,7 +84,7 @@
  block:
    - name: Drain node
      include_role:
-        name: remove-node/pre-remove
+        name: remove_node/pre_remove
        apply:
          tags:
            - pre-remove
@@ -111,7 +111,7 @@
  block:
    - name: Drain node
      include_role:
-        name: remove-node/pre-remove
+        name: remove_node/pre_remove
        apply:
          tags:
            - pre-remove
@@ -137,7 +137,7 @@
  block:
    - name: Drain node
      include_role:
-        name: remove-node/pre-remove
+        name: remove_node/pre_remove
        apply:
          tags:
            - pre-remove
--- a/kubespray/project/roles/container-engine/youki/molecule/default/converge.yml
+++ b/kubespray/project/roles/container-engine/youki/molecule/default/converge.yml
@@ -6,6 +6,6 @@
    youki_enabled: true
    container_manager: crio
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: container-engine/cri-o
    - role: container-engine/youki
--- a/kubespray/project/roles/container-engine/youki/molecule/default/molecule.yml
+++ b/kubespray/project/roles/container-engine/youki/molecule/default/molecule.yml
@@ -14,8 +14,8 @@ platforms:
      - kube_control_plane
    provider_options:
      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
+  - name: almalinux9
+    box: almalinux/9
    cpus: 1
    memory: 1024
    nested: true
--- a/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml
+++ b/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml
@@ -3,8 +3,8 @@
  hosts: all
  become: true
  roles:
-    - role: kubespray-defaults
-    - role: bootstrap-os
+    - role: kubespray_defaults
+    - role: bootstrap_os
    - role: adduser
      user: "{{ addusers.kube }}"
  tasks:
@@ -20,7 +20,7 @@
    container_manager: crio
    kube_network_plugin: cni
  roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
    - role: network_plugin/cni
    - role: container-engine/crictl
  tasks:
--- a/kubespray/project/roles/container-engine/youki/tasks/main.yml
+++ b/kubespray/project/roles/container-engine/youki/tasks/main.yml
@@ -6,7 +6,7 @@

 - name: Youki | Copy youki binary from download dir
  copy:
-    src: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux/youki-{{ youki_version }}/youki"
+    src: "{{ local_release_dir }}/youki"
    dest: "{{ youki_bin_dir }}/youki"
    mode: "0755"
    remote_src: true