Upgrade ansible (#10190)

* project: update all dependencies including ansible Upgrade to ansible 7.x and ansible-core 2.14.x. There seems to be issue with ansible 8/ansible-core 2.15 so we remain on those versions for now. It's quite a big bump already anyway. Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * tests: install aws galaxy collection Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * ansible-lint: disable various rules after ansible upgrade Temporarily disable a bunch of linting action following ansible upgrade. Those should be taken care of separately. Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve deprecated-module ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve no-free-form ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve schema[meta] ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve schema[playbook] ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve schema[tasks] ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve risky-file-permissions ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve risky-shell-pipe ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: remove deprecated warn args Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: use fqcn for non builtin tasks Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve syntax-check[missing-file] for contrib playbook Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: use arithmetic inside jinja to fix ansible 6 upgrade Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> --------- Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>
2026-02-25 23:16:05 -03:30 · 2023-06-26 12:15:45 +02:00
parent 3311e0a296
commit 25cb90bc2d
81 changed files with 345 additions and 207 deletions
--- a/roles/bootstrap-os/tasks/bootstrap-centos.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-centos.yml
@@ -5,7 +5,7 @@
    filter: ansible_distribution_*version

 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
-  ini_file:
+  community.general.ini_file:
    path: "{{ ( (ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf','/etc/dnf/dnf.conf') }}"
    section: main
    option: proxy
@@ -21,6 +21,7 @@
  get_url:
    url: https://yum.oracle.com/public-yum-ol7.repo
    dest: /etc/yum.repos.d/public-yum-ol7.repo
+    mode: 0644
  when:
    - use_oracle_public_repo|default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
@@ -28,7 +29,7 @@
  environment: "{{ proxy_env }}"

 - name: Enable Oracle Linux repo
-  ini_file:
+  community.general.ini_file:
    dest: /etc/yum.repos.d/public-yum-ol7.repo
    section: "{{ item }}"
    option: enabled
@@ -53,7 +54,7 @@
    - (ansible_distribution_version | float) >= 7.6

 - name: Enable Oracle Linux repo
-  ini_file:
+  community.general.ini_file:
    dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_distribution_major_version }}.repo"
    section: "ol{{ ansible_distribution_major_version }}_addons"
    option: "{{ item.option }}"
@@ -69,7 +70,7 @@
    - (ansible_distribution_version | float) >= 7.6

 - name: Enable Centos extra repo for Oracle Linux
-  ini_file:
+  community.general.ini_file:
    dest: "/etc/yum.repos.d/centos-extras.repo"
    section: "extras"
    option: "{{ item.option }}"
--- a/roles/bootstrap-os/tasks/bootstrap-fedora.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-fedora.yml
@@ -10,7 +10,7 @@
    - facts

 - name: Add proxy to dnf.conf if http_proxy is defined
-  ini_file:
+  community.general.ini_file:
    path: "/etc/dnf/dnf.conf"
    section: main
    option: proxy
--- a/roles/bootstrap-os/tasks/bootstrap-opensuse.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-opensuse.yml
@@ -58,7 +58,7 @@

 # Without this package, the get_url module fails when trying to handle https
 - name: Install python-cryptography
-  zypper:
+  community.general.zypper:
    name: python-cryptography
    state: present
    update_cache: true
@@ -67,7 +67,7 @@
    - ansible_distribution_version is version('15.4', '<')

 - name: Install python3-cryptography
-  zypper:
+  community.general.zypper:
    name: python3-cryptography
    state: present
    update_cache: true
@@ -77,7 +77,7 @@

 # Nerdctl needs some basic packages to get an environment up
 - name: Install basic dependencies
-  zypper:
+  community.general.zypper:
    name:
      - iptables
      - apparmor-parser
--- a/roles/bootstrap-os/tasks/bootstrap-redhat.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-redhat.yml
@@ -5,7 +5,7 @@
    filter: ansible_distribution_*version

 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
-  ini_file:
+  community.general.ini_file:
    path: "{{ ( (ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf','/etc/dnf/dnf.conf') }}"
    section: main
    option: proxy
@@ -31,7 +31,7 @@
  become: true

 - name: RHEL subscription Organization ID/Activation Key registration
-  redhat_subscription:
+  community.general.redhat_subscription:
    state: present
    org_id: "{{ rh_subscription_org_id }}"
    activationkey: "{{ rh_subscription_activation_key }}"
@@ -50,7 +50,7 @@

 # this task has no_log set to prevent logging security sensitive information such as subscription passwords
 - name: RHEL subscription Username/Password registration
-  redhat_subscription:
+  community.general.redhat_subscription:
    state: present
    username: "{{ rh_subscription_username }}"
    password: "{{ rh_subscription_password }}"
@@ -70,7 +70,7 @@

 # container-selinux is in extras repo
 - name: Enable RHEL 7 repos
-  rhsm_repository:
+  community.general.rhsm_repository:
    name:
      - "rhel-7-server-rpms"
      - "rhel-7-server-extras-rpms"
@@ -81,7 +81,7 @@

 # container-selinux is in appstream repo
 - name: Enable RHEL 8 repos
-  rhsm_repository:
+  community.general.rhsm_repository:
    name:
      - "rhel-8-for-*-baseos-rpms"
      - "rhel-8-for-*-appstream-rpms"
--- a/roles/container-engine/cri-o/tasks/cleanup.yaml
+++ b/roles/container-engine/cri-o/tasks/cleanup.yaml
@@ -83,7 +83,7 @@
  when: ansible_distribution in ["Amazon"]

 - name: Disable modular repos for CRI-O
-  ini_file:
+  community.general.ini_file:
    path: "/etc/yum.repos.d/{{ item.repo }}.repo"
    section: "{{ item.section }}"
    option: enabled
--- a/roles/container-engine/cri-o/tasks/main.yaml
+++ b/roles/container-engine/cri-o/tasks/main.yaml
@@ -122,7 +122,7 @@
    mode: 0755

 - name: cri-o | set overlay driver
-  ini_file:
+  community.general.ini_file:
    dest: /etc/containers/storage.conf
    section: storage
    option: "{{ item.option }}"
@@ -136,7 +136,7 @@

 # metacopy=on is available since 4.19 and was backported to RHEL 4.18 kernel
 - name: cri-o | set metacopy mount options correctly
-  ini_file:
+  community.general.ini_file:
    dest: /etc/containers/storage.conf
    section: storage.options.overlay
    option: mountopt
--- a/roles/container-engine/cri-o/tasks/reset.yml
+++ b/roles/container-engine/cri-o/tasks/reset.yml
@@ -43,8 +43,6 @@

 - name: CRI-O | Run yum-clean-metadata
  command: yum clean metadata
-  args:
-    warn: no
  when:
    - ansible_os_family == "RedHat"
  tags:
--- a/roles/container-engine/cri-o/tasks/setup-amazon.yaml
+++ b/roles/container-engine/cri-o/tasks/setup-amazon.yaml
@@ -14,7 +14,7 @@
    - amzn2_extras_file_stat.stat.exists

 - name: Remove docker repository
-  ini_file:
+  community.general.ini_file:
    dest: /etc/yum.repos.d/amzn2-extras.repo
    section: amzn2extra-docker
    option: enabled
--- a/roles/container-engine/kata-containers/tasks/main.yml
+++ b/roles/container-engine/kata-containers/tasks/main.yml
@@ -36,7 +36,7 @@
    - qemu

 - name: kata-containers | Load vhost kernel modules
-  modprobe:
+  community.general.modprobe:
    state: present
    name: "{{ item }}"
  with_items:
--- a/roles/download/tasks/download_container.yml
+++ b/roles/download/tasks/download_container.yml
@@ -80,7 +80,7 @@
        - download_run_once

    - name: download_container | Copy image to ansible host cache
-      synchronize:
+      ansible.posix.synchronize:
        src: "{{ image_path_final }}"
        dest: "{{ image_path_cached }}"
        use_ssh_args: true
@@ -92,7 +92,7 @@
        - download_delegate == inventory_hostname

    - name: download_container | Upload image to node if it is cached
-      synchronize:
+      ansible.posix.synchronize:
        src: "{{ image_path_cached }}"
        dest: "{{ image_path_final }}"
        use_ssh_args: true
--- a/roles/download/tasks/download_file.yml
+++ b/roles/download/tasks/download_file.yml
@@ -105,7 +105,7 @@
    no_log: "{{ not (unsafe_show_logs|bool) }}"

  - name: download_file | Copy file back to ansible host file cache
-    synchronize:
+    ansible.posix.synchronize:
      src: "{{ file_path_cached }}"
      dest: "{{ file_path_cached }}"
      use_ssh_args: true
@@ -116,7 +116,7 @@
    - download_delegate == inventory_hostname

  - name: download_file | Copy file from cache to nodes, if it is available
-    synchronize:
+    ansible.posix.synchronize:
      src: "{{ file_path_cached }}"
      dest: "{{ download.dest }}"
      use_ssh_args: true
--- a/roles/etcd/handlers/backup.yml
+++ b/roles/etcd/handlers/backup.yml
@@ -11,7 +11,8 @@
  when: etcd_cluster_is_healthy.rc == 0

 - name: Refresh Time Fact
-  setup: filter=ansible_date_time
+  setup:
+    filter: ansible_date_time

 - name: Set Backup Directory
  set_fact:
@@ -40,7 +41,7 @@
      --data-dir {{ etcd_data_dir }}
      --backup-dir {{ etcd_backup_directory }}
  environment:
-    ETCDCTL_API: 2
+    ETCDCTL_API: "2"
  retries: 3
  register: backup_v2_command
  until: backup_v2_command.rc == 0
@@ -51,7 +52,7 @@
    {{ bin_dir }}/etcdctl
      snapshot save {{ etcd_backup_directory }}/snapshot.db
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses.split(',') | first }}"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
--- a/roles/etcd/handlers/backup_cleanup.yml
+++ b/roles/etcd/handlers/backup_cleanup.yml
@@ -7,5 +7,6 @@
 - name: Remove old etcd backups
  shell:
    chdir: "{{ etcd_backup_prefix }}"
-    cmd: "find . -name 'etcd-*' -type d | sort -n | head -n -{{ etcd_backup_retention_count }} | xargs rm -rf"
+    cmd: "set -o pipefail && find . -name 'etcd-*' -type d | sort -n | head -n -{{ etcd_backup_retention_count }} | xargs rm -rf"
+    executable: /bin/bash
  when: etcd_backup_retention_count >= 0
--- a/roles/etcd/tasks/configure.yml
+++ b/roles/etcd/tasks/configure.yml
@@ -8,11 +8,13 @@
  changed_when: false
  check_mode: no
  run_once: yes
-  when: is_etcd_master and etcd_cluster_setup
+  when:
+    - is_etcd_master
+    - etcd_cluster_setup
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
@@ -27,11 +29,13 @@
  changed_when: false
  check_mode: no
  run_once: yes
-  when: is_etcd_master and etcd_events_cluster_setup
+  when:
+    - is_etcd_master
+    - etcd_events_cluster_setup
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
@@ -96,7 +100,7 @@
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
@@ -119,7 +123,7 @@
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
@@ -135,7 +139,7 @@
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
@@ -151,7 +155,7 @@
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
--- a/roles/etcd/tasks/gen_certs_script.yml
+++ b/roles/etcd/tasks/gen_certs_script.yml
@@ -41,16 +41,18 @@
 - name: Gen_certs | run cert generation script for etcd and kube control plane nodes
  command: "bash -x {{ etcd_script_dir }}/make-ssl-etcd.sh -f {{ etcd_config_dir }}/openssl.conf -d {{ etcd_cert_dir }}"
  environment:
-    - MASTERS: "{% for m in groups['etcd'] %}
-                  {% if gen_master_certs[m] %}
-                    {{ m }}
-                  {% endif %}
-                {% endfor %}"
-    - HOSTS: "{% for h in groups['kube_control_plane'] %}
-                {% if gen_node_certs[h] %}
-                    {{ h }}
-                {% endif %}
-              {% endfor %}"
+    MASTERS: |-
+      {% for m in groups['etcd'] %}
+        {% if gen_master_certs[m] %}
+          {{ m }}
+        {% endif %}
+      {% endfor %}
+    HOSTS: |-
+      {% for h in groups['kube_control_plane'] %}
+        {% if gen_node_certs[h] %}
+          {{ h }}
+        {% endif %}
+      {% endfor %}
  run_once: yes
  delegate_to: "{{ groups['etcd'][0] }}"
  when: gen_certs|default(false)
@@ -59,11 +61,12 @@
 - name: Gen_certs | run cert generation script for all clients
  command: "bash -x {{ etcd_script_dir }}/make-ssl-etcd.sh -f {{ etcd_config_dir }}/openssl.conf -d {{ etcd_cert_dir }}"
  environment:
-    - HOSTS: "{% for h in groups['k8s_cluster'] %}
-                {% if gen_node_certs[h] %}
-                    {{ h }}
-                {% endif %}
-              {% endfor %}"
+    HOSTS: |-
+      {% for h in groups['k8s_cluster'] %}
+        {% if gen_node_certs[h] %}
+          {{ h }}
+        {% endif %}
+      {% endfor %}
  run_once: yes
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
--- a/roles/etcd/tasks/gen_nodes_certs_script.yml
+++ b/roles/etcd/tasks/gen_nodes_certs_script.yml
@@ -17,7 +17,6 @@
  shell: "set -o pipefail && tar cfz - -C {{ etcd_cert_dir }} {{ my_etcd_node_certs|join(' ') }} | base64 --wrap=0"
  args:
    executable: /bin/bash
-    warn: false
  no_log: "{{ not (unsafe_show_logs|bool) }}"
  register: etcd_node_certs
  check_mode: no
--- a/roles/etcd/tasks/join_etcd-events_member.yml
+++ b/roles/etcd/tasks/join_etcd-events_member.yml
@@ -1,12 +1,12 @@
 ---
 - name: Join Member | Add member to etcd-events cluster  # noqa 301 305
-  shell: "{{ bin_dir }}/etcdctl member add {{ etcd_member_name }} --peer-urls={{ etcd_events_peer_url }}"
+  command: "{{ bin_dir }}/etcdctl member add {{ etcd_member_name }} --peer-urls={{ etcd_events_peer_url }}"
  register: member_add_result
  until: member_add_result.rc == 0
  retries: "{{ etcd_retries }}"
  delay: "{{ retry_stagger | random + 3 }}"
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
@@ -34,7 +34,7 @@
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
--- a/roles/etcd/tasks/join_etcd_member.yml
+++ b/roles/etcd/tasks/join_etcd_member.yml
@@ -1,13 +1,13 @@
 ---
 - name: Join Member | Add member to etcd cluster  # noqa 301 305
-  shell: "{{ bin_dir }}/etcdctl member add {{ etcd_member_name }} --peer-urls={{ etcd_peer_url }}"
+  command: "{{ bin_dir }}/etcdctl member add {{ etcd_member_name }} --peer-urls={{ etcd_peer_url }}"
  register: member_add_result
  until: member_add_result.rc == 0 or 'Peer URLs already exists' in member_add_result.stderr
  failed_when: member_add_result.rc != 0 and 'Peer URLs already exists' not in member_add_result.stderr
  retries: "{{ etcd_retries }}"
  delay: "{{ retry_stagger | random + 3 }}"
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
@@ -38,7 +38,7 @@
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
--- a/roles/kubernetes-apps/argocd/tasks/main.yml
+++ b/roles/kubernetes-apps/argocd/tasks/main.yml
@@ -5,7 +5,7 @@
    download: "{{ download_defaults | combine(downloads.yq) }}"

 - name: Kubernetes Apps | Copy yq binary from download dir
-  synchronize:
+  ansible.posix.synchronize:
    src: "{{ downloads.yq.dest }}"
    dest: "{{ bin_dir }}/yq"
    compress: no
@@ -46,7 +46,7 @@
    - "inventory_hostname == groups['kube_control_plane'][0]"

 - name: Kubernetes Apps | Copy ArgoCD remote manifests from download dir
-  synchronize:
+  ansible.posix.synchronize:
    src: "{{ local_release_dir }}/{{ item.file }}"
    dest: "{{ kube_config_dir }}/{{ item.file }}"
    compress: no
--- a/roles/kubernetes-apps/cloud_controller/oci/tasks/main.yml
+++ b/roles/kubernetes-apps/cloud_controller/oci/tasks/main.yml
@@ -1,6 +1,6 @@
 ---

- include: credentials-check.yml
+- import_tasks: credentials-check.yml

 - name: "OCI Cloud Controller | Generate Cloud Provider Configuration"
  template:
--- a/roles/kubernetes-apps/cluster_roles/tasks/main.yml
+++ b/roles/kubernetes-apps/cluster_roles/tasks/main.yml
@@ -66,7 +66,10 @@
    - cloud_provider == 'oci'

 - name: PriorityClass | Copy k8s-cluster-critical-pc.yml file
-  copy: src=k8s-cluster-critical-pc.yml dest={{ kube_config_dir }}/k8s-cluster-critical-pc.yml mode=0640
+  copy:
+    src: k8s-cluster-critical-pc.yml
+    dest: "{{ kube_config_dir }}/k8s-cluster-critical-pc.yml"
+    mode: 0640
  when: inventory_hostname == groups['kube_control_plane']|last

 - name: PriorityClass | Create k8s-cluster-critical
--- a/roles/kubernetes/control-plane/handlers/main.yml
+++ b/roles/kubernetes/control-plane/handlers/main.yml
@@ -44,7 +44,9 @@
    state: restarted

 - name: Master | Remove apiserver container docker
-  shell: docker ps -af name=k8s_kube-apiserver* -q | xargs --no-run-if-empty docker rm -f
+  shell: "set -o pipefail && docker ps -af name=k8s_kube-apiserver* -q | xargs --no-run-if-empty docker rm -f"
+  args:
+    executable: /bin/bash
  register: remove_apiserver_container
  retries: 10
  until: remove_apiserver_container.rc == 0
@@ -52,7 +54,9 @@
  when: container_manager == "docker"

 - name: Master | Remove apiserver container containerd/crio
-  shell: "{{ bin_dir }}/crictl pods --name kube-apiserver* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-apiserver* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  args:
+    executable: /bin/bash
  register: remove_apiserver_container
  retries: 10
  until: remove_apiserver_container.rc == 0
@@ -60,7 +64,9 @@
  when: container_manager in ['containerd', 'crio']

 - name: Master | Remove scheduler container docker
-  shell: "{{ docker_bin_dir }}/docker ps -af name=k8s_kube-scheduler* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -af name=k8s_kube-scheduler* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  args:
+    executable: /bin/bash
  register: remove_scheduler_container
  retries: 10
  until: remove_scheduler_container.rc == 0
@@ -68,7 +74,9 @@
  when: container_manager == "docker"

 - name: Master | Remove scheduler container containerd/crio
-  shell: "{{ bin_dir }}/crictl pods --name kube-scheduler* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-scheduler* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  args:
+    executable: /bin/bash
  register: remove_scheduler_container
  retries: 10
  until: remove_scheduler_container.rc == 0
@@ -76,7 +84,9 @@
  when: container_manager in ['containerd', 'crio']

 - name: Master | Remove controller manager container docker
-  shell: "{{ docker_bin_dir }}/docker ps -af name=k8s_kube-controller-manager* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -af name=k8s_kube-controller-manager* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  args:
+    executable: /bin/bash
  register: remove_cm_container
  retries: 10
  until: remove_cm_container.rc == 0
@@ -84,7 +94,9 @@
  when: container_manager == "docker"

 - name: Master | Remove controller manager container containerd/crio
-  shell: "{{ bin_dir }}/crictl pods --name kube-controller-manager* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-controller-manager* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  args:
+    executable: /bin/bash
  register: remove_cm_container
  retries: 10
  until: remove_cm_container.rc == 0
--- a/roles/kubernetes/node/tasks/facts.yml
+++ b/roles/kubernetes/node/tasks/facts.yml
@@ -1,7 +1,9 @@
 ---
 - block:
  - name: look up docker cgroup driver
-    shell: "docker info | grep 'Cgroup Driver' | awk -F': ' '{ print $2; }'"
+    shell: "set -o pipefail && docker info | grep 'Cgroup Driver' | awk -F': ' '{ print $2; }'"
+    args:
+      executable: /bin/bash
    register: docker_cgroup_driver_result
    changed_when: false
    check_mode: no
@@ -13,7 +15,9 @@

 - block:
  - name: look up crio cgroup driver
-    shell: "{{ bin_dir }}/crio-status info | grep 'cgroup driver' | awk -F': ' '{ print $2; }'"
+    shell: "set -o pipefail && {{ bin_dir }}/crio-status info | grep 'cgroup driver' | awk -F': ' '{ print $2; }'"
+    args:
+      executable: /bin/bash
    register: crio_cgroup_driver_result
    changed_when: false

@@ -40,7 +44,6 @@
  when: kubelet_cgroup_driver == 'cgroupfs'

 - name: set kubelet_config_extra_args options when cgroupfs is used
-  vars:
  set_fact:
    kubelet_config_extra_args: "{{ kubelet_config_extra_args | combine(kubelet_config_extra_args_cgroupfs) }}"
  when: kubelet_cgroup_driver == 'cgroupfs'
--- a/roles/kubernetes/node/tasks/main.yml
+++ b/roles/kubernetes/node/tasks/main.yml
@@ -41,7 +41,7 @@
    - haproxy

 - name: Ensure nodePort range is reserved
-  sysctl:
+  ansible.posix.sysctl:
    name: net.ipv4.ip_local_reserved_ports
    value: "{{ kube_apiserver_node_port_range }}"
    sysctl_set: yes
@@ -68,7 +68,7 @@
    mode: 0755

 - name: Enable br_netfilter module
-  modprobe:
+  community.general.modprobe:
    name: br_netfilter
    state: present
  when: modinfo_br_netfilter.rc == 0
@@ -89,7 +89,7 @@
  register: sysctl_bridge_nf_call_iptables

 - name: Enable bridge-nf-call tables
-  sysctl:
+  ansible.posix.sysctl:
    name: "{{ item }}"
    state: present
    sysctl_file: "{{ sysctl_file_path }}"
@@ -102,7 +102,7 @@
    - net.bridge.bridge-nf-call-ip6tables

 - name: Modprobe Kernel Module for IPVS
-  modprobe:
+  community.general.modprobe:
    name: "{{ item }}"
    state: present
  with_items:
@@ -115,7 +115,7 @@
    - kube-proxy

 - name: Modprobe nf_conntrack_ipv4
-  modprobe:
+  community.general.modprobe:
    name: nf_conntrack_ipv4
    state: present
  register: modprobe_nf_conntrack_ipv4
--- a/roles/kubernetes/preinstall/handlers/main.yml
+++ b/roles/kubernetes/preinstall/handlers/main.yml
@@ -68,7 +68,9 @@
  when: inventory_hostname in groups['kube_control_plane'] and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'

 - name: Preinstall | restart kube-controller-manager docker
-  shell: "{{ docker_bin_dir }}/docker ps -f name=k8s_POD_kube-controller-manager* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -f name=k8s_POD_kube-controller-manager* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  args:
+    executable: /bin/bash
  when:
    - container_manager == "docker"
    - inventory_hostname in groups['kube_control_plane']
@@ -77,7 +79,9 @@
    - kube_controller_set.stat.exists

 - name: Preinstall | restart kube-controller-manager crio/containerd
-  shell: "{{ bin_dir }}/crictl pods --name kube-controller-manager* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-controller-manager* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  args:
+    executable: /bin/bash
  register: preinstall_restart_controller_manager
  retries: 10
  delay: 1
@@ -90,7 +94,9 @@
    - kube_controller_set.stat.exists

 - name: Preinstall | restart kube-apiserver docker
-  shell: "{{ docker_bin_dir }}/docker ps -f name=k8s_POD_kube-apiserver* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -f name=k8s_POD_kube-apiserver* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  args:
+    executable: /bin/bash
  when:
    - container_manager == "docker"
    - inventory_hostname in groups['kube_control_plane']
@@ -99,7 +105,9 @@
    - kube_apiserver_set.stat.exists

 - name: Preinstall | restart kube-apiserver crio/containerd
-  shell: "{{ bin_dir }}/crictl pods --name kube-apiserver* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-apiserver* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'"
+  args:
+    executable: /bin/bash
  register: preinstall_restart_apiserver
  retries: 10
  until: preinstall_restart_apiserver.rc == 0
--- a/roles/kubernetes/preinstall/tasks/0010-swapoff.yml
+++ b/roles/kubernetes/preinstall/tasks/0010-swapoff.yml
@@ -1,6 +1,6 @@
 ---
 - name: Remove swapfile from /etc/fstab
-  mount:
+  ansible.posix.mount:
    name: "{{ item }}"
    fstype: swap
    state: absent
--- a/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml
+++ b/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml
@@ -1,6 +1,6 @@
 ---
 - name: NetworkManager | Add nameservers to NM configuration
-  ini_file:
+  community.general.ini_file:
    path: /etc/NetworkManager/conf.d/dns.conf
    section: global-dns-domain-*
    option: servers
@@ -15,7 +15,7 @@
  when: not remove_default_searchdomains|default()|bool or (remove_default_searchdomains|default()|bool and searchdomains|default([])|length==0)

 - name: NetworkManager | Add DNS search to NM configuration
-  ini_file:
+  community.general.ini_file:
    path: /etc/NetworkManager/conf.d/dns.conf
    section: global-dns
    option: searches
@@ -25,7 +25,7 @@
  notify: Preinstall | update resolvconf for networkmanager

 - name: NetworkManager | Add DNS options to NM configuration
-  ini_file:
+  community.general.ini_file:
    path: /etc/NetworkManager/conf.d/dns.conf
    section: global-dns
    option: options
--- a/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml
+++ b/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml
@@ -12,7 +12,7 @@
  register: slc

 - name: Set selinux policy
-  selinux:
+  ansible.posix.selinux:
    policy: targeted
    state: "{{ preinstall_selinux_state }}"
  when:
@@ -71,7 +71,7 @@
    mode: 0755

 - name: Enable ip forwarding
-  sysctl:
+  ansible.posix.sysctl:
    sysctl_file: "{{ sysctl_file_path }}"
    name: net.ipv4.ip_forward
    value: "1"
@@ -79,7 +79,7 @@
    reload: yes

 - name: Enable ipv6 forwarding
-  sysctl:
+  ansible.posix.sysctl:
    sysctl_file: "{{ sysctl_file_path }}"
    name: net.ipv6.conf.all.forwarding
    value: "1"
@@ -97,7 +97,7 @@
  ignore_errors: true  # noqa ignore-errors

 - name: Set fs.may_detach_mounts if needed
-  sysctl:
+  ansible.posix.sysctl:
    sysctl_file: "{{ sysctl_file_path }}"
    name: fs.may_detach_mounts
    value: 1
@@ -106,7 +106,7 @@
  when: fs_may_detach_mounts.stat.exists | d(false)

 - name: Ensure kube-bench parameters are set
-  sysctl:
+  ansible.posix.sysctl:
    sysctl_file: "{{ sysctl_file_path }}"
    name: "{{ item.name }}"
    value: "{{ item.value }}"
@@ -122,14 +122,14 @@
  when: kubelet_protect_kernel_defaults|bool

 - name: Check dummy module
-  modprobe:
+  community.general.modprobe:
    name: dummy
    state: present
    params: 'numdummies=0'
  when: enable_nodelocaldns

 - name: Set additional sysctl variables
-  sysctl:
+  ansible.posix.sysctl:
    sysctl_file: "{{ sysctl_file_path }}"
    name: "{{ item.name }}"
    value: "{{ item.value }}"
--- a/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
+++ b/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
@@ -78,7 +78,7 @@
    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Set timezone
-  timezone:
+  community.general.timezone:
    name: "{{ ntp_timezone }}"
  when:
    - ntp_timezone
--- a/roles/kubernetes/tokens/tasks/gen_tokens.yml
+++ b/roles/kubernetes/tokens/tasks/gen_tokens.yml
@@ -45,7 +45,6 @@
 - name: Gen_tokens | Gather tokens
  shell: "set -o pipefail && tar cfz - {{ tokens_list.stdout_lines | join(' ') }} | base64 --wrap=0"
  args:
-    warn: false
    executable: /bin/bash
  register: tokens_data
  check_mode: no
--- a/roles/kubespray-defaults/defaults/main.yaml
+++ b/roles/kubespray-defaults/defaults/main.yaml
@@ -33,13 +33,13 @@ kubeadm_init_timeout: 300s
 kubeadm_init_phases_skip_default: [ "addon/coredns" ]
 kubeadm_init_phases_skip: >-
  {%- if kube_network_plugin == 'kube-router' and (kube_router_run_service_proxy is defined and kube_router_run_service_proxy) -%}
-  {{ kubeadm_init_phases_skip_default }} + [ "addon/kube-proxy" ]
+  {{ kubeadm_init_phases_skip_default + [ "addon/kube-proxy" ] }}
  {%- elif kube_network_plugin == 'cilium' and (cilium_kube_proxy_replacement is defined and cilium_kube_proxy_replacement == 'strict') -%}
-  {{ kubeadm_init_phases_skip_default }} + [ "addon/kube-proxy" ]
+  {{ kubeadm_init_phases_skip_default + [ "addon/kube-proxy" ] }}
  {%- elif kube_network_plugin == 'calico' and (calico_bpf_enabled is defined and calico_bpf_enabled) -%}
-  {{ kubeadm_init_phases_skip_default }} + [ "addon/kube-proxy" ]
+  {{ kubeadm_init_phases_skip_default + [ "addon/kube-proxy" ] }}
  {%- elif kube_proxy_remove is defined and kube_proxy_remove -%}
-  {{ kubeadm_init_phases_skip_default }} + [ "addon/kube-proxy" ]
+  {{ kubeadm_init_phases_skip_default + [ "addon/kube-proxy" ] }}
  {%- else -%}
  {{ kubeadm_init_phases_skip_default }}
  {%- endif -%}
--- a/roles/network_plugin/calico/handlers/main.yml
+++ b/roles/network_plugin/calico/handlers/main.yml
@@ -13,14 +13,18 @@
    state: absent

 - name: Calico | delete calico-node docker containers
-  shell: "{{ docker_bin_dir }}/docker ps -af name=k8s_POD_calico-node* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -af name=k8s_POD_calico-node* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f"
+  args:
+    executable: /bin/bash
  register: docker_calico_node_remove
  until: docker_calico_node_remove is succeeded
  retries: 5
  when: container_manager in ["docker"]

 - name: Calico | delete calico-node crio/containerd containers
-  shell: '{{ bin_dir }}/crictl pods --name calico-node-* -q | xargs -I% --no-run-if-empty bash -c "{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %"'
+  shell: 'set -o pipefail && {{ bin_dir }}/crictl pods --name calico-node-* -q | xargs -I% --no-run-if-empty bash -c "{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %"'
+  args:
+    executable: /bin/bash
  register: crictl_calico_node_remove
  until: crictl_calico_node_remove is succeeded
  retries: 5
--- a/roles/network_plugin/cilium/tasks/install.yml
+++ b/roles/network_plugin/cilium/tasks/install.yml
@@ -1,6 +1,6 @@
 ---
 - name: Cilium | Ensure BPFFS mounted
-  mount:
+  ansible.posix.mount:
    fstype: bpf
    path: /sys/fs/bpf
    src: bpffs
--- a/roles/network_plugin/kube-router/handlers/main.yml
+++ b/roles/network_plugin/kube-router/handlers/main.yml
@@ -6,14 +6,18 @@
    - Kube-router | delete kube-router crio/containerd containers

 - name: Kube-router | delete kube-router docker containers
-  shell: "{{ docker_bin_dir }}/docker ps -af name=k8s_POD_kube-router* -q | xargs --no-run-if-empty docker rm -f"
+  shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -af name=k8s_POD_kube-router* -q | xargs --no-run-if-empty docker rm -f"
+  args:
+    executable: /bin/bash
  register: docker_kube_router_remove
  until: docker_kube_router_remove is succeeded
  retries: 5
  when: container_manager in ["docker"]

 - name: Kube-router | delete kube-router crio/containerd containers
-  shell: '{{ bin_dir }}/crictl pods --name kube-router* -q | xargs -I% --no-run-if-empty bash -c "{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %"'
+  shell: 'set -o pipefail && {{ bin_dir }}/crictl pods --name kube-router* -q | xargs -I% --no-run-if-empty bash -c "{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %"'
+  args:
+    executable: /bin/bash
  register: crictl_kube_router_remove
  until: crictl_kube_router_remove is succeeded
  retries: 5
--- a/roles/network_plugin/kube-router/tasks/main.yml
+++ b/roles/network_plugin/kube-router/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
 - name: kube-router | Create annotations
-  include: annotate.yml
+  import_tasks: annotate.yml
  tags: annotate

 - name: kube-router | Create config directory
--- a/roles/network_plugin/macvlan/tasks/main.yml
+++ b/roles/network_plugin/macvlan/tasks/main.yml
@@ -7,7 +7,7 @@

 - name: Macvlan | set node_pod_cidr
  set_fact:
-    node_pod_cidr={{ node_pod_cidr_cmd.stdout }}
+    node_pod_cidr: "{{ node_pod_cidr_cmd.stdout }}"

 - name: Macvlan | Retrieve default gateway network interface
  become: false
@@ -17,7 +17,7 @@

 - name: Macvlan | set node_default_gateway_interface
  set_fact:
-    node_default_gateway_interface={{ node_default_gateway_interface_cmd.stdout | trim }}
+    node_default_gateway_interface: "{{ node_default_gateway_interface_cmd.stdout | trim }}"

 - name: Macvlan | Install network gateway interface on debian
  template:
@@ -101,7 +101,7 @@
    mode: 0644

 - name: Enable net.ipv4.conf.all.arp_notify in sysctl
-  sysctl:
+  ansible.posix.sysctl:
    name: net.ipv4.conf.all.arp_notify
    value: 1
    sysctl_set: yes
--- a/roles/network_plugin/multus/tasks/main.yml
+++ b/roles/network_plugin/multus/tasks/main.yml
@@ -20,6 +20,7 @@
  template:
    src: multus-daemonset.yml.j2
    dest: "{{ kube_config_dir }}/{{ item.file }}"
+    mode: 0644
  with_items:
    - {name: multus-daemonset-containerd, file: multus-daemonset-containerd.yml, type: daemonset, engine: containerd }
    - {name: multus-daemonset-docker, file: multus-daemonset-docker.yml, type: daemonset, engine: docker }
--- a/roles/recover_control_plane/control-plane/tasks/main.yml
+++ b/roles/recover_control_plane/control-plane/tasks/main.yml
@@ -2,7 +2,7 @@
 - name: Wait for apiserver
  command: "{{ kubectl }} get nodes"
  environment:
-    - KUBECONFIG: "{{ ansible_env.HOME | default('/root') }}/.kube/config"
+    KUBECONFIG: "{{ ansible_env.HOME | default('/root') }}/.kube/config"
  register: apiserver_is_ready
  until: apiserver_is_ready.rc == 0
  retries: 6
@@ -13,7 +13,7 @@
 - name: Delete broken kube_control_plane nodes from cluster
  command: "{{ kubectl }} delete node {{ item }}"
  environment:
-    - KUBECONFIG: "{{ ansible_env.HOME | default('/root') }}/.kube/config"
+    KUBECONFIG: "{{ ansible_env.HOME | default('/root') }}/.kube/config"
  with_items: "{{ groups['broken_kube_control_plane'] }}"
  register: delete_broken_kube_masters
  failed_when: false
--- a/roles/recover_control_plane/etcd/tasks/main.yml
+++ b/roles/recover_control_plane/etcd/tasks/main.yml
@@ -6,25 +6,25 @@
  changed_when: false
  check_mode: no
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses }}"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
  when:
-    - groups['broken_etcd']
+    - inventory_hostname in groups['broken_etcd']

 - name: Set healthy fact
  set_fact:
    healthy: "{{ etcd_endpoint_health.stderr is match('Error: unhealthy cluster') }}"
  when:
-    - groups['broken_etcd']
+    - inventory_hostname in groups['broken_etcd']

 - name: Set has_quorum fact
  set_fact:
    has_quorum: "{{ etcd_endpoint_health.stdout_lines | select('match', '.*is healthy.*') | list | length >= etcd_endpoint_health.stderr_lines | select('match', '.*is unhealthy.*') | list | length }}"
  when:
-    - groups['broken_etcd']
+    - inventory_hostname in groups['broken_etcd']

 - include_tasks: recover_lost_quorum.yml
  when:
@@ -39,7 +39,7 @@
  with_items: "{{ groups['broken_etcd'] }}"
  ignore_errors: true  # noqa ignore-errors
  when:
-    - groups['broken_etcd']
+    - inventory_hostname in groups['broken_etcd']
    - has_quorum

 - name: Delete old certificates
@@ -56,7 +56,7 @@
  loop: "{{ delete_old_cerificates.results }}"
  changed_when: false
  when:
-    - groups['broken_etcd']
+    - inventory_hostname in groups['broken_etcd']
    - "item.rc != 0 and not 'No such file or directory' in item.stderr"

 - name: Get etcd cluster members
@@ -65,20 +65,20 @@
  changed_when: false
  check_mode: no
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses }}"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
  when:
-    - groups['broken_etcd']
+    - inventory_hostname in groups['broken_etcd']
    - not healthy
    - has_quorum

 - name: Remove broken cluster members
  command: "{{ bin_dir }}/etcdctl member remove {{ item[1].replace(' ','').split(',')[0] }}"
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses }}"
    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
@@ -87,7 +87,7 @@
    - "{{ groups['broken_etcd'] }}"
    - "{{ member_list.stdout_lines }}"
  when:
-    - groups['broken_etcd']
+    - inventory_hostname in groups['broken_etcd']
    - not healthy
    - has_quorum
    - hostvars[item[0]]['etcd_member_name'] == item[1].replace(' ','').split(',')[2]
--- a/roles/recover_control_plane/etcd/tasks/recover_lost_quorum.yml
+++ b/roles/recover_control_plane/etcd/tasks/recover_lost_quorum.yml
@@ -2,11 +2,11 @@
 - name: Save etcd snapshot
  command: "{{ bin_dir }}/etcdctl snapshot save /tmp/snapshot.db"
  environment:
-    - ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
-    - ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
-    - ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
-    - ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses.split(',') | first }}"
-    - ETCDCTL_API: 3
+    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
+    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
+    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
+    ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses.split(',') | first }}"
+    ETCDCTL_API: "3"
  when: etcd_snapshot is not defined

 - name: Transfer etcd snapshot to host
@@ -29,11 +29,11 @@
 - name: Restore etcd snapshot  # noqa 301 305
  shell: "{{ bin_dir }}/etcdctl snapshot restore /tmp/snapshot.db --name {{ etcd_member_name }} --initial-cluster {{ etcd_member_name }}={{ etcd_peer_url }} --initial-cluster-token k8s_etcd --initial-advertise-peer-urls {{ etcd_peer_url }} --data-dir {{ etcd_data_dir }}"
  environment:
-    - ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
-    - ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
-    - ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
-    - ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses }}"
-    - ETCDCTL_API: 3
+    ETCDCTL_CERT: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem"
+    ETCDCTL_KEY: "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem"
+    ETCDCTL_CACERT: "{{ etcd_cert_dir }}/ca.pem"
+    ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses }}"
+    ETCDCTL_API: "3"

 - name: Remove etcd snapshot
  file:
--- a/roles/remove-node/remove-etcd-node/tasks/main.yml
+++ b/roles/remove-node/remove-etcd-node/tasks/main.yml
@@ -26,7 +26,9 @@
    - inventory_hostname in groups['etcd']

 - name: Lookup etcd member id
-  shell: "{{ bin_dir }}/etcdctl member list | grep {{ node_ip }} | cut -d, -f1"
+  shell: "set -o pipefail && {{ bin_dir }}/etcdctl member list | grep {{ node_ip }} | cut -d, -f1"
+  args:
+    executable: /bin/bash
  register: etcd_member_id
  ignore_errors: true  # noqa ignore-errors
  changed_when: false
@@ -34,7 +36,7 @@
  tags:
    - facts
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ kube_cert_dir + '/etcd/server.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/admin-' + groups['etcd']|first + '.pem' }}"
    ETCDCTL_KEY: "{{ kube_cert_dir + '/etcd/server.key' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/admin-' + groups['etcd']|first + '-key.pem' }}"
    ETCDCTL_CACERT: "{{ kube_cert_dir + '/etcd/ca.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/ca.pem' }}"
@@ -45,7 +47,7 @@
 - name: Remove etcd member from cluster
  command: "{{ bin_dir }}/etcdctl member remove {{ etcd_member_id.stdout }}"
  environment:
-    ETCDCTL_API: 3
+    ETCDCTL_API: "3"
    ETCDCTL_CERT: "{{ kube_cert_dir + '/etcd/server.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/admin-' + groups['etcd']|first + '.pem' }}"
    ETCDCTL_KEY: "{{ kube_cert_dir + '/etcd/server.key' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/admin-' + groups['etcd']|first + '-key.pem' }}"
    ETCDCTL_CACERT: "{{ kube_cert_dir + '/etcd/ca.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/ca.pem' }}"
--- a/roles/reset/tasks/main.yml
+++ b/roles/reset/tasks/main.yml
@@ -178,7 +178,6 @@
  shell: set -o pipefail && mount | grep /var/lib/kubelet/ | awk '{print $3}' | tac
  args:
    executable: /bin/bash
-    warn: false
  check_mode: no
  register: mounted_dirs
  failed_when: false
@@ -279,6 +278,7 @@
    path: "{{ filedir_path }}"
    state: touch
    attributes: "-i"
+    mode: 0644
  loop: "{{ var_lib_kubelet_files_dirs_w_attrs.stdout_lines|select('search', 'Immutable')|list }}"
  loop_control:
    loop_var: file_dir_line