kubelet: conditionalize staticPodPath location (#12433)

Add variable to set kubelet staticPodPath location.
It can be set to empty so that we can choose to disable it for some nodes.
STIG recommendation is to disable it.

Signed-off-by: Shaleen Bathla <shaleenbathla@gmail.com>
Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

roles/kubernetes/node/defaults/main.yml

@@ -188,6 +188,8 @@ conntrack_modules:
   - nf_conntrack
   - nf_conntrack_ipv4
 
+# Set this option to "" (empty) to disable staticPodPath (See docs/operations/hardening.md)
+kubelet_static_pod_path: "{{ kube_manifest_dir }}"
 
 ## Enable distributed tracing for kubelet
 kubelet_tracing: false

roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2

@@ -22,7 +22,7 @@ enforceNodeAllocatable:
 - {{ item }}
 {% endfor %}
 {% endif %}
-staticPodPath: {{ kube_manifest_dir }}
+staticPodPath: "{{ kubelet_static_pod_path }}"
 cgroupDriver: {{ kubelet_cgroup_driver | default('systemd') }}
 containerLogMaxFiles: {{ kubelet_logfiles_max_nr }}
 containerLogMaxSize: {{ kubelet_logfiles_max_size }}