fix: configure Kubernetes feature gates with dictionaries (#13608)

* fix: configure Kubernetes feature gates with dictionaries

* docs: update feature gate settings to dictionaries

roles/kubespray_defaults/defaults/main/main.yml

@@ -633,15 +633,14 @@ additional_sysctl: []
 #   kernel.pid_max: 0
 additional_sysctl_min: {}
 
-## List of key=value pairs that describe feature gates for
-## the k8s cluster.
-kube_feature_gates: []
-kube_apiserver_feature_gates: []
-kube_controller_feature_gates: []
-kube_scheduler_feature_gates: []
-kube_proxy_feature_gates: []
-kubelet_feature_gates: []
-kubeadm_feature_gates: []
+## Dictionaries of feature gate names and boolean values for the k8s cluster.
+kube_feature_gates: {}
+kube_apiserver_feature_gates: {}
+kube_controller_feature_gates: {}
+kube_scheduler_feature_gates: {}
+kube_proxy_feature_gates: {}
+kubelet_feature_gates: {}
+kubeadm_feature_gates: {}
 
 local_volume_provisioner_storage_class: local-storage
 local_volume_provisioner_base_dir: /mnt/disks

roles/kubespray_defaults/vars/main/main.yml

@@ -20,6 +20,15 @@ etcd_supported_versions:
 
 kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}"
 
+# cri-dockerd does not support WebSocket streaming to the kubelet.
+# https://github.com/kubernetes-sigs/kubespray/issues/13360
+_kubelet_feature_gates: >-
+    {{ (kubelet_feature_gates | default(kube_feature_gates, true)) | combine(
+         {'ExtendWebSocketsToKubelet': false}
+         if container_manager == 'docker' and kube_version is version('1.36.0', '>=') else
+         {}
+       ) }}
+
 # Sysctl floors: only applied when the node's current value is lower than
 # the desired one, so pre-tuned images and newer kernels are not regressed.
 # Values are aligned with OpenShift Node Tuning Operator and kops, and