Fix anonymous access cleanup during cluster upgrade (#13417)

roles/kubernetes/control-plane/tasks/kubeadm-setup.yml

@@ -226,7 +226,10 @@
 
 - name: Remove binding to anonymous user
   command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
-  when: inventory_hostname == first_kube_control_plane and remove_anonymous_access
+  when:
+    - inventory_hostname == first_kube_control_plane
+    - remove_anonymous_access
+    - not upgrade_cluster_setup
 
 - name: Create kubeadm token for joining nodes with 24h expiration (default)
   command: "{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create --config={{ kube_config_dir }}/kubeadm-config.yaml"

tests/files/ubuntu22-calico-all-in-one-upgrade.yml

@@ -7,6 +7,7 @@ vm_memory: 3072
 # Kubespray settings
 auto_renew_certificates: true
 system_upgrade_autoclean: true
+remove_anonymous_access: true
 
 # Currently ipvs not available on KVM: https://packages.ubuntu.com/search?suite=focal&arch=amd64&mode=exactfilename&searchon=contents&keywords=ip_vs_sh.ko
 kube_proxy_mode: iptables