actualized for kubespray version 2.28.0

.ansible-lint

@@ -0,0 +1,45 @@
+---
+parseable: true
+skip_list:
+  # see https://docs.ansible.com/ansible-lint/rules/default_rules.html for a list of all default rules
+
+  # DO NOT add any other rules to this skip_list, instead use local `# noqa` with a comment explaining WHY it is necessary
+
+  # These rules are intentionally skipped:
+  #
+  # [role-name] "meta/main.yml" Role name role-name does not match ``^+$`` pattern
+  # Meta roles in Kubespray don't need proper names
+  # (Disabled in June 2021)
+  - 'role-name'
+
+  # [var-naming] "defaults/main.yml" File defines variable 'apiVersion' that violates variable naming standards
+  # In Kubespray we use variables that use camelCase to match their k8s counterparts
+  # (Disabled in June 2021)
+  - 'var-naming'
+
+  # [fqcn-builtins]
+  # Roles in kubespray don't need fully qualified collection names
+  # (Disabled in Feb 2023)
+  - 'fqcn-builtins'
+
+  # We use template in names
+  - 'name[template]'
+
+  # No changed-when on commands
+  # (Disabled in June 2023 after ansible upgrade; FIXME)
+  - 'no-changed-when'
+
+  # Disable run-once check with free strategy
+  # (Disabled in June 2023 after ansible upgrade; FIXME)
+  - 'run-once[task]'
+exclude_paths:
+  # Generated files
+  - tests/files/custom_cni/cilium.yaml
+  - venv
+  - .github
+  - .ansible
+  - .cache
+  - .gitlab-ci.yml
+  - .gitlab-ci
+mock_modules:
+  - gluster.gluster.gluster_volume

.ansible-lint-ignore

@@ -0,0 +1,8 @@
+# This file contains ignores rule violations for ansible-lint
+inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml jinja[spacing]
+roles/kubernetes/control-plane/defaults/main/kube-proxy.yml jinja[spacing]
+roles/kubernetes/control-plane/defaults/main/main.yml jinja[spacing]
+roles/kubernetes/kubeadm/defaults/main.yml jinja[spacing]
+roles/kubernetes/node/defaults/main.yml jinja[spacing]
+roles/kubernetes/preinstall/defaults/main.yml jinja[spacing]
+roles/kubespray-defaults/defaults/main/main.yml jinja[spacing]

.gitignore

@@ -7,3 +7,7 @@ vault-keys.json
 config.yaml
 temp
 *id_rsa*
+.venv
+.ropeproject
+*__pycache__
+bin

Makefile

@@ -0,0 +1,18 @@
+BINNAME    := kube-forge
+BINDIR  := $(CURDIR)/bin
+TARGETS := darwin/amd64 darwin/arm64 linux/amd64 linux/arm linux/arm64 windows/amd64 windows/arm64
+
+.PHONY: run
+run:
+	@'$(BINDIR)/'$(BINNAME)
+
+
+.PHONY: build
+build:
+	@go build -v -trimpath -ldflags "-s -w $(ADDITIONAL_LLD_FLAGS)" -o '$(BINDIR)/'$(BINNAME) ./cmd/main/main.go
+
+.PHONY: clean
+clean:
+	@rm -r ${BINDIR}
+
+.DEFAULT_GOAL := build

ansible.cfg

@@ -11,7 +11,8 @@ gathering = smart
 fact_caching = jsonfile
 fact_caching_connection = /tmp
 fact_caching_timeout = 86400
-stdout_callback = dense
+timeout = 300
+stdout_callback = default
 display_skipped_hosts = no
 library = ./library
 callbacks_enabled = profile_tasks,ara_default

config.sample.yaml

@@ -17,7 +17,7 @@ hosts:
     roles: [node]
 
 orchestrator:
-  version: v1.30.3
+  version: v1.32
   cluster_name: cluster.local
   kubelet_dir: "/app/k8s/kubelet"
   proxy_mode: "ipvs" # iptables, ipvs

internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl

@@ -44,14 +44,6 @@ containerd_state_dir:  {{ .Orchestrator.ContainerEngine.StateDir }}
 
 # containerd_metrics_grpc_histogram: false
 
-# Registries defined within containerd.
-# containerd_registries_mirrors:
-#  - prefix: docker.io
-#    mirrors:
-#     - host: https://registry-1.docker.io
-#       capabilities: ["pull", "resolve"]
-#       skip_verify: false
-
 # containerd_max_container_log_line_size: -1
 
 # containerd_registry_auth:

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl

@@ -448,10 +448,7 @@ auto_renew_certificates: {{ .Orchestrator.AutoRenewCertificates }}
 # auto_renew_certificates_systemd_calendar: {{ `"Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"` }}
 
 # kubeadm patches path
-kubeadm_patches:
+kubeadm_patches: []
-  enabled: false
-  source_dir: {{ `"{{ inventory_dir }}/patches"` }}
-  dest_dir: {{ `"{{ kube_config_dir }}/patches"` }}
 
 {{- if not (eq .Orchestrator.KubeletDir "/var/lib/kubelet") }}
 ## Kubelet additional settings

internal/resources/templates/kubespray/inventory/hosts.tmpl

@@ -44,10 +44,6 @@
 {{- end }}
 {{- end }}
 
-[k8s_cluster:children]
-kube_control_plane
-kube_node
-
 [all:vars]
 ansible_connection=ssh
 {{- if not (eq .Credentials.User "") }}

kubespray/inventory/group_vars/all/containerd.yml

@@ -45,12 +45,15 @@ containerd_state_dir:  /app/containerd-state
 # containerd_metrics_grpc_histogram: false
 
 # Registries defined within containerd.
-# containerd_registries_mirrors:
+containerd_registries_mirrors:
-#  - prefix: docker.io
+  - prefix: docker.io
-#    mirrors:
+    mirrors:
-#     - host: https://registry-1.docker.io
+      - host: https://mirror.gcr.io
-#       capabilities: ["pull", "resolve"]
+        capabilities: ["pull", "resolve"]
-#       skip_verify: false
+        skip_verify: false
+      - host: https://quay.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
 
 # containerd_max_container_log_line_size: -1
 

kubespray/inventory/group_vars/k8s_cluster/addons.yml

@@ -12,7 +12,7 @@ local_path_provisioner_enabled: true
 # local_path_provisioner_namespace: "local-path-storage"
 local_path_provisioner_storage_class: local-path
 local_path_provisioner_reclaim_policy: Delete
-local_path_provisioner_claim_root: /opt/local-path-provisioner/
+local_path_provisioner_claim_root: /app/local-path-provisioner
 # local_path_provisioner_debug: false
 # local_path_provisioner_image_repo: "rancher/local-path-provisioner"
 # local_path_provisioner_image_tag: "v0.0.23"

kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml

@@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
 kube_api_anonymous_auth: true
 
 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.29.0
+kube_version: 1.32.4
 
 # Where the binaries will be downloaded.
 # Note: ensure that you've enough disk space (about 1G)
@@ -226,15 +226,6 @@ dns_domain: "{{ cluster_name }}"
 ## docker for docker, crio for cri-o and containerd for containerd.
 ## Default: containerd
 container_manager: containerd
-containerd_registries_mirrors:
-  - prefix: docker.io
-    mirrors:
-      - host: https://mirror.gcr.io
-        capabilities: ["pull", "resolve"]
-        skip_verify: false
-      - host: https://quay.io
-        capabilities: ["pull", "resolve"]
-        skip_verify: false
 
 ## CRI-O registry mirrors setup
 crio_registries:
@@ -401,7 +392,7 @@ auto_renew_certificates: true
 # auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"
 
 # kubeadm patches path
-kubeadm_patches:
+kubeadm_patches: []
-  enabled: false
+## Kubelet additional settings
-  source_dir: "{{ inventory_dir }}/patches"
+kubelet_custom_flags:
-  dest_dir: "{{ kube_config_dir }}/patches"
+  - "--root-dir=/app/k8s/kubelet"

kubespray/inventory/hosts

@@ -1,39 +1,17 @@
 
-t1-disk-lt-k8s-master-01 ansible_host=10.100.20.43 ip=10.100.20.43  
+k8s-master-1 ansible_host=172.16.1.136 ip=172.16.1.136  
-t1-disk-lt-k8s-master-02 ansible_host=10.100.20.38 ip=10.100.20.38  
+k8s-worker-1 ansible_host=172.16.1.135 ip=172.16.1.135  
-t1-disk-lt-k8s-master-03 ansible_host=10.100.20.42 ip=10.100.20.42  
-t1-disk-lt-k8s-slave-01 ansible_host=10.100.20.40 ip=10.100.20.40  
-t1-disk-lt-k8s-slave-02 ansible_host=10.100.20.41 ip=10.100.20.41  
-t1-disk-lt-k8s-slave-03 ansible_host=10.100.20.39 ip=10.100.20.39  
-t1-disk-lt-k8s-slave-04 ansible_host=10.100.20.45 ip=10.100.20.45  
-t1-disk-lt-k8s-slave-05 ansible_host=10.100.20.44 ip=10.100.20.44  
-t1-disk-lt-k8s-slave-06 ansible_host=10.100.20.50 ip=10.100.20.50  
-t1-disk-lt-k8s-slave-07 ansible_host=10.100.20.51 ip=10.100.20.51  
 
 [kube_control_plane]
-t1-disk-lt-k8s-master-01
+k8s-master-1
-t1-disk-lt-k8s-master-02
-t1-disk-lt-k8s-master-03
 
 [etcd]
-t1-disk-lt-k8s-master-01
+k8s-master-1
-t1-disk-lt-k8s-master-02
-t1-disk-lt-k8s-master-03
 
 [kube_node]
-t1-disk-lt-k8s-slave-01
+k8s-worker-1
-t1-disk-lt-k8s-slave-02
-t1-disk-lt-k8s-slave-03
-t1-disk-lt-k8s-slave-04
-t1-disk-lt-k8s-slave-05
-t1-disk-lt-k8s-slave-06
-t1-disk-lt-k8s-slave-07
-
-[k8s_cluster:children]
-kube_control_plane
-kube_node
 
 [all:vars]
 ansible_connection=ssh
-ansible_user=sre-admin
+ansible_user=georgest
-ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa_bastion_ift
+ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa

kubespray/project/boilerplate.yml

@@ -2,57 +2,45 @@
 - name: Check ansible version
   import_playbook: ansible_version.yml
 
-# These are inventory compatibility tasks to ensure we keep compatibility with old style group names
+# These are inventory compatibility tasks with two purposes:
+# - to ensure we keep compatibility with old style group names
+# - to reduce inventory boilerplate (defining parent groups / empty groups)
 
-- name: Add kube-master nodes to kube_control_plane
+- name: Define groups for legacy less structured inventories
-  hosts: kube-master
+  hosts: all
   gather_facts: false
   tags: always
   tasks:
-    - name: Add nodes to kube_control_plane group
+    - name: Match needed groups by their old names or definition
+      vars:
+        group_mappings:
+          kube_control_plane:
+            - kube-master
+          kube_node:
+            - kube-node
+          calico_rr:
+            - calico-rr
+          no_floating:
+            - no-floating
+          k8s_cluster:
+            - kube_node
+            - kube_control_plane
+            - calico_rr
       group_by:
-        key: 'kube_control_plane'
+        key: "{{ (group_names | intersect(item.value) | length > 0) | ternary(item.key, '_all') }}"
+      loop: "{{ group_mappings | dict2items }}"
 
-- name: Add kube-node nodes to kube_node
+- name: Check inventory settings
-  hosts: kube-node
+  hosts: all
   gather_facts: false
   tags: always
-  tasks:
+  roles:
-    - name: Add nodes to kube_node group
+    - validate_inventory
-      group_by:
-        key: 'kube_node'
-
-- name: Add k8s-cluster nodes to k8s_cluster
-  hosts: k8s-cluster
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to k8s_cluster group
-      group_by:
-        key: 'k8s_cluster'
-
-- name: Add calico-rr nodes to calico_rr
-  hosts: calico-rr
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to calico_rr group
-      group_by:
-        key: 'calico_rr'
-
-- name: Add no-floating nodes to no_floating
-  hosts: no-floating
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to no-floating group
-      group_by:
-        key: 'no_floating'
 
 - name: Install bastion ssh config
   hosts: bastion[0]
   gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: bastion-ssh-config, tags: ["localhost", "bastion"] }

kubespray/project/cluster.yml

@@ -11,12 +11,15 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/preinstall, tags: preinstall }
     - { role: "container-engine", tags: "container-engine", when: deploy_container_engine }
     - { role: download, tags: download, when: "not skip_downloads" }
 
 - name: Install etcd
+  vars:
+    etcd_cluster_setup: true
+    etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
   import_playbook: install_etcd.yml
 
 - name: Install Kubernetes nodes
@@ -25,7 +28,7 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/node, tags: node }
 
 - name: Install the control plane
@@ -34,7 +37,7 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/control-plane, tags: master }
     - { role: kubernetes/client, tags: client }
     - { role: kubernetes-apps/cluster_roles, tags: cluster-roles }
@@ -45,12 +48,16 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/kubeadm, tags: kubeadm}
     - { role: kubernetes/node-label, tags: node-label }
     - { role: kubernetes/node-taint, tags: node-taint }
+    - role: kubernetes-apps/gateway_api
+      when: gateway_api_enabled
+      tags: gateway_api
+      delegate_to: "{{ groups['kube_control_plane'][0] }}"
+      run_once: true
     - { role: network_plugin, tags: network }
-    - { role: kubernetes-apps/kubelet-csr-approver, tags: kubelet-csr-approver }
 
 - name: Install Calico Route Reflector
   hosts: calico_rr
@@ -58,7 +65,7 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: network_plugin/calico/rr, tags: ['network', 'calico_rr'] }
 
 - name: Patch Kubernetes for Windows
@@ -67,7 +74,7 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }
 
 - name: Install Kubernetes apps
@@ -76,7 +83,7 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller }
     - { role: kubernetes-apps/network_plugin, tags: network }
     - { role: kubernetes-apps/policy_controller, tags: policy-controller }
@@ -90,5 +97,5 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }

kubespray/project/facts.yml

@@ -5,19 +5,17 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   gather_facts: false
   environment: "{{ proxy_disable_env }}"
-  vars:
-    # Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining
-    # fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.
-    ansible_ssh_pipelining: false
   roles:
-    - { role: kubespray-defaults }
+    - { role: bootstrap_os, tags: bootstrap_os}
-    - { role: bootstrap-os, tags: bootstrap-os}
 
 - name: Gather facts
   hosts: k8s_cluster:etcd:calico_rr
   gather_facts: false
   tags: always
   tasks:
+    - name: Gather and compute network facts
+      import_role:
+        name: network_facts
     - name: Gather minimal facts
       setup:
         gather_subset: '!all'

kubespray/project/install_etcd.yml

@@ -2,7 +2,7 @@
 - name: Add worker nodes to the etcd play if needed
   hosts: kube_node
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
   tasks:
     - name: Check if nodes needs etcd client certs (depends on network_plugin)
       group_by:
@@ -20,10 +20,7 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - role: etcd
       tags: etcd
-      vars:
-        etcd_cluster_setup: true
-        etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
       when: etcd_deployment_type != "kubeadm"

kubespray/project/recover_control_plane.yml

@@ -6,7 +6,7 @@
   hosts: etcd[0]
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - role: recover_control_plane/etcd
       when: etcd_deployment_type != "kubeadm"
 
@@ -14,7 +14,7 @@
   hosts: kube_control_plane[0]
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: recover_control_plane/control-plane }
 
 - name: Apply whole cluster install
@@ -24,5 +24,5 @@
   hosts: kube_control_plane
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: recover_control_plane/post-recover }

kubespray/project/remove_node.yml

@@ -1,9 +1,19 @@
 ---
+- name: Validate nodes for removal
+  hosts: localhost
+  tasks:
+    - name: Assert that nodes are specified for removal
+      assert:
+        that:
+          - node is defined
+          - node | length > 0
+        msg: "No nodes specified for removal. The `node` variable must be set explicitly."
+
 - name: Common tasks for every playbooks
   import_playbook: boilerplate.yml
 
 - name: Confirm node removal
-  hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}"
+  hosts: "{{ node | default('this_is_unreachable') }}"
   gather_facts: false
   tasks:
     - name: Confirm Execution
@@ -24,20 +34,25 @@
   when: reset_nodes | default(True) | bool
 
 - name: Reset node
-  hosts: "{{ node | default('kube_node') }}"
+  hosts: "{{ node | default('this_is_unreachable') }}"
   gather_facts: false
   environment: "{{ proxy_disable_env }}"
+  pre_tasks:
+    - name: Gather information about installed services
+      service_facts:
+      when: reset_nodes | default(True) | bool
   roles:
-    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
+    - { role: kubespray_defaults, when: reset_nodes | default(True) | bool }
-    - { role: remove-node/pre-remove, tags: pre-remove }
+    - { role: remove_node/pre_remove, tags: pre-remove }
-    - { role: remove-node/remove-etcd-node }
+    - role: remove-node/remove-etcd-node
+      when: "'etcd' in group_names"
     - { role: reset, tags: reset, when: reset_nodes | default(True) | bool }
 
-# Currently cannot remove first master or etcd
+# Currently cannot remove first control plane node or first etcd node
 - name: Post node removal
-  hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}"
+  hosts: "{{ node | default('this_is_unreachable') }}"
   gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
+    - { role: kubespray_defaults, when: reset_nodes | default(True) | bool }
     - { role: remove-node/post-remove, tags: post-remove }

kubespray/project/reset.yml

@@ -30,6 +30,6 @@
 
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_early: true }
     - { role: reset, tags: reset }

kubespray/project/roles/adduser/molecule/default/molecule.yml

@@ -2,22 +2,18 @@
 role_name_check: 1
 dependency:
   name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
-  - name: adduser-01
+  - name: ubuntu20
-    box: generic/ubuntu2004
+    cloud_image: ubuntu-2004
-    cpus: 1
+    vm_cpu_cores: 1
-    memory: 512
+    vm_memory: 512
-    provider_options:
-      driver: kvm
 provisioner:
   name: ansible
   config_options:
     defaults:
       callbacks_enabled: profile_tasks
       timeout: 120
+  playbooks:
+    create: ../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/bastion-ssh-config/molecule/default/molecule.yml

@@ -2,17 +2,11 @@
 role_name_check: 1
 dependency:
   name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
   - name: bastion-01
-    box: generic/ubuntu2004
+    cloud_image: ubuntu-2004
-    cpus: 1
+    vm_cpu_cores: 1
-    memory: 512
+    vm_memory: 512
-    provider_options:
-      driver: kvm
 provisioner:
   name: ansible
   config_options:
@@ -27,5 +21,7 @@ provisioner:
           bastion:
             hosts:
               bastion-01:
+  playbooks:
+    create: ../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml

@@ -1,47 +0,0 @@
----
-role_name_check: 1
-dependency:
-  name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
-platforms:
-  - name: ubuntu20
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: ubuntu22
-    box: generic/ubuntu2204
-    cpus: 1
-    memory: 1024
-    provider_options:
-      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: debian10
-    box: generic/debian10
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      callbacks_enabled: profile_tasks
-      timeout: 120
-  inventory:
-    group_vars:
-      all:
-        user:
-          name: foo
-          comment: My test comment
-verifier:
-  name: testinfra

kubespray/project/roles/bootstrap-os/tasks/main.yml

@@ -1,64 +1,10 @@
 ---
-- name: Fetch /etc/os-release
+- name: Warn for usage of deprecated role
-  raw: cat /etc/os-release
+  fail:
-  register: os_release
+    msg: bootstrap-os is deprecated, switch to bootstrap_os
-  changed_when: false
+  ignore_errors: true # noqa ignore-errors
-  # This command should always run, even in check mode
+  run_once: true
-  check_mode: false
 
-- name: Include distro specifics vars and tasks
+- name: Compat for direct role import
-  vars:
+  import_role:
-    os_release_dict: "{{ os_release.stdout_lines | select('regex', '^.+=.*$') | map('regex_replace', '\"', '') |
+    name: bootstrap_os
-                         map('split', '=') | community.general.dict }}"
-  block:
-  - name: Include vars
-    include_vars: "{{ item }}"
-    tags:
-    - facts
-    with_first_found:
-    - &search
-      files:
-      - "{{ os_release_dict['ID'] }}-{{ os_release_dict['VARIANT_ID'] }}.yml"
-      - "{{ os_release_dict['ID'] }}.yml"
-      paths:
-      - vars/
-      skip: true
-  - name: Include tasks
-    include_tasks: "{{ included_tasks_file }}"
-    with_first_found:
-    - <<: *search
-      paths: []
-    loop_control:
-      loop_var: included_tasks_file
-
-
-- name: Create remote_tmp for it is used by another module
-  file:
-    path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
-    state: directory
-    mode: "0700"
-
-- name: Gather facts
-  setup:
-    gather_subset: '!all'
-    filter: ansible_*
-
-- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
-  hostname:
-    name: "{{ inventory_hostname }}"
-  when: override_system_hostname
-
-- name: Install ceph-commmon package
-  package:
-    name:
-    - ceph-common
-    state: present
-  when: rbd_provisioner_enabled | default(false)
-
-- name: Ensure bash_completion.d folder exists
-  file:
-    name: /etc/bash_completion.d/
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"

kubespray/project/roles/bootstrap_os/defaults/main.yml

@@ -2,11 +2,16 @@
 ## CentOS/RHEL/AlmaLinux specific variables
 # Use the fastestmirror yum plugin
 centos_fastestmirror_enabled: false
+# Timeout (in seconds) for checking RHEL subscription status
+rh_subscription_check_timeout: 180
 
 ## Flatcar Container Linux specific variables
 # Disable locksmithd or leave it in its current state
 coreos_locksmithd_disable: false
 
+# Install epel repo on Centos/RHEL
+epel_enabled: false
+
 ## Oracle Linux specific variables
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true
@@ -14,6 +19,8 @@ use_oracle_public_repo: true
 ## Ubuntu specific variables
 # Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
 ubuntu_kernel_unattended_upgrades_disabled: false
+# Stop unattended-upgrades if it is currently running on Ubuntu
+ubuntu_stop_unattended_upgrades: false
 
 fedora_coreos_packages:
   - python
@@ -21,6 +28,7 @@ fedora_coreos_packages:
   - ethtool                 # required in kubeadm preflight phase for verifying the environment
   - ipset                   # required in kubeadm preflight phase for verifying the environment
   - conntrack-tools         # required by kube-proxy
+  - containernetworking-plugins  # required by crio
 
 ## General
 # Set the hostname to inventory_hostname

kubespray/project/roles/bootstrap_os/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: kubespray_defaults

kubespray/project/roles/bootstrap_os/molecule/default/converge.yml

@@ -2,5 +2,6 @@
 - name: Converge
   hosts: all
   gather_facts: false
+  become: true
   roles:
-    - role: bootstrap-os
+    - role: bootstrap_os

kubespray/project/roles/bootstrap_os/molecule/default/molecule.yml

@@ -0,0 +1,37 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+platforms:
+  - name: ubuntu20
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 1
+    vm_memory: 512
+  - name: ubuntu22
+    cloud_image: ubuntu-2204
+    vm_cpu_cores: 1
+    vm_memory: 512
+  - name: almalinux9
+    cloud_image: almalinux-9
+    vm_cpu_cores: 1
+    vm_memory: 512
+  - name: debian12
+    cloud_image: debian-12
+    vm_cpu_cores: 1
+    vm_memory: 512
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      callbacks_enabled: profile_tasks
+      timeout: 120
+  inventory:
+    group_vars:
+      all:
+        user:
+          name: foo
+          comment: My test comment
+  playbooks:
+    create: ../../../../tests/cloud_playbooks/create-kubevirt.yml
+verifier:
+  name: testinfra

kubespray/project/roles/bootstrap_os/tasks/centos.yml

@@ -108,11 +108,3 @@
   when:
     - fastestmirror.stat.exists
     - not centos_fastestmirror_enabled
-
-# libselinux-python is required on SELinux enabled hosts
-# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
-- name: Install libselinux python package
-  package:
-    name: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
-    state: present
-  become: true

kubespray/project/roles/bootstrap_os/tasks/flatcar.yml

@@ -23,7 +23,7 @@
 
 - name: Make interpreter discovery works on Flatcar
   set_fact:
-    ansible_interpreter_python_fallback: "{{ ansible_interpreter_python_fallback + [ '/opt/bin/python' ] }}"
+    ansible_interpreter_python_fallback: "{{ (ansible_interpreter_python_fallback | default([])) + ['/opt/bin/python'] }}"
 
 - name: Disable auto-upgrade
   systemd_service:

kubespray/project/roles/bootstrap_os/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: Fetch /etc/os-release
+  raw: cat /etc/os-release
+  register: os_release
+  changed_when: false
+  # This command should always run, even in check mode
+  check_mode: false
+
+- name: Include distro specifics vars and tasks
+  vars:
+    os_release_dict: "{{ os_release.stdout_lines | select('regex', '^.+=.*$') | map('regex_replace', '\"', '') |
+                         map('split', '=') | community.general.dict }}"
+  block:
+  - name: Include vars
+    include_vars: "{{ item }}"
+    tags:
+    - facts
+    with_first_found:
+    - &search
+      files:
+      - "{{ os_release_dict['ID'] }}-{{ os_release_dict['VARIANT_ID'] }}.yml"
+      - "{{ os_release_dict['ID'] }}.yml"
+      paths:
+      - vars/
+      skip: true
+  - name: Include tasks
+    include_tasks: "{{ included_tasks_file }}"
+    with_first_found:
+    - <<: *search
+      paths: []
+    loop_control:
+      loop_var: included_tasks_file
+
+- name: Install system packages
+  import_role:
+    name: system_packages
+  tags:
+  - system-packages
+
+- name: Create remote_tmp for it is used by another module
+  file:
+    path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
+    state: directory
+    mode: "0700"
+
+- name: Gather facts
+  setup:
+    gather_subset: '!all'
+    filter: ansible_*
+
+- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
+  hostname:
+    name: "{{ inventory_hostname }}"
+  when: override_system_hostname
+
+- name: Ensure bash_completion.d folder exists
+  file:
+    name: /etc/bash_completion.d/
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"

kubespray/project/roles/bootstrap_os/tasks/rhel.yml

@@ -28,6 +28,7 @@
   register: rh_subscription_status
   changed_when: "rh_subscription_status.rc != 0"
   ignore_errors: true  # noqa ignore-errors
+  timeout: "{{ rh_subscription_check_timeout }}"
   become: true
 
 - name: RHEL subscription Organization ID/Activation Key registration
@@ -92,11 +93,3 @@
   when:
     - fastestmirror.stat.exists
     - not centos_fastestmirror_enabled
-
-# libselinux-python is required on SELinux enabled hosts
-# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
-- name: Install libselinux python package
-  package:
-    name: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
-    state: present
-  become: true

kubespray/project/roles/bootstrap_os/tasks/ubuntu.yml

@@ -19,3 +19,11 @@
   when:
     - ubuntu_kernel_unattended_upgrades_disabled
     - unattended_upgrades_file_stat.stat.exists
+
+- name: Stop unattended-upgrades service
+  service:
+    name: unattended-upgrades
+    state: stopped
+    enabled: false
+  become: true
+  when: ubuntu_stop_unattended_upgrades

kubespray/project/roles/container-engine/containerd-common/defaults/main.yml

@@ -3,15 +3,3 @@
 # manager controlled installs to direct download ones.
 containerd_package: 'containerd.io'
 yum_repo_dir: /etc/yum.repos.d
-
-# Keep minimal repo information around for cleanup
-containerd_repo_info:
-  repos:
-
-# Ubuntu docker-ce repo
-containerd_ubuntu_repo_base_url: "https://download.docker.com/linux/ubuntu"
-containerd_ubuntu_repo_component: "stable"
-
-# Debian docker-ce repo
-containerd_debian_repo_base_url: "https://download.docker.com/linux/debian"
-containerd_debian_repo_component: "stable"

kubespray/project/roles/container-engine/containerd/defaults/main.yml

@@ -17,8 +17,8 @@ containerd_runc_runtime:
   root: ""
   base_runtime_spec: cri-base.json
   options:
-    systemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}"
+    SystemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}"
-    binaryName: "{{ bin_dir }}/runc"
+    BinaryName: "{{ bin_dir }}/runc"
 
 containerd_additional_runtimes: []
 # Example for Kata Containers as additional runtime:
@@ -62,8 +62,10 @@ containerd_registries_mirrors:
       - host: https://registry-1.docker.io
         capabilities: ["pull", "resolve"]
         skip_verify: false
+#        ca: ["/etc/certs/mirror.pem"]
+#        client: [["/etc/certs/client.pem", ""],["/etc/certs/client.cert", "/etc/certs/client.key"]]
 
-containerd_max_container_log_line_size: -1
+containerd_max_container_log_line_size: 16384
 
 # If enabled it will allow non root users to use port numbers <1024
 containerd_enable_unprivileged_ports: false
@@ -90,12 +92,9 @@ containerd_registry_auth: []
 # Configure containerd service
 containerd_limit_proc_num: "infinity"
 containerd_limit_core: "infinity"
-containerd_limit_open_file_num: "infinity"
+containerd_limit_open_file_num: 1048576
 containerd_limit_mem_lock: "infinity"
 
-# If enabled it will use config_path and config to be put in {{ containerd_cfg_dir }}/certs.d/
-containerd_use_config_path: false
-
 # OS distributions that already support containerd
 containerd_supported_distributions:
   - "CentOS"
@@ -123,7 +122,7 @@ enable_cdi: false
 # For containerd tracing configuration please check out the official documentation:
 # https://github.com/containerd/containerd/blob/main/docs/tracing.md
 containerd_tracing_enabled: false
-containerd_tracing_endpoint: "0.0.0.0:4317"
+containerd_tracing_endpoint: "[::]:4317"
 containerd_tracing_protocol: "grpc"
 containerd_tracing_sampling_ratio: 1.0
 containerd_tracing_service_name: "containerd"

kubespray/project/roles/container-engine/containerd/molecule/default/converge.yml

@@ -5,5 +5,5 @@
   vars:
     container_manager: containerd
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: container-engine/containerd

kubespray/project/roles/container-engine/containerd/molecule/default/molecule.yml

@@ -1,40 +1,30 @@
 ---
 role_name_check: 1
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
-  - name: ubuntu20
+  - cloud_image: ubuntu-2004
-    box: generic/ubuntu2004
+    name: ubuntu20
-    cpus: 1
+    vm_cpu_cores: 1
-    memory: 1024
+    vm_memory: 1024
-    groups:
+    node_groups:
       - kube_control_plane
       - kube_node
       - k8s_cluster
-    provider_options:
+  - cloud_image: debian-11
-      driver: kvm
+    name: debian11
-  - name: debian11
+    vm_cpu_cores: 1
-    box: generic/debian11
+    vm_memory: 1024
-    cpus: 1
+    node_groups:
-    memory: 1024
-    groups:
       - kube_control_plane
       - kube_node
       - k8s_cluster
-    provider_options:
+  - cloud_image: almalinux-9
-      driver: kvm
+    name: almalinux9
-  - name: almalinux8
+    vm_cpu_cores: 1
-    box: almalinux/8
+    vm_memory: 1024
-    cpus: 1
+    node_groups:
-    memory: 1024
-    groups:
       - kube_control_plane
       - kube_node
       - k8s_cluster
-    provider_options:
-      driver: kvm
 provisioner:
   name: ansible
   env:
@@ -43,5 +33,7 @@ provisioner:
     defaults:
       callbacks_enabled: profile_tasks
       timeout: 120
+  playbooks:
+    create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml

@@ -6,8 +6,9 @@
   vars:
     ignore_assert_errors: true
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
-    - role: bootstrap-os
+    - role: bootstrap_os
+    - role: network_facts
     - role: kubernetes/preinstall
     - role: adduser
       user: "{{ addusers.kube }}"
@@ -25,5 +26,5 @@
     ignore_assert_errors: true
     kube_network_plugin: cni
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: network_plugin/cni

kubespray/project/roles/container-engine/containerd/tasks/main.yml

@@ -1,31 +1,4 @@
 ---
-- name: Fail containerd setup if distribution is not supported
-  fail:
-    msg: "{{ ansible_distribution }} is not supported by containerd."
-  when:
-    - not (allow_unsupported_distribution_setup | default(false)) and (ansible_distribution not in containerd_supported_distributions)
-
-- name: Containerd | Remove any package manager controlled containerd package
-  package:
-    name: "{{ containerd_package }}"
-    state: absent
-  when:
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
-
-- name: Containerd | Remove containerd repository
-  file:
-    path: "{{ yum_repo_dir }}/containerd.repo"
-    state: absent
-  when:
-    - ansible_os_family in ['RedHat']
-
-- name: Containerd | Remove containerd repository
-  apt_repository:
-    repo: "{{ item }}"
-    state: absent
-  with_items: "{{ containerd_repo_info.repos }}"
-  when: ansible_pkg_mgr == 'apt'
-
 - name: Containerd | Download containerd
   include_tasks: "../../../download/tasks/download_file.yml"
   vars:
@@ -41,21 +14,6 @@
       - --strip-components=1
   notify: Restart containerd
 
-- name: Containerd | Remove orphaned binary
-  file:
-    path: "/usr/bin/{{ item }}"
-    state: absent
-  when:
-    - containerd_bin_dir != "/usr/bin"
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
-  ignore_errors: true  # noqa ignore-errors
-  with_items:
-    - containerd
-    - containerd-shim
-    - containerd-shim-runc-v1
-    - containerd-shim-runc-v2
-    - ctr
-
 - name: Containerd | Generate systemd service for containerd
   template:
     src: containerd.service.j2
@@ -108,14 +66,13 @@
 
 - name: Containerd | Copy containerd config file
   template:
-    src: config.toml.j2
+    src: "{{ 'config.toml.j2' if containerd_version is version('2.0.0', '>=') else 'config-v1.toml.j2' }}"
     dest: "{{ containerd_cfg_dir }}/config.toml"
     owner: "root"
     mode: "0640"
   notify: Restart containerd
 
 - name: Containerd | Configure containerd registries
-  when: containerd_registries_mirrors is defined
   block:
     - name: Containerd | Create registry directories
       file:

kubespray/project/roles/container-engine/containerd/tasks/reset.yml

@@ -1,22 +1,4 @@
 ---
-- name: Containerd | Remove containerd repository for RedHat os family
-  file:
-    path: "{{ yum_repo_dir }}/containerd.repo"
-    state: absent
-  when:
-    - ansible_os_family in ['RedHat']
-  tags:
-    - reset_containerd
-
-- name: Containerd | Remove containerd repository for Debian os family
-  apt_repository:
-    repo: "{{ item }}"
-    state: absent
-  with_items: "{{ containerd_repo_info.repos }}"
-  when: ansible_pkg_mgr == 'apt'
-  tags:
-    - reset_containerd
-
 - name: Containerd | Stop containerd service
   service:
     name: containerd

kubespray/project/roles/container-engine/containerd/templates/config-v1.toml.j2

@@ -0,0 +1,102 @@
+# This is for containerd v1 for compatibility
+version = 2
+
+root = "{{ containerd_storage_dir }}"
+state = "{{ containerd_state_dir }}"
+oom_score = {{ containerd_oom_score }}
+
+{% if containerd_extra_args is defined %}
+{{ containerd_extra_args }}
+{% endif %}
+
+[grpc]
+  max_recv_message_size = {{ containerd_grpc_max_recv_message_size }}
+  max_send_message_size = {{ containerd_grpc_max_send_message_size }}
+
+[debug]
+  address = "{{ containerd_debug_address }}"
+  level = "{{ containerd_debug_level }}"
+  format = "{{ containerd_debug_format }}"
+  uid = {{ containerd_debug_uid }}
+  gid = {{ containerd_debug_gid }}
+
+[metrics]
+  address = "{{ containerd_metrics_address }}"
+  grpc_histogram = {{ containerd_metrics_grpc_histogram | lower }}
+
+[plugins]
+  [plugins."io.containerd.grpc.v1.cri"]
+    sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
+    max_container_log_line_size = {{ containerd_max_container_log_line_size }}
+    enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
+    enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
+    enable_selinux = {{ containerd_enable_selinux | lower }}
+    disable_apparmor = {{ containerd_disable_apparmor | lower }}
+    tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
+    disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
+    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
+{% if enable_cdi %}
+    enable_cdi = true
+    cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
+{% endif %}
+    [plugins."io.containerd.grpc.v1.cri".containerd]
+      default_runtime_name = "{{ containerd_default_runtime }}"
+      snapshotter = "{{ containerd_snapshotter }}"
+      discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
+{% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %}
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}]
+          runtime_type = "{{ runtime.type }}"
+          runtime_engine = "{{ runtime.engine }}"
+          runtime_root = "{{ runtime.root }}"
+{% if runtime.base_runtime_spec is defined %}
+          base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}"
+{% endif %}
+
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}.options]
+{% for key, value in runtime.options.items() %}
+{% if value | string != "true" and value | string != "false" %}
+            {{ key }} = "{{ value }}"
+{% else %}
+            {{ key }} = {{ value }}
+{% endif %}
+{% endfor %}
+{% endfor %}
+{% if kata_containers_enabled %}
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu]
+          runtime_type = "io.containerd.kata-qemu.v2"
+{% endif %}
+{% if gvisor_enabled %}
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
+          runtime_type = "io.containerd.runsc.v1"
+{% endif %}
+    [plugins."io.containerd.grpc.v1.cri".registry]
+      config_path = "{{ containerd_cfg_dir }}/certs.d"
+{% for registry in containerd_registry_auth if registry['registry'] is defined %}
+{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %}
+      [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth]
+{% if registry['username'] is defined and registry['password'] is defined %}
+        password = "{{ registry['password'] }}"
+        username = "{{ registry['username'] }}"
+{% else %}
+        auth = "{{ registry['auth'] }}"
+{% endif %}
+{% endif %}
+{% endfor %}
+
+{% if nri_enabled and containerd_version is version('1.7.0', '>=') %}
+  [plugins."io.containerd.nri.v1.nri"]
+    disable = false
+{% endif %}
+
+{% if containerd_tracing_enabled %}
+  [plugins."io.containerd.tracing.processor.v1.otlp"]
+    endpoint = "{{ containerd_tracing_endpoint }}"
+    protocol = "{{ containerd_tracing_protocol }}"
+{% if containerd_tracing_protocol == "grpc" %}
+    insecure = false
+{% endif %}
+  [plugins."io.containerd.internal.v1.tracing"]
+    sampling_ratio = {{ containerd_tracing_sampling_ratio }}
+    service_name = "{{ containerd_tracing_service_name }}"
+{% endif %}

kubespray/project/roles/container-engine/containerd/templates/config.toml.j2

@@ -1,4 +1,5 @@
-version = 2
+version = 3
+
 root = "{{ containerd_storage_dir }}"
 state = "{{ containerd_state_dir }}"
 oom_score = {{ containerd_oom_score }}
@@ -23,8 +24,7 @@ oom_score = {{ containerd_oom_score }}
   grpc_histogram = {{ containerd_metrics_grpc_histogram | lower }}
 
 [plugins]
-  [plugins."io.containerd.grpc.v1.cri"]
+  [plugins."io.containerd.cri.v1.runtime"]
-    sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
     max_container_log_line_size = {{ containerd_max_container_log_line_size }}
     enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
     enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
@@ -32,18 +32,16 @@ oom_score = {{ containerd_oom_score }}
     disable_apparmor = {{ containerd_disable_apparmor | lower }}
     tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
     disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
-    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
 {% if enable_cdi %}
     enable_cdi = true
     cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
 {% endif %}
-    [plugins."io.containerd.grpc.v1.cri".containerd]
+
+   [plugins."io.containerd.cri.v1.runtime".containerd]
      default_runtime_name = "{{ containerd_default_runtime }}"
-      snapshotter = "{{ containerd_snapshotter }}"
+     [plugins."io.containerd.cri.v1.runtime".containerd.runtimes]
-      discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
-      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
 {% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %}
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}]
+       [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.{{ runtime.name }}]
          runtime_type = "{{ runtime.type }}"
          runtime_engine = "{{ runtime.engine }}"
          runtime_root = "{{ runtime.root }}"
@@ -51,7 +49,7 @@ oom_score = {{ containerd_oom_score }}
          base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}"
 {% endif %}
 
-          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}.options]
+         [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.{{ runtime.name }}.options]
 {% for key, value in runtime.options.items() %}
 {% if value | string != "true" and value | string != "false" %}
            {{ key }} = "{{ value }}"
@@ -61,49 +59,25 @@ oom_score = {{ containerd_oom_score }}
 {% endfor %}
 {% endfor %}
 {% if kata_containers_enabled %}
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu]
+       [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata-qemu]
          runtime_type = "io.containerd.kata-qemu.v2"
 {% endif %}
 {% if gvisor_enabled %}
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
+       [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runsc]
          runtime_type = "io.containerd.runsc.v1"
 {% endif %}
-    [plugins."io.containerd.grpc.v1.cri".registry]
-{% if containerd_use_config_path is defined and containerd_use_config_path|bool %}
-      config_path = "{{ containerd_cfg_dir }}/certs.d"
-{% else %}
-      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
-{% set insecure_registries_addr = [] %}
-{% for registry in containerd_registries_mirrors %}
-        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."{{ registry.prefix }}"]
-{% set endpoint = [] %}
-{% for mirror in registry.mirrors %}
-{% if endpoint.append(mirror.host) %}{% endif %}
-{% if mirror.skip_verify is defined and mirror.skip_verify|bool %}{% if insecure_registries_addr.append(mirror.host | urlsplit('netloc')) %}{% endif %}{% endif %}
-{% endfor %}
-          endpoint = ["{{ ( endpoint | unique ) | join('","') }}"]
-{% endfor %}
-{% for addr in insecure_registries_addr | unique %}
-        [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ addr }}".tls]
-          insecure_skip_verify = true
-{% endfor %}
-{% endif %}
-{% for registry in containerd_registry_auth if registry['registry'] is defined %}
-{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %}
-      [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth]
-{% if registry['username'] is defined and registry['password'] is defined %}
-        password = "{{ registry['password'] }}"
-        username = "{{ registry['username'] }}"
-{% else %}
-        auth = "{{ registry['auth'] }}"
-{% endif %}
-{% endif %}
-{% endfor %}
 
-{% if nri_enabled and containerd_version is version('1.7.0', '>=') %}
+  [plugins."io.containerd.cri.v1.images"]
+    snapshotter = "{{ containerd_snapshotter }}"
+    discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
+    image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
+  [plugins."io.containerd.cri.v1.images".pinned_images]
+    sandbox = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
+  [plugins."io.containerd.cri.v1.images".registry]
+    config_path = "{{ containerd_cfg_dir }}/certs.d"
+
   [plugins."io.containerd.nri.v1.nri"]
-    disable = false
+    disable = {{ 'false' if nri_enabled else 'true' }}
-{% endif %}
 
 {% if containerd_tracing_enabled %}
   [plugins."io.containerd.tracing.processor.v1.otlp"]

kubespray/project/roles/container-engine/containerd/templates/containerd.service.j2

@@ -15,7 +15,7 @@
 [Unit]
 Description=containerd container runtime
 Documentation=https://containerd.io
-After=network.target local-fs.target
+After=network.target local-fs.target dbus.service
 
 [Service]
 ExecStartPre=-/sbin/modprobe overlay

kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2

@@ -4,4 +4,10 @@ server = "{{ item.server | default("https://" + item.prefix) }}"
   capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"]
   skip_verify = {{ mirror.skip_verify | default('false') | string | lower }}
   override_path = {{ mirror.override_path | default('false') | string | lower }}
+{% if mirror.ca is defined %}
+  ca = ["{{ ([ mirror.ca ] | flatten ) | join('","') }}"]
+{% endif %}
+{% if mirror.client is defined %}
+  client = [{% for pair in mirror.client %}["{{ pair[0] }}", "{{ pair[1] }}"]{% if not loop.last %},{% endif %}{% endfor %}]
+{% endif %}
 {% endfor %}

kubespray/project/roles/container-engine/containerd/vars/debian.yml

@@ -1,7 +0,0 @@
----
-containerd_repo_info:
-  repos:
-    - >
-      deb {{ containerd_debian_repo_base_url }}
-      {{ ansible_distribution_release | lower }}
-      {{ containerd_debian_repo_component }}

kubespray/project/roles/container-engine/containerd/vars/ubuntu.yml

@@ -1,7 +0,0 @@
----
-containerd_repo_info:
-  repos:
-    - >
-      deb {{ containerd_ubuntu_repo_base_url }}
-      {{ ansible_distribution_release | lower }}
-      {{ containerd_ubuntu_repo_component }}

kubespray/project/roles/container-engine/cri-dockerd/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# Default is "info" (like if not provided). Possible values are any log level string parseable by logrus
+cri_dockerd_log_level: "info"

kubespray/project/roles/container-engine/cri-dockerd/molecule/default/converge.yml

@@ -5,5 +5,5 @@
   vars:
     container_manager: docker
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: container-engine/cri-dockerd

kubespray/project/roles/container-engine/cri-dockerd/molecule/default/molecule.yml

@@ -1,28 +1,18 @@
 ---
 role_name_check: 1
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
-  - name: almalinux8
+  - name: almalinux9
-    box: almalinux/8
+    cloud_image: almalinux-9
-    cpus: 1
+    vm_cpu_cores: 1
-    memory: 1024
+    vm_memory: 1024
-    nested: true
+    node_groups:
-    groups:
       - kube_control_plane
-    provider_options:
-      driver: kvm
   - name: ubuntu20
-    box: generic/ubuntu2004
+    cloud_image: ubuntu-2004
-    cpus: 1
+    vm_cpu_cores: 1
-    memory: 1024
+    vm_memory: 1024
-    nested: true
+    node_groups:
-    groups:
       - kube_control_plane
-    provider_options:
-      driver: kvm
 provisioner:
   name: ansible
   env:
@@ -35,5 +25,7 @@ provisioner:
     group_vars:
       all:
         become: true
+  playbooks:
+    create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml

@@ -3,8 +3,8 @@
   hosts: all
   become: true
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
-    - role: bootstrap-os
+    - role: bootstrap_os
     - role: adduser
       user: "{{ addusers.kube }}"
   tasks:
@@ -20,7 +20,7 @@
     container_manager: containerd
     kube_network_plugin: cni
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: network_plugin/cni
   tasks:
     - name: Copy test container files

kubespray/project/roles/container-engine/cri-dockerd/templates/cri-dockerd.service.j2

@@ -7,7 +7,7 @@ Requires=cri-dockerd.socket
 
 [Service]
 Type=notify
-ExecStart={{ bin_dir }}/cri-dockerd --container-runtime-endpoint {{ cri_socket }} --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin --network-plugin=cni --pod-cidr={{ kube_pods_subnet }} --pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_version }} {% if enable_dual_stack_networks %}--ipv6-dual-stack=True{% endif %}
+ExecStart={{ bin_dir }}/cri-dockerd --container-runtime-endpoint {{ cri_socket }} --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin --network-plugin=cni --pod-cidr={{ kube_pods_subnets }} --pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_version }} --log-level {{ cri_dockerd_log_level }} {% if ipv6_stack %}--ipv6-dual-stack=True{% endif %}
 
 ExecReload=/bin/kill -s HUP $MAINPID
 TimeoutSec=0

kubespray/project/roles/container-engine/cri-o/defaults/main.yml

@@ -2,6 +2,8 @@
 
 crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}"
 crio_conmon: "{{ bin_dir }}/conmon"
+crio_default_runtime: "crun"
+crio_libexec_dir: "/usr/libexec/crio"
 crio_enable_metrics: false
 crio_log_level: "info"
 crio_metrics_port: "9090"
@@ -35,14 +37,16 @@ crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/def
 
 crio_stream_port: "10010"
 
-crio_required_version: "{{ kube_version | regex_replace('^v(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
+crio_required_version: "{{ kube_version | regex_replace('^(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
+
+crio_root: "/var/lib/containers/storage"
 
 # The crio_runtimes variable defines a list of OCI compatible runtimes.
 crio_runtimes:
-  - name: runc
+  - name: crun
-    path: "{{ bin_dir }}/runc"
+    path: "{{ crio_runtime_bin_dir }}/crun"
     type: oci
-    root: /run/runc
+    root: /run/crun
 
 # Kata Containers is an OCI runtime, where containers are run inside lightweight
 # VMs. Kata provides additional isolation towards the host, minimizing the host attack
@@ -55,10 +59,16 @@ kata_runtimes:
     root: /run/kata-containers
     privileged_without_host_devices: true
 
+runc_runtime:
+  name: runc
+  path: "{{ crio_runtime_bin_dir }}/runc"
+  type: oci
+  root: /run/runc
+
 # crun is a fast and low-memory footprint OCI Container Runtime fully written in C.
 crun_runtime:
   name: crun
-  path: "{{ bin_dir }}/crun"
+  path: "{{ crio_runtime_bin_dir }}/crun"
   type: oci
   root: /run/crun
 
@@ -89,3 +99,15 @@ crio_man_files:
 
 # If set to true, it will enable the CRIU support in cri-o
 crio_criu_support_enabled: false
+
+# Configure default_capabilities in crio.conf
+crio_default_capabilities:
+  - CHOWN
+  - DAC_OVERRIDE
+  - FSETID
+  - FOWNER
+  - SETGID
+  - SETUID
+  - SETPCAP
+  - NET_BIND_SERVICE
+  - KILL

kubespray/project/roles/container-engine/cri-o/meta/main.yml

@@ -1,5 +1,5 @@
 ---
 dependencies:
-  - role: container-engine/runc
+  - role: container-engine/crun
   - role: container-engine/crictl
   - role: container-engine/skopeo

kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml

@@ -5,5 +5,5 @@
   vars:
     container_manager: crio
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: container-engine/cri-o

kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml

@@ -1,50 +1,38 @@
 ---
 role_name_check: 1
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
   - name: ubuntu20
-    box: generic/ubuntu2004
+    cloud_image: ubuntu-2004
-    cpus: 2
+    vm_cpu_cores: 2
-    memory: 1024
+    vm_memory: 1024
-    groups:
+    node_groups:
       - kube_control_plane
       - kube_node
       - k8s_cluster
-    provider_options:
+  - name: almalinux9
-      driver: kvm
+    cloud_image: almalinux-9
-  - name: almalinux8
+    vm_cpu_cores: 2
-    box: almalinux/8
+    vm_memory: 1024
-    cpus: 2
+    node_groups:
-    memory: 1024
-    groups:
       - kube_control_plane
       - kube_node
       - k8s_cluster
-    provider_options:
-      driver: kvm
   - name: fedora
-    box: fedora/38-cloud-base
+    cloud_image: fedora-39
-    cpus: 2
+    vm_cpu_cores: 2
-    memory: 2048
+    vm_memory: 1024
-    groups:
+    node_groups:
       - kube_control_plane
       - kube_node
       - k8s_cluster
-    provider_options:
+  - name: debian12
-      driver: kvm
+    cloud_image: debian-12
-  - name: debian10
+    vm_cpu_cores: 2
-    box: generic/debian10
+    vm_memory: 1024
-    cpus: 2
+    node_groups:
-    memory: 1024
-    groups:
       - kube_control_plane
       - kube_node
       - k8s_cluster
-    provider_options:
-      driver: kvm
 provisioner:
   name: ansible
   env:
@@ -53,5 +41,7 @@ provisioner:
     defaults:
       callbacks_enabled: profile_tasks
       timeout: 120
+  playbooks:
+    create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml

@@ -6,8 +6,9 @@
   vars:
     ignore_assert_errors: true
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
-    - role: bootstrap-os
+    - role: bootstrap_os
+    - role: network_facts
     - role: kubernetes/preinstall
     - role: adduser
       user: "{{ addusers.kube }}"
@@ -25,7 +26,7 @@
     ignore_assert_errors: true
     kube_network_plugin: cni
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: network_plugin/cni
   tasks:
     - name: Copy test container files

kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py

@@ -21,7 +21,7 @@ def test_run(host):
     assert "RuntimeName:  cri-o" in cmd.stdout
 
 def test_run_pod(host):
-    runtime = "runc"
+    runtime = "crun"
 
     run_command = "/usr/local/bin/crictl run --with-pull --runtime {} /tmp/container.json /tmp/sandbox.json".format(runtime)
     with host.sudo():

kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml

@@ -1,8 +1,8 @@
 ---
-- name: Cri-o | include vars/v1.28.yml
-  include_vars: v1.28.yml
-  when: crio_version is version("v1.29.0", operator="<")
-
 - name: Cri-o | include vars/v1.29.yml
   include_vars: v1.29.yml
-  when: crio_version is version("v1.29.0", operator=">=")
+  when: crio_version is version("1.29.0", operator=">=")
+
+- name: Cri-o | include vars/v1.31.yml
+  include_vars: v1.31.yml
+  when: crio_version is version("1.31.0", operator=">=")

kubespray/project/roles/container-engine/cri-o/tasks/main.yaml

@@ -36,11 +36,18 @@
   when:
     - kata_containers_enabled
 
-- name: Cri-o | build a list of crio runtimes with crun runtime
+## After CRI-O v1.31, crun is default runtime.
+# - name: Cri-o | build a list of crio runtimes with crun runtime
+#   set_fact:
+#     crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}"
+#   when:
+#     - crun_enabled
+
+- name: Cri-o | build a list of crio runtimes with runc runtime
   set_fact:
-    crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}"
+    crio_runtimes: "{{ crio_runtimes + [runc_runtime] }}"
   when:
-    - crun_enabled
+    - runc_enabled
 
 - name: Cri-o | build a list of crio runtimes with youki runtime
   set_fact:
@@ -82,6 +89,23 @@
     - "{{ crio_bin_files }}"
   notify: Restart crio
 
+- name: Cri-o | create directory for libexec
+  file:
+    path: "{{ crio_libexec_dir }}"
+    state: directory
+    owner: root
+    mode: "0755"
+
+- name: Cri-o | copy libexec
+  copy:
+    src: "{{ local_release_dir }}/cri-o/bin/{{ item }}"
+    dest: "{{ crio_libexec_dir }}/{{ item }}"
+    mode: "0755"
+    remote_src: true
+  with_items:
+    - "{{ crio_libexec_files }}"
+  notify: Restart crio
+
 - name: Cri-o | copy service file
   copy:
     src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
@@ -156,7 +180,7 @@
     dest: /etc/containers/storage.conf
     section: storage.options.overlay
     option: mountopt
-    value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
+    value: '{{ ''"nodev"'' if ansible_kernel is version(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
     mode: "0644"
 
 - name: Cri-o | create directory registries configs

kubespray/project/roles/container-engine/cri-o/tasks/reset.yml

@@ -19,7 +19,7 @@
 
 - name: CRI-O | Remove cri-o apt repo
   apt_repository:
-    repo: "deb {{ crio_download_crio }}{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /"
+    repo: "deb {{ crio_download_crio }}v{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /"
     state: absent
     filename: devel-kubic-libcontainers-stable-cri-o
   when: crio_kubic_debian_repo_name is defined
@@ -36,7 +36,7 @@
 
 - name: CRI-O | Remove CRI-O kubic yum repo
   yum_repository:
-    name: "devel_kubic_libcontainers_stable_cri-o_{{ crio_version }}"
+    name: "devel_kubic_libcontainers_stable_cri-o_v{{ crio_version }}"
     state: absent
   when:
     - ansible_os_family == "RedHat"
@@ -88,3 +88,11 @@
   with_items: "{{ crio_bin_files }}"
   tags:
     - reset_crio
+
+- name: CRI-O | Remove CRI-O libexec
+  file:
+    name: "{{ item }}"
+    state: absent
+  with_items: "{{ crio_libexec_files }}"
+  tags:
+    - reset_crio

kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2

@@ -17,7 +17,7 @@
 
 # Path to the "root directory". CRI-O stores all of its data, including
 # containers images, in this directory.
-root = "/var/lib/containers/storage"
+root = "{{ crio_root }}"
 
 # Path to the "run directory". CRI-O stores all of its state in this directory.
 # Read from /etc/containers/storage.conf first so unnecessary here
@@ -97,7 +97,7 @@ grpc_max_recv_msg_size = 16777216
 
 # default_runtime is the _name_ of the OCI runtime to be used as the default.
 # The name is matched against the runtimes map below.
-default_runtime = "runc"
+default_runtime = "{{ crio_default_runtime }}"
 
 # If true, the runtime will not use pivot_root, but instead use MS_MOVE.
 no_pivot = false
@@ -155,17 +155,9 @@ cgroup_manager = "{{ crio_cgroup_manager }}"
 # only the capabilities defined in the containers json file by the user/kube
 # will be added.
 default_capabilities = [
-	"CHOWN",
+{%- for item in crio_default_capabilities %}
-	"DAC_OVERRIDE",
+        "{{ item }}",
-	"FSETID",
+{%- endfor %}
-	"FOWNER",
-	"NET_RAW",
-	"SETGID",
-	"SETUID",
-	"SETPCAP",
-	"NET_BIND_SERVICE",
-	"SYS_CHROOT",
-	"KILL",
 ]
 
 # List of default sysctls. If it is empty or commented out, only the sysctls
@@ -382,7 +374,7 @@ enable_metrics = {{ crio_enable_metrics | bool | lower }}
 # The port on which the metrics server will listen.
 metrics_port = {{ crio_metrics_port }}
 
-{% if nri_enabled and crio_version is version('v1.26.0', operator='>=') %}
+{% if nri_enabled and crio_version is version('1.26.0', operator='>=') %}
 [crio.nri]
 
 enable_nri=true

kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml

@@ -1,9 +0,0 @@
----
-# cri-o binary files
-crio_bin_files:
-  - conmon
-  - crio
-  - crio-status
-  - pinns
-
-crio_status_command: crio-status

kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml

@@ -1,5 +1,6 @@
 ---
 crio_conmon: "{{ bin_dir }}/crio-conmon"
+crio_runtime_bin_dir: "{{ bin_dir }}"
 
 # cri-o binary files
 crio_bin_files:

kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml

@@ -0,0 +1,16 @@
+---
+crio_conmon: "{{ crio_libexec_dir }}/conmon"
+crio_runtime_bin_dir: "{{ crio_libexec_dir }}"
+
+# cri-o binary files
+crio_bin_files:
+  - crio
+  - pinns
+
+crio_libexec_files:
+  - conmon
+  - conmonrs
+  - crun
+  - runc
+
+crio_status_command: crio status

kubespray/project/roles/container-engine/docker/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-docker_version: '26.1'
+docker_version: '28.0'
 docker_cli_version: "{{ docker_version }}"
 
 docker_package_info:
@@ -53,8 +53,8 @@ docker_fedora_repo_base_url: 'https://download.docker.com/linux/fedora/{{ ansibl
 docker_fedora_repo_gpgkey: 'https://download.docker.com/linux/fedora/gpg'
 
 # CentOS/RedHat docker-ce repo
-docker_rh_repo_base_url: 'https://download.docker.com/linux/centos/{{ ansible_distribution_major_version }}/$basearch/stable'
+docker_rh_repo_base_url: 'https://download.docker.com/linux/rhel/{{ ansible_distribution_major_version }}/$basearch/stable'
-docker_rh_repo_gpgkey: 'https://download.docker.com/linux/centos/gpg'
+docker_rh_repo_gpgkey: 'https://download.docker.com/linux/rhel/gpg'
 
 # Ubuntu docker-ce repo
 docker_ubuntu_repo_base_url: "https://download.docker.com/linux/ubuntu"

kubespray/project/roles/container-engine/docker/tasks/main.yml

@@ -50,7 +50,7 @@
   apt_key:
     id: "{{ item }}"
     url: "{{ docker_repo_key_info.url }}"
-    keyring: "{{ docker_repo_key_keyring|default(omit) }}"
+    keyring: "{{ docker_repo_key_keyring | default(omit) }}"
     state: present
   register: keyserver_task_result
   until: keyserver_task_result is succeeded

kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml

@@ -10,12 +10,12 @@
 
 - name: Add upstream dns servers
   set_fact:
-    docker_dns_servers: "{{ docker_dns_servers + upstream_dns_servers | default([]) }}"
+    docker_dns_servers: "{{ docker_dns_servers + upstream_dns_servers }}"
   when: dns_mode in ['coredns', 'coredns_dual']
 
 - name: Add global searchdomains
   set_fact:
-    docker_dns_search_domains: "{{ docker_dns_search_domains + searchdomains | default([]) }}"
+    docker_dns_search_domains: "{{ docker_dns_search_domains + searchdomains }}"
 
 - name: Check system nameservers
   shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/'

kubespray/project/roles/container-engine/docker/vars/debian.yml

@@ -25,8 +25,17 @@ containerd_versioned_pkg:
   '1.6.28': "{{ containerd_package }}=1.6.28-2"
   '1.6.31': "{{ containerd_package }}=1.6.31-1"
   '1.6.32': "{{ containerd_package }}=1.6.32-1"
-  'stable': "{{ containerd_package }}=1.6.32-1"
+  '1.6.33': "{{ containerd_package }}=1.6.33-1"
-  'edge': "{{ containerd_package }}=1.6.32-1"
+  '1.7.18': "{{ containerd_package }}=1.7.18-1"
+  '1.7.19': "{{ containerd_package }}=1.7.19-1"
+  '1.7.20': "{{ containerd_package }}=1.7.20-1"
+  '1.7.21': "{{ containerd_package }}=1.7.21-1"
+  '1.7.22': "{{ containerd_package }}=1.7.22-1"
+  '1.7.23': "{{ containerd_package }}=1.7.23-1"
+  '1.7.24': "{{ containerd_package }}=1.7.24-1"
+  '1.7.25': "{{ containerd_package }}=1.7.25-1"
+  'stable': "{{ containerd_package }}=1.7.25-1"
+  'edge': "{{ containerd_package }}=1.7.25-1"
 
 # https://download.docker.com/linux/debian/
 docker_versioned_pkg:
@@ -38,9 +47,16 @@ docker_versioned_pkg:
   '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -51,9 +67,16 @@ docker_cli_versioned_pkg:
   '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
   '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
 
 docker_package_info:
   pkgs:

kubespray/project/roles/container-engine/docker/vars/fedora.yml

@@ -25,8 +25,17 @@ containerd_versioned_pkg:
   '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}"
   '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}"
   '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.fc{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"
 
 # https://docs.docker.com/install/linux/docker-ce/fedora/
 # https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/
@@ -37,9 +46,16 @@ docker_versioned_pkg:
   '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }}
   '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
   '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -48,9 +64,16 @@ docker_cli_versioned_pkg:
   '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }}
   '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
   '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.fc{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.fc{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }}
 
 docker_package_info:
   enablerepo: "docker-ce"

kubespray/project/roles/container-engine/docker/vars/redhat-7.yml

@@ -1,63 +0,0 @@
----
-# containerd versions are only relevant for docker
-containerd_versioned_pkg:
-  'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el7"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el7"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el7"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el7"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el7"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el7"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el7"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el7"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el7"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el7"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el7"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el7"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el7"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el7"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el7"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el7"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el7"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el7"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el7"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el7"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el7"
-  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el7"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el7"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.el7"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.el7"
-
-# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
-# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
-# or do 'yum --showduplicates list docker-engine'
-docker_versioned_pkg:
-  'latest': docker-ce
-  '18.09': docker-ce-18.09.9-3.el7
-  '19.03': docker-ce-19.03.15-3.el7
-  '20.10': docker-ce-20.10.20-3.el7
-  '23.0': docker-ce-23.0.6-1.el7
-  '24.0': docker-ce-24.0.9-1.el7
-  '26.0': docker-ce-26.0.2-1.el7
-  '26.1': docker-ce-26.1.2-1.el7
-  'stable': docker-ce-26.1.2-1.el7
-  'edge': docker-ce-26.1.2-1.el7
-
-docker_cli_versioned_pkg:
-  'latest': docker-ce-cli
-  '18.09': docker-ce-cli-18.09.9-3.el7
-  '19.03': docker-ce-cli-19.03.15-3.el7
-  '20.10': docker-ce-cli-20.10.20-3.el7
-  '23.0': docker-ce-cli-23.0.6-1.el7
-  '24.0': docker-ce-cli-24.0.9-1.el7
-  '26.0': docker-ce-cli-26.0.2-1.el7
-  '26.1': docker-ce-cli-26.1.2-1.el7
-  'stable': docker-ce-cli-26.1.2-1.el7
-  'edge': docker-ce-cli-26.1.2-1.el7
-
-docker_package_info:
-  enablerepo: "docker-ce"
-  pkgs:
-    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
-    - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
-    - "{{ docker_versioned_pkg[docker_version | string] }}"

kubespray/project/roles/container-engine/docker/vars/redhat.yml

@@ -25,11 +25,20 @@ containerd_versioned_pkg:
   '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
   '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}"
   '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.el{{ ansible_distribution_major_version }}"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"
 
-# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
+# https://docs.docker.com/engine/installation/linux/rhel/#install-from-a-package
-# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
+# https://download.docker.com/linux/rhel/<rhel_version>>/x86_64/stable/Packages/
 # or do 'yum --showduplicates list docker-engine'
 docker_versioned_pkg:
   'latest': docker-ce
@@ -39,9 +48,16 @@ docker_versioned_pkg:
   '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
   '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
   '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.3-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.3-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.3-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.3-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.3-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -51,9 +67,16 @@ docker_cli_versioned_pkg:
   '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
   '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
   '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }}
-  '26.1': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.el{{ ansible_distribution_major_version }}
-  'stable': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.el{{ ansible_distribution_major_version }}
-  'edge': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.3-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.3-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.3-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.3-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.3-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }}
 
 docker_package_info:
   enablerepo: "docker-ce"

kubespray/project/roles/container-engine/docker/vars/ubuntu.yml

@@ -2,13 +2,6 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
   'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}=1.3.7-1"
-  '1.3.9': "{{ containerd_package }}=1.3.9-1"
-  '1.4.3': "{{ containerd_package }}=1.4.3-2"
-  '1.4.4': "{{ containerd_package }}=1.4.4-1"
-  '1.4.6': "{{ containerd_package }}=1.4.6-1"
-  '1.4.9': "{{ containerd_package }}=1.4.9-1"
-  '1.4.12': "{{ containerd_package }}=1.4.12-1"
   '1.6.4': "{{ containerd_package }}=1.6.4-1"
   '1.6.6': "{{ containerd_package }}=1.6.6-1"
   '1.6.7': "{{ containerd_package }}=1.6.7-1"
@@ -25,8 +18,17 @@ containerd_versioned_pkg:
   '1.6.28': "{{ containerd_package }}=1.6.28-2"
   '1.6.31': "{{ containerd_package }}=1.6.31-1"
   '1.6.32': "{{ containerd_package }}=1.6.32-1"
-  'stable': "{{ containerd_package }}=1.6.32-1"
+  '1.6.33': "{{ containerd_package }}=1.6.33-1"
-  'edge': "{{ containerd_package }}=1.6.32-1"
+  '1.7.18': "{{ containerd_package }}=1.7.18-1"
+  '1.7.19': "{{ containerd_package }}=1.7.19-1"
+  '1.7.20': "{{ containerd_package }}=1.7.20-1"
+  '1.7.21': "{{ containerd_package }}=1.7.21-1"
+  '1.7.22': "{{ containerd_package }}=1.7.22-1"
+  '1.7.23': "{{ containerd_package }}=1.7.23-1"
+  '1.7.24': "{{ containerd_package }}=1.7.24-1"
+  '1.7.25': "{{ containerd_package }}=1.7.25-1"
+  'stable': "{{ containerd_package }}=1.7.25-1"
+  'edge': "{{ containerd_package }}=1.7.25-1"
 
 # https://download.docker.com/linux/ubuntu/
 docker_versioned_pkg:
@@ -37,9 +39,16 @@ docker_versioned_pkg:
   '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
   '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
   '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
@@ -49,9 +58,16 @@ docker_cli_versioned_pkg:
   '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
   '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
   '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  '26.1': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'stable': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
-  'edge': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
 
 docker_package_info:
   pkgs:

kubespray/project/roles/container-engine/gvisor/molecule/default/converge.yml

@@ -6,6 +6,6 @@
     gvisor_enabled: true
     container_manager: containerd
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: container-engine/containerd
     - role: container-engine/gvisor

kubespray/project/roles/container-engine/gvisor/molecule/default/molecule.yml

@@ -14,8 +14,8 @@ platforms:
       - kube_control_plane
     provider_options:
       driver: kvm
-  - name: almalinux8
+  - name: almalinux9
-    box: almalinux/8
+    box: almalinux/9
     cpus: 1
     memory: 1024
     nested: true

kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml

@@ -3,8 +3,8 @@
   hosts: all
   become: true
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
-    - role: bootstrap-os
+    - role: bootstrap_os
     - role: adduser
       user: "{{ addusers.kube }}"
   tasks:
@@ -20,7 +20,7 @@
     container_manager: containerd
     kube_network_plugin: cni
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: network_plugin/cni
     - role: container-engine/crictl
   tasks:

kubespray/project/roles/container-engine/kata-containers/OWNERS

@@ -1,6 +0,0 @@
-# See the OWNERS docs at https://go.k8s.io/owners
-
-approvers:
-  - pasqualet
-reviewers:
-  - pasqualet

kubespray/project/roles/container-engine/kata-containers/molecule/default/converge.yml

@@ -6,6 +6,6 @@
     kata_containers_enabled: true
     container_manager: containerd
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: container-engine/containerd
     - role: container-engine/kata-containers

kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml

@@ -3,8 +3,8 @@
   hosts: all
   become: true
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
-    - role: bootstrap-os
+    - role: bootstrap_os
     - role: adduser
       user: "{{ addusers.kube }}"
   tasks:
@@ -20,7 +20,7 @@
     container_manager: containerd
     kube_network_plugin: cni
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: network_plugin/cni
     - role: container-engine/crictl
   tasks:

kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml

@@ -84,7 +84,7 @@
   block:
     - name: Drain node
       include_role:
-        name: remove-node/pre-remove
+        name: remove_node/pre_remove
         apply:
           tags:
             - pre-remove
@@ -111,7 +111,7 @@
   block:
     - name: Drain node
       include_role:
-        name: remove-node/pre-remove
+        name: remove_node/pre_remove
         apply:
           tags:
             - pre-remove
@@ -137,7 +137,7 @@
   block:
     - name: Drain node
       include_role:
-        name: remove-node/pre-remove
+        name: remove_node/pre_remove
         apply:
           tags:
             - pre-remove

kubespray/project/roles/container-engine/youki/molecule/default/converge.yml

@@ -6,6 +6,6 @@
     youki_enabled: true
     container_manager: crio
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: container-engine/cri-o
     - role: container-engine/youki

kubespray/project/roles/container-engine/youki/molecule/default/molecule.yml

@@ -14,8 +14,8 @@ platforms:
       - kube_control_plane
     provider_options:
       driver: kvm
-  - name: almalinux8
+  - name: almalinux9
-    box: almalinux/8
+    box: almalinux/9
     cpus: 1
     memory: 1024
     nested: true

kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml

@@ -3,8 +3,8 @@
   hosts: all
   become: true
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
-    - role: bootstrap-os
+    - role: bootstrap_os
     - role: adduser
       user: "{{ addusers.kube }}"
   tasks:
@@ -20,7 +20,7 @@
     container_manager: crio
     kube_network_plugin: cni
   roles:
-    - role: kubespray-defaults
+    - role: kubespray_defaults
     - role: network_plugin/cni
     - role: container-engine/crictl
   tasks:

kubespray/project/roles/container-engine/youki/tasks/main.yml

@@ -6,7 +6,7 @@
 
 - name: Youki | Copy youki binary from download dir
   copy:
-    src: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux/youki-{{ youki_version }}/youki"
+    src: "{{ local_release_dir }}/youki"
     dest: "{{ youki_bin_dir }}/youki"
     mode: "0755"
     remote_src: true

kubespray/project/roles/download/tasks/download_file.yml

@@ -7,7 +7,8 @@
     set_fact:
       download_force_cache: "{{ true if download_run_once else download_force_cache }}"
 
-  - name: Download_file | Show url of file to dowload
+  - name: Download_file | Show url of file to download
+    when: unsafe_show_logs | bool
     debug:
       msg: "{{ download.url }}"
     run_once: "{{ download_run_once }}"
@@ -61,7 +62,7 @@
       dest: "{{ file_path_cached if download_force_cache else download.dest }}"
       owner: "{{ omit if download_localhost else (download.owner | default(omit)) }}"
       mode: "{{ omit if download_localhost else (download.mode | default(omit)) }}"
-      checksum: "{{ 'sha256:' + download.sha256 if download.sha256 else omit }}"
+      checksum: "{{ download.checksum }}"
       validate_certs: "{{ download_validate_certs }}"
       url_username: "{{ download.username | default(omit) }}"
       url_password: "{{ download.password | default(omit) }}"

kubespray/project/roles/download/tasks/extract_file.yml

@@ -5,7 +5,7 @@
     dest: "{{ download.dest | dirname }}"
     owner: "{{ download.owner | default(omit) }}"
     mode: "{{ download.mode | default(omit) }}"
-    copy: false
+    remote_src: true
     extra_opts: "{{ download.unarchive_extra_opts | default(omit) }}"
   when:
     - download.unarchive | default(false)

kubespray/project/roles/download/tasks/main.yml

@@ -11,7 +11,7 @@
   include_tasks: prep_kubeadm_images.yml
   when:
     - not skip_downloads | default(false)
-    - inventory_hostname in groups['kube_control_plane']
+    - ('kube_control_plane' in group_names)
   tags:
     - download
     - upload