actualized for kubespray version 2.28.0

kubespray/project/roles/kubernetes/control-plane/tasks/main.yml

@@ -18,6 +18,18 @@
     mode: "0640"
   when: kube_webhook_authorization | default(false)
 
+- name: Create structured AuthorizationConfiguration file
+  copy:
+    content: "{{ authz_config | to_nice_yaml(indent=2, sort_keys=false) }}"
+    dest: "{{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml"
+    mode: "0640"
+  vars:
+    authz_config:
+      apiVersion: apiserver.config.k8s.io/{{ kube_apiserver_authorization_config_api_version }}
+      kind: AuthorizationConfiguration
+      authorizers: "{{ kube_apiserver_authorization_config_authorizers }}"
+  when: kube_apiserver_use_authorization_config_file
+
 - name: Create kube-scheduler config
   template:
     src: kubescheduler-config.yaml.j2
@@ -43,7 +55,7 @@
 
 - name: Install kubectl bash completion
   shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
-  when: ansible_os_family in ["Debian","RedHat"]
+  when: ansible_os_family in ["Debian","RedHat", "Suse"]
   tags:
     - kubectl
   ignore_errors: true  # noqa ignore-errors
@@ -54,7 +66,7 @@
     owner: root
     group: root
     mode: "0755"
-  when: ansible_os_family in ["Debian","RedHat"]
+  when: ansible_os_family in ["Debian","RedHat", "Suse"]
   tags:
     - kubectl
     - upgrade
@@ -73,7 +85,7 @@
     state: present
     marker: "# Ansible entries {mark}"
   when:
-    - ansible_os_family in ["Debian","RedHat"]
+    - ansible_os_family in ["Debian","RedHat", "Suse"]
     - kubectl_alias is defined and kubectl_alias != ""
   tags:
     - kubectl
@@ -93,6 +105,13 @@
 - name: Include kubeadm secondary server apiserver fixes
   include_tasks: kubeadm-fix-apiserver.yml
 
+- name: Cleanup unused AuthorizationConfiguration file versions
+  file:
+    path: "{{ kube_config_dir }}/apiserver-authorization-config-{{ item }}.yaml"
+    state: absent
+  loop: "{{ ['v1alpha1', 'v1beta1', 'v1'] | reject('equalto', kube_apiserver_authorization_config_api_version) | list }}"
+  when: kube_apiserver_use_authorization_config_file
+
 - name: Include kubelet client cert rotation fixes
   include_tasks: kubelet-fix-client-cert-rotation.yml
   when: kubelet_rotate_certificates