Initial plan

2026-05-17 14:27:47 -02:30 · 2026-03-22 11:20:53 +00:00
71 changed files with 387 additions and 953 deletions
--- a/.github/workflows/auto-label-os.yml
+++ b/.github/workflows/auto-label-os.yml
@@ -16,7 +16,7 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@cb6e97157cbf851e3a393ff8d57c93a484cc323f
+        uses: stefanbuck/github-issue-parser@10dcc54158ba4c137713d9d69d70a2da63b6bda3
        id: issue-parser
        with:
          template-path: .github/ISSUE_TEMPLATE/bug-report.yaml
--- a/.github/workflows/upgrade-patch-versions.yml
+++ b/.github/workflows/upgrade-patch-versions.yml
@@ -14,7 +14,7 @@ jobs:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        ref: ${{ inputs.branch }}
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@v6
      with:
        python-version: '3.13'
        cache: 'pip'
@@ -22,14 +22,14 @@ jobs:
    - run: update-hashes
      env:
        API_KEY: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@v5
      with:
        key: pre-commit-hook-propagate
        path: |
          ~/.cache/pre-commit
    - run: pre-commit run --all-files propagate-ansible-variables
      continue-on-error: true
-    - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+    - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
      with:
        commit-message: Patch versions updates
        title: Patch versions updates - ${{ inputs.branch }}
--- a/.gitlab-ci/kubevirt.yml
+++ b/.gitlab-ci/kubevirt.yml
@@ -40,8 +40,8 @@ pr:
          - debian11-macvlan
          - debian12-cilium
          - debian13-cilium
-          - fedora42-kube-router
+          - fedora39-kube-router
-          - fedora43-kube-router
+          - fedora41-kube-router
          - fedora42-calico
          - rockylinux9-cilium
          - rockylinux10-cilium
@@ -56,21 +56,18 @@ pr:
          - ubuntu24-kube-router-sep
          - ubuntu24-kube-router-svc-proxy
          - ubuntu24-ha-separate-etcd
-          - fedora43-flannel-crio-collection-scale
+          - fedora40-flannel-crio-collection-scale
          - openeuler24-calico
 # This is for flakey test so they don't disrupt the PR worklflow too much.
 # Jobs here MUST have a open issue so we don't lose sight of them
 pr-flakey:
  extends: pr
-  rules:
+  retry: 1
    - if: $PR_LABELS =~ /.*(ci-extended|ci-full).*/
      when: on_success
  retry: 2
  parallel:
    matrix:
      - TESTCASE:
          - flatcar4081-calico # https://github.com/kubernetes-sigs/kubespray/issues/12309
          - openeuler24-calico # https://github.com/kubernetes-sigs/kubespray/issues/12877
 # The ubuntu24-calico-all-in-one jobs are meant as early stages to prevent running the full CI if something is horribly broken
 ubuntu24-calico-all-in-one:
@@ -105,10 +102,10 @@ pr_full:
          - debian11-custom-cni
          - debian11-kubelet-csr-approver
          - debian12-custom-cni-helm
-          - fedora42-calico-swap-selinux
+          - fedora39-calico-swap-selinux
-          - fedora42-crio
+          - fedora39-crio
-          - fedora43-calico-swap-selinux
+          - fedora41-calico-swap-selinux
-          - fedora43-crio
+          - fedora41-crio
          - ubuntu24-calico-ha-wireguard
          - ubuntu24-flannel-ha
          - ubuntu24-flannel-ha-once
@@ -166,9 +163,9 @@ periodic:
          - debian11-calico-upgrade
          - debian11-calico-upgrade-once
          - debian12-cilium-svc-proxy
-          - fedora42-calico-selinux
+          - fedora39-calico-selinux
-          - fedora43-calico-selinux
+          - fedora40-docker-calico
-          - fedora43-docker-calico
+          - fedora41-calico-selinux
          - ubuntu24-calico-etcd-kubeadm-upgrade-ha
          - ubuntu24-calico-ha-recover
          - ubuntu24-calico-ha-recover-noquorum
--- a/.gitlab-ci/molecule.yml
+++ b/.gitlab-ci/molecule.yml
@@ -35,6 +35,7 @@ molecule:
      - container-engine/containerd
      - container-engine/cri-o
      - container-engine/gvisor
      - container-engine/youki
      - adduser
      - bastion-ssh-config
      - bootstrap_os
@@ -52,5 +53,3 @@ molecule_full:
    - ROLE:
      # FIXME : tests below are perma-failing
      - container-engine/kata-containers
      # FIXME: until youki release 0.6.1
      - container-engine/youki
--- a/4
+++ b/4
@@ -35,8 +35,8 @@ RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN OS_ARCHITECTURE=$(dpkg --print-architecture) \
-    && curl -L "https://dl.k8s.io/release/v1.36.1/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
+    && curl -L "https://dl.k8s.io/release/v1.35.1/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
-    && echo "$(curl -L "https://dl.k8s.io/release/v1.36.1/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
+    && echo "$(curl -L "https://dl.k8s.io/release/v1.35.1/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl
 COPY *.yml ./
--- a/1
+++ b/1
@@ -8,7 +8,6 @@ aliases:
  kubespray-reviewers:
    - cyclinder
    - erikjiang
    - guoard
    - mzaian
    - tico88612
    - vannten
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ Ensure you have installed Docker then
 ```ShellSession
 docker run --rm -it --mount type=bind,source="$(pwd)"/inventory/sample,dst=/inventory \
  --mount type=bind,source="${HOME}"/.ssh/id_rsa,dst=/root/.ssh/id_rsa \
-  quay.io/kubespray/kubespray:v2.31.0 bash
+  quay.io/kubespray/kubespray:v2.30.0 bash
 # Inside the container you may now run the kubespray playbooks:
 ansible-playbook -i /inventory/inventory.ini --private-key /root/.ssh/id_rsa cluster.yml
 ```
@@ -111,23 +111,23 @@ Note:
 <!-- BEGIN ANSIBLE MANAGED BLOCK -->
 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.36.1
+  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.35.1
-  - [etcd](https://github.com/etcd-io/etcd) 3.6.11
+  - [etcd](https://github.com/etcd-io/etcd) 3.6.8
  - [docker](https://www.docker.com/) 28.3
-  - [containerd](https://containerd.io/) 2.2.3
+  - [containerd](https://containerd.io/) 2.2.1
-  - [cri-o](https://cri-o.io/) 1.36.0 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [cri-o](http://cri-o.io/) 1.35.0 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
-  - [cni-plugins](https://github.com/containernetworking/plugins) 1.9.1
+  - [cni-plugins](https://github.com/containernetworking/plugins) 1.8.0
-  - [calico](https://github.com/projectcalico/calico) 3.31.5
+  - [calico](https://github.com/projectcalico/calico) 3.30.6
-  - [cilium](https://github.com/cilium/cilium) 1.19.4
+  - [cilium](https://github.com/cilium/cilium) 1.19.1
-  - [flannel](https://github.com/flannel-io/flannel) 0.28.4
+  - [flannel](https://github.com/flannel-io/flannel) 0.27.3
  - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
  - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
  - [multus](https://github.com/k8snetworkplumbingwg/multus-cni) 4.2.2
  - [kube-vip](https://github.com/kube-vip/kube-vip) 1.0.3
 - Application
  - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3
-  - [coredns](https://github.com/coredns/coredns) 1.14.2
+  - [coredns](https://github.com/coredns/coredns) 1.12.4
  - [argocd](https://argoproj.github.io/) 2.14.5
  - [helm](https://helm.sh/) 3.18.4
  - [metallb](https://metallb.universe.tf/) 0.13.9
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -58,7 +58,7 @@ You can create a release note with:
 export GITHUB_TOKEN=<your-github-token>
 export ORG=kubernetes-sigs
 export REPO=kubespray
-release-notes generate --org "${ORG}" --repo "${REPO}" --repo-path "${PWD}" --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note
+release-notes --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note --required-author=""
 ```
 If the release note file(/tmp/kubespray-release-note) contains "### Uncategorized" pull requests, those pull requests don't have a valid kind label(`kind/feature`, etc.).
--- a/contrib/terraform/openstack/README.md
+++ b/contrib/terraform/openstack/README.md
@@ -8,11 +8,6 @@ OpenStack.
 This will install a Kubernetes cluster on an OpenStack Cloud. It should work on
 most modern installs of OpenStack that support the basic services.
 ## OpenStack Support Documentation
 For OpenStack cloud provider configuration (Octavia load balancers, Cinder CSI storage,
 network plugins like Calico), see the [main OpenStack documentation](../../../docs/cloud_controllers/openstack.md).
 ### Known compatible public clouds
 - [Auro](https://auro.io/)
@@ -94,8 +89,8 @@ binaries available on hyperkube v1.4.3_coreos.0 or higher.
 ## Requirements
- [Install OpenTofu](https://opentofu.org/docs/intro/install/) 1.9.0 or later
+- [Install Terraform](https://www.terraform.io/intro/getting-started/install.html) 0.14 or later
- [Install Ansible](https://docs.ansible.com/ansible/latest/intro_installation.html)
+- [Install Ansible](http://docs.ansible.com/ansible/latest/intro_installation.html)
 - you already have a suitable OS image in Glance
 - you already have a floating IP pool created
 - you have security groups enabled
@@ -134,7 +129,6 @@ Terraform will be used to provision all of the OpenStack resources with base sof
 Create an inventory directory for your cluster by copying the existing sample and linking the `hosts` script (used to build the inventory based on Terraform state):
 ```ShellSession
 CLUSTER=your-cluster-name
 cp -LRp contrib/terraform/openstack/sample-inventory inventory/$CLUSTER
 cd inventory/$CLUSTER
 ln -s ../../contrib/terraform/openstack/hosts
@@ -152,7 +146,7 @@ different OpenStack environments may support Identity API version 2 or 3.
 These are examples and may vary depending on your OpenStack cloud provider,
 for an exhaustive list on how to authenticate on OpenStack with Terraform
-please read the [OpenStack provider documentation](https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs).
+please read the [OpenStack provider documentation](https://www.terraform.io/docs/providers/openstack/).
 ##### Declarative method (recommended)
@@ -268,7 +262,6 @@ For your cluster, edit `inventory/$CLUSTER/cluster.tfvars`.
 |`image_uuid`,`image_gfs_uuid`, `image_master_uuid` | UUID of the image to use in provisioning the compute resources. Should already be loaded into glance. |
 |`ssh_user`,`ssh_user_gfs` | The username to ssh into the image with. This usually depends on the image you have selected |
 |`public_key_path` | Path on your local workstation to the public key file you wish to use in creating the key pairs |
 |`group_vars_path` | path to the inventory group vars directory, `./group_vars` by default |
 |`number_of_k8s_masters`, `number_of_k8s_masters_no_floating_ip` | Number of nodes that serve as both master and etcd. These can be provisioned with or without floating IP addresses|
 |`number_of_k8s_masters_no_etcd`, `number_of_k8s_masters_no_floating_ip_no_etcd` |  Number of nodes that serve as just master with no etcd. These can be provisioned with or without floating IP addresses |
 |`number_of_etcd` | Number of pure etcd nodes |
@@ -618,13 +611,7 @@ Edit `inventory/$CLUSTER/group_vars/all/all.yml`:
 bin_dir: /opt/bin
 ```
- **external_cloud_provider**:
+- and **cloud_provider**:
 ```yml
 external_cloud_provider: openstack
 ```
 - **Only if K8s < v1.31 - cloud_provider**:
 ```yml
 cloud_provider: openstack
@@ -730,12 +717,6 @@ Basically you will install Gluster as
 ansible-playbook --become -i inventory/$CLUSTER/hosts ./contrib/network-storage/glusterfs/glusterfs.yml
 ```
 ## Relevant Resources
 - [HauptJ - Example cluster.tfvars using floating IPs for all Master and Nodes](https://gist.github.com/HauptJ/d72e2a8fe0698d448283a51e847a5dfa)
 - [openmetal - Deploying a Kubespray cluster to OpenStack using Terraform](https://openmetal.io/docs/manuals/kubernetes-guides/deploying-a-kubespray-cluster-to-openstack-using-terraform/)
 - [Guoqiang Lan - Deploy Kubernetes with Kubespray on OpenStack](https://guoqianglan.github.io/tutorial/cloud/deploy-kubernetes-with-kubespray-on-openstack/)
 ## What's next
 Try out your new Kubernetes cluster with the [Hello Kubernetes service](https://kubernetes.io/docs/tasks/access-application-cluster/service-access-application-cluster/).
--- a/docs/CNI/cilium.md
+++ b/docs/CNI/cilium.md
@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version
 ```yml
-cilium_version: "1.19.4"
+cilium_version: "1.19.1"
 ```
 ## Add variable to config
--- a/docs/developers/ci.md
+++ b/docs/developers/ci.md
@@ -11,8 +11,10 @@ amazon |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | :x: | :white_check_mark: |
 debian12 |  :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
 debian13 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
+fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
+fedora40 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
 fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
@@ -29,8 +31,10 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
@@ -47,8 +51,10 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora39 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora41 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
--- a/docs/operations/offline-environment.md
+++ b/docs/operations/offline-environment.md
@@ -22,10 +22,6 @@ Then you need to setup the following services on your offline environment:
 You can get artifact lists with [generate_list.sh](/contrib/offline/generate_list.sh) script.
 In addition, you can find some tools for offline deployment under [contrib/offline](/contrib/offline/README.md).
 ## Tip: use the original domains as top directories in the files_repo, i.e `github.com/`, `dl.k8s.io/`, `storage.googleapis.com/`, `get.helm.sh/`
 ## Tip: for Cilium ensure to mirror <https://helm.cilium.io/index.yaml> and the chart cilium-1.18.2.tgz in files_repo
 ## Access Control
 ### Note: access controlled files_repo
@@ -48,8 +44,7 @@ files_repo: "https://{{ files_repo_user ~ ':' ~ files_repo_pass ~ '@' ~ files_re
 ### Note: access controlled registry
-Specify a "{{ registry_user }}" and "{{ registry_pass }}" for "{{ registry_addr }}",
+To specify a username and password for "{{ registry_host }}", used to download the container images, you can use url-encoding too.
 These are used to download the container images. Ensure to encrypt the password (if used) with ansible-vault.
 ```yaml
 registry_pass: !vault |
@@ -59,30 +54,7 @@ registry_pass: !vault |
          64653965663965356137333436616536643132336630313235333232336661373761643766356366
          6232353233386534380a373262313634613833623537626132633033373064336261383166323230
          3164
 ```
 To enable Containerd **2+** to access the private registry:
 ```yaml
 containerd_registries_mirrors:
  - prefix: docker.io
    mirrors:
      - host: https://registry-1.docker.io
        capabilities: ["pull", "resolve"]
        skip_verify: false
  - prefix: "{{ registry_addr }}"
    mirrors:
      - host: "https://{{ registry_addr }}"
        capabilities: ["pull", "resolve"]
        skip_verify: false
        header:
          Authorization: ["Basic {{ (registry_user + ':' + registry_pass) | b64encode }}"]
 ```
 To enable Containerd **1.7** to access the private registry:
 ```yaml
 containerd_registry_auth:
  - registry: "{{ registry_host }}"
    username: "{{ registry_user }}"
@@ -101,12 +73,25 @@ gcr_image_repo: "{{ registry_host }}"
 docker_image_repo: "{{ registry_host }}"
 quay_image_repo: "{{ registry_host }}"
 github_image_repo: "{{ registry_host }}"
-github_url: "{{ files_repo }}/github.com"
+
 dl_k8s_io_url: "{{ files_repo }}/dl.k8s.io"
 storage_googleapis_url: "{{ files_repo }}/storage.googleapis.com"
 get_helm_url: "{{ files_repo }}/get.helm.sh"
 local_path_provisioner_helper_image_repo: "{{ registry_host }}/busybox"
-# Insecure registries for containerd (see authenticated example above)
+kubeadm_download_url: "{{ files_repo }}/kubernetes/v{{ kube_version }}/kubeadm"
 kubectl_download_url: "{{ files_repo }}/kubernetes/v{{ kube_version }}/kubectl"
 kubelet_download_url: "{{ files_repo }}/kubernetes/v{{ kube_version }}/kubelet"
 # etcd is optional if you **DON'T** use etcd_deployment=host
 etcd_download_url: "{{ files_repo }}/kubernetes/etcd/etcd-v{{ etcd_version }}-linux-{{ image_arch }}.tar.gz"
 cni_download_url: "{{ files_repo }}/kubernetes/cni/cni-plugins-linux-{{ image_arch }}-v{{ cni_version }}.tgz"
 crictl_download_url: "{{ files_repo }}/kubernetes/cri-tools/crictl-v{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
 # If using Calico
 calicoctl_download_url: "{{ files_repo }}/kubernetes/calico/v{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}"
 # If using Calico with kdd
 calico_crds_download_url: "{{ files_repo }}/github.com/projectcalico/calico/raw/v{{ calico_version }}/manifests/crds.yaml"
 # Containerd
 containerd_download_url: "{{ files_repo }}/containerd-{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
 runc_download_url: "{{ files_repo }}/runc.{{ image_arch }}"
 nerdctl_download_url: "{{ files_repo }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
 get_helm_url: "{{ files_repo }}/get.helm.sh"
 # Insecure registries for containerd
 containerd_registries_mirrors:
  - prefix: "{{ registry_addr }}"
    mirrors:
@@ -114,34 +99,6 @@ containerd_registries_mirrors:
        capabilities: ["pull", "resolve"]
        skip_verify: true
 # Cilium
 cilium_install_extra_flags: "--repository {{ files_repo }}/helm.cilium.io/"
 cilium_extra_values:
  image:
    useDigest: false
  hubble:
    relay:
      image:
        useDigest: false
    ui:
      backend:
        image:
          useDigest: false
      frontend:
        image:
          useDigest: false
  operator:
    image:
      override: "{{ registry_host }}/cilium/operator-generic:v1.18.2"
      useDigest: false
      extension: ""
  certgen:
    image:
      useDigest: false
  envoy:
    image:
      useDigest: false
 # CentOS/Redhat/AlmaLinux/Rocky Linux
 ## Docker / Containerd
 docker_rh_repo_base_url: "{{ yum_repo }}/docker-ce/$releasever/$basearch"
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -2,7 +2,7 @@
 namespace: kubernetes_sigs
 description: Deploy a production ready Kubernetes cluster
 name: kubespray
-version: 2.32.0
+version: 2.31.0
 readme: README.md
 authors:
  - The Kubespray maintainers (https://kubernetes.slack.com/channels/kubespray)
--- a/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
@@ -53,21 +53,6 @@ credentials_dir: "{{ inventory_dir }}/credentials"
 # kube_oidc_groups_claim: groups
 # kube_oidc_groups_prefix: 'oidc:'
 ## Structured AuthenticationConfiguration https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration
 ## Note: --authentication-config and --oidc-* flags are mutually exclusive
 # kube_apiserver_use_authentication_config_file: false
 # kube_apiserver_authentication_config_jwt:
 #   - issuer:
 #       url: https://issuer.example.com
 #       audiences:
 #       - my-audience
 #     claimMappings:
 #       username:
 #         expression: 'claims.sub'
 # kube_apiserver_authentication_config_anonymous:
 #   enabled: "{{ kube_api_anonymous_auth }}"
 #   conditions: []
 ## Variables to control webhook authn/authz
 # kube_webhook_token_auth: false
 # kube_webhook_token_auth_url: https://...
--- a/pipeline.Dockerfile
+++ b/pipeline.Dockerfile
@@ -46,8 +46,8 @@ ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
 RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
    && pip install --break-system-packages --ignore-installed --no-compile --no-cache-dir pip -U \
    && pip install --break-system-packages --no-compile --no-cache-dir -r tests/requirements.txt \
-    && curl -L https://dl.k8s.io/release/v1.36.1/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
+    && curl -L https://dl.k8s.io/release/v1.35.1/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
-    && echo $(curl -L https://dl.k8s.io/release/v1.36.1/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
+    && echo $(curl -L https://dl.k8s.io/release/v1.35.1/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl \
    # Install Vagrant
    && curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,6 @@
 ansible==11.13.0
 # Needed for community.crypto module
-cryptography==48.0.0
+cryptography==46.0.5
 # Needed for jinja2 json_query templating
 jmespath==1.1.0
 # Needed for ansible.utils.ipaddr
--- a/roles/bootstrap_os/defaults/main.yml
+++ b/roles/bootstrap_os/defaults/main.yml
@@ -20,10 +20,6 @@ openeuler_metalink_enabled: false
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true
 ## RHEL specific variables
 # Enable RHEL subscription repos
 rhel_enable_repos: true
 ## Ubuntu specific variables
 # Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
 ubuntu_kernel_unattended_upgrades_disabled: false
--- a/roles/bootstrap_os/tasks/centos.yml
+++ b/roles/bootstrap_os/tasks/centos.yml
@@ -23,7 +23,7 @@
    name: "oracle-epel-release-el{{ ansible_distribution_major_version }}"
    state: present
  when:
-    - use_oracle_public_repo
+    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
    - (ansible_distribution_version | float) >= 7.6
@@ -39,7 +39,7 @@
    - { option: "enabled", value: "1" }
    - { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_distribution_major_version }}/addons/$basearch/" }
  when:
-    - use_oracle_public_repo
+    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
    - (ansible_distribution_version | float) >= 7.6
@@ -56,7 +56,7 @@
    - { option: "gpgcheck", value: "0" }
    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_distribution_major_version }}/extras/$basearch/os/" }
  when:
-    - use_oracle_public_repo
+    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
    - (ansible_distribution_version | float) >= 7.6
    - (ansible_distribution_version | float) < 9
--- a/roles/bootstrap_os/tasks/openEuler.yml
+++ b/roles/bootstrap_os/tasks/openEuler.yml
@@ -2,25 +2,6 @@
 - name: Import CentOS bootstrap for openEuler
  ansible.builtin.import_tasks: centos.yml
 - name: Read openEuler release string
  ansible.builtin.command: cat /etc/openEuler-release
  register: _openeuler_release_raw
  changed_when: false
  check_mode: false
  become: true
  when: openeuler_metalink_enabled
 # /etc/openEuler-release contains e.g. "openEuler release 24.03 (LTS)"
 # The metalink server expects "24.03LTS" (no spaces/parens/dashes),
 # but DNF's $releasever resolves to just "24.03", causing "invalid repo or arch".
 - name: Set openEuler metalink releasever
  ansible.builtin.set_fact:
    _openeuler_releasever: >-
      {{ _openeuler_release_raw.stdout
         | regex_replace('.*release\s+', '')
         | regex_replace('[() -]', '') }}
  when: openeuler_metalink_enabled
 - name: Get existing openEuler repo sections
  ansible.builtin.shell:
    cmd: "set -o pipefail && grep '^\\[' /etc/yum.repos.d/openEuler.repo | tr -d '[]'"
@@ -46,16 +27,16 @@
  register: _openeuler_metalink_result
  vars:
    _openeuler_metalink_repos:
-      OS: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/OS&arch=$basearch"
+      OS: "https://mirrors.openeuler.org/metalink?repo=$releasever/OS&arch=$basearch"
-      everything: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/everything&arch=$basearch"
+      everything: "https://mirrors.openeuler.org/metalink?repo=$releasever/everything&arch=$basearch"
-      EPOL: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/EPOL/main&arch=$basearch"
+      EPOL: "https://mirrors.openeuler.org/metalink?repo=$releasever/EPOL/main&arch=$basearch"
-      debuginfo: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/debuginfo&arch=$basearch"
+      debuginfo: "https://mirrors.openeuler.org/metalink?repo=$releasever/debuginfo&arch=$basearch"
-      source: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}&arch=source"
+      source: "https://mirrors.openeuler.org/metalink?repo=$releasever&arch=source"
-      update: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/update&arch=$basearch"
+      update: "https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=$basearch"
-      update-source: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/update&arch=source"
+      update-source: "https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=source"
- name: Clean dnf metadata cache to apply metalink mirror selection
+- name: Clean dnf cache to apply metalink mirror selection
-  ansible.builtin.command: dnf clean metadata
+  ansible.builtin.command: dnf clean all
  become: true
  when:
    - openeuler_metalink_enabled
--- a/roles/bootstrap_os/tasks/rhel.yml
+++ b/roles/bootstrap_os/tasks/rhel.yml
@@ -69,7 +69,7 @@
    name:
      - "rhel-8-for-*-baseos-rpms"
      - "rhel-8-for-*-appstream-rpms"
-    state: "{{ 'enabled' if (rhel_enable_repos | bool) else 'disabled' }}"
+    state: "{{ 'enabled' if (rhel_enable_repos | default(True) | bool) else 'disabled' }}"
  when:
    - ansible_distribution_major_version == "8"
    - (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)
--- a/roles/container-engine/kata-containers/templates/configuration-qemu.toml.j2
+++ b/roles/container-engine/kata-containers/templates/configuration-qemu.toml.j2
@@ -678,16 +678,6 @@ experimental=[]
 # (default: false)
 # enable_pprof = true
 {% if kata_containers_version is version('3.4.0', '>=') %}
 # Indicates the CreateContainer request timeout needed for the workload(s)
 # It using guest_pull this includes the time to pull the image inside the guest
 # Defaults to 60 second(s)
 # Note: The effective timeout is determined by the lesser of two values: runtime-request-timeout from kubelet config
 # (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout) and create_container_timeout.
 # In essence, the timeout used for guest pull=runtime-request-timeout<create_container_timeout?runtime-request-timeout:create_container_timeout.
 create_container_timeout = 60
 {% endif %}
 # WARNING: All the options in the following section have not been implemented yet.
 # This section was added as a placeholder. DO NOT USE IT!
 [image]
--- a/roles/etcd/tasks/check_certs.yml
+++ b/roles/etcd/tasks/check_certs.yml
@@ -13,8 +13,6 @@
    sync_certs: false
    gen_certs: false
    etcd_secret_changed: false
    etcd_member_requires_sync: false
    kubernetes_host_requires_sync: false
 - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
  stat:
@@ -130,7 +128,7 @@
  set_fact:
    sync_certs: true
  when:
-    - etcd_member_requires_sync or
+    - etcd_member_requires_sync | default(false) or
-      kubernetes_host_requires_sync or
+      kubernetes_host_requires_sync | default(false) or
      'gen_master_certs_True' in group_names or
      'gen_node_certs_True' in group_names
--- a/roles/etcd/tasks/gen_certs_script.yml
+++ b/roles/etcd/tasks/gen_certs_script.yml
@@ -24,7 +24,7 @@
  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
-    - gen_certs
+    - gen_certs | default(false)
    - inventory_hostname == groups['etcd'][0]
 - name: Gen_certs | copy certs generation script
@@ -43,7 +43,7 @@
    HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['kube_control_plane']) | join(' ') }}"
  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
-  when: gen_certs
+  when: gen_certs | default(false)
  notify: Set etcd_secret_changed
 - name: Gen_certs | run cert generation script for all clients
@@ -55,7 +55,7 @@
  when:
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
-    - gen_certs
+    - gen_certs | default(false)
  notify: Set etcd_secret_changed
 - name: Gen_certs | Gather etcd member/admin and kube_control_plane client certs from first etcd node
@@ -78,7 +78,7 @@
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
    - ('etcd' in group_names)
-    - sync_certs
+    - sync_certs | default(false)
    - inventory_hostname != groups['etcd'][0]
  notify: Set etcd_secret_changed
@@ -92,7 +92,7 @@
  with_items: "{{ etcd_master_certs.results }}"
  when:
    - ('etcd' in group_names)
-    - sync_certs
+    - sync_certs | default(false)
    - inventory_hostname != groups['etcd'][0]
  loop_control:
    label: "{{ item.item }}"
@@ -134,7 +134,7 @@
  include_tasks: gen_nodes_certs_script.yml
  when:
    - ('kube_control_plane' in group_names) and
-        sync_certs and inventory_hostname not in groups['etcd']
+        sync_certs | default(false) and inventory_hostname not in groups['etcd']
 - name: Gen_certs | Generate etcd certs on nodes if needed
  include_tasks: gen_nodes_certs_script.yml
@@ -142,7 +142,7 @@
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
    - ('k8s_cluster' in group_names) and
-        sync_certs and inventory_hostname not in groups['etcd']
+        sync_certs | default(false) and inventory_hostname not in groups['etcd']
 # This is a hack around the fact kubeadm expect the same certs path on all kube_control_plane
 # TODO: fix certs generation to have the same file everywhere
--- a/roles/etcd/tasks/main.yml
+++ b/roles/etcd/tasks/main.yml
@@ -84,7 +84,7 @@
  when:
    - ('etcd' in group_names)
    - etcd_cluster_setup
-    - etcd_secret_changed
+    - etcd_secret_changed | default(false)
 - name: Restart etcd-events if certs changed
  command: /bin/true
@@ -92,7 +92,7 @@
  when:
    - ('etcd' in group_names)
    - etcd_events_cluster_setup
-    - etcd_secret_changed
+    - etcd_secret_changed | default(false)
 # After etcd cluster is assembled, make sure that
 # initial state of the cluster is in `existing`
--- a/roles/helm-apps/tasks/main.yml
+++ b/roles/helm-apps/tasks/main.yml
@@ -1,11 +1,9 @@
 ---
 - name: Add Helm repositories
  environment: "{{ proxy_env }}"
  kubernetes.core.helm_repository: "{{ helm_repository_defaults | combine(item) }}"  # noqa args[module]
  loop: "{{ repositories }}"
 - name: Update Helm repositories
  environment: "{{ proxy_env }}"
  kubernetes.core.helm:
    state: absent
    binary_path: "{{ bin_dir }}/helm"
@@ -17,6 +15,5 @@
    - helm_update
 - name: Install Helm Applications
  environment: "{{ proxy_env }}"
  kubernetes.core.helm: "{{ helm_defaults | combine(release_common_opts, item) }}"  # noqa args[module]
  loop: "{{ releases }}"
--- a/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml
+++ b/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml
@@ -20,7 +20,7 @@
 - name: External OCI Cloud Controller Manager | Get base64 cloud-config
  set_fact:
-    external_oracle_cloud_config_secret: "{{ lookup('template', 'external-oci-cloud-config.yml.j2') | b64encode }}"
+    external_oracle_cloud_config_secret: "{{ lookup('template', 'external-oci-cloud-config.j2') | b64encode }}"
  when: inventory_hostname == groups['kube_control_plane'][0]
  tags: external-oci
--- a/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml
+++ b/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml
@@ -4,7 +4,9 @@ dependencies:
    when:
      - inventory_hostname == groups['kube_control_plane'][0]
      - kubelet_csr_approver_enabled
-    environment: "{{ proxy_env }}"
+    environment:
      http_proxy: "{{ http_proxy | default('') }}"
      https_proxy: "{{ https_proxy | default('') }}"
    release_common_opts: {}
    releases:
      - name: kubelet-csr-approver
--- a/roles/kubernetes-apps/metallb/tasks/main.yml
+++ b/roles/kubernetes-apps/metallb/tasks/main.yml
@@ -3,8 +3,7 @@
  fail:
    msg: "MetalLB require kube_proxy_strict_arp = true, see https://github.com/danderson/metallb/issues/153#issuecomment-518651132"
  when:
-    - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
+    - "kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp"
    - not kube_proxy_remove
 - name: Kubernetes Apps | Check that the deprecated 'matallb_auto_assign' variable is not used anymore
  fail:
--- a/roles/kubernetes/control-plane/defaults/main/main.yml
+++ b/roles/kubernetes/control-plane/defaults/main/main.yml
@@ -41,9 +41,6 @@ control_plane_health_retries: 60  # Default retries for apiserver, scheduler, co
 kube_controller_manager_leader_elect_lease_duration: 15s
 kube_controller_manager_leader_elect_renew_deadline: 10s
 # Controls whether or not the kube_controller_manager allocates subnets for the node object
 kube_controller_manager_allocate_node_cidrs: true
 # discovery_timeout modifies the discovery timeout
 discovery_timeout: 5m0s
--- a/roles/kubernetes/control-plane/tasks/main.yml
+++ b/roles/kubernetes/control-plane/tasks/main.yml
@@ -18,19 +18,6 @@
    mode: "0640"
  when: kube_webhook_authorization | default(false)
 - name: Create structured AuthenticationConfiguration file
  copy:
    content: "{{ authn_config | to_nice_yaml(indent=2, sort_keys=false) }}"
    dest: "{{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml"
    mode: "0640"
  vars:
    authn_config:
      apiVersion: apiserver.config.k8s.io/{{ kube_apiserver_authentication_config_api_version }}
      kind: AuthenticationConfiguration
      jwt: "{{ kube_apiserver_authentication_config_jwt }}"
      anonymous: "{{ kube_apiserver_authentication_config_anonymous }}"
  when: kube_apiserver_use_authentication_config_file
 - name: Create structured AuthorizationConfiguration file
  copy:
    content: "{{ authz_config | to_nice_yaml(indent=2, sort_keys=false) }}"
@@ -112,13 +99,6 @@
  include_tasks: kubeadm-etcd.yml
  when: etcd_deployment_type == "kubeadm"
 - name: Cleanup unused AuthenticationConfiguration file versions
  file:
    path: "{{ kube_config_dir }}/apiserver-authentication-config-{{ item }}.yaml"
    state: absent
  loop: "{{ ['v1alpha1', 'v1beta1', 'v1'] | reject('equalto', kube_apiserver_authentication_config_api_version) | list }}"
  when: kube_apiserver_use_authentication_config_file
 - name: Cleanup unused AuthorizationConfiguration file versions
  file:
    path: "{{ kube_config_dir }}/apiserver-authorization-config-{{ item }}.yaml"
--- a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
+++ b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
@@ -131,7 +131,8 @@ apiServer:
    value: "{{ kube_apiserver_pod_eviction_not_ready_timeout_seconds }}"
  - name: default-unreachable-toleration-seconds
    value: "{{ kube_apiserver_pod_eviction_unreachable_timeout_seconds }}"
-{% if kube_api_anonymous_auth is defined and not kube_apiserver_use_authentication_config_file %}
+{% if kube_api_anonymous_auth is defined %}
 {# TODO: rework once suppport for structured auth lands #}
  - name: anonymous-auth
    value: "{{ kube_api_anonymous_auth }}"
 {% endif %}
@@ -180,7 +181,7 @@ apiServer:
  - name: service-account-lookup
    value: "{{ kube_apiserver_service_account_lookup }}"
 {% endif %}
-{% if kube_oidc_auth and kube_oidc_url is defined and kube_oidc_client_id is defined and not kube_apiserver_use_authentication_config_file %}
+{% if kube_oidc_auth and kube_oidc_url is defined and kube_oidc_client_id is defined %}
  - name: oidc-issuer-url
    value: "{{ kube_oidc_url }}"
  - name: oidc-client-id
@@ -206,10 +207,6 @@ apiServer:
    value: "{{ kube_oidc_groups_prefix }}"
 {%   endif %}
 {% endif %}
 {% if kube_apiserver_use_authentication_config_file %}
  - name: authentication-config
    value: "{{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml"
 {% endif %}
 {% if kube_webhook_token_auth %}
  - name: authentication-token-webhook-config-file
    value: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
@@ -282,7 +279,7 @@ apiServer:
  - name: tracing-config-file
    value: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml"
 {% endif %}
-{% if kubernetes_audit or kube_token_auth or kube_webhook_token_auth or kube_apiserver_use_authorization_config_file or kube_apiserver_use_authentication_config_file or apiserver_extra_volumes or ssl_ca_dirs | length %}
+{% if kubernetes_audit or kube_token_auth or kube_webhook_token_auth or apiserver_extra_volumes or ssl_ca_dirs | length %}
  extraVolumes:
 {% if kube_token_auth %}
  - name: token-auth-config
@@ -304,11 +301,6 @@ apiServer:
    hostPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml
    mountPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml
 {% endif %}
 {% if kube_apiserver_use_authentication_config_file %}
  - name: authentication-config
    hostPath: {{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml
    mountPath: {{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml
 {% endif %}
 {% if kubernetes_audit or kubernetes_audit_webhook %}
  - name: {{ audit_policy_name }}
    hostPath: {{ audit_policy_hostpath }}
@@ -365,17 +357,7 @@ controllerManager:
 {% endif %}
  - name: service-cluster-ip-range
    value: "{{ kube_service_subnets }}"
-{% if not kube_controller_manager_allocate_node_cidrs
+{% if kube_network_plugin is defined and kube_network_plugin == "calico" and not calico_ipam_host_local %}
  or kube_network_plugin is defined and (
    (
      kube_network_plugin == "calico" and
      not calico_ipam_host_local
    ) or (
      kube_network_plugin == "cilium" and
      cilium_ipam_mode == "cluster-pool"
    )
  )
 %}
  - name: allocate-node-cidrs
    value: "false"
 {% else %}
--- a/roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml
+++ b/roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml
@@ -4,7 +4,6 @@
    msg: "kube-vip require kube_proxy_strict_arp = true, see https://github.com/kube-vip/kube-vip/blob/main/docs/kubernetes/arp/index.md"
  when:
    - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
    - not kube_proxy_remove
    - kube_vip_arp_enabled
 - name: Kube-vip | Check mutually exclusive BGP source settings
--- a/roles/kubernetes/node/tasks/main.yml
+++ b/roles/kubernetes/node/tasks/main.yml
@@ -114,9 +114,7 @@
    state: present
    persistent: present
  loop: "{{ kube_proxy_ipvs_modules }}"
-  when:
+  when: kube_proxy_mode == 'ipvs'
    - kube_proxy_mode == 'ipvs'
    - not kube_proxy_remove
  tags:
    - kube-proxy
@@ -132,7 +130,6 @@
    - nf_conntrack_ipv4
  when:
    - kube_proxy_mode == 'ipvs'
    - not kube_proxy_remove
    - modprobe_conntrack_module is not defined or modprobe_conntrack_module is ansible.builtin.failed  # loop until first success
  tags:
    - kube-proxy
@@ -142,9 +139,7 @@
    name: "nf_tables"
    state: present
    persistent: present
-  when:
+  when: kube_proxy_mode == 'nftables'
    - kube_proxy_mode == 'nftables'
    - not kube_proxy_remove
  tags:
    - kube-proxy
--- a/roles/kubernetes/preinstall/defaults/main.yml
+++ b/roles/kubernetes/preinstall/defaults/main.yml
@@ -104,7 +104,7 @@ redhat_os_family_extensions:
  - "UniontechOS"
 # Sets DNSStubListener=no, useful if you get "0.0.0.0:53: bind: address already in use"
-systemd_resolved_disable_stub_listener: "{{ ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
+systemd_resolved_disable_stub_listener: "{{ ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
 # Used to disable File Access Policy Daemon service.
 # If service is enabled, the CNI plugin installation will fail
--- a/roles/kubernetes/preinstall/handlers/main.yml
+++ b/roles/kubernetes/preinstall/handlers/main.yml
@@ -1,8 +1,8 @@
 ---
 - name: Preinstall | apply resolvconf cloud-init
  command: /usr/bin/coreos-cloudinit --from-file {{ resolveconf_cloud_init_conf }}
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
-  listen: Preinstall | propagate resolvconf to k8s components
+  listen: Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk
 - name: Preinstall | reload NetworkManager
  service:
@@ -24,6 +24,7 @@
  when: not dns_early | bool
  listen:
    - Preinstall | propagate resolvconf to k8s components
    - Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk
    - Preinstall | update resolvconf for networkmanager
 # FIXME(mattymo): Also restart for kubeadm mode
@@ -118,6 +119,7 @@
    - ('kube_control_plane' in group_names)
    - dns_mode != 'none'
    - resolvconf_mode == 'host_resolvconf'
    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
  listen: Preinstall | propagate resolvconf to k8s components
 - name: Preinstall | Restart systemd-resolved
--- a/roles/kubernetes/preinstall/tasks/0020-set_facts.yml
+++ b/roles/kubernetes/preinstall/tasks/0020-set_facts.yml
@@ -1,12 +1,9 @@
 ---
- name: Normalize ansible_facts for redhat-family extensions
+- name: Set os_family fact for other redhat-based operating systems
  set_fact:
-    ansible_facts: >-
+    ansible_os_family: "RedHat"
-      {{ ansible_facts | combine({
+    ansible_distribution_major_version: "8"
-           'os_family': 'RedHat',
+  when: ansible_distribution in redhat_os_family_extensions
           'distribution_major_version': '8'
         }) }}
  when: ansible_facts['distribution'] in redhat_os_family_extensions
  tags:
    - facts
@@ -89,12 +86,12 @@
      {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/base{%- endif -%}
    head: >-
      {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/head{%- endif -%}
-  when: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
+  when: not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
 - name: Target temporary resolvconf cloud init file (Flatcar Container Linux by Kinvolk / Fedora CoreOS)
  set_fact:
    resolvconffile: /tmp/resolveconf_cloud_init_conf
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos
 - name: Check if /etc/dhclient.conf exists
  stat:
@@ -125,12 +122,12 @@
 - name: Target dhclient hook file for Red Hat family
  set_fact:
    dhclienthookfile: /etc/dhcp/dhclient.d/zdnsupdate.sh
-  when: ansible_facts['os_family'] == "RedHat"
+  when: ansible_os_family == "RedHat"
 - name: Target dhclient hook file for Debian family
  set_fact:
    dhclienthookfile: /etc/dhcp/dhclient-exit-hooks.d/zdnsupdate
-  when: ansible_facts['os_family'] == "Debian"
+  when: ansible_os_family == "Debian"
 - name: Set etcd vars if using kubeadm mode
  set_fact:
--- a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
+++ b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
@@ -15,25 +15,25 @@
    - not ignore_assert_errors
 - name: Stop if non systemd OS type
  assert:
-    that: ansible_facts['service_mgr'] == "systemd"
+    that: ansible_service_mgr == "systemd"
  when: not ignore_assert_errors
 - name: Stop if the os does not support
  assert:
-    that: (allow_unsupported_distribution_setup | default(false)) or ansible_facts['distribution'] in supported_os_distributions
+    that: (allow_unsupported_distribution_setup | default(false)) or ansible_distribution in supported_os_distributions
-    msg: "{{ ansible_facts['distribution'] }} is not a known OS"
+    msg: "{{ ansible_distribution }} is not a known OS"
  when: not ignore_assert_errors
 - name: Stop if memory is too small for control plane nodes
  assert:
-    that: ansible_facts['memtotal_mb'] >= minimal_master_memory_mb
+    that: ansible_memtotal_mb >= minimal_master_memory_mb
  when:
    - not ignore_assert_errors
    - ('kube_control_plane' in group_names)
 - name: Stop if memory is too small for nodes
  assert:
-    that: ansible_facts['memtotal_mb'] >= minimal_node_memory_mb
+    that: ansible_memtotal_mb >= minimal_node_memory_mb
  when:
    - not ignore_assert_errors
    - ('kube_node' in group_names)
@@ -47,8 +47,8 @@
 - name: Stop if ip var does not match local ips
  assert:
-    that: (ip in ansible_facts['all_ipv4_addresses']) or (ip in ansible_facts['all_ipv6_addresses'])
+    that: (ip in ansible_all_ipv4_addresses) or (ip in ansible_all_ipv6_addresses)
-    msg: "IPv4: '{{ ansible_facts['all_ipv4_addresses'] }}' and IPv6: '{{ ansible_facts['all_ipv6_addresses'] }}' do not contain '{{ ip }}'"
+    msg: "IPv4: '{{ ansible_all_ipv4_addresses }}' and IPv6: '{{ ansible_all_ipv6_addresses }}' do not contain '{{ ip }}'"
  when:
    - not ignore_assert_errors
    - ip is defined
@@ -63,17 +63,16 @@
 - name: Stop if kernel version is too low for cilium
  assert:
-    that: ansible_facts['kernel'].split('-')[0] is version('4.9.17', '>=')
+    that: ansible_kernel.split('-')[0] is version('4.9.17', '>=')
  when:
    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
    - not ignore_assert_errors
 - name: Stop if kernel version is too low for nftables
  assert:
-    that: ansible_facts['kernel'].split('-')[0] is version('5.13', '>=')
+    that: ansible_kernel.split('-')[0] is version('5.13', '>=')
  when:
    - kube_proxy_mode == 'nftables'
    - not kube_proxy_remove
    - not ignore_assert_errors
 - name: Stop if bad hostname
@@ -93,6 +92,6 @@
 - name: Stop if download_localhost is enabled for Flatcar Container Linux
  assert:
-    that: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    that: ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
    msg: "download_run_once not supported for Flatcar Container Linux"
  when: download_run_once or download_force_cache
--- a/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml
+++ b/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml
@@ -1,7 +1,7 @@
 ---
 - name: Create temporary resolveconf cloud init file
  command: cp -f /etc/resolv.conf "{{ resolvconffile }}"
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
 - name: Add domain/search/nameservers/options to resolv.conf
  blockinfile:
@@ -45,7 +45,7 @@
 - name: Get temporary resolveconf cloud init file content
  command: cat {{ resolvconffile }}
  register: cloud_config
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
 - name: Persist resolvconf cloud init file
  template:
@@ -53,5 +53,5 @@
    src: resolvconf.j2
    owner: root
    mode: "0644"
-  notify: Preinstall | propagate resolvconf to k8s components
+  notify: Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
--- a/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml
+++ b/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml
@@ -7,8 +7,8 @@
    get_checksum: false
    get_mime: false
  when:
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
-    - "'Amazon' not in ansible_facts['distribution']"
+    - "'Amazon' not in ansible_distribution"
  register: slc
 - name: Set selinux policy
@@ -16,8 +16,8 @@
    policy: targeted
    state: "{{ preinstall_selinux_state }}"
  when:
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
-    - "'Amazon' not in ansible_facts['distribution']"
+    - "'Amazon' not in ansible_distribution"
    - slc.stat.exists
  tags:
    - bootstrap_os
@@ -32,7 +32,7 @@
    mode: "0644"
  when:
    - disable_ipv6_dns
-    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  tags:
    - bootstrap_os
@@ -125,27 +125,6 @@
    - { name: vm.panic_on_oom, value: 0 }
  when: kubelet_protect_kernel_defaults | bool
 - name: Read current sysctl values
  command: sysctl -n {{ item.key }}
  register: sysctl_settings
  changed_when: false
  vars:
    # For integer sysctls only
    sysctl_minimum_values:
      fs.inotify.max_user_instances: 8192
  loop: "{{ sysctl_minimum_values | dict2items }}"
 - name: Increase sysctl value if lower than minimum
  ansible.posix.sysctl:
    sysctl_file: "{{ sysctl_file_path }}"
    name: "{{ item.item.key }}"
    value: "{{ item.item.value }}"
    state: present
    reload: true
    ignoreerrors: "{{ sysctl_ignore_unknown_keys }}"
  when: item.stdout | int < item.item.value
  loop: "{{ sysctl_settings.results }}"
 - name: Check dummy module
  community.general.modprobe:
    name: dummy
--- a/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
+++ b/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
@@ -15,7 +15,7 @@
      /etc/ntp.conf
      {%- elif ntp_package == "ntpsec" -%}
      /etc/ntpsec/ntp.conf
-      {%- elif ansible_facts['os_family'] in ['RedHat', 'Suse'] -%}
+      {%- elif ansible_os_family in ['RedHat', 'Suse'] -%}
      /etc/chrony.conf
      {%- else -%}
      /etc/chrony/chrony.conf
@@ -24,7 +24,7 @@
    ntp_service_name: >-
      {% if ntp_package == "chrony" -%}
      chronyd
-      {%- elif ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
+      {%- elif ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
      ntpd
      {%- else -%}
      ntp
@@ -72,14 +72,14 @@
  when:
    - ntp_timezone
    - not is_fedora_coreos
-    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
 - name: Gather selinux facts
  ansible.builtin.setup:
    gather_subset: selinux
  when:
    - ntp_timezone
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
 - name: Put SELinux in permissive mode, logging actions that would be blocked.
  ansible.posix.selinux:
@@ -87,7 +87,7 @@
    state: permissive
  when:
    - ntp_timezone
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
    - ansible_facts.selinux.status == 'enabled'
    - ansible_facts.selinux.mode == 'enforcing'
@@ -103,5 +103,5 @@
    state: "{{ preinstall_selinux_state }}"
  when:
    - ntp_timezone
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
    - ansible_facts.selinux.status == 'enabled'
--- a/roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml
+++ b/roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml
@@ -26,7 +26,7 @@
    owner: root
    mode: "0755"
  notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_facts['os_family'] not in [ "RedHat", "Suse" ]
+  when: ansible_os_family not in [ "RedHat", "Suse" ]
 - name: Configure dhclient hooks for resolv.conf (RH-only)
  template:
@@ -35,4 +35,4 @@
    owner: root
    mode: "0755"
  notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_facts['os_family'] == "RedHat"
+  when: ansible_os_family == "RedHat"
--- a/roles/kubernetes/preinstall/tasks/main.yml
+++ b/roles/kubernetes/preinstall/tasks/main.yml
@@ -83,7 +83,7 @@
    - dns_mode != 'none'
    - resolvconf_mode == 'host_resolvconf'
    - dhclientconffile is defined
-    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  tags:
    - bootstrap_os
    - resolvconf
@@ -94,7 +94,7 @@
    - dns_mode != 'none'
    - resolvconf_mode != 'host_resolvconf'
    - dhclientconffile is defined
-    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  tags:
    - bootstrap_os
    - resolvconf
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -112,11 +112,11 @@ calico_apiserver_version: "{{ calico_version }}"
 typha_enabled: false
 calico_apiserver_enabled: false
-flannel_version: 0.28.4
+flannel_version: 0.27.3
 flannel_cni_version: 1.7.1-flannel1
 cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"
-cilium_version: "1.19.4"
+cilium_version: "1.19.1"
 cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
 cilium_enable_hubble: false
@@ -239,13 +239,13 @@ cilium_operator_image_tag: "v{{ cilium_version }}"
 cilium_hubble_relay_image_repo: "{{ quay_image_repo }}/cilium/hubble-relay"
 cilium_hubble_relay_image_tag: "v{{ cilium_version }}"
 cilium_hubble_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
-cilium_hubble_certgen_image_tag: "v0.4.3"
+cilium_hubble_certgen_image_tag: "v0.2.4"
 cilium_hubble_ui_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui"
-cilium_hubble_ui_image_tag: "v0.13.5"
+cilium_hubble_ui_image_tag: "v0.13.3"
 cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend"
-cilium_hubble_ui_backend_image_tag: "v0.13.5"
+cilium_hubble_ui_backend_image_tag: "v0.13.3"
 cilium_hubble_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
-cilium_hubble_envoy_image_tag: "v1.37.2-1778236003-7c2f6580d32e50f1a6866c12122662856f54eec2"
+cilium_hubble_envoy_image_tag: "v1.34.10-1762597008-ff7ae7d623be00078865cff1b0672cc5d9bfc6d5"
 kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn"
 kube_ovn_container_image_tag: "v{{ kube_ovn_version }}"
 kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway"
@@ -271,9 +271,9 @@ haproxy_image_tag: 3.2.13-alpine
 # bundle with kubeadm; if not 'basic' upgrade can sometimes fail
 coredns_supported_versions:
  '1.36': 1.14.2
  '1.35': 1.12.4
  '1.34': 1.12.1
  '1.33': 1.12.0
 coredns_version: "{{ coredns_supported_versions[kube_major_version] }}"
 coredns_image_repo: "{{ kube_image_repo }}{{ '/coredns' if coredns_version is version('1.7.1', '>=') else '' }}/coredns"
 coredns_image_tag: "{{ 'v' if coredns_version is version('1.7.1', '>=') else '' }}{{ coredns_version }}"
@@ -294,7 +294,7 @@ scheduler_plugins_scheduler_image_tag: "v{{ scheduler_plugins_version }}"
 registry_version: "2.8.1"
 registry_image_repo: "{{ docker_image_repo }}/library/registry"
 registry_image_tag: "{{ registry_version }}"
-metrics_server_version: "0.8.1"
+metrics_server_version: "0.8.0"
 metrics_server_image_repo: "{{ kube_image_repo }}/metrics-server/metrics-server"
 metrics_server_image_tag: "v{{ metrics_server_version }}"
 local_volume_provisioner_version: "2.5.0"
@@ -327,9 +327,9 @@ csi_livenessprobe_image_repo: "{{ kube_image_repo }}/sig-storage/livenessprobe"
 csi_livenessprobe_image_tag: "v2.11.0"
 snapshot_controller_supported_versions:
  '1.36': "v7.0.2"
  '1.35': "v7.0.2"
  '1.34': "v7.0.2"
  '1.33': "v7.0.2"
 snapshot_controller_image_repo: "{{ kube_image_repo }}/sig-storage/snapshot-controller"
 snapshot_controller_image_tag: "{{ snapshot_controller_supported_versions[kube_major_version] }}"
--- a/roles/kubespray_defaults/defaults/main/main.yml
+++ b/roles/kubespray_defaults/defaults/main/main.yml
@@ -33,10 +33,6 @@ kube_version_min_required: "{{ (kubelet_checksums['amd64'] | dict2items)[-1].key
 ## Kube Proxy mode One of ['ipvs', 'iptables', 'nftables']
 kube_proxy_mode: ipvs
 # When true, kubeadm skips the kube-proxy addon (for example Cilium kube-proxy replacement).
 # Node and package tasks that exist only for kube-proxy also honor this (IPVS/nftables modules, ipvsadm, strict_arp checks).
 kube_proxy_remove: false
 # Debugging option for the kubeadm config validate command
 # Set to false only for development and testing scenarios where validation is expected to fail (pre-release Kubernetes versions, etc.)
 kubeadm_config_validate_enabled: true
@@ -237,10 +233,6 @@ cilium_deploy_additionally: false
 #   - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
 cilium_identity_allocation_mode: crd
 # The default IP address management mode is "Cluster Scope".
 # https://docs.cilium.io/en/stable/concepts/networking/ipam/
 cilium_ipam_mode: cluster-pool
 # Determines if calico_rr group exists
 peer_with_calico_rr: "{{ 'calico_rr' in groups and groups['calico_rr'] | length > 0 }}"
@@ -529,33 +521,6 @@ external_hcloud_cloud:
  ##    arg2: "value2"
  controller_extra_args: {}
 ## Structured authentication config
 ## Structured AuthenticationConfiguration (GA in k8s v1.34) configures the API server's authentication with a structured configuration file.
 ## Note: The `--authentication-config` and `--oidc-*` flags are mutually exclusive. The two features cannot be used at the same time.
 ## Docs: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration
 ## KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3331-structured-authentication-configuration
 ## Config API Reference: https://kubernetes.io/docs/reference/config-api/apiserver-config.v1/#apiserver-config-k8s-io-v1-AuthenticationConfiguration
 kube_apiserver_use_authentication_config_file: false
 kube_apiserver_authentication_config_api_version: "{{ 'v1beta1' if kube_version is version('1.34.0', '<') else 'v1' }}"
 kube_apiserver_authentication_config_anonymous:
  enabled: "{{ kube_api_anonymous_auth }}"
  conditions: []
 kube_apiserver_authentication_config_jwt: []
 ## Example structured authentication issuer config that replicates --oidc-* flag based config by reusing the kube_oidc_* variables
 # kube_apiserver_authentication_config_jwt:
 #   - issuer:
 #       url: "{{ kube_oidc_url }}"
 #       certificateAuthority: "{{ kube_oidc_ca_file }}"
 #       audiences:
 #       - "{{ kube_oidc_client_id }}"
 #     claimMappings:
 #       username:
 #         claim: "{{ kube_oidc_username_claim }}"
 #         prefix: "{{ kube_oidc_username_prefix }}"
 #       groups:
 #         claim: "{{ kube_oidc_groups_claim }}"
 #         prefix: "{{ kube_oidc_groups_prefix }}"
 ## List of authorization modes that must be configured for
 ## the k8s cluster. Only 'AlwaysAllow', 'AlwaysDeny', 'Node' and
 ## 'RBAC' modes are tested. Order is important.
@@ -601,6 +566,21 @@ kube_apiserver_authorization_config_authorizers:
 #     - expression: "!('kubeadm:cluster-admins' in request.groups)"
 #     - expression: "!('system:masters' in request.groups)"
 ## Two workarounds are required to use AuthorizationConfiguration with kubeadm v1.29.x:
 ## 1. Enable the StructuredAuthorizationConfiguration feature gate:
 # kube_apiserver_feature_gates:
 # - StructuredAuthorizationConfiguration=true
 ## 2. Use the following kubeadm_patches to remove defaulted authorization-mode flags (Workaround for a kubeadm defaulting bug on v1.29.x. fixed in 1.30+ via: https://github.com/kubernetes/kubernetes/pull/123654)
 # kubeadm_patches:
 # - target: kube-apiserver
 #   type: strategic
 #   patch:
 #     spec:
 #       containers:
 #       - name: kube-apiserver
 #         $deleteFromPrimitiveList/command:
 #           - --authorization-mode=Node,RBAC
 rbac_enabled: "{{ ('RBAC' in authorization_modes and not kube_apiserver_use_authorization_config_file) or (kube_apiserver_use_authorization_config_file and kube_apiserver_authorization_config_authorizers | selectattr('type', 'equalto', 'RBAC') | list | length > 0) }}"
 # When enabled, API bearer tokens (including service account tokens) can be used to authenticate to the kubelet's HTTPS endpoint
--- a/roles/kubespray_defaults/vars/main/checksums.yml
+++ b/roles/kubespray_defaults/vars/main/checksums.yml
@@ -1,254 +1,247 @@
 ---
 crictl_checksums:
  arm64:
    1.36.0: sha256:68328594ccf780a80ae2b092d9f6ce484eec7cf540c275242e8fd954bfd95332
    1.35.0: sha256:519071de89b64c43e2a1661bb5489c6c3fd5e9e5fcef75e50e542b0c891f1118
    1.34.0: sha256:c31d252e203df5f4cf37f314bd3092eb79087e791631c1e607087c74b6d0423f
    1.33.0: sha256:e1f34918d77d5b4be85d48f5d713ca617698a371b049ea1486000a5e86ab1ff3
  amd64:
    1.36.0: sha256:83855e114566a8a8c44c548d515670f51de3a5e1da8b2effb59870e2f10c25a3
    1.35.0: sha256:2e141e5b22cb189c40365a11807d69b76b9b3caced89fac2f4ec879408ce2177
    1.34.0: sha256:a8ff2a3edb37a98daf3aba7c3b284fe0aa5bff24166d896ab9ef64c8913c9f51
    1.33.0: sha256:8307399e714626e69d1213a4cd18c8dec3d0201ecdac009b1802115df8973f0f
  ppc64le:
    1.36.0: sha256:43c696ef906f072f4733203809a0c9a5ec0902422ecbfa18bba92248ff1d3f20
    1.35.0: sha256:786522b14d684604c8b435312a310972bc1b460cddb1bb216a298098cd86b22e
    1.34.0: sha256:1da50181f2f6f6f6332b9dbc7d7cc020457ccd542620167953c0e288535acc93
    1.33.0: sha256:4224acfef4d1deba2ba456b7d93fa98feb0a96063ef66024375294f1de2b064f
 crio_archive_checksums:
  arm64:
    1.36.0: sha256:b9d32392f2c7db6b72e917b8473e12f5d1b9da9d7d9f8d037ab9f19fab2f8ddd
    1.35.3: sha256:ba8a300eaa93224190bb3dabfcdf6bd264a0c5cbd6f86cec1bb9ff00a3727d32
    1.35.2: sha256:c51d0a78afa0b267fcadf49ad481f35cce3728a7d09ebd05db7c8fb8417f9ef0
    1.35.1: sha256:15fe5c7b87c985a3a78324227b920a01f3309fd1aa5eadfaa38fd48a4dd96d17
    1.35.0: sha256:e57175a4d00387b78adfbe248d087d8127bed625afb529e34b2c90d08cfdaf87
    1.34.8: sha256:a868ea0459a36b52ac183d830cc589d99b5c8b0f9ed9299922453bbf3758c3fd
    1.34.7: sha256:5c25e7084f8369f540e236be1a1a7e830fd1fa6256422466d414c2fc20aa0e86
    1.34.6: sha256:ac189974bcc1cb6829e7b61a39bc3f34fc27a32e5c9d2628bdfc74f88edb6988
    1.34.5: sha256:999a5dc2dc9854222aeff8a20897e0b34f0ba02c9b260b611d66c62e00e279e0
    1.34.4: sha256:d176f6256d606a3fc279f9f2994ef4a4c4cbaaa0601f4d1bba1a19bec5674ce9
    1.34.3: sha256:314595247054b53767a736e24bc3030a5f7c17552944c62b2e190c9e95fe4ca6
    1.34.2: sha256:ac7530f7fc9d531a87bfdfcae9cf8bf81a8bbdb75e63a046ed96911aa7b68ebd
    1.34.1: sha256:41a71cab6a61ae429ec447d572fd1cdea0a7e33d62aaa58c3b07467665b50b9f
    1.34.0: sha256:3006658270477c5fb1e88e9124e40982d2ba7b34495fcc12f0fecd33bbab9a5a
    1.33.9: sha256:bfcd534db3d1a9380dd7007d623e1eb3250ba64f7c4657e79e9e99b1d874f8f1
    1.33.8: sha256:59c91726535dcadd0372df0c6aa8595e4d59590994b598b2d97ea2510b216359
    1.33.7: sha256:af3ea22d3d6944c9a907c6c13d77e9fc4dbcf3972ffbde18dd6f37f1c2ffbd0d
    1.33.6: sha256:6ee49e746d1a5be1a664a6f801c68b169cb181a9aaf12218eed121e2b151bfdb
    1.33.5: sha256:ef1b5e2162b0f55722e0966db0cfe387f3ba7cb91d6a803f627121733132792d
    1.33.4: sha256:6a04cb1ab2020508927d7237ff1174bb330211a1076683417b30642a9c8e4996
    1.33.3: sha256:39cfbb196326952e554e0fb5f95ebcb6cc1735cf6d56a88b8ecd17d89fbc6c26
    1.33.2: sha256:0a161cb1437a50fbdb04bf5ca11dbec8bfc567871d0597a5676737278a945a36
    1.33.1: sha256:6bf135db438937f0ab7a533af64564a0fb1d2079a43723ce9255ecbf9556ae05
    1.33.0: sha256:8a0dbee2879495d5b33e6fdeac32e5d86c356897bdcf3a94cd602851620ce8b5
  amd64:
    1.36.0: sha256:7fc7a2cca25b4cf2de01660bc730fad92b6bcbecd47751e76be3d6ae545c56cd
    1.35.3: sha256:ab7362f76bf7c908c486a2f36d1587c98aeedb8f6ad4bd6731a708b9b44033f6
    1.35.2: sha256:d38771791f2bae086b24400a1e04cffed4eba6c8e9d30b03c625f8aea70921a9
    1.35.1: sha256:cd819546f01ae9dddd4a85b82f220518b37596053555a85e4b4a3d200a6e9354
    1.35.0: sha256:55b6d3e9fc9a5864ab5cdf0b24d54b1dcbaf6d4919274b3b9eb37bfc4b0b8cb5
    1.34.8: sha256:b1828dd21446fb1d60d5ce8d8d45db1930e02b0ae404c01c94136bc23d45d39e
    1.34.7: sha256:8e1d625f6137ee08f669db6ce361cecbd7c5bb52e8e3e314e82999d738570dfa
    1.34.6: sha256:9f17d9a7dc8d8c4fc16eccca65fe5db8177392f26156335dc6318a14215a5cd1
    1.34.5: sha256:d6606fb6d686b8f814dfec801f0f3cf2ded974c194fa90facefda36075b6fab2
    1.34.4: sha256:f6348a781c34b433fe1c5150da3408e51e828b610eacbe734405e9c31136d810
    1.34.3: sha256:e269914f3bc4f36ac87cd593d74daaa43c390571994062180019248be32cc6f7
    1.34.2: sha256:3a0012938ed389e9270a208bb73b250062d5f1be5798472b1728403d55ddc1da
    1.34.1: sha256:22c1e4d68d9339aa58a1b0f1b40a8944102934a7505105abe461dc8a7e3de540
    1.34.0: sha256:5a8bc5c3b8072cb9bde1cf025d5597f75bf21018712c5b72d5cb0657948595c8
    1.33.9: sha256:81c20a12866d9a7c08c6e381ed326141c917454b696a05b46ae27665fe3c5cfa
    1.33.8: sha256:537adda39074377893f1f650a71b576ba487b3c4d2ee55e9b22f4e95fc188594
    1.33.7: sha256:e2999436a272c77370241a4f962c80737698dd8c2400fe75e5c7cf2142c96001
    1.33.6: sha256:4d0d446f73d9db6d5bf2c03ecdc39d9d702836886f4715886c15dc2f461cc810
    1.33.5: sha256:b8883e51837ee7fd45c88c762f37ca4b96d80ec6a7b46ec989381089e762aa7f
    1.33.4: sha256:8f6d14828659b85da7c83bad798d50c2f7e0311742615fb7ed305f77bab54e50
    1.33.3: sha256:2ee843fd1bbdf32607015771a2e1320b46829f22516e559a49dc7c4e29bb756e
    1.33.2: sha256:6e82739bbbeae12d571a277a88d85e8a0e23dbc87529414a91ee5f2e23792dcf
    1.33.1: sha256:036063194028d24c75b9ce080e475ad97bacc955de796b7c895845294db8edbf
    1.33.0: sha256:dad0cec9e09368b37b35ce824b0ef517a1b33365c4bb164fe82310c73c886f7e
  ppc64le:
    1.36.0: sha256:0fbf8502f1e289316bc0cb19915c7765bd3cfce8fd880e19f9ba343e2c5ab3ea
    1.35.3: sha256:bd95d3aa3b41f173312bd1a0c8a4398c37d08d5a65d63f773f2f4635ccb769bc
    1.35.2: sha256:aff7a251a0a8f57c7ce4794d8d28465baa43e49990cd5c9d5958da22e958d5eb
    1.35.1: sha256:b4a23e9f70297f01da2840f94b82adf2ac67a4017e1d93f0c20526637df282ca
    1.35.0: sha256:081ab73a6970ac3c68893dea9a03b0732ca22ab44a2aa8794fddac0bd4dfa749
    1.34.8: sha256:092e501730611d5161052b9248e42003bd158890f4597282c00242346fecc5c8
    1.34.7: sha256:9d8c7660d6e4d03f059aa90aba762b94d7b481fff603247b2a8ed9ca8c477c05
    1.34.6: sha256:395a475c0181a0c82e89e6dd8e258c6c0529f889a7fc9d0a54da3218b76f58f4
    1.34.5: sha256:3a10d4c1406df01bd9ab88750eabc1273964e9c5f24c7d4a0b719ae77e6cfec2
    1.34.4: sha256:dca59a28fe9b0b9163418eca1545c9ed01cf514179f108d14e462c6074fd103c
    1.34.3: sha256:4dd782484eeb460b9a95e6e2e07474216fc02ad45a27ba871799d18f2b6ee0ae
    1.34.2: sha256:d4c3c9ba24b1b0eabf3c11ddec98801dda7a87b0529706e9ede18b8cc9e4182a
    1.34.1: sha256:cba0ac74e7202fe28cf8aa895b83f7a30d78b148666add78e19215259f629bb0
    1.34.0: sha256:e9e41d14439db0ca88cf2cd8533038203f379c25cd612f37635c17908e050ebf
    1.33.9: sha256:c0a9e60800f66f85c70615128fec5a8358ffde0f715a4058163707dbcca8eb94
    1.33.8: sha256:1d69c01512e8ebdd51fc70fc64473a31d492e8db095c0ee5d3ee58722048150c
    1.33.7: sha256:076e7519bfff72a43fb1121ce836eee3cc1fec5bb5a59a11747c514e9d162d26
    1.33.6: sha256:3643eefe295604288f5b652fb9c672a60f96dc803e63edaf9ee64ed4047a50dd
    1.33.5: sha256:cf85062f39d755418da0ee4f869c7a4817bf95daee6e35df53010ad29be37c88
    1.33.4: sha256:2b1594dad9af944e29ee74e788a8d28e1304e3f435f2efb61e5c38f20c2106f7
    1.33.3: sha256:4293bc74f348db58adb0b0dd6affb918abee999cbaf0e42ea8a33427b8d278a5
    1.33.2: sha256:8ed65404a57262a9f8eb75b61afa37fcec134472eb1a6d81f1889a74ff32c651
    1.33.1: sha256:12646aca33f65fe335c27d3af582c599584d3f51185f01044e7ddd0668bb2b4c
    1.33.0: sha256:b4fa46b25538d8145197f8bf2e935486392c0ca2a9fa609aedd02b9f106d37a6
 kubelet_checksums:
  arm64:
    1.36.1: sha256:bf274dd3affbf2543d20465dee1f763f668f78c6fbd56197794f81337a49d687
    1.36.0: sha256:049d95107361583e64f3ac9b8c9bdaf73fc7e512a838972b13b423a33ece87e9
    1.35.5: sha256:a100cfe89d7dd7a49a07164c6ccb78df02563483ef5b37330e1150e37e8868b3
    1.35.4: sha256:d710eef03bb4ad164bb77af9be5b11b44f874e2fc08153c7d383420d685f73e8
    1.35.3: sha256:58496a5d16d4316b18397735190d2d41e0c368169ecb458d91b09f4cd1e03c80
    1.35.2: sha256:eaf11f9c20c385624775671662e127b083c9b5d0b451fd613f9468e09ca5656c
    1.35.1: sha256:73475c6db8fd8a9780b1b378fa2f917875e6146166c24603c1abc6eafd4493a8
    1.35.0: sha256:aa658d077348b43d238f50966a583f4244b2a7d45590c77b3b165b7d44983ab8
    1.34.8: sha256:5d8d62d15f18c18998af09fcab83420b9cbccc2be7fede2a0b26f4a3f523c6b5
    1.34.7: sha256:07658e949e5a089faf36da7ae4e7242a4d2a97fa8eaace0980fd9705d23143a8
    1.34.6: sha256:6b30975e2a582367b5048ffdf9ae26e05442cc18faaf29b5dbd9c6a6b556fa26
    1.34.5: sha256:a4cd54fa5af5ed6b4ed14cf172d30f53fd1f197d7d3f43af733b54b19cc87ac5
    1.34.4: sha256:c78845473c434ee85a2444eeab87f8b20f524e3ab6854a078f79468f44aad8f5
    1.34.3: sha256:765b740e3ad9c590852652a2623424ec60e2dddce2c6280d7f042f56c8c98619
    1.34.2: sha256:3e31b1bee9ab32264a67af8a19679777cd372b1c3a04b5d7621289cf137b357c
    1.34.1: sha256:6a66bc08d6c637fcea50c19063cf49e708fde1630a7f1d4ceca069a45a87e6f1
    1.34.0: sha256:e45a7795391cd62ee226666039153832d3096c0f892266cd968936e18b2b40b0
    1.33.8: sha256:e835f15be6d8b7b27b963a46c4a054f7663c26741f17e003bfcb8271350cf882
    1.33.7: sha256:3035c44e0d429946d6b4b66c593d371cf5bbbfc85df39d7e2a03c422e4fe404a
    1.33.6: sha256:7d8b7c63309cfe2da2331a1ae13cce070b9ba01e487099e7881a4281667c131d
    1.33.5: sha256:c6ad0510c089d49244eede2638b4a4ff125258fd29a0649e7eef05c7f79c737f
    1.33.4: sha256:623329b1a5f4858e3a5406d3947807b75144f4e71dde11ef1a71362c3a8619cc
    1.33.3: sha256:3f69bb32debfaf25fce91aa5e7181e1e32f3550f3257b93c17dfb37bed621a9c
    1.33.2: sha256:0fa15aca9b90fe7aef1ed3aad31edd1d9944a8c7aae34162963a6aaaf726e065
    1.33.1: sha256:10540261c311ae005b9af514d83c02694e12614406a8524fd2d0bad75296f70d
    1.33.0: sha256:ae5a4fc6d733fc28ff198e2d80334e21fcb5c34e76b411c50fff9cb25accf05a
  amd64:
    1.36.1: sha256:7efa1780c73d9fb3a464002864e582eb2d15aa691e475eaae323093d08feae14
    1.36.0: sha256:d857082946c28493e8fdc52227feabd962e0e0900b6c6e4f6510168043b79dd4
    1.35.5: sha256:4ba1f892bd52fdae7cd2abb1b1111054ff274c71f88af0a85fd9f1107e8d46c8
    1.35.4: sha256:983a6ba5a49823dcdd745c674e5e2416377dd27d6ad1b42d2befa0fb961a19f6
    1.35.3: sha256:28d570423eaad5f1f5658a646bd8c015c786c95d62ffaf14bf35fa0c4326fa05
    1.35.2: sha256:20887f461c0de96b0cb14c7af6b897f92d424ac078f8642f98e83ef52a0bf03e
    1.35.1: sha256:e7343310e03ff0d424df4397bdfa4468947d6d1f0f93dac586c1e8d6e4086d5d
    1.35.0: sha256:2f4ed7778681649b81244426c29c5d98df60ccabf83d561d69e61c1cbb943ddf
    1.34.8: sha256:117ff5f6923c9ab4af7fa4e995a2bdc48b4b0f84d00017b4d7368e1e861e84f2
    1.34.7: sha256:1bc50f574e2f365513c07055e007d284d5e93322282ed288d27e81c2b4356d8c
    1.34.6: sha256:603e15187e0a909a2f104b17b3ea1d927514eae9fe1e96cd8a05b015cf1ee82c
    1.34.5: sha256:660c7da5cca02dcd83ba21bb3df95a8983bb1c0169af396a8cc234a6d6e7297f
    1.34.4: sha256:03b8fea715a7ef82eeaf518dee34c72670c57cc7bc40dc1320c04fbf4f15172f
    1.34.3: sha256:0e759f40bbc717c05227ae3994b77786f58f59ffa0137a34958c6b26fa5bcbbd
    1.34.2: sha256:9c5e717b774ee9b9285ce47e7d2150c29e84837eb19a7eaa24b60b1543c9d58f
    1.34.1: sha256:5a72c596c253ea0b0e5bcc6f29903fd41d1d542a7cadf3700c165a2a041a8d82
    1.34.0: sha256:5c0d28cea2a3a5c91861dda088a29d56c1b027e184dae1d792686f0710750076
    1.33.8: sha256:1caa69c5328cfa774218f75f0621a6f10a1b97e095af85015f468aeb8fdf956a
    1.33.7: sha256:2cea40c8c6929330e799f8fc73233a4b61e63f208739669865e2a23a39c3a007
    1.33.6: sha256:10cd08fe1f9169fd7520123bcdfff87e37b8a4e21c39481faa382f00355b6973
    1.33.5: sha256:8f6106b970259486c5af5cbee404d4f23406d96d99dfb92a6965b299c2a4db0e
    1.33.4: sha256:109bd2607b054a477ede31c55ae814eae8e75543126dc4cea40b04424d843489
    1.33.3: sha256:37f9093ed2b4669cccf5474718e43ec412833e1267c84b01e662df2c4e5d7aaa
    1.33.2: sha256:77fa5d29995653fe7e2855759a909caf6869c88092e2f147f0b84cbdba98c8f3
    1.33.1: sha256:f7224648451dd4f9f2c4f79416f9874223c286ce41727788965fd0341ddb59c4
    1.33.0: sha256:dd416d94850c342226d3dcdce838518b040ccea16548bfeaf2595934af88ef60
  ppc64le:
    1.36.1: sha256:98b63a44b87fb78ceca06918b5a0b5d01ab581fb12fbed9a2f7e8998fca64e8a
    1.36.0: sha256:761a1f6d3570fd4f25b151ec7570d061629320931c10e57f93f3924a490738eb
    1.35.5: sha256:96ead1e3161093f38627ebb02acfb9cb0b76e09f444dc134b5ae40ca9dbe5684
    1.35.4: sha256:2ad1490dd74092d3be53953b13bef36f6fd45d6ad5c05caeffb6afef67ac8ef7
    1.35.3: sha256:f4665d0ad4f43784d90037d67dcce17cc2b079e4d7b165b85a8a90fb1ddc1b51
    1.35.2: sha256:6516f318a3711e83c0b3b8b069514a87c7dfeda931082c1b561043a7c54e312e
    1.35.1: sha256:ec8b7f870043f711b5d73e528342af1705d6ad7f8308d7f31d74d967986b54f6
    1.35.0: sha256:f24eb1244878a3876fe180e6052822cc9998033850478b2f4776e5c3b09baecd
    1.34.8: sha256:4b4406352433e26c1dd245f879962d7a571c4173f84cc7f5013d89ad315648f7
    1.34.7: sha256:a63cc1b7ef2ae22ca800a6be55a316db72127d97dd19fc49457a76f28126c708
    1.34.6: sha256:4047c3c7b3c099554b91a57ca7f1f314445d04acd201609b7f9b4151ba8b2fdb
    1.34.5: sha256:625858ed19559873af61728a50cc250419432ecaa2c8062f78e86e41df358f3c
    1.34.4: sha256:fab75e3eb1e0edf15aef7e8ba219256b44f047544ac421737d1778784fa46676
    1.34.3: sha256:67dcceb6d91710e4da7af720eda7b20fd4e8c24237fc345602bb54439ad8ccca
    1.34.2: sha256:a195f278b9bac26803f1e26b0f608e0dce66aad033e8c043e8555775612530c9
    1.34.1: sha256:c4782dbf1987680e9b2baa3ecf5db9e66395772e82b251eb73a150fbfbe0b906
    1.34.0: sha256:ed663fa4ff3e305276dd889885303e07989dfab073e95ef2da931b975f6686e8
    1.33.8: sha256:392ed39b6c037bc5c510412c9b5cfd29238d31dd67d1a3cbae7ef4a274304c63
    1.33.7: sha256:f96dd4272ca8eccf1f93fb5162323840b9286c5a42a5305fcc1b4d47889534d3
    1.33.6: sha256:00ae91297503518efd237d40900af4de0067597ae4f2ab8250ddb629ffb6df05
    1.33.5: sha256:1d785ead3f6709f66a105c629a020b9dfe6dff775fae42f7d147edec2d178351
    1.33.4: sha256:5133077024e5a59ece48d2e6d0fdaeed5c4f90c5e781f25c89c984ee4da396a6
    1.33.3: sha256:bb4123e09734348d4b553c031bfe7710adcffffe79ed9973a526e36d87aa19fe
    1.33.2: sha256:be8412cb9bf30125e3a88ecb9bfca4df1ff5d4e650947c46222683071f1a17d7
    1.33.1: sha256:c1bc01115a513eaec76d56dc52a52aeb05f866a6d07c55335c1fff56c868543d
    1.33.0: sha256:6fa5abbc14d65b943b00fcfc8a6ac7eb39fd7e924271738c6f17e0b7e74c665b
 kubectl_checksums:
  arm:
    1.36.1: sha256:0f5f7530e6ac3b887e01c963b5eea477cc6f590ec5e3a4e23a5485e6d9227761
    1.36.0: sha256:bd1ab1f3d3cb7dec7c46799355e82717a6519fa83708752c2be88fe5c378681f
    1.35.5: sha256:7c3ad2c154975287027cbfaaeaeed83c2f5ec1d602e9b10646da204850d295df
    1.35.4: sha256:44093efefd9f776b352f634cea6c4e8fcf4e78378ffda7f31db23072cef97864
    1.35.3: sha256:9cec279039e5c95c79f939f7245d57cf3f65c799de8d76e68281479ace742f68
    1.35.2: sha256:02b6affb0da9837b88354e44a7a188cbe2ad522060c880c70eacd33f19944c35
    1.35.1: sha256:dbe14e5b12184d72978b17b167aedc3f42f4a1faf249180025d6359eebcd983e
    1.35.0: sha256:dca28f6af03b31ca6043baa1da7332472c7a3df743606a758534b9ac3ed7ecce
    1.34.8: sha256:3b55edd8e01af9b9d1cf566058fb421ea5fbbea001ec66d6e0f826e11d05ccea
    1.34.7: sha256:e016e26a114941a68777b521cc92f0c9fcd2a3bcba01045822450c04d9719bf4
    1.34.6: sha256:7dcec0e5d6cd49608e42988eb6485908ed0be7cdc4a9a874f916806f22cfcf01
    1.34.5: sha256:a042713dd3911a46c2118d2df3967cfcee0e3cdf4e78865e1d427a67cf58e7ba
    1.34.4: sha256:3a6e631bdbb79e633d23055dadc97b45f45d325105ddf40e696de2a324a254c0
    1.34.3: sha256:e0cf1eddede6abfd539e30ccbb4e50f65b2d6ff44b3bb9d9107ea8775a90a7e4
    1.34.2: sha256:18e03c1c6ab1dbff6d2a648bf944213f627369d1daeea5b43a7890181ab33abf
    1.34.1: sha256:ca6218ae8bf366bd8ccdcb440b756c67422a4e04936163845f74d8c056e786ee
    1.34.0: sha256:69d2ce88274caf9d9117b359cc27656fb6f9dd6517c266cfd93c6513043968b8
    1.33.8: sha256:734dea07663751c8b45926c843e2c250f13473d65f396555a1ecfe0c9c502fa8
    1.33.7: sha256:f6b9ac99f4efb406c5184d0a51d9ed896690c80155387007291309cbb8cdd847
    1.33.6: sha256:89bcef827ac8662781740d092cff410744c0653d828b68cc14051294fcd717e6
    1.33.5: sha256:5a3a416a85cfc9f7a348c0c0e6334b7449e00a57288ab5a57286ccf68a4d06af
    1.33.4: sha256:eefd3864ce5440e0ba648b12d53ccffaad97f1c049781b1aa21af6a5278f035f
    1.33.3: sha256:0124dba9e9091b872591cabcbaea7df07069cb132d38d95f3c7bc8d5b8b621a9
    1.33.2: sha256:f3992382aa0ea21f71a976b6fd6a213781c9b58be60c42013950110cf2184f2a
    1.33.1: sha256:6b1cd6e2bf05c6adaa76b952f9c4ea775f5255913974ccdb12145175d4809e93
    1.33.0: sha256:bbb4b4906d483f62b0fc3a0aea3ddac942820984679ad11635b81ee881d69ab3
  arm64:
    1.36.1: sha256:59f7ee8e477fae658447607dc3c8790ac17a1b016c01c622c12070e969e2d4e7
    1.36.0: sha256:9f9d9c44a7b5264515ac9da5991584e2395bd50662e651132337e7b4d0c56f8f
    1.35.5: sha256:ac69e06fd6860d69786692f5af1c3a1208ed54f8366a4d97ab15c172e99765ee
    1.35.4: sha256:6a5a4cc4e396d7626a7a693a3044b51c75520f81db30fe6816c2554e53be336f
    1.35.3: sha256:6f0cd088a82dde5d5807122056069e2fac4ed447cc518efc055547ae46525f14
    1.35.2: sha256:cd859449f54ad2cb05b491c490c13bb836cdd0886ae013c0aed3dd67ff747467
    1.35.1: sha256:706256e21a4e9192ee62d1a007ac0bfcff2b0b26e92cc7baad487a6a5d08ff82
    1.35.0: sha256:58f82f9fe796c375c5c4b8439850b0f3f4d401a52434052f2df46035a8789e25
    1.34.8: sha256:4c9fe1f717738950c638c38056130a8db5075e6413ae36d8687221a240cdf88b
    1.34.7: sha256:93d2113f1f38b5709f2955b7981fcd37d675c9aafda81702c202a63361b6093b
    1.34.6: sha256:a49a439f83f504e6bc051f516a8baf8d2220d74110f7f9bcaf25feac69e368d1
    1.34.5: sha256:2d433b53b99ea532f877df6fa5044286e3950d4933967ac3d99262760bc649fd
    1.34.4: sha256:5b982c0644ab1e27780246b9085a5886651b4a7ed86243acbb2bacc1bea01dda
    1.34.3: sha256:46913a7aa0327f6cc2e1cc2775d53c4a2af5e52f7fd8dacbfbfd098e757f19e9
    1.34.2: sha256:95df604e914941f3172a93fa8feeb1a1a50f4011dfbe0c01e01b660afc8f9b85
    1.34.1: sha256:420e6110e3ba7ee5a3927b5af868d18df17aae36b720529ffa4e9e945aa95450
    1.34.0: sha256:00b182d103a8a73da7a4d11e7526d0543dcf352f06cc63a1fde25ce9243f49a0
    1.33.8: sha256:76e284669f1f6343bd9fe2a011757809c8c01cf51da9f85ee6ef4eb93c8393a8
    1.33.7: sha256:fa7ee98fdb6fba92ae05b5e0cde0abd5972b2d9a4a084f7052a1fd0dce6bc1de
    1.33.6: sha256:3ab32d945a67a6000ba332bf16382fc3646271da6b7d751608b320819e5b8f38
    1.33.5: sha256:6db7c5d846c3b3ddfd39f3137a93fe96af3938860eefdbf2429805ee1656e381
    1.33.4: sha256:76cd7a2aa59571519b68c3943521404cbce55dafb7d8866f8d0ea2995b396eef
    1.33.3: sha256:3d514dbae5dc8c09f773df0ef0f5d449dfad05b3aca5c96b13565f886df345fd
    1.33.2: sha256:54dc02c8365596eaa2b576fae4e3ac521db9130e26912385e1e431d156f8344d
    1.33.1: sha256:d595d1a26b7444e0beb122e25750ee4524e74414bbde070b672b423139295ce6
    1.33.0: sha256:48541d119455ac5bcc5043275ccda792371e0b112483aa0b29378439cf6322b9
  amd64:
    1.36.1: sha256:629d3f410e09bf49b64ae7079f7f0bda1191efed311f7d37fdbab0ad5b0ec2b7
    1.36.0: sha256:123d8c8844f46b1244c547fffb3c17180c0c26dac9890589fe7e67763298748e
    1.35.5: sha256:90f75ea6ecc9ea5633262e1c0b83a40560003b30fc94a04cb099404fcef0c224
    1.35.4: sha256:b529430df69a688fd61b64ad2299edb5fd71cb58be2a4779dba624c7d3510efd
    1.35.3: sha256:fd31c7d7129260e608f6faf92d5984c3267ad0b5ead3bced2fe125686e286ad6
    1.35.2: sha256:924eb50779153f20cb668117d141440b95df2f325a64452d78dff9469145e277
    1.35.1: sha256:36e2f4ac66259232341dd7866952d64a958846470f6a9a6a813b9117bd965207
    1.35.0: sha256:a2e984a18a0c063279d692533031c1eff93a262afcc0afdc517375432d060989
    1.34.8: sha256:f6249132865c13abe3c9dd5038f5da65849cb86eee1608c001831504e481aa8c
    1.34.7: sha256:b46ecf2b80f76d5a7d58c296c2e11e42c85eaa1eb866ddbc1e91625f71c21000
    1.34.6: sha256:3166155b17198c0af34ff5a360bd4d9d58db98bafadc6f3c2a57ae560563cd6b
    1.34.5: sha256:6a17dd8387783b3144a65535e38d02c351027e9718ea34a6c360476cb26d28bb
    1.34.4: sha256:d50c359d95e0841eaad08ddc27c7be37cba8fdccfba5c8e2ded65e121ff112db
    1.34.3: sha256:ab60ca5f0fd60c1eb81b52909e67060e3ba0bd27e55a8ac147cbc2172ff14212
    1.34.2: sha256:9591f3d75e1581f3f7392e6ad119aab2f28ae7d6c6e083dc5d22469667f27253
    1.34.1: sha256:7721f265e18709862655affba5343e85e1980639395d5754473dafaadcaa69e3
    1.34.0: sha256:cfda68cba5848bc3b6c6135ae2f20ba2c78de20059f68789c090166d6abc3e2c
    1.33.8: sha256:7f9c3faab7c9f9cc3f318d49eb88efc60eb3b3a7ce9eee5feb39b1280e108a29
    1.33.7: sha256:471d94e208a89be62eb776700fc8206cbef11116a8de2dc06fc0086b0015375b
    1.33.6: sha256:d25d9b63335c038333bed785e9c6c4b0e41d791a09cac5f3e8df9862c684afbe
    1.33.5: sha256:6a12d6c39e4a611a3687ee24d8c733961bb4bae1ae975f5204400c0a6930c6fc
    1.33.4: sha256:c2ba72c115d524b72aaee9aab8df8b876e1596889d2f3f27d68405262ce86ca1
    1.33.3: sha256:2fcf65c64f352742dc253a25a7c95617c2aba79843d1b74e585c69fe4884afb0
    1.33.2: sha256:33d0cdec6967817468f0a4a90f537dfef394dcf815d91966ca651cc118393eea
    1.33.1: sha256:5de4e9f2266738fd112b721265a0c1cd7f4e5208b670f811861f699474a100a3
    1.33.0: sha256:9efe8d3facb23e1618cba36fb1c4e15ac9dc3ed5a2c2e18109e4a66b2bac12dc
  ppc64le:
    1.36.1: sha256:b6acc7be1bfd5f9a10cd6b03b8e6c25a96c0f9a127efa31932752d3ffe97d909
    1.36.0: sha256:c0a8afcb7899202969000debabcf98013c902c42765537e96c52da0e31be3032
    1.35.5: sha256:152feec62929570afd0baf83aa4c75e0f1d7ef72aa643a2317a23c2763d6fcc0
    1.35.4: sha256:f342a732cd59cb390e1bbcae1262d07b5e700ff0e8447ced0ee2331ae6e39c70
    1.35.3: sha256:71bbea965f06679407e3b394103c83104d730510cdb5e1d1826359d789eeef7c
    1.35.2: sha256:2101400af7fb53d326cee8d3411c9348e0735ac85d7059cd61514632181b8810
    1.35.1: sha256:bced44e491ce52cce11e2b4bd4bd9181f4f963ffe868438778d028d56485c5d9
    1.35.0: sha256:8989809d0ac771244dabe50ed742249ac60eeb6d385cd234ee151eb40b7c32c4
    1.34.8: sha256:a571c1cd7106696ee8ce9a88e1fccc291fef7e7e2973a5b4acefaeb14fad4645
    1.34.7: sha256:0769c29f0f0f5d8e342e514c23ca5763d2843f93d7d9d6f1b1e4b3c267eefc6a
    1.34.6: sha256:21c68869ad4adce9ea9ad6f3a3adb031104331e1a5f442ab01a4b6851d6a6c0e
    1.34.5: sha256:22e5813388d20881c2225c86420cd2ff69ed7fc5e953842bb041d4842c38d7f7
    1.34.4: sha256:b083c39879483816f34d1f7e2e31e70ec48984fcc1753c79f4b846cfedbf41ac
    1.34.3: sha256:ae239b7f6f071e47014e1b5b20aa60626e06b32922a6b5054562ae2c5fa82c18
    1.34.2: sha256:49a985986a9add6c229c628bf2a83addebbdeeef40469fce2a54e51b6f1bb05b
    1.34.1: sha256:45499f0728b4a3428400db289edb444609d41787061f09b66f18028c0a73652f
    1.34.0: sha256:1773805a0c128f4d267b2e11f4c74cac287e9a07fffaecc3f7af6df9c8aaf82c
    1.33.8: sha256:aa079f403c80ba6017449c230733fed4e5d7b0a8700bd6590ee202161b8b12af
    1.33.7: sha256:0807c38a1342ab8dea6435f33d5897a01527d348a968a5c4ca2929769f3d54f2
    1.33.6: sha256:4b056b1749c619fab6a855247c3bd04123f2b61cf136ca6bddf69ff97a727e32
    1.33.5: sha256:37e2204d371bbbb90fd693049a7a45b81991ca8bcc9b8baf041a7c9f23e9035c
    1.33.4: sha256:fa61404b9c3d76f342f2ad05616753475739ab488e0beffd22942e0cb266cfa9
    1.33.3: sha256:e0261727822c685f63902f7d78ddfcd112bfde4619692b6c1aae68d162245f67
    1.33.2: sha256:d1cdf13cb786c1ee6d5bf6d85034f496aa2fee97b287028043eb14c5dc74993f
    1.33.1: sha256:f922dd8f558dc616ebaa34908ceb7964ebb8caadd7c48699d0b791ffff2be1aa
    1.33.0: sha256:580d076c891711ec37afaf5994f72a8aad9d45c25413e6e94648e988a5a9933a
 kubeadm_checksums:
  arm64:
    1.36.1: sha256:82fa5119d6687f721cd80cb278bac08f54cc5d3fd0320c66cef9394d42e153a9
    1.36.0: sha256:43d4ca3a9f8f49c2c2f6db2c056de1a00fa110a3dd5aa68a74fbc52e42d96c01
    1.35.5: sha256:24658203703a8bfa2813571881c1ba08f8cc4aff714a5b43bbf417af7d3cf229
    1.35.4: sha256:e8f6b5bee3e2c8b5965f4ae65c2ae04e3f9f426d2458a1e2f159e824d419d92c
    1.35.3: sha256:647a9821c37a27bcaf6d679a191732b686c01cecd0219d5e579129f0cfd62cef
    1.35.2: sha256:b540b734e9eaeb134e2cb7c7803dc62160589ac3b2615d717ce41acb22bbec98
    1.35.1: sha256:80097a3c4ef824f4edfe131d2bd429772c4be3a460c42a44f2320164a917de32
    1.35.0: sha256:1dac7dc2c6a56548bbc6bf8a7ecf4734f2e733fb336d7293d84541ebe52d0e50
    1.34.8: sha256:7b06f4442a7a819fcb4e0697721a2e4a8acda068d66ecfb4e781f213ee804884
    1.34.7: sha256:f0ca19db42757a3612e2a20268209a3843b6eb8c1284f11c5fa7c31d40ed8c8f
    1.34.6: sha256:7878391ea18b276ad69c570dcdaa46f74449a978f8e222f92d99855332a01f62
    1.34.5: sha256:cc8a59c0f04a1d7389790dc872b1c714e4cf4d3ba0c38ca2f4ca1388fb38b774
    1.34.4: sha256:d8028b7e8c8d6c9b3fc3da6bc88d4d0cfb33df1b4b026a7d6e8c35d1471c9f6e
    1.34.3: sha256:697cf3aa54f1a5740b883a3b18a5d051b4032fd68ba89af626781a43ec9bccc3
    1.34.2: sha256:065f7de266c59831676cc48b50f404fd18d1f6464502d53980957158e4cab3a7
    1.34.1: sha256:b0dc5cf091373caf87d069dc3678e661464837e4f10156f1436bd35a9a7db06b
    1.34.0: sha256:6b7108016bb2b74132f7494e200501d6522682c01759db91892051a052079c77
    1.33.8: sha256:b5248b51e66e4716261f2c926fe2f08a293795e6863099e7792b4d57dbb9109e
    1.33.7: sha256:b24eeeff288f9565e11a2527e5aed42c21386596110537adb805a5a2a7b3e9ce
    1.33.6: sha256:ef80c198ca15a0850660323655ebf5c32cc4ab00da7a5a59efe95e4bcf8503ab
    1.33.5: sha256:b1c00657649e35771569d095e531d826bd19baf57bcb53cccf3f91d7d60b7808
    1.33.4: sha256:ef471b454d68ee211e279ddeaebde6ee7a8e14b66ae58e0d0184e967c3595892
    1.33.3: sha256:bf8ed3bc3952e04f29863c6910ae84b359fe7ac1e642ed4d742ceb396e62c6f2
    1.33.2: sha256:21efc1ba54a1cf25ac68208b7dde2e67f6d0331259f432947d83e70b975ad4cc
    1.33.1: sha256:5b3e3a1e18d43522fdee0e15be13a42cee316e07ddcf47ef718104836edebb3e
    1.33.0: sha256:746c0ee45f4d32ec5046fb10d4354f145ba1ff0c997f9712d46036650ad26340
  amd64:
    1.36.1: sha256:f35980333a4dae753807345ae359eca03f48f9945855e6a6a6708fe8b3b24038
    1.36.0: sha256:f962dcee1f49a51368c3b383742144d99eacff77b2132cd0a540ed8c6b30fe81
    1.35.5: sha256:cbf71fbee3a3f60edf3fae4e50994f88a35b35cddf65d373d7955b58e8785397
    1.35.4: sha256:0c0497da793f8897c14e45340da919534b615294a1aab69dc1998896c0f11145
    1.35.3: sha256:a3fb4b3a214a807e2ef4c3fda3196c7f97dcf8152558de5a3c473c869bda0b07
    1.35.2: sha256:a51cb85c70c98ec6868fd3413ac786af5fab4ce51438963752ec5f58e68e5452
    1.35.1: sha256:8a7ff344eef1bfba88f9a74b3fdc9ea4448c94f1b3cefb8c0aeeaf1f96e05053
    1.35.0: sha256:729e7fb34e4f1bfcf2bdaf2a14891ed64bd18c47aaab42f8cc5030875276cfed
    1.34.8: sha256:27ec4962fc855f4e7fdc3875aa275168a66e721c27533c4953294968da96e7e5
    1.34.7: sha256:679f304e592c6f8e20bf24c424a2c5f35d8d181d171e15774cecd0cb1dffb7ba
    1.34.6: sha256:75a48673b8b9149c1555e0de3a2ce603468037d5396d746a75158828c9b56d7c
    1.34.5: sha256:e381f7f5c41f2a6916432177d95c1ee95d5539f790bbeacafe9ef61dc68e8e35
    1.34.4: sha256:b967f1fa0e36621c402d38bb560eb4a943954d5cf5a00e5150842f6f5da73455
    1.34.3: sha256:f9ce265434d306e59d800b26f3049b8430ba71f815947f4bacdcdc33359417fb
    1.34.2: sha256:6a2346006132f6e1ed0b5248e518098cf5abbce25bf11b8926fb1073091b83f4
    1.34.1: sha256:20654fd7c5155057af5c30b86c52c9ba169db6229eee6ac7abab4309df4172e7
    1.34.0: sha256:aecc23726768d1753fd417f6e7395cb1a350373295e8e9d9f80e95ed3618e38e
    1.33.8: sha256:8259af514dc3655e8abec1a69b637f31cce2ecb940a80ae4a268e5287890f009
    1.33.7: sha256:c10813d54f58ef33bbe6675f3d39c8bd401867743ebc729afdd043265040c31d
    1.33.6: sha256:c1b84cb3482dd79e26629012f432541ccb505c17f5073aa1fdbca26b1e4909fd
    1.33.5: sha256:6761219749c6c67a56a5668dfe65d669e0c1f34d4b280b72de6d74d47c601f1e
    1.33.4: sha256:a109ebcb68e52d3dd605d92f92460c884dcc8b68aebe442404af19b6d9d778ec
    1.33.3: sha256:baaa1f7621c9c239cd4ac3be5b7e427df329d7e1e15430db5f6ea5bb7a15a02b
    1.33.2: sha256:5c623ec9a9b8584beba510da5c2b775c41cf51c0accdfb43af093bc084563845
    1.33.1: sha256:9a481b0a5f1cee1e071bc9a0867ca0aad5524408c2580596c00767ba1a7df0bd
    1.33.0: sha256:5a65cfec0648cabec124c41be8c61040baf2ba27a99f047db9ca08cac9344987
  ppc64le:
    1.36.1: sha256:4278b80f58501b29040ec574ee5afd433e140d6f93c1697a465a9fdb215cb2bd
    1.36.0: sha256:e621bf6a3115bea05c26e8d6ef9f7946a27437934e0244bbf59dc296bdf6459e
    1.35.5: sha256:26169d372ea165a01b33ad15259bf9d298ab1f66e326ab83ae0a942c6f3a43df
    1.35.4: sha256:3da9884894da6a6c1083f00c6a837b52084dca9275114694bdc387ba66bff474
    1.35.3: sha256:907fb03a83683e82b0d183675a0c6f0cd36b2cc3970bfe8fdb47098f67ce7828
    1.35.2: sha256:8a3800d88070679a09d2c5cd5dd479d70539dce84415623e876cbaf366d94043
    1.35.1: sha256:eec12948cfabc18115636c44aca894bf9abef3b2ea73cba180314ee3c218dcca
    1.35.0: sha256:77a466e1b6a8e28362a729541269de0a7c4a6b9e7770cccefcd745502e656b90
    1.34.8: sha256:6e52f5fadeaee1fd5218021a47e33864b6a6cb40c7f98b7bef606c5f734d08e5
    1.34.7: sha256:c433c4f7f4193125265b57ea2e99c5dae51a6213db9902558507a2c675ff1131
    1.34.6: sha256:afd06f4f900e6cd65a93248829c9d521c5e78c22ecf9f212628cc7456f14a23b
    1.34.5: sha256:5e5d7dba56b5bb663e70a5d7962b0f6d4328d9b9a8ee77ddbb2e9760265ff61d
    1.34.4: sha256:69f1065e718ef2aa5f0287444ef97bd4a5fb8841fc0662f54ca8992a39865391
    1.34.3: sha256:2b8b48b3b0eb657e04122a158cb7fcad964fba5bd2d8e07f8eeec6f856a63ecf
    1.34.2: sha256:bea4ed6d971523da794a802de15910b08c09e23bc4c850ee3b953c4bdb0b7976
    1.34.1: sha256:ddb6bd80bee0719924ae901672b99205226badab74fb13a9e1bb6d3de49fbb21
    1.34.0: sha256:7201ba36f44187f408a036c4a545e2a3cd12943b1297092687bb66c9a1a9fed6
    1.33.8: sha256:d618fa97b5782b57512e0a8ab9ed17af190236907af7bd3c9c0776d81c78273f
    1.33.7: sha256:db2e20d0c20928ae7d68d7603020f8ffd89dcdac4fdc160ef83f1da663868bed
    1.33.6: sha256:58aaec7b5066b6e3705e0493a2f51c7f101b17165ce714c4d52a2b53861c078b
    1.33.5: sha256:b1e261109a4e22e0a417d10724bed7f71ba12c2acc167a55d89211e49c2e5eee
    1.33.4: sha256:eb4f3b7a875ffe06aadd5b5ff7b3dccec125933b7ba6fcb5baed39c9c01220c4
    1.33.3: sha256:d9f30f0eb538be98cd07603b945611b056be5e5871369b16e23090545ef8cdfa
    1.33.2: sha256:1b818900ac7af72a14f50300d6c6ad600eecdc578c37b75fa488cc654ca08c25
    1.33.1: sha256:a772834ba22478c9119f03ecca2a27a70234623d74ff1d7671ee85675a4e830b
    1.33.0: sha256:26cb7ac57d522a59c84c4784b176097d23c7b4e61874fab84ae719d0e43ac0bc
 etcd_binary_checksums:
  arm64:
    3.6.11: sha256:5302f1a6157c34eb0568c75fba9d06da98353576df04399f08645bef634acd2d
    3.6.10: sha256:e40dc34b7a512b99c651f7700c1014e9b76e02415e2e24365b248966b173524c
    3.6.9: sha256:b51e433724325b66770019c4819d091b8965d2e81c07571a46e0619da1c8ece6
    3.6.8: sha256:438f56a700d17ce761510a3e63e6fa5c1d587b2dd4d7a22c179c09a649366760
    3.6.7: sha256:ef5fc443cf7cc5b82738f3c28363704896551900af90a6d622cae740b5644270
    3.6.6: sha256:8a15f5427c111ff4692753682374970fb68878401d946c2c28bdad6857db652f
@@ -258,9 +251,6 @@ etcd_binary_checksums:
    3.6.2: sha256:79d0a2488967aa07ecfde79158b1dab458158522f834810c2827eecac4695a31
    3.6.1: sha256:5f8ed6e314df44128c218decbf0d146cf882583d05c6f6d9023ce905d232aaec
    3.6.0: sha256:81477b120ef66ff338fe7de63d894e5feec17e6e1f1d98507676832e089d9b58
    3.5.30: sha256:4d19473d2567a58e1dbf556e0813b91d506666e58d23bfd5370660c67639eb5e
    3.5.29: sha256:10817d916de91fdab373947977682e083f0a1ac7f37650c1b690c2a746e4c269
    3.5.28: sha256:779a741604d2ff45240b277812f6c300bca71754adfd8de1436a3f2df3a18e67
    3.5.27: sha256:1277309f540c5a0329c428f95455c9f76d24f768c8d28fd2753e891c379053fa
    3.5.26: sha256:93ac1667df0e178ea6d152476ce4088df4075604fe4bc7f85f4719e863cd030b
    3.5.25: sha256:419dce0b679df31cc45201ef2449b7a6a48e9d241af01741957c9ac86a35badc
@@ -284,9 +274,6 @@ etcd_binary_checksums:
    3.5.7: sha256:1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51
    3.5.6: sha256:888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87
  amd64:
    3.6.11: sha256:8756f7a4eaf921668a83de0bf13c0f65cae9186a165696e3ae8396afe6f557ed
    3.6.10: sha256:ed579fafab5701e3aaa95509969e7bc74776a4ae5269d32e3928408b406456ec
    3.6.9: sha256:633136f13fcadac52e5c0ddcb97912643af6fcb9cb362e75774d0f96f7666396
    3.6.8: sha256:cf9cfe91a4856cb90eed9c99e6aee4b708db2c7888b88a6f116281f04b0ea693
    3.6.7: sha256:cf8af880c5a01ee5363cefa14a3e0cb7e5308dcf4ed17a6973099c9a7aee5a9a
    3.6.6: sha256:887afaa4a99f22d802ccdfbe65730a5e79aa5c9ce2c8799c67e9d804c50ecedb
@@ -296,9 +283,6 @@ etcd_binary_checksums:
    3.6.2: sha256:4b5d55d61e2218fab7c1cc1c00b341c469159ecde8cedd575fa858683f67e9f4
    3.6.1: sha256:1324664bfe56d178d1362a57462ca5a7b26a6d2cbe9e1c94b6820e32cb82d673
    3.6.0: sha256:42305b0dcbba7b6fdff0382d0c7b99c42026c88c44847a619ab58cde216725d9
    3.5.30: sha256:a495115162845640be08c6cda069ff961260dbced53207c5a83b1b006ff2ea8e
    3.5.29: sha256:7692f812db0bfeee3a731c45046864cf729e552bad82ce7cb5b507053d033267
    3.5.28: sha256:e11b6fab2ffbf0a1d6ee8f6227594045a19e0974ec779c42b8b5bb1942b2abe0
    3.5.27: sha256:0aad9a9e4e0817a021e933f9806a2b2960a62f949ad5a3d6436d8886945cb1bc
    3.5.26: sha256:0a682a91201dc8351d507210bc30b021a11e254eab806f03224b51e8fad29abb
    3.5.25: sha256:168af82b59772e1811a9af7b358d42f5c6df44e0d9767afb006ecf12c4bbd607
@@ -322,9 +306,6 @@ etcd_binary_checksums:
    3.5.7: sha256:a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396
    3.5.6: sha256:4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb
  ppc64le:
    3.6.11: sha256:4031a332e71c263ed054a9149761d77dfd57f1bcc301b2aa0e2b1b6079af7095
    3.6.10: sha256:2892716d2826deed1ea392c91651ebabe1da35c5e71964d842fdcd424adb71c1
    3.6.9: sha256:bd21e07aa8f19308c96986bf9457f779ba8103a3204066bb89c8c3fb7a1e47dc
    3.6.8: sha256:3b9bb486b0eb8d79b30410749ec26e174db075956c9ecb533b313b9263e7ba78
    3.6.7: sha256:de3b1ed50fc8868cdd56b12b0cd81d6740bf53edbca570400a78e530e4829b7b
    3.6.6: sha256:e4f528b63a731e9b96f5d10f55ce096223fb4e1bc1778aa2535a3d47e9a129e5
@@ -334,9 +315,6 @@ etcd_binary_checksums:
    3.6.2: sha256:bf79b9d4c7e9f86e611e73de9fe54a195bc0ad54aeb17200b1c8bda3c4119705
    3.6.1: sha256:bb87fcd0ea4b9fabf502703512c416ca1d9f4082679cb7f6dbc34bed3dfc13f6
    3.6.0: sha256:1180d06e3a3787ab65078d9a488f778a4712c59cc82d614abde80c5d06efe38f
    3.5.30: sha256:5f5412fb68aa87df05c5c6e75ffca458ee43e00f23ae43122e81201eaf0187fc
    3.5.29: sha256:3c198d0a0a5e76c0828568c34c1b8811c29830ca62c64043e18474b2625ecadb
    3.5.28: sha256:f928b7f0e615d8125640c0840121ad0001d0736531fd0b95ad24514a8ce0ba3b
    3.5.27: sha256:b41d488dcd579e780f49f5bd747e9386e17e1376ffb77bfff061f7944818a678
    3.5.26: sha256:9678ddaced9fcd4878b76b0b76c9c2a3638a70bdc362c9f4cb25ecc48de2c6d3
    3.5.25: sha256:0dee64e99a43a06dd9541a40a18b52c7309eb1682a2a32740d4bdf358296c007
@@ -361,38 +339,27 @@ etcd_binary_checksums:
    3.5.6: sha256:e235cb885996b8aac133975e0077eaf0a2f8dc7062ad052fa7395668a365906b
 cni_binary_checksums:
  arm:
    1.9.1: sha256:21416880bea0541d78afaf106373d6dbb471edb92c0114fa263494fe4aec8d3b
    1.8.0: sha256:7ed51af2ee5c7784c8b978b293ad1cf6c3022d7792a2e79197fb9cdc98f3f752
    1.7.1: sha256:1df4fa20a0fe279bda5a671d172911de2c1a81813bfe8fb0398b46fa9e49d0fb
    1.6.2: sha256:ee31b0117206dc6242a0349443020025a71752d20d683c08caa70b32de179c4b
    1.6.0: sha256:10cd1b6b0f7c1e6faf18b2e46ee338beb1e1cce253efc7086f8bc1f4e1061d1a
  arm64:
    1.9.1: sha256:56171987d3947707c3563db2f4001bccaf50fd63468611b9f3cbecb1375ee7ec
    1.8.0: sha256:57ce466fc3b79db1f19b8f4c63e07a1112306efa53c94fe810a2150dd9e07ddb
    1.7.1: sha256:119fcb508d1ac2149e49a550752f9cd64d023a1d70e189b59c476e4d2bf7c497
    1.6.2: sha256:01e0e22acc7f7004e4588c1fe1871cc86d7ab562cd858e1761c4641d89ebfaa4
    1.6.0: sha256:db09ab057ecf60b05ba05cbec38d55b95cc139c7f1078e2e4857cc13af158cee
  amd64:
    1.9.1: sha256:b98f74a0f8522f0a83867178729c1aa70f2158f90c45a2ca8fa791db1c76b303
    1.8.0: sha256:ab3bda535f9d90766cccc90d3dddb5482003dd744d7f22bcf98186bf8eea8be6
    1.7.1: sha256:1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
    1.6.2: sha256:b8e811578fb66023f90d2e238d80cec3bdfca4b44049af74c374d4fae0f9c090
    1.6.0: sha256:682b49ff8933a997a52107161f1745f8312364b4c7f605ccdf7a77499130d89d
  ppc64le:
    1.9.1: sha256:44b743ff6e4dc145eb4e5280e49eca182fcc586d8d52ab431d5904b66e5ca6f7
    1.8.0: sha256:63f762df723eb7dbee83e3751167ff1e18cf7b86ef5b48eb620c91af2def434a
    1.7.1: sha256:15a4070b20c4d6c8bc9b3db52d8303d0520ff7a89cd2e87a2fdf1e9b8dd69373
    1.6.2: sha256:66dcb90886a039e919904f2fb761b88e03dedd25fb718196855432771eaaa325
    1.6.0: sha256:d8d4bd74247407c8c73de057bc00adac28bb1ed2d2ee60a9dda278e3b398bcc2
 calicoctl_binary_checksums:
  arm64:
    3.31.5: sha256:8d9dbdba4a41e490238f01223a768df1858cc19e563562b314489657d1eb5eef
    3.31.4: sha256:460af7c6dd1b34d0c0f3a3d036ccd0e4d71bd505bb28cbb90aac918232fb2cf2
    3.31.3: sha256:3cb41949679c963ac42a39c30024b225b53485985b9fb7f1eb6177e86a0ec564
    3.31.2: sha256:b85133520c21d1195f799de9d123d1bb476eb68f4becc2d9ba0a42259d805192
    3.31.1: sha256:7d828835f7e578775a8d55dac065a5553324ae486a336a1b7126f519474dabf9
    3.31.0: sha256:1307df3b220e195fdd57a298997cdc1f1291223622414fdcb40097e86ea8a76a
    3.30.7: sha256:e62d6f909d72bfd8876a363c3f49cda722d7bfdb282a4bbdeca38dd7e26e7578
    3.30.6: sha256:47ecc00bdd797f82e4bac0ff3904c3a5143ba2d61e8ae1cbbce286ca76d3790a
    3.30.5: sha256:7611343e7a56e770b95e2bb882dda787efbbd4331b1dd6316ff8ea189238dfaa
    3.30.4: sha256:b21fbbc55b6f5d50c1c0faae714242cae3e013185cb8e26ce56981bd10da260d
@@ -408,14 +375,13 @@ calicoctl_binary_checksums:
    3.29.2: sha256:3a9b80335338b7f4af762d4a7cf68e67b40839e50711fbe6e67f9a62b69bafdd
    3.29.1: sha256:6f662d316a267854dc5487242ca7ec8ca70c35b52bed258aafb76c2d113643c2
    3.29.0: sha256:ab23afb283fcdffcf0e1156cdced68d05b6c2b70fd4ea2cbc3189d0ecd43bdfd
    3.28.5: sha256:691baba17e6a50d0ceee7f95569b864729e436f474fce1e9842041b33cc14316
    3.28.4: sha256:48887a6dd715f7340511788c3f311810326e61dcce5a6c1554e365cd372ffab1
    3.28.3: sha256:b61b5206bc7795793edf792040acf5c52d48ff5de701001d0dbbd850edd0c077
    3.28.2: sha256:8ebe965424ac94084499182b2853de62e5d18cdc346a3b8974e991d8b7a9592d
    3.28.1: sha256:c062d13534498a427c793a4a9190be4df3cf796a3feb29e4a501e1d6f48daa7c
    3.28.0: sha256:c4ca8563d2a920729116a3a30171c481580c8c447938ce974ce14d7ce25a31bf
  amd64:
    3.31.5: sha256:d1dd3a3fb2f5640987eab589dc1dcb03c47c11b32bc19a65c45c39421cd887d2
    3.31.4: sha256:f3a3fe9a7452844be851ca3f804fd616b7df06de741dd40b35331d4503bef76e
    3.31.3: sha256:dc920efee0045d352780c73cfdd3f6fbd6eab9fdb0675897095c755715a8fc8d
    3.31.2: sha256:d12c89b7f5a9c2b19deb4cf2e3004a02995e32ed56b10b4bc32fdadbbabc74a2
    3.31.1: sha256:a37297cc889c78e2884fa4beb24127404949b4018269b0d7530b46279ec523a7
    3.31.0: sha256:134b323b18ce416a79d8438fe27fb586a79e3ba9bee714dbe723de521327cbb7
    3.30.7: sha256:087e1547878913587ebaa756686f38184a730e9af9b71f3d91b92f6c99b60c11
    3.30.6: sha256:2017e19727dca689d8bb73a9d8dff3c6a8ba7d8c75049f99ee207272161b5749
    3.30.5: sha256:6cdfb17b0276f648f4fdb051a5d75617a50b3c328d4cccfc40d087b96c361d80
    3.30.4: sha256:7e2e5e75b25c55683b68eabeb9b00390b1d359e72bf57f7ec2b76bb006fd175f
@@ -431,14 +397,13 @@ calicoctl_binary_checksums:
    3.29.2: sha256:6076d6745c4d60c0c4322961cbb256a0ffa8476cf7f8dbe5de4ae82c55bca020
    3.29.1: sha256:2ac849181cb1fb40c61c06d075711025cdb909d80562d078cc548d50a0edcd3d
    3.29.0: sha256:df5048549d72a1f7ea4f61c655699d3b16d8a45873f28c3855c39597b73e8a3d
    3.28.5: sha256:fe4702ce171045728b6c37b2c01e6f903780997aea7e695b35735754eeeeaf64
    3.28.4: sha256:ff07f5ac4dbf9a849adb12db20e7b35857869fb98b23e802404dbb4a8a98e013
    3.28.3: sha256:b7dc6d01407ea04c110b8d50312591d7a7c3aa5239c875354ced83ac6b924137
    3.28.2: sha256:d7f30447f0f59262051b95bdc656407442c4f71066dc37ddd3b676108fab569d
    3.28.1: sha256:22ec5727c38dbe19001792b4ca64ac760a6e2985d5c1a231d919dbebe5bca171
    3.28.0: sha256:4ea270699e67ca29e5533ddb0a68d370cb0005475796c7e841f83047da6297b6
  ppc64le:
    3.31.5: sha256:6592de001ec48307c805d00a678f54674473cddd64cf946e34fc644ef2e5f537
    3.31.4: sha256:5a89e5bea3ddb83ce311c7f149b755889e82d50c5db5987dc48b264e7637faa2
    3.31.3: sha256:d7682534cee144c72eeb363798f750f8c44e40dac1ddc20a85b3e10dd164b2cf
    3.31.2: sha256:51fc81bea42b4be6cb9b8875779e4f96ccd8c09a01134199a791ad19b622c781
    3.31.1: sha256:cdc5eb8402079ca2cb883ec64a67ce69b810e3ba3007f9d430a3d912443853de
    3.31.0: sha256:13fe7a02983cc3594073a6de3461d72c58de3dfb781dfc5e84648d8d93de0faf
    3.30.7: sha256:a7a5bbd35abeaa39625d101ddb075ed04f08c1ffb209ef60b3f0204336073379
    3.30.6: sha256:9a9c368499b1e3d08418dfbb566379483e15c50d08dd1bcaf6148c115d82ed36
    3.30.5: sha256:5b6de49da1af2633549bff5e8f4d8a573a175b65c47c29d327ef6a0760d39a93
    3.30.4: sha256:8fc8ef492d463e184e714bc6d31b05f9066c8af3445928efef233850f036bb92
@@ -454,6 +419,12 @@ calicoctl_binary_checksums:
    3.29.2: sha256:6f3fd72be26fcf52605d9ece716363a73bb194ca59ee34a257156d30fa5c1542
    3.29.1: sha256:ef6064f2ec1a09b5eb8c43ab0c64bd42785c24f5b22b950583fb5074f472c2b7
    3.29.0: sha256:c9c2a29a349c6f681aa79b5f5d6aee738305d95aa7f158b6217f487808758e53
    3.28.5: sha256:1aa3b36f198aecdad312664c7b2dd2b15daced54fd4e2db56563d57431fb10d3
    3.28.4: sha256:9646b8b66981ed68017d30291f44e3e4ff1f6ce318c88c1e837097c061e2bb79
    3.28.3: sha256:08bfe47df894ae22f2a1256f28b46345cc1718cd9c936ca8248ae5b761c33dab
    3.28.2: sha256:9889a2f9c26ae82a501b33440b3a0772f552a4ece128cd57a21e395452b4238f
    3.28.1: sha256:985caad36fed7b883a2cd4cf91e556974bcca95fe4e6b7ff4cb64d8d8fbe9223
    3.28.0: sha256:0789cb0d1478ec3f0a44db265b19042be9dfc18bc1776343c7ea8d246561d12b
 ciliumcli_binary_checksums:
  arm64:
    0.18.9: sha256:eaa2b3570d3737592ec912505a247173e25fc7bca92d16b32d72b3aca94a743f
@@ -531,13 +502,6 @@ ciliumcli_binary_checksums:
    0.16.0: sha256:da98675f961833d4ffd68b1046d907b228a7d394ded2abd70a50b20eaca171c4
 calico_crds_checksums:
  no_arch:
    3.31.5: sha256:1d6d5e523f92ee1e8227a48c016229c668f94035431b82f19139affeb45dbeff
    3.31.4: sha256:93422c69713a91fd2bbaeb6f33003e1957cb4a95522b26b9d19dd1d6ed897c5e
    3.31.3: sha256:476bc19de0408520d6aee0790d51d5a0f31f56ced5c45386779c302717b3493d
    3.31.2: sha256:476bc19de0408520d6aee0790d51d5a0f31f56ced5c45386779c302717b3493d
    3.31.1: sha256:476bc19de0408520d6aee0790d51d5a0f31f56ced5c45386779c302717b3493d
    3.31.0: sha256:1c55e1979a6d8dcb8fcb0dd1b4ebd88c6f59be197b4fe683678e1e184ac5b1f8
    3.30.7: sha256:b0eb83f6d70afac27e8830f22642cd12b0692e4d1a1b5060caa9231a951e736a
    3.30.6: sha256:b0eb83f6d70afac27e8830f22642cd12b0692e4d1a1b5060caa9231a951e736a
    3.30.5: sha256:68bbe7f44693374f1379aa3fa55f254e9a689d070c26d0de26b2c9fb8d1166ab
    3.30.4: sha256:be1d346a966a0be79cad7c9856ee5fc0eef8d88b70eba8d4d0bc4be057138bd3
@@ -553,6 +517,12 @@ calico_crds_checksums:
    3.29.2: sha256:1620ee6f539de44bbb3ec4aa3c2687b5023d4ee30795b30663ab3423b0c5f5d5
    3.29.1: sha256:aaa336bf0ef87495eccecae7eb65acaf59508a7f0a44dbeec933e05d73bbe0a0
    3.29.0: sha256:ed35a2bd383674f4d61b013f2588be1ee08b5e7a26eb3208ba6a5565ebf0175c
    3.28.5: sha256:541635bf3e0cd409ff2f5b9b78363ac8901da4565fffaeb4c1507e19461bf4c7
    3.28.4: sha256:541635bf3e0cd409ff2f5b9b78363ac8901da4565fffaeb4c1507e19461bf4c7
    3.28.3: sha256:541635bf3e0cd409ff2f5b9b78363ac8901da4565fffaeb4c1507e19461bf4c7
    3.28.2: sha256:f09dbaf5b25419659af654f3b50edb3a2b1ebcfeab80b0e56f7fbc79721e8ec3
    3.28.1: sha256:f09dbaf5b25419659af654f3b50edb3a2b1ebcfeab80b0e56f7fbc79721e8ec3
    3.28.0: sha256:f09dbaf5b25419659af654f3b50edb3a2b1ebcfeab80b0e56f7fbc79721e8ec3
 helm_archive_checksums:
  arm:
    3.18.4: sha256:34ea88aef15fd822e839da262176a36e865bb9cfdb89b1f723811c0cc527f981
@@ -612,7 +582,6 @@ helm_archive_checksums:
    3.16.0: sha256:d13a4b87b31a5b50c8d93dd9988dfb312a61e56504102f466a4004e5a3ab8e9e
 cri_dockerd_archive_checksums:
  arm64:
    0.3.25: sha256:7eda6e815ed80ddf28095587038a8c48cb9af2060f7b45f9d8e68603c42caa67
    0.3.24: sha256:c783a03735887c4a8fc894bd4cf7a1c0defef3ecf50a4d79ff31eed45c26b17e
    0.3.23: sha256:a78037d2d2e9c52c48372a5cbba7b94b1c57be5759449beef29cfe03cbe6f14b
    0.3.22: sha256:3260b214c9b12dbf0cbf4d60410c45aacfc31ba52aa7b74164135968e8950cb6
@@ -633,7 +602,6 @@ cri_dockerd_archive_checksums:
    0.3.6: sha256:793b8f57cecf734c47bface10387a8e90994c570b516cb755900f21ebd0a663b
    0.3.5: sha256:c20014dc5a71e6991a3bd7e1667c744e3807b5675b1724b26bb7c70093582cfe
  amd64:
    0.3.25: sha256:adb9b9785dc10fe49107f5d9e6a62c4271d268a214b9813f5dce251afc9d78ff
    0.3.24: sha256:dd4b7f514c248a3aaca398f467430a4c58aae9a77ea8b96a2f5b5d6fba0948d1
    0.3.23: sha256:c7fe5db7f9396186193b58ded0e62a31eca7b3c58ad8691d57017986f96482ee
    0.3.22: sha256:6621a96a885c82844d12318de00f510eae3459871cf1ad47317f38dd242f9a03
@@ -655,10 +623,6 @@ cri_dockerd_archive_checksums:
    0.3.5: sha256:30d47bd89998526d51a8518f9e8ef10baed408ab273879ee0e30350702092938
 runc_checksums:
  arm64:
    1.4.2: sha256:ea54032310588e115633aa2f4bba8bf9500257f657e1deca88df5778775138db
    1.4.1: sha256:80d5757c46152c35151621cf394ee08cec881716169d0fdd40f9ce124d3c85f5
    1.4.0: sha256:2adbeed4c751d6f2201c642ed06269ff4370fcc4165abd3f323e19c653716c31
    1.3.5: sha256:bd843d75a788e612c9df286b1fa519a44fcbb7a7b8d01e2268431433cc7c718c
    1.3.4: sha256:d6dcab36d1b6af1b72c7f0662e5fcf446a291271ba6006532b95c4144e19d428
    1.3.3: sha256:3c9a8e9e6dafd00db61f4611692447ebab4a56388bae4f82192aed67b66df712
    1.3.2: sha256:06fbccb4528ecd490f3f333d6dcf22c876bd72a024813a0c0a46312121f4c5fd
@@ -683,10 +647,6 @@ runc_checksums:
    1.1.9: sha256:b43e9f561e85906f469eef5a7b7992fc586f750f44a0e011da4467e7008c33a0
    1.1.8: sha256:7c22cb618116d1d5216d79e076349f93a672253d564b19928a099c20e4acd658
  amd64:
    1.4.2: sha256:ac8a90f9e225bb9322189937b230cdc5478d5753f0e31e1bda98a5cf06bd9539
    1.4.1: sha256:b6d50dad89a420cafcdc0eebf4bed132a45b161d5bc1ba4ddd8cc4422d24a983
    1.4.0: sha256:c5d4995c5aec204d7e1827d9d9a6b45042602736f7f415f484252e576dcdac28
    1.3.5: sha256:66fa8390be8fb3b23dfbb60c767368bb5b51f1acfa88692bbff1a82953d4d9e9
    1.3.4: sha256:5966ca40b6187b30e33bfc299c5f1fe72e8c1aa01cf3fefdadf391668f47f103
    1.3.3: sha256:8781ab9f71c12f314d21c8e85f13ca1a82d90cf475aa5131a7b543fcc5487543
    1.3.2: sha256:e7a8e30bd6d248f494aae9163521ff4eb112a30602ac56ada0871e3531269c2d
@@ -711,10 +671,6 @@ runc_checksums:
    1.1.9: sha256:b9bfdd4cb27cddbb6172a442df165a80bfc0538a676fbca1a6a6c8f4c6933b43
    1.1.8: sha256:1d05ed79854efc707841dfc7afbf3b86546fc1d0b3a204435ca921c14af8385b
  ppc64le:
    1.4.2: sha256:572a4b78f7cb55569f12c4b3999fbc44e6d3c2c7e94ec0024cf7ae09922438b4
    1.4.1: sha256:9758879188759989fd54fa287af3e51a78cf147309cd0336139685f026f531ed
    1.4.0: sha256:9effd22d207c80ceab4816ce1736356c6b87ddf687ae1b5d9310523a7da92786
    1.3.5: sha256:62e8f062291c2b2b29bd8ab8c983cef56409063287e256c50ab54fb54f5d98a7
    1.3.4: sha256:268d9be1188f3efa82cad0d8e6b938d8da0d741427660d874ca9386c68d72937
    1.3.3: sha256:c42394e7cf7cd508a91b090b72d57ff4df262effde742d5e29ea607e65f38b43
    1.3.2: sha256:9373062bc547b5afe44fb0122a12aaa980763969d4b69dd17134a6a292838ce5
@@ -785,19 +741,6 @@ kata_containers_binary_checksums:
    3.5.0: sha256:fa4cf67d010244c4f8d0e6d450d04e28d1bbce5ad1a3cbc0154adff628d56c0c
 gvisor_runsc_binary_checksums:
  arm64:
    '20260511.0': sha512:1a1da6060bbfb98fcd98304a7e73afb2c23a897ae4a8bf741e1c6a16cf07e0cd14bcd9d0f0e51aff201feb0cf8d19952f944aeb5eb5d92b091509374b9702a26
    '20260504.0': sha512:e2a6c39afa478e4040e8b2a803324011fb81ee268fdac5cd005f64e165218b3a45e45ba9cef15fcf7f514e80da13b752ce2733d035d6dcded48c89a468d4fd17
    '20260427.0': sha512:985d4412e50229bb107bc38f53be34ac09c3ae7e654c371557c261d44a6b40b6582688ec4ab39d4df55a14213b4eb6ac328fe5bf1e01ee037a349e2acfada836
    '20260420.0': sha512:3d12263b01edd46d75cd96586f6860596d8ef1300c591b1e2cba6f5396a3f0f065ede03da454a5009a18c3dfa9c702dc2018ed655d7d8034ad31de2f9738369f
    '20260413.0': sha512:3c69577f48319452aa15552631eec21560a6ae5d80b5bf6d327e5c6c31989b6c02e02f57023a322717bb387c16417355aafdddcc10c760cf6ed5c4cb3eed6bfa
    '20260406.0': sha512:b2a0bf0096bcff15bcfe097bd16c8c00491578d1dd69309effa3aa3584eab5143b721f79522c217cd76b6c5337eaac7385eb0c6da3413826df228b54a4f02303
    '20260330.0': sha512:5d289b8528483a4082a74420446e4267558c2e5c0cbe270d29a1a814a0039f9e9797229fec1416119c286621b899cc8a8919514fa60db199e8b05257505c23b1
    '20260323.0': sha512:2aacb4de88e9c4fadceb9c81c47b9aebf3ecb16df4f68d7def428d844bf3bc3ca1cc7d61a30bf73996e2485cea6a8c12ef86823fa473d0eb6489a95898be7d98
    '20260316.0': sha512:d73d7dc4b318b513c0df2e4d568a81d894695ab60a892da670d8fd3502dbe0983aaf450b2bdc5df0940d3c5ca7ff5bee9245893f35f2c54d6a3ecb83c55cdcb5
    '20260309.0': sha512:85d37e7a0b249706f1b3b0ec5d84cc38f4dd53a4e490395f489eb406194529233631405be8bcd1648126db3fc0221a8a1b599743eca2b183b2a35ef3aca638fa
    '20260302.0': sha512:1f5a81cd6080252d4bee22e0828ed796b438bc768b0845015457944ca659b37fa5a2c22acdf655963b1a27855d5bb2263887463238eaf930efb55b0e4ca801ed
    '20260223.0': sha512:b3077dc8da3142b117829955ea8ecca7f75fda22f8bd59323a62ba34c6b836f62edea0b10ce0b745d3cd001814cd215175a3bd51d90abc07556bafe600683056
    '20260216.0': sha512:e5e46739fe6eb26477f57224dc66152ac259706b1d76512391eab6cfc70ff235f5d0a506d54d685520534b76576f2837c1f909bbf33b19dbe2e6186010a58c0e
    '20260209.1': sha512:e95170b4f70688d014c795ffa9b3d583753f865edfd8afb4e2969490869bdb46b60672f641741f788e2ffee8f29751a017e9a68b98c1e44f5194da9a64b0ff28
    '20260202.0': sha512:5fbb9c68efdf3a404217fb57be55051b4b5f8b83ca631101204615b87ff5b6ea8680cd6599e434f1d87fecb9071367b65e90cd8ad5df3f0b9f0101796ecc8c43
    '20260126.0': sha512:c1b42f5789c09a68eb006964048448c058776440477fac83c7fd9cef879cec40878fb2f5f2450315ca0e7f568889f0b52c842b84929784a57023961f6eb77d04
@@ -830,19 +773,6 @@ gvisor_runsc_binary_checksums:
    '20250414.0': sha512:d1ba68b20057622e58e886f472e021a473222590c936a86951005d7b97366b446ef0342b91457ffc0d7e543d54c9c06a363f2883bdd6c594799c4ca1091dabd5
    '20250407.0': sha512:cb590f72b0fbda45e89a2300e9247f12ff295a8c52653c8cf815c662d3fbbc774f9b915cdd4fad59e30694d8cc8737fe2a1a8186ab5136f7701bd6e6877a1662
  amd64:
    '20260511.0': sha512:e227a71c95e794119f6648a44083df945392c6cd457f36abbc49c2b6e0b87c7f01b94e6bf4632f4cb22ee34fbec7a2c34ca03d30efa9c689db76a6215a6e44e1
    '20260504.0': sha512:27ade75278e3ee7d8ff1b1cdd979383f8beca2327a2a572d054280b43a5a6db615db6387fa82b230839fed30c9a0c65ac249195a81b51298e639ef1262182640
    '20260427.0': sha512:9844ad2493999c579d0b4bcbde99ad3ed98e9f0ee175d87003b2e4da2e61f22efe452c378503cb911edac1b627820cb7985326e52b44dafe5d17e593d4b9095a
    '20260420.0': sha512:9efeefada7b9a7bcc21dc3a1ad3531d11dfac267808cced45d047aab742f15ecb91b2bb635dea78a4ae36817f76e5ed223b7ad80f3165f15dd24de9b0c95726f
    '20260413.0': sha512:12f98f1305ea883a5cf68d158877b26e011348100211fa65cc01f91af25d6777ddf84893a4945dceb133346a5e045719d98da353fdc30d67e9f697f2483cf8d0
    '20260406.0': sha512:daabda0cf22b1f7f7e0c587b625d684cceb6777e08f99d8010d4bc9bbe99a8396cd0590ecd67084f6cbaa05869c2a44249ec40ce6f8262a7010dec5d1df90b39
    '20260330.0': sha512:12ec9545b7b0d2ab3234f9942dd32965112a459cea597f65bb5e9678608046a7c05b2468b28641c35fce1d40d8b6f68acbe9c067be292817ef17c4a590698a52
    '20260323.0': sha512:8cfc4e0580e49a0463fafd51661305ac4e69d27eea68de4fc569760a55a7f2c4a2cc75d43d7edeae982288ebfdf4644d6840533b95167bb5f0758cb237e49217
    '20260316.0': sha512:224cd1518f43c2b58052f1d15b0ff0736eac07562d0cb584415798b172cc15a18b0a5644cc37916c6759a0860d1c67eb54cede843cfdb94f0b11657d86aa41f4
    '20260309.0': sha512:2f2d5092d53cae40c53006dead1c5b75552f7c901b9f15bd63b967d2444b59953647c029548ee3950adac0de82be6411a7bf199b3aa7a1dfaab59a51509e4768
    '20260302.0': sha512:67c0125cc0e3b2633c2557ab0d76f1f15f9fe7b47db77b5a0c4d1e025b184c3f10803b88109948378995cf72068a5d486b05bac8f7a69ca77bf38460ae43ccdc
    '20260223.0': sha512:9ec46dca073545187cc6640350b728d5eb358740919236915f7f1619fdeb1ed14815dd4b117156ea2c6b00a9cf97024902dd6ee9b2b6be0693f1e930c59f40c2
    '20260216.0': sha512:f9a0c0094e5fdddffabfa1f0f5d6d3e048a320f85c17686f8697df66f6472d594ab11a290348e97f9a78b614aeb3ab814dc60a8f4ecaa73b1bec49b5b33e8f76
    '20260209.1': sha512:1e0e42f7d3f4b3eded4e96be5af4dcdbecc9bca7ce40f5b9fa191210690397d71771c7c0e0835c32221261b004250fe513a9265447e62d9bf92fb6a5f7276a68
    '20260202.0': sha512:f7bb9cc5e3f5e36a6788f959361415f6d7f7cd0225b8b4d99728da4b1ac7e5c7ce9c72b4c61e424ba93db77c983109d56b54907a3b2e2b982b34058410611023
    '20260126.0': sha512:cce974fa832c50d26c6ccc08ce50b4972921cd0818ebe8007587211d360cbc828ceea4ec8296703200afa208b679437d24f27a6dca31887b3c0fc6ee8be5eb05
@@ -876,19 +806,6 @@ gvisor_runsc_binary_checksums:
    '20250407.0': sha512:097259d6d93548bf669e21cfec5ba6a47081e43f61d22c5d8a8a4c0c209c81ac9c4454162b826f98cec49e047bbdc29c270113ab6db5519ef3e6a90f302fa47b
 gvisor_containerd_shim_binary_checksums:
  arm64:
    '20260511.0': sha512:76dc2b9ce47d4231b0f7cb4e4de670a28105d44af13b89a147e4f13a34c6bea969b01dd58aa3ac032e38a922fe9824f1b287384d5fe24ca21a9150224d087937
    '20260504.0': sha512:1ffd9edb4d200661d1b6b85dd07dab02ec71e211909a20fe61a96ce554fcb03494378f10ca226c5c345afaf039902675959fb06eeafbde693acc63967d0d7cc9
    '20260427.0': sha512:39ef1a110d14b385bc2ac115b46fdd25e80de37b5659ec5c7151858baa83c584980e5fd97f1f0e4819e9e1eb3b6ad33bd20cb6011fa24908e1fcc0274453d052
    '20260420.0': sha512:8cfdd518126f2be36b25d4498d0bc9873cc0f36b786e8398fa97c05b2393fad5dd82d14060c16361f43e5e100ecfcd177bb5fe5a39516608fdfd5557267101d5
    '20260413.0': sha512:bbcb0e39a0ed14625c57cd4b7d73dfeb8847f27302e27a2bb34fed01a87446f10b3f3b5d6e877d6fcde417ebe628c7f9dca2e3f9b60b4d6784ab3559331511d8
    '20260406.0': sha512:abd41610cf09e2dbcc2095cc54c2c27047c4b99271d75936475014bb5dd04d24bc5daa912498c91ad86d5e745b4c80b8c7c9feba770a8611d823d7387ba29483
    '20260330.0': sha512:a79a419e501399ee16398294f68d96e323a2f2d49434ef091766d5be8c90cf12fe935cad9292a816dcdb5a565fd24c44039d997b7421205a93b87e89ab27ac09
    '20260323.0': sha512:b285a1ca814d62e2252b30c5ab00888ca6e5a7f51102b83f10babd903faed5eb922e3a5801e3c970e5e89ff957dcce0f112088aa28f834cc7b155c6bfd37eb35
    '20260316.0': sha512:6959774b99cfad26d588cde8dea4f21a3c9e6cdb1f49ca20bca6a356ef0c17898662ec1eb218c802bb2a034a7a06d3ba458d39ca49327cb838eb3a14ef9e8ddb
    '20260309.0': sha512:43ffb3accd1b4e3d12319824917b3defd268190b1efcdce76bdaea862e7784c598dbd1dd4a3565d12db01452a02609fd1d0b68d9e29c4d26cac5dfde1329a8cb
    '20260302.0': sha512:9bdc7ed0fe570223e6a60368d75e19dd2b211d1b4f84cfbc3d466b0be8b028ba75f49bd9b97e2836ab30140ef2910aec81bebdc444ae9e83805236e5e165b0a9
    '20260223.0': sha512:9bdc7ed0fe570223e6a60368d75e19dd2b211d1b4f84cfbc3d466b0be8b028ba75f49bd9b97e2836ab30140ef2910aec81bebdc444ae9e83805236e5e165b0a9
    '20260216.0': sha512:74474c2302ff5623ab55057b9f552edd81f8e41f2b8e702e6236e1c2c56295f6beabd9ff6eb788cf23a42c18fc6c2a328a2af70ac4ebc04fbc586eb9cd0616e3
    '20260209.1': sha512:714ad3a53a28aa4acd891553d848278f5a873d0a1733836382eaf2bf701d62ece9cef324390602d2676af5e2e3a3d329486d2b18803c9cef5685220764757eb4
    '20260202.0': sha512:714ad3a53a28aa4acd891553d848278f5a873d0a1733836382eaf2bf701d62ece9cef324390602d2676af5e2e3a3d329486d2b18803c9cef5685220764757eb4
    '20260126.0': sha512:84abf41b68ba450ed2cbbdf544e7d347d30f6fd577572e2e58f2fa8e038689f557953148287e26c8f4ee5040c1e928670f113bebca6d81ed7ce014ec4e0ad256
@@ -921,19 +838,6 @@ gvisor_containerd_shim_binary_checksums:
    '20250414.0': sha512:33b9c67bc7b73ca49154aff48da52029414a707b6a3a25eb4f71e861a94dec8fce220e63a162841670ddd4876f45b0e39abdf9f8c3235019c89f209684d3007d
    '20250407.0': sha512:1c3838e10c905af0cb52697712bf6bd76b94c9e9d3d07a7643cd43dc2f8dab03b4ed4693c117e555e07a158e04ee583b6b1f1cf2fb9705244ffa5fdc4af67248
  amd64:
    '20260511.0': sha512:69d7c9e04dacc3c983016624050a53381326bd1d221f6f5879e1109bae76f1ded91101c7235aa289304852f64c5789c726ad94f0099beb22573078f681c6b529
    '20260504.0': sha512:5b502b951bfd80666ad628d6f68ebe5a888d986163db9efc6647b07b26eac95e108367648d642b5d4dc8c44b631de55b7ea35e737d620d3b88e636fe11cd20e3
    '20260427.0': sha512:86a7107d797c36124e1d4800ce4ec596974cb63d17bca1d4b77130047ee3663f37f36851e01ac89638f5bd7a4745d477f954830b370975dab5a6f090c13be80f
    '20260420.0': sha512:9cdfa92704695beacfe6c57eada3f2fbf18f1c7c274e498468aad91480ea29e3204201fe97799f3cfb5b2c249898ebb7076373e2429a70011710c6aa0e1cef80
    '20260413.0': sha512:48f388ee9ac5d71181ae65e3b8a9076d95e6dfc0a74d0037c5a11ec2225622cfd154231868d7d09e999f10a2f09e96e6eb4228f10e0bab1d1da235703238a7c0
    '20260406.0': sha512:2a7c5b2465ab533837710529e9ba5c84a70df5b06d1e782ecf33408b678cf442cae4d600a93e0a9b4d0bf9be3cc64c781b760c3bb29cbee703d6769ef6df7181
    '20260330.0': sha512:9987505521a22166cbb4e6e736020eb88315642d2b4bab4083e64206151ee69b569eabd2266e424b08f17063ef812dc176e2dfbd7186759767baba7881a4172a
    '20260323.0': sha512:d7cc0c78c8f33c3eafc0424eed6e63e447917350cf04d1db09073ebcc8b3880d3bc853a5abad4bcb2bd5d156aa15c5ff82ae95d243d7bbce62e546bdf63bb15e
    '20260316.0': sha512:427f141f011b79cc68b4b805e2d15f040d96e1b2324d139e16948e4f94e6bb63c40c14111ad9e0c6c319e44da9e5b99c39924a1feef88919fcca2dea55256c90
    '20260309.0': sha512:f5708fd1fdad4da12f440780c2c09ca6f2ca7cb47089e24e536851388bae54228927a462d61c584c3adf3426f03addea9f08e390be39c744cac008a84e7559e9
    '20260302.0': sha512:7b0cbc9130b4f2fdffe45d0f811070a868bbcdafc9cc30264108ee35fa17ee3a54f1a1c7775619c6afa4b7fc623bd4acf0e80f4fb40fbc7f1f58a1cceb8a9f83
    '20260223.0': sha512:7b0cbc9130b4f2fdffe45d0f811070a868bbcdafc9cc30264108ee35fa17ee3a54f1a1c7775619c6afa4b7fc623bd4acf0e80f4fb40fbc7f1f58a1cceb8a9f83
    '20260216.0': sha512:f42c07dc741d52720ee531cd8928386ecb9a7605ccb4bd0805a8c3396213e05cd10572936dccc77049e6b4b8094cbdaf02752291047c852e7a48608d35832d58
    '20260209.1': sha512:bd21b80502be25484d8b43168c88d66b6f3e853c78c0ae5b5206c5625e2a365e98c8b3ba259453d18c01d1aa08fb7c8c1e7f122fdcd7ef806bfc2f44f5837b5e
    '20260202.0': sha512:bd21b80502be25484d8b43168c88d66b6f3e853c78c0ae5b5206c5625e2a365e98c8b3ba259453d18c01d1aa08fb7c8c1e7f122fdcd7ef806bfc2f44f5837b5e
    '20260126.0': sha512:51c3b4bc21cb5c3d4e3baf9f43e5fecd86c327abf0c84d492510f480cdfb38c90d43f3b0dbf1887ada8846d3806da79a73729acaedc570894ba6ed7cf9e083ed
@@ -967,7 +871,6 @@ gvisor_containerd_shim_binary_checksums:
    '20250407.0': sha512:09acdc895cea6706ba528939da2e6ddab148dfee56addb0d52d7af74378454f4e05cfd47cbb29ad0569139c49cf298be9d4b94a3c2d28b75c05f713e425746e8
 nerdctl_archive_checksums:
  arm:
    2.2.2: sha256:a5515536b3a85486c819f9ca278b63eb1a182ee2a4ce0a7a68f9f36249e18685
    2.2.1: sha256:8d49681ac806dd3acb2477675daba3574b7d019aea26513ac1960549473738df
    2.2.0: sha256:91f286e4babbd6e000e743f55e2ec6fd6b93f5b227386175f7932d247ab5a431
    2.1.6: sha256:9523cce6ed87d379fe06d9b043936398f1b047917037d0faae151de83acb3b4d
@@ -991,7 +894,6 @@ nerdctl_archive_checksums:
    1.7.1: sha256:799d35de7a182da35d850308c7f1787cd7321404348ff2d5ba64ad43b06b395a
    1.7.0: sha256:8b9e7cccbcc0a472685d1bc285f591f41005f8699e7265ea5438a3e06aefdcfd
  arm64:
    2.2.2: sha256:4e222d6be16d94052079a4773e04f21c82e07f9b5847163fed78396e6ad8eeb5
    2.2.1: sha256:abc83c9ac3d843c3442eedfb61c6456b8b59b1e4cd69f69598ca1582acc7c094
    2.2.0: sha256:37b353122e0785578d1680fb1d7be546f4c64d0a4aed7875d3a216b2c44be76d
    2.1.6: sha256:5c30be3ec118eb222bf635f8049c2f96b4c46d9343ec445058e9bc2ee9531c28
@@ -1015,7 +917,6 @@ nerdctl_archive_checksums:
    1.7.1: sha256:46affa0564bb74f595a817e7d5060140099d9cfd9e00e1272b4dbe8b0b85c655
    1.7.0: sha256:1255eea5bc2dbac9339d0a9acfb0651dda117504d52cd52b38cf3c2251db4f39
  amd64:
    2.2.2: sha256:6f637760fb2875e3454e97c3de7438fd17281b5996908cbd8ee1c872b0653cc8
    2.2.1: sha256:34144de7f12756aa4b9dc42a907fd95b0c5eb82a63566a650ca10c8abe7a26a0
    2.2.0: sha256:1b3390a832eaeaa1459cf42357da983205da2dd72300a015ad018b3499fc455e
    2.1.6: sha256:22857b373edea479a4534ba62cae1c77f2af38f0aac4c91c1c68cf09e29d6f9e
@@ -1039,7 +940,6 @@ nerdctl_archive_checksums:
    1.7.1: sha256:5fc0a6e8c3a71cbba95fbdb6833fb8a7cd8e78f53de10988362d4029c14b905a
    1.7.0: sha256:844c47b175a3d6bc8eaad0c51f23624a5ef10c09e55607803ec2bc846fb04df9
  ppc64le:
    2.2.2: sha256:afc4635fa900815857be72dc17fcbfe81a35251c7de9aac62187974c3e49328c
    2.2.1: sha256:05c3573e0468fbe6ccecce497b8129beec0fa1d8afadeba244e3d5ac63047fce
    2.2.0: sha256:cc9f55ffec892498bb27db1f6b0eef16b591ee4ce873b61f2fd9a9a30930c620
    2.1.6: sha256:807678bc5042cccf81dbe13b00bbe8e18dc24412481c3cc68eafa316ae43842d
@@ -1064,11 +964,8 @@ nerdctl_archive_checksums:
    1.7.0: sha256:e421ae655ff68461bad04b4a1a0ffe40c6f0fcfb0847d5730d66cd95a7fd10cd
 containerd_archive_checksums:
  arm64:
    2.2.3: sha256:2942d72435b18610f7b69c1ddb74f99cef5c549425ff80d3e74f04e5e80db6a4
    2.2.2: sha256:cb102473d6e353beb604178879d51cc456da0cdf368d9437d8d404ed01baf674
    2.2.1: sha256:dac15a0d412a24be8bfe6a40cec8f51829062725169f1e72ac7d120a891ef5b6
    2.2.0: sha256:8805c2123d3b7c7ee2030e9f8fc07a1167d8a3f871d6a7d7ec5d1deb0b51a4a7
    2.1.7: sha256:5e6a05fc6990912f856fab297bee13b6ba83ff4e9b6b3bc507da33da8c1f5b5f
    2.1.6: sha256:88d6e32348c36628c8500a630c6dd4b3cb8c680b1d18dc8d1d19041f67757c6e
    2.1.5: sha256:fe81122c0cc8222470fa3be51f42fa918ac29ffd956ccd2fc408c1997babd2ca
    2.1.4: sha256:846d13bc2bf1c01ae2f20d13beb9b3a1e50b52c86e955b4ac7d658f5847f2b0e
@@ -1076,7 +973,6 @@ containerd_archive_checksums:
    2.1.2: sha256:57fa4005ed3bb648f4a2ff3ef2f9ce12b27ee1397225626e3165b9ef4af45530
    2.1.1: sha256:4e3c8c0c2e61438bb393a9ea6bb94f8f56b559ec3243d7b1a2943117bca4dcb4
    2.1.0: sha256:f6c3972347848177805eed8a9c282fca6aaec0e6fd28701579e63cb20bdbce07
    2.0.8: sha256:ce4708163e0b6a8787a6480c588569d3440865bbd37f455d50a6736d6dfff78f
    2.0.7: sha256:e590e39956a451ff692454ea991961b08627c514dcc253e8845d2a57f9a78e2f
    2.0.6: sha256:0f308f386b1ee24712875f02bded92ce7099a707ed43f57b3fb9c934dcb6bed1
    2.0.5: sha256:36eaf77dc65df4b60d6e06204631a4105b4e942dd2704d618758a2aa0eecc264
@@ -1085,7 +981,6 @@ containerd_archive_checksums:
    2.0.2: sha256:14a2a9f7f75f73e5bcfb8b183d0b84830c54b98ef8c5f6ed70e51f1a230c673e
    2.0.1: sha256:b07120ae227b52edfdb54131d44b13b987b39e8c1f740b0c969b7701e0fad4fa
    2.0.0: sha256:2a00b1553f38aa9e716d61316b661961c2fbfbb7aad7bd73b377be5725ecc0f1
    1.7.31: sha256:d375de285eaaa5a3a58c0b03d92aff6bfa7987657781bce8cd5d30335f9aa2a6
    1.7.30: sha256:a09c3b01b3b6935e839c8a9588b5528c57ebfca4747d816654a7d1e7575c0a63
    1.7.29: sha256:176d523a6d6dc5520e0c35b8eb0de6e54bd4d00486d5fbbeb4163f30e2962f17
    1.7.28: sha256:97457594ff8549cb82d664306593cafd3d2c781c706f9fffed885a46d8919bec
@@ -1118,11 +1013,8 @@ containerd_archive_checksums:
    1.7.1: sha256:1f828dc063e3c24b0840b284c5635b5a11b1197d564c97f9e873b220bab2b41b
    1.7.0: sha256:e7e5be2d9c92e076f1e2e15c9f0a6e0609ddb75f7616999b843cba92d01e4da2
  amd64:
    2.2.3: sha256:ca26ef5138f17b847bbeeec36d4bf5e002b54d25858197a870c125d57f44d32f
    2.2.2: sha256:2c08c99cbde73b3388c6d5da68e0bcaebc70c9174f2b14d785695e4401b3ede0
    2.2.1: sha256:f5d8e90ecb6c1c7e33ecddf8cc268a93b9e5b54e0e850320d765511d76624f41
    2.2.0: sha256:b9626a94ab93b00bcbcbf13d98deef972c6fb064690e57940632df54ad39ee71
    2.1.7: sha256:a04a39607d6a54f467c93fcd0b78ee31a1f4a3b90e76938dcfe9005ccf6a5f36
    2.1.6: sha256:4793dc5c1f34ebf8402990d0050f3c294aa3c794cd5a4baa403c1cf10602326d
    2.1.5: sha256:403af72d9f956ed8a5ad5b0ac0f1e8e371a1488f2b9edf9b4ba13db0653936ea
    2.1.4: sha256:316d510a0428276d931023f72c09fdff1a6ba81d6cc36f31805fea6a3c88f515
@@ -1130,7 +1022,6 @@ containerd_archive_checksums:
    2.1.2: sha256:87c18b2686f38ee6f738492d04fc849f80567b7849d0710ee9d19fac3454adc4
    2.1.1: sha256:918e88fd393c28c89424e6535df0546ca36c1dfa7d8a5d685dee70b449380a9b
    2.1.0: sha256:0e5359e957b66b679be807563a543c7416e305e3aafcf56bad90ef87a917014d
    2.0.8: sha256:3507e6205867331660e881cdf9bd5fea83eed67b4ba50074be1d82296fdc4de2
    2.0.7: sha256:6dc663cd245d19c3e68260ca86247469563a31decac925087b62a2a819dfcbee
    2.0.6: sha256:a545471a67b8508a3c58ad01a4e6bb2921ace1e59e00a0a2d2e784c1f4fa8caa
    2.0.5: sha256:88ab31f3e78e4d2fa12dcb933032122d11d441c83b79a89c6c8076f871e50df8
@@ -1139,7 +1030,6 @@ containerd_archive_checksums:
    2.0.2: sha256:9bd5b6a1bdf505d520d9a329c520258ed0a17faa9fe3db12712ee858ad59aae3
    2.0.1: sha256:85061a5ce1b306292d5a64f85d5cd3aff93d0982737a1069d370dd6cb7bbfd09
    2.0.0: sha256:6f8da716941f7e89315cefaa6e5a8f1ff10b323ff46611313c455df7ab1ebee1
    1.7.31: sha256:85795979166ae04c6c0681664ab54d0810d472e390cf54dde0de399ff6d54bef
    1.7.30: sha256:ca0f27e34411504acd1cd24fcbaa71b9c47d31ce9408c47c54a2dc1810ceb1df
    1.7.29: sha256:71d9f6e4ea4a9e108e2172b0e7f6fa137e086808db3e6874dbdb91c01102d3d4
    1.7.28: sha256:7a8c262deb63becc877e82d23749e4f99f4a17e8e660f9b8c257ca87a5c056b6
@@ -1172,11 +1062,8 @@ containerd_archive_checksums:
    1.7.1: sha256:9504771bcb816d3b27fab37a6cf76928ee5e95a31eb41510a7d10ae726e01e85
    1.7.0: sha256:b068b05d58025dc9f2fc336674cac0e377a478930f29b48e068f97c783a423f0
  ppc64le:
    2.2.3: sha256:95889d141444ce5845255042c8757a5ca816e895cc884f8d345e9a6d5e99e130
    2.2.2: sha256:8f7a8190f2a635cd0e5580a131408a275ba277f7a04edffba4a4005960093987
    2.2.1: sha256:3de0f215ea649952a9e99040cb3888d8059bd3d35b04edbe6afb916c763f9ea7
    2.2.0: sha256:e4ecd0b03200864e117371b25cce5335e39ce0b0a168a01d2ba6562a05020f0b
    2.1.7: sha256:20fd0e3740fce802a3971e242bea689800c3f128335696dcae4506d99cf6cdc3
    2.1.6: sha256:aef2b639a14ae79f2bbe43356b25e84ecfb2c7f269c87f41e41585e724073e54
    2.1.5: sha256:dc95edc01958d18f8475ab4d415e8c92cb3bad580167db8b0054374fd9004f78
    2.1.4: sha256:d519e40e266f39cdd68f2c31e2e4e9b70eda09b96f3c3de343a7a3e11d49ad4c
@@ -1184,7 +1071,6 @@ containerd_archive_checksums:
    2.1.2: sha256:9d8a02413050ae234eeef4152fb703b3d093b5809411f0e905f098554fc066d6
    2.1.1: sha256:36c90c9993e9f2142aa014cbd352bd7d3db6b8daa2990b4a9f59e706db78deaf
    2.1.0: sha256:3e380629da9d21366c916ec3873022a2a5700584d409297a1bc183b11fcb0809
    2.0.8: sha256:2980b4e80a5607d7723e9d3914d8d94533ed198c4bce4251f153906245a8ea74
    2.0.7: sha256:15186b11d555f61e495e94d5a99b2eb2c7f21a5e569eca02170c4bc12fa8c7f6
    2.0.6: sha256:20df16cac3a912d6df34040dc81c7e5e2c95a06b2b21fc2ffb4372b6d41274e4
    2.0.5: sha256:09773a42829c0ac9b8dd449753c755b3ba65cb7e8d06485950f99d32fd6c1e0d
@@ -1193,7 +1079,6 @@ containerd_archive_checksums:
    2.0.2: sha256:1b19d31bb8a7f9d26d9b50675e78f397d0b01fa635c33cca456f91c412fa6df1
    2.0.1: sha256:09a25357343c7336fe519e5fd1a9dd0f22da869e9deda50c2bc61b6e8c9384be
    2.0.0: sha256:2e7f4b15ac85c22c1ced102bbb424124078248f0af3183425ff335a998079809
    1.7.31: sha256:c0956f5975a113fa15d627ff45d7f072aa596d75e8ae6d97b8aa8ae2f3c44058
    1.7.30: sha256:2edba94f31ed0c32cde0cca2e79e4426224eece4ef4fa1f194b2df4c811417fe
    1.7.29: sha256:8c08edb22b53a44cf7b5a5e31ca8fb86d1d6df378724048ae0d9890a3b66f081
    1.7.28: sha256:e8f64abf81503aeee0db0d5682197e9ce377ffeb858313c5bc9fc3d7faa4b85f
@@ -1227,11 +1112,8 @@ containerd_archive_checksums:
    1.7.0: sha256:051e897d3ee5b8c8097f65be447fea2d29226b583ca5d9ed78e9aebcf4e69889
 containerd_static_archive_checksums:
  arm64:
    2.2.3: sha256:b222c671503e7bdac671bb634463cffdea70d694d2420fcdc77b2b04df8c7864
    2.2.2: sha256:f22e03e12edd08dc49e139fec1fb0e0571950df0b6275577bbca718733acea9d
    2.2.1: sha256:6b3b011ee388638eace05ac3be0eb32dfb4a43086695c29d06e997febd336f2e
    2.2.0: sha256:5f2a7f451231ff35d8306f874c51606fc9da1e2db56048834a23260f68a78eef
    2.1.7: sha256:f289ec5ec53987b6eddc5ac55d7a701cc4f5c8005983972ad44ca47f37778d4c
    2.1.6: sha256:9da292010d36d80afa3bb48cbd15f65d3bf38177217060272a1c3fd65351cfa4
    2.1.5: sha256:d1a1e64c4334e17d6f9f40093d5ff9f810b95ac34c7dcba55e7d2226d2a8ab79
    2.1.4: sha256:c5f0957064e6ed5a67905ea3f8e451dadd16530334b86baaad678dd357205c30
@@ -1239,7 +1121,6 @@ containerd_static_archive_checksums:
    2.1.2: sha256:3f1dcd2bc02cbf9e8fde308c144551153f19e15105a26cebf213c8e232a27f5e
    2.1.1: sha256:f4525d8adc4445f8d623c6fd91e7dd750189b96539c29ede2636583ac5e4cf7b
    2.1.0: sha256:1239f60717f4ec2e06e51d2ed86c43d8a0ee10880c73131e58e1e0689e9ad049
    2.0.8: sha256:0e68ca38e33760ce581194933572211a2d2961dcad9a0a751258cca9a4cbf8a2
    2.0.7: sha256:cb46d915f8dea6e94fccd204f29bdb3cbe502d7deb9220a6e662cb33f29784fb
    2.0.6: sha256:4b6e773839b153a189935d76aace6e965811fbacce5cc938d74910582f2c0de3
    2.0.5: sha256:302a57f36c80c547c57e439e5f4d5d4e6ce73a9c7266a6787c739a3b9d4dd813
@@ -1248,7 +1129,6 @@ containerd_static_archive_checksums:
    2.0.2: sha256:da5631d38702257674da542969c285adfdbdccffc12c5ea39de4db6113de51bc
    2.0.1: sha256:6022bd160b6d83f13fccd87b1c3854b0294a940335fdf014c10c80d71b279115
    2.0.0: sha256:428cd0b08eab57003db8a98742d8404b4b69dcd335c5f0f66ceec5fe3b9b31b6
    1.7.31: sha256:f4a329b5a97ff6241b3eed011f32a0c78969f2d7106524a628b7ee4b547896ff
    1.7.30: sha256:1458b3c4a20eb1305bb1d4680c660d0726fa7709acdd95ec7c0fd6bdd632c36a
    1.7.29: sha256:d428ad3fb7036c07c141f6666de575d8c7fd862e658a28da5ae20b737fdf7d75
    1.7.28: sha256:360307a347f1114d6f67fe261674033661c56e6deb3c2529705fc834aba98ff1
@@ -1281,11 +1161,8 @@ containerd_static_archive_checksums:
    1.7.1: sha256:f0435e7cda3c3abc40d3f27d403a8e24bd0b927a8a893a7e4dfaec5996fa9731
    1.7.0: sha256:6e648cd832f026e23eb6998191e618da7c1ec0c0373263d503ff464e0ae3977a
  amd64:
    2.2.3: sha256:80326f17cc35de84f652a8a633a2f14086c1d828a48b62e96720b3c42059e49c
    2.2.2: sha256:5db46232ce716f85bf1e71497a9038c87e63030574bf03f9d09557802188ad27
    2.2.1: sha256:af3e82bac6abed58d45956c653244aa2be583359a9753614278ef652012f2883
    2.2.0: sha256:2d20037947cbb0def12b8ac0c572b212284c1832bf3c921df1e58975515d1d08
    2.1.7: sha256:b6bf44cf2aa2db9ac40060e57a62b46c6622a3c49f00508c2049d225a5717749
    2.1.6: sha256:577900a5a8684c27e344aeeb1fc64e355745f58cba7f83c53649235ba25abbbf
    2.1.5: sha256:9389a4bff0112258bd953c66382709c2a4a11e25e376c8c4c7075b39de156882
    2.1.4: sha256:50e53500800f4f74d0d8b2e57e939297eab68b0fe11a0957b771d5faa61fae5b
@@ -1293,7 +1170,6 @@ containerd_static_archive_checksums:
    2.1.2: sha256:5b2b8e82c5d3e6019428db55296b5169e748b94601c0c944c1d780904aa35543
    2.1.1: sha256:9ab7df748ae3e9c2a513586668b46175c27290eda6028609223d9065eb777964
    2.1.0: sha256:e8e5da8ca6586bf2023940ec5bc5d4e949924ac8dca2a9f0dc469bb9a297146f
    2.0.8: sha256:d7857b2d4f203ac4df95b5eca805e2ae29484e2a864c95806e51b1b34918bf35
    2.0.7: sha256:23371338ea3d930f020f6ad476a608aa8196ecdd016f9f5cd511c87cf37f86b7
    2.0.6: sha256:e6d69c5931af2a36c98cd066c96d60ee8b05a961d1f54d3d13d80c9afcd74a16
    2.0.5: sha256:3506b47f8f0806c86ab315ee50e09580fb6f21e1ed3a30051105c98c5592c57b
@@ -1302,7 +1178,6 @@ containerd_static_archive_checksums:
    2.0.2: sha256:7cd4de9c8ad37f3248a45b9d6347b7628e4d77d1c8e35c1f80343450fa47dc00
    2.0.1: sha256:22b2a7df86fe3e53e219af22a2b5e81d1b67e67d55ec3a18f89990b161fb2157
    2.0.0: sha256:e72cc69db9984a8d46a34495c302d2b50188ee2dd5c7000a7b471d0350e14ad1
    1.7.31: sha256:fcefac10cab1d6d254917ca62596022fb4c3fb91984e052a3618674f75071930
    1.7.30: sha256:290eea517a7aa919aa319563f8270d284ab5197736362285da09b198b76a34b5
    1.7.29: sha256:ba4a2e919d2882dba707d8c9c436ed3496e3bb99f5cfb13a31b29b497cf7ec2e
    1.7.28: sha256:659eceb8a5831a704089825d980f63abfb686650646751e13f9f9fac780ea08e
@@ -1335,11 +1210,8 @@ containerd_static_archive_checksums:
    1.7.1: sha256:8b4e8ed8a650ea435aa71e115fa1a70701ab98bc1836b3ed33341af35bf85a3a
    1.7.0: sha256:64ad6428cc4aca486db3a6148682052955d1e3134b69f079edf686c21d123fcd
  ppc64le:
    2.2.3: sha256:63e884ac7a25591ced974235396ed4ee98569506258672636ed55f60d4bcd66a
    2.2.2: sha256:7e3d541c578fe06bcdb36ee58140e6e36dc97e784a9228e31c3ce99937cbad10
    2.2.1: sha256:fc9235be9a3dd3005e7fe6a9d7bb80e42dbfbff4b119cdce6ea3ee66bc7ae9ca
    2.2.0: sha256:d15a4edfe689ce71df8cc5a0c1837856f54aba8d7336170600e6592c2fbf3d8d
    2.1.7: sha256:0454397e1179ff0c3cdc4ea8fb7816b634c6fd69a3003fdcc4008a657c4e9977
    2.1.6: sha256:c64312b87181d900452b5c3360a90578acd39ec7664d0c2e060183b24a708766
    2.1.5: sha256:4404b918b9e101274baa072188054766a1af16be8d22f02a51a5f6ee4e5d159f
    2.1.4: sha256:9bc1ac45ba197873a4d47045313e0cc55910802937739bf57aded125abe55c8c
@@ -1347,7 +1219,6 @@ containerd_static_archive_checksums:
    2.1.2: sha256:4e61d5f9b5789e27c28b94fe0901552fb0070aa0c36aeaabc6e2786f3d5828ff
    2.1.1: sha256:32c307e4b5cf014b594a9e7c22c610238143da8797f2bf4058dfb94225606ad4
    2.1.0: sha256:df73c5ce713196be46f4b20d3ff081d67dabb5c730f61da7a3a65a9029b4f762
    2.0.8: sha256:b014afa514a68eabf009021ff7ad1707f628d3050eafce41f7d54d8e4f344f82
    2.0.7: sha256:3f5993c7717216ae82083ce8c96af4d471da6e55affb03bfe4b86c59c6f54781
    2.0.6: sha256:15a9af201730810fa2b2943c94a2651063a7d09b684f706520965c02000bbd0a
    2.0.5: sha256:7e16bdcc5ceab50a880f6a9c7885b15f98ab60f0b963b3092928f89a7b26c8be
@@ -1356,7 +1227,6 @@ containerd_static_archive_checksums:
    2.0.2: sha256:4085c490ad5afb40b34782d427130396513a7eb35a49da8a6b7ade946dd309ce
    2.0.1: sha256:6e8608e1993099f4ad44d77765be76fd67147108a6247f6886af33be08287a84
    2.0.0: sha256:c389b68c9ca7774efdbc9e479d9a3be14b71d60a2a8c23f1d8764ec9598f3d55
    1.7.31: sha256:460c276e75cb9bb205d0b4f685875c533fd6a904d91af539604d8085482e6453
    1.7.30: sha256:95f12a656977f516b257f6447c197a30bd75b8b9d494a741a7f1f486a069de8c
    1.7.29: sha256:5f4a351d4ecf0aedda743b2ea4b7304a72cf534f4f83c976de3a0d5adf006445
    1.7.28: sha256:94dcce54f82bcd34a171af082cd035163cbb281923afc09454e0539eeef73974
@@ -1451,8 +1321,6 @@ yq_checksums:
    4.40.3: sha256:2fe818a0b141913a41548e0e727267479d0f755221c73f9e304788c8e9139a45
 gateway_api_standard_crds_checksums:
  no_arch:
    1.5.1: sha256:751002b3b91a87f7ae3bd2517c79a47a8d7ed6702901808a1cf9bd97d284f9b8
    1.5.0: sha256:510338cf6709f84410efcce5269268f4c7c5067efdc5d04c75aa2fd2f8380c96
    1.4.1: sha256:73b91b77f6be023a8c92c969fc664e5bd3b1a28aea59eac9ebc904607354dad2
    1.4.0: sha256:6a4029e661446d64add866a00ecdc40c14219b68777ab614c5cdaac0adb481f1
    1.3.0: sha256:78796d5c51450fc55d8dc8092ba8137f8c807982d7508d7875d5c537a24082b9
@@ -1463,8 +1331,6 @@ gateway_api_standard_crds_checksums:
    1.0.0: sha256:23e4e1095c72a0587474f7fb3f85c319cdec77a083ab91237ffbdec1f1834d2a
 gateway_api_experimental_crds_checksums:
  no_arch:
    1.5.1: sha256:64ec76609a6ac885e0405dea79ca509c229fa019d342f0857aa8b6bdc8b8ba92
    1.5.0: sha256:f7cc7d309a7ad9d316938341046ed81c40e787d8082f0b281df3926289a7a445
    1.4.1: sha256:553327e0ff32a1a2be446bf93823c8413cf9253ac6a6d5407eebd1e8d269f69e
    1.4.0: sha256:0414b160767377e85fd362855501200c6b83b84758bcd532652e3fe1cc677e49
    1.3.0: sha256:3e7a27e4456ff3d68606a6a8516306aaff354d6f0950b32bb31930669b7bf8b8
--- a/roles/kubespray_defaults/vars/main/main.yml
+++ b/roles/kubespray_defaults/vars/main/main.yml
@@ -7,15 +7,14 @@ kube_next: "{{ ((kube_version | split('.'))[1] | int) + 1 }}"
 kube_major_next_version: "1.{{ kube_next }}"
 pod_infra_supported_versions:
  '1.36': '3.10.2'
  '1.35': '3.10.1'
  '1.34': '3.10.1'
  '1.33': '3.10'
 etcd_supported_versions:
  '1.36': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"
  '1.35': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"
  '1.34': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
-
+  '1.33': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
 # Kubespray constants
 kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}"
--- a/roles/network_plugin/cilium/defaults/main.yml
+++ b/roles/network_plugin/cilium/defaults/main.yml
@@ -171,6 +171,10 @@ cilium_hubble_peer_service_cluster_domain: "{{ dns_domain }}"
 cilium_gateway_api_enabled: false
 # The default IP address management mode is "Cluster Scope".
 # https://docs.cilium.io/en/stable/concepts/networking/ipam/
 cilium_ipam_mode: cluster-pool
 # Cluster Pod CIDRs use the kube_pods_subnet value by default.
 # If your node network is in the same range you will lose connectivity to other nodes.
 # Defaults to kube_pods_subnet if not set.
--- a/roles/network_plugin/cilium/tasks/check.yml
+++ b/roles/network_plugin/cilium/tasks/check.yml
@@ -67,19 +67,3 @@
    that: "cilium_hubble_event_buffer_capacity in [1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191, 16383, 32767, 65535]"
    msg: "Error: cilium_hubble_event_buffer_capacity:{{ cilium_hubble_event_buffer_capacity }} is not a power of 2 minus 1 and it should be between 1 and 65535."
  when: cilium_hubble_event_buffer_capacity is defined
 # Cilium < 1.20 only supports Gateway API v1.4.1; v1.5+ standard channel drops
 # TLSRoute v1alpha2 (served=false) which makes cilium-operator CrashLoopBackOff.
 # Fix is in Cilium 1.20+ (cilium/cilium#45251) and will not be backported.
 - name: Stop if cilium_gateway_api_enabled is incompatible with the Gateway API CRD bundle
  assert:
    that:
      - gateway_api_version is version('1.5.0', '<') or gateway_api_channel != 'standard'
    msg: |
      Cilium < 1.20 only supports Gateway API v1.4.1, see
      https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/.
      Pin gateway_api_version: '1.4.1', or set gateway_api_channel: 'experimental'.
  when:
    - cilium_gateway_api_enabled
    - gateway_api_enabled
    - cilium_version is version('1.20.0', '<')
--- a/roles/network_plugin/cilium/templates/cilium/cilium-bgp-advertisement.yml.j2
+++ b/roles/network_plugin/cilium/templates/cilium/cilium-bgp-advertisement.yml.j2
@@ -4,9 +4,8 @@ apiVersion: "cilium.io/v2"
 kind: CiliumBGPAdvertisement
 metadata:
  name: "{{ cilium_bgp_advertisement.name }}"
-{% if 'labels' in cilium_bgp_advertisement %}
+{% if cilium_bgp_advertisement.labels %}
-  labels:
+  labels: {{ cilium_bgp_advertisement.labels | to_yaml }}
 {{ cilium_bgp_advertisement.labels | to_nice_yaml | indent(4, first=True) }}
 {% endif %}
 spec:
  {{ cilium_bgp_advertisement.spec | to_yaml | indent(4) }}
--- a/roles/network_plugin/cilium/templates/values.yaml.j2
+++ b/roles/network_plugin/cilium/templates/values.yaml.j2
@@ -177,9 +177,6 @@ hostFirewall:
 policyAuditMode: {{ cilium_policy_audit_mode | to_json }}
 prometheus:
  enabled: {{ cilium_enable_prometheus | to_json }}
 certgen:
  image:
    repository: {{ cilium_hubble_certgen_image_repo }}
--- a/roles/network_plugin/custom_cni/meta/main.yml
+++ b/roles/network_plugin/custom_cni/meta/main.yml
@@ -4,7 +4,9 @@ dependencies:
    when:
      - inventory_hostname == groups['kube_control_plane'][0]
      - custom_cni_chart_release_name | length > 0
-    environment: "{{ proxy_env }}"
+    environment:
      http_proxy: "{{ http_proxy | default('') }}"
      https_proxy: "{{ https_proxy | default('') }}"
    release_common_opts: {}
    releases:
      - name: "{{ custom_cni_chart_release_name }}"
--- a/roles/system_packages/vars/main.yml
+++ b/roles/system_packages/vars/main.yml
@@ -65,7 +65,6 @@ pkgs:
    - "{{ ping_access_ip }}"
  ipvsadm:
    - "{{ kube_proxy_mode == 'ipvs' }}"
    - "{{ not kube_proxy_remove }}"
    - "{{ 'k8s_cluster' in group_names }}"
  libseccomp:
    - "{{ ansible_os_family == 'RedHat' }}"
@@ -81,7 +80,6 @@ pkgs:
    - "{{ ansible_distribution_major_version == '12' }}"
  nftables:
    - "{{ kube_proxy_mode == 'nftables' }}"
    - "{{ not kube_proxy_remove }}"
    - "{{ 'k8s_cluster' in group_names }}"
  nss:
    - "{{ ansible_os_family == 'RedHat' }}"
--- a/scripts/readme_versions.md.j2
+++ b/scripts/readme_versions.md.j2
@@ -3,7 +3,7 @@
  - [etcd](https://github.com/etcd-io/etcd) {{ etcd_version }}
  - [docker](https://www.docker.com/) {{ docker_version }}
  - [containerd](https://containerd.io/) {{ containerd_version }}
-  - [cri-o](https://cri-o.io/) {{ crio_version }} (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [cri-o](http://cri-o.io/) {{ crio_version }} (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
  - [cni-plugins](https://github.com/containernetworking/plugins) {{ cni_version }}
  - [calico](https://github.com/projectcalico/calico) {{ calico_version }}
--- a/test-infra/image-builder/Makefile
+++ b/test-infra/image-builder/Makefile
@@ -1,28 +1,2 @@
 deploy:
 	ansible-playbook -i hosts.ini -e docker_password=$(docker_password) cluster.yml
 validate:
 	ansible-playbook -i localhost, -c local \
 		-e images_dir=$(CURDIR)/.image-builder \
 		-e kubevirt_buildkit_output_dir=$(CURDIR)/.image-builder/buildkit-output \
 		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "buildkit", "kubevirt_images_target_host": "localhost"}' \
 		cluster.yml
 validate-single:
 	ansible-playbook -i localhost, -c local \
 		-e images_dir=$(CURDIR)/.image-builder \
 		-e kubevirt_buildkit_output_dir=$(CURDIR)/.image-builder/buildkit-output \
 		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "buildkit", "kubevirt_images_target_host": "localhost", "kubevirt_images_selected": ["$(image_name)"]}' \
 		cluster.yml
 validate-docker:
 	ansible-playbook -i localhost, -c local \
 		-e images_dir=$(CURDIR)/.image-builder \
 		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "docker", "kubevirt_images_target_host": "localhost"}' \
 		cluster.yml
 validate-single-docker:
 	ansible-playbook -i localhost, -c local \
 		-e images_dir=$(CURDIR)/.image-builder \
 		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "docker", "kubevirt_images_target_host": "localhost", "kubevirt_images_selected": ["$(image_name)"]}' \
 		cluster.yml
--- a/test-infra/image-builder/README.md
+++ b/test-infra/image-builder/README.md
@@ -55,27 +55,3 @@ make docker_password=<quay-robot-token>
 3. Submit a PR with the `defaults/main.yml` change so CI can use the new image.
   See [#12379](https://github.com/kubernetes-sigs/kubespray/pull/12379) for an example.
 ## CI Validation
 ### Build only
 ```bash
 cd test-infra/image-builder/
 make validate
 ```
 This validation path runs locally and uses BuildKit, so it does not depend on SSH access to the remote builder host or a Docker daemon.
 ### Build only for one image
 ```bash
 cd test-infra/image-builder/
 make validate-single image_name=ubuntu-2404
 ```
 ## Runtime Variables
 - `kubevirt_images_push` (default: `true`): when `false`, skip docker login/push/logout.
 - `kubevirt_images_selected` (default: `[]`): list of image keys to build. Empty list builds all images.
 - `kubevirt_container_builder` (default: `docker`): use `buildkit` for local CI validation without Docker daemon access.
--- a/test-infra/image-builder/cluster.yml
+++ b/test-infra/image-builder/cluster.yml
@@ -1,6 +1,6 @@
 ---
 - name: Build kubevirt images
-  hosts: "{{ kubevirt_images_target_host | default('image-builder') }}"
+  hosts: image-builder
  gather_facts: false
  roles:
    - kubevirt-images
--- a/test-infra/image-builder/roles/kubevirt-images/defaults/main.yml
+++ b/test-infra/image-builder/roles/kubevirt-images/defaults/main.yml
@@ -4,10 +4,6 @@ images_dir: /images/base
 docker_user: kubespray+buildvmimages
 docker_host: quay.io
 registry: quay.io/kubespray
 kubevirt_images_push: true
 kubevirt_images_selected: []
 kubevirt_container_builder: docker
 kubevirt_buildkit_output_dir: "{{ images_dir }}/buildkit-output"
 images:
  ubuntu-2004:
@@ -26,8 +22,8 @@ images:
  ubuntu-2404:
    filename: noble-server-cloudimg-amd64.img
-    url: https://cloud-images.ubuntu.com/noble/20260323/noble-server-cloudimg-amd64.img
+    url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
-    checksum: sha256:6e7016f2c9f4d3c00f48789eb6b9043ba2172ccc1b6b1eaf3ed1e29dd3e52bb3
+    checksum: sha256:0cf56a2b23b430c350311dbcb9221b64823a5f7a401b5cf6ab4821f2ffdabe76
    converted: false
    tag: "latest"
@@ -73,13 +69,6 @@ images:
    converted: true
    tag: "latest"
  fedora-43:
    filename: Fedora-Cloud-Base-Generic-43-1.6.x86_64.qcow2
    url: https://download.fedoraproject.org/pub/fedora/linux/releases/43/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-43-1.6.x86_64.qcow2
    checksum: sha256:846574c8a97cd2d8dc1f231062d73107cc85cbbbda56335e264a46e3a6c8ab2f
    converted: true
    tag: "latest"
  fedora-coreos:
    filename: fedora-coreos-32.20200601.3.0-openstack.x86_64.qcow2.xz
    url: https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/32.20200601.3.0/x86_64/fedora-coreos-32.20200601.3.0-openstack.x86_64.qcow2.xz
--- a/test-infra/image-builder/roles/kubevirt-images/tasks/main.yml
+++ b/test-infra/image-builder/roles/kubevirt-images/tasks/main.yml
@@ -1,201 +1,58 @@
 ---
- name: Build kubevirt images
+- name: Create image directory
-  vars:
+  file:
-    kubevirt_images_to_build: "{{ images | dict2items if kubevirt_images_selected | length == 0 else ([images] | community.general.keep_keys(target=kubevirt_images_selected))[0] | dict2items }}"
+    state: directory
-  block:
+    path: "{{ images_dir }}"
-    - name: Validate selected image names
+    mode: "0755"
      assert:
        that:
          - kubevirt_images_selected | length == 0 or kubevirt_images_to_build | length > 0
        fail_msg: "No matching images found in `images` for `kubevirt_images_selected={{ kubevirt_images_selected }}`"
-    - name: Validate requested container builder
+- name: Download images files
-      assert:
+  get_url:
-        that:
+    url: "{{ item.value.url }}"
-          - kubevirt_container_builder in ['docker', 'buildkit']
+    dest: "{{ images_dir }}/{{ item.value.filename }}"
-        fail_msg: "Unsupported kubevirt_container_builder={{ kubevirt_container_builder }}"
+    checksum: "{{ item.value.checksum }}"
    mode: "0644"
  loop: "{{ images | dict2items }}"
-    - name: Validate BuildKit push mode
+- name: Unxz compressed images
-      assert:
+  command: unxz --force {{ images_dir }}/{{ item.value.filename }}
-        that:
+  loop: "{{ images | dict2items }}"
-          - not (kubevirt_container_builder == 'buildkit' and kubevirt_images_push)
+  when:
-        fail_msg: "BuildKit validation currently requires kubevirt_images_push=false"
+    - item.value.filename.endswith('.xz')
-    - name: Check qemu-img availability
+- name: Convert images which is not in qcow2 format
-      command: qemu-img --version
+  command: qemu-img convert -O qcow2 {{ images_dir }}/{{ item.value.filename.rstrip('.xz') }} {{ images_dir }}/{{ item.key }}.qcow2
-      changed_when: false
+  loop: "{{ images | dict2items }}"
  when:
    - not (item.value.converted | bool)
-    - name: Check Docker availability
+- name: Make sure all images are ending with qcow2
-      command: docker --version
+  command: cp {{ images_dir }}/{{ item.value.filename.rstrip('.xz') }} {{ images_dir }}/{{ item.key }}.qcow2
-      changed_when: false
+  loop: "{{ images | dict2items }}"
-      when: kubevirt_container_builder == 'docker'
+  when:
    - item.value.converted | bool
-    - name: Detect BuildKit daemonless wrapper availability
+- name: Resize images
-      shell: command -v buildctl-daemonless.sh
+  command: qemu-img resize {{ images_dir }}/{{ item.key }}.qcow2 +8G
-      args:
+  loop: "{{ images | dict2items }}"
        executable: /bin/bash
      register: kubevirt_buildctl_daemonless_available
      changed_when: false
      failed_when: false
      when: kubevirt_container_builder == 'buildkit'
-    - name: Check BuildKit availability
+# STEP 2: Include the images inside a container
-      shell: |
+- name: Template default Dockerfile
-        set -euo pipefail
+  template:
-        if [ "{{ kubevirt_buildctl_daemonless_available.rc | default(1) }}" -eq 0 ]; then
+    src: Dockerfile
-          buildctl-daemonless.sh --version
+    dest: "{{ images_dir }}/Dockerfile"
-        else
+    mode: "0644"
          buildctl --version
          buildkitd --version
        fi
      args:
        executable: /bin/bash
      changed_when: false
      when: kubevirt_container_builder == 'buildkit'
-    - name: Create image directory
+- name: Create docker images for each OS
-      file:
+  command: docker build -t {{ registry }}/vm-{{ item.key }}:{{ item.value.tag }} --build-arg cloud_image="{{ item.key }}.qcow2" {{ images_dir }}
-        state: directory
+  loop: "{{ images | dict2items }}"
        path: "{{ images_dir }}"
        mode: "0755"
-    - name: Create buildkit output directory
+- name: Docker login
-      file:
+  command: docker login -u="{{ docker_user }}" -p="{{ docker_password }}" "{{ docker_host }}"
        state: directory
        path: "{{ kubevirt_buildkit_output_dir }}"
        mode: "0755"
      when: kubevirt_container_builder == 'buildkit'
-    - name: Download images files
+- name: Docker push image
-      get_url:
+  command: docker push {{ registry }}/vm-{{ item.key }}:{{ item.value.tag }}
-        url: "{{ item.value.url }}"
+  loop: "{{ images | dict2items }}"
        dest: "{{ images_dir }}/{{ item.value.filename }}"
        checksum: "{{ item.value.checksum }}"
        mode: "0644"
      loop: "{{ kubevirt_images_to_build }}"
-    - name: Unxz compressed images
+- name: Docker logout
-      command: unxz --force {{ images_dir }}/{{ item.value.filename }}
+  command: docker logout -u="{{ docker_user }}" "{{ docker_host }}"
      loop: "{{ kubevirt_images_to_build }}"
      when:
        - item.value.filename.endswith('.xz')
    - name: Convert images which is not in qcow2 format
      command: qemu-img convert -O qcow2 {{ images_dir }}/{{ item.value.filename.rstrip('.xz') }} {{ images_dir }}/{{ item.key }}.qcow2
      loop: "{{ kubevirt_images_to_build }}"
      when:
        - not (item.value.converted | bool)
    - name: Make sure all images are ending with qcow2
      command: cp {{ images_dir }}/{{ item.value.filename.rstrip('.xz') }} {{ images_dir }}/{{ item.key }}.qcow2
      loop: "{{ kubevirt_images_to_build }}"
      when:
        - item.value.converted | bool
    - name: Resize images
      command: qemu-img resize {{ images_dir }}/{{ item.key }}.qcow2 +8G
      loop: "{{ kubevirt_images_to_build }}"
    # STEP 2: Include the images inside a container
    - name: Template default Dockerfile
      template:
        src: Dockerfile
        dest: "{{ images_dir }}/Dockerfile"
        mode: "0644"
    - name: Create docker images for each OS
      command: docker build -t {{ registry }}/vm-{{ item.key }}:{{ item.value.tag }} --build-arg cloud_image="{{ item.key }}.qcow2" {{ images_dir }}
      loop: "{{ kubevirt_images_to_build }}"
      when: kubevirt_container_builder == 'docker'
    - name: Create container images for each OS with BuildKit
      shell: |
        set -euo pipefail
        IMAGE_REF="{{ registry }}/vm-{{ item.key }}:{{ item.value.tag }}"
        OUTPUT_TAR="{{ kubevirt_buildkit_output_dir }}/vm-{{ item.key }}-{{ item.value.tag }}.tar"
        # Rootless BuildKit is the CI path; root mode must not use rootless-only flags.
        if [ "$(id -u)" -eq 0 ]; then
          BUILDKITD_FLAGS="${BUILDKITD_FLAGS:-}"
        else
          BUILDKITD_FLAGS="${BUILDKITD_FLAGS:---rootless --oci-worker-no-process-sandbox --oci-worker-snapshotter=native}"
        fi
        run_buildkit() {
        if [ "{{ kubevirt_buildctl_daemonless_available.rc | default(1) }}" -eq 0 ]; then
          export BUILDKITD_FLAGS
          buildctl-daemonless.sh build \
            --frontend dockerfile.v0 \
            --local context={{ images_dir }} \
            --local dockerfile={{ images_dir }} \
            --opt filename=Dockerfile \
            --opt build-arg:cloud_image={{ item.key }}.qcow2 \
            --output "{{ 'type=image,name=' ~ registry ~ '/vm-' ~ item.key ~ ':' ~ item.value.tag ~ ',push=true' if kubevirt_images_push else 'type=oci,dest=' ~ kubevirt_buildkit_output_dir ~ '/vm-' ~ item.key ~ '-' ~ item.value.tag ~ '.tar' }}"
        else
          BUILDKIT_ADDR="unix:///tmp/buildkitd-{{ item.key }}.sock"
          buildkitd ${BUILDKITD_FLAGS} --addr "${BUILDKIT_ADDR}" >/tmp/buildkitd-{{ item.key }}.log 2>&1 &
          buildkitd_pid=$!
          cleanup() {
            kill "${buildkitd_pid}" >/dev/null 2>&1 || true
            wait "${buildkitd_pid}" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT
          for _ in $(seq 1 50); do
            if buildctl --addr "${BUILDKIT_ADDR}" debug workers >/dev/null 2>&1; then
              break
            fi
            sleep 0.2
          done
          buildctl --addr "${BUILDKIT_ADDR}" build \
            --frontend dockerfile.v0 \
            --local context={{ images_dir }} \
            --local dockerfile={{ images_dir }} \
            --opt filename=Dockerfile \
            --opt build-arg:cloud_image={{ item.key }}.qcow2 \
            --output "{{ 'type=image,name=' ~ registry ~ '/vm-' ~ item.key ~ ':' ~ item.value.tag ~ ',push=true' if kubevirt_images_push else 'type=oci,dest=' ~ kubevirt_buildkit_output_dir ~ '/vm-' ~ item.key ~ '-' ~ item.value.tag ~ '.tar' }}"
        fi
        }
        if run_buildkit; then
          exit 0
        fi
        echo "BuildKit failed in this environment; attempting Docker fallback for {{ item.key }}" >&2
        if ! command -v docker >/dev/null 2>&1; then
          echo "Docker fallback unavailable: docker command not found" >&2
          exit 1
        fi
        docker build -t "${IMAGE_REF}" --build-arg cloud_image="{{ item.key }}.qcow2" {{ images_dir }}
        {% if kubevirt_images_push %}
        docker push "${IMAGE_REF}"
        {% else %}
        docker save -o "${OUTPUT_TAR}" "${IMAGE_REF}"
        {% endif %}
      args:
        executable: /bin/bash
      loop: "{{ kubevirt_images_to_build }}"
      when: kubevirt_container_builder == 'buildkit'
    - name: Docker login
      command: docker login -u="{{ docker_user }}" -p="{{ docker_password }}" "{{ docker_host }}"
      when:
        - kubevirt_container_builder == 'docker'
        - kubevirt_images_push
    - name: Docker push image
      command: docker push {{ registry }}/vm-{{ item.key }}:{{ item.value.tag }}
      loop: "{{ kubevirt_images_to_build }}"
      when:
        - kubevirt_container_builder == 'docker'
        - kubevirt_images_push
    - name: Docker logout
      command: docker logout "{{ docker_host }}"
      when:
        - kubevirt_container_builder == 'docker'
        - kubevirt_images_push
--- a/tests/files/debian13-calico.yml
+++ b/tests/files/debian13-calico.yml
@@ -7,7 +7,3 @@ gateway_api_enabled: true
 dns_mode: coredns_dual
 kube_asymmetric_encryption_algorithm: "RSA-3072"
 # Test download/container images pre-loading
 k8s_image_pull_policy: Never
--- a/tests/files/fedora39-calico-selinux.yml
+++ b/tests/files/fedora39-calico-selinux.yml
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-42
+cloud_image: fedora-39
 # Kubespray settings
 auto_renew_certificates: true
--- a/tests/files/fedora39-calico-swap-selinux.yml
+++ b/tests/files/fedora39-calico-swap-selinux.yml
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-42
+cloud_image: fedora-39
 # Kubespray settings
 auto_renew_certificates: true
--- a/tests/files/fedora39-crio.yml
+++ b/tests/files/fedora39-crio.yml
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-43
+cloud_image: fedora-39
 # Kubespray settings
 container_manager: crio
--- a/tests/files/fedora39-kube-router.yml
+++ b/tests/files/fedora39-kube-router.yml
@@ -1,5 +1,5 @@
 ---
-cloud_image: fedora-43
+cloud_image: fedora-39
 cluster_layout:
  - node_groups: ['kube_control_plane', 'etcd', 'kube_node']
  - node_groups: ['kube_node']
--- a/tests/files/fedora40-docker-calico.yml
+++ b/tests/files/fedora40-docker-calico.yml
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-43
+cloud_image: fedora-40
 # Kubespray settings
 auto_renew_certificates: true
--- a/tests/files/fedora40-flannel-crio-collection-scale.yml
+++ b/tests/files/fedora40-flannel-crio-collection-scale.yml
@@ -1,5 +1,5 @@
 ---
-cloud_image: fedora-43
+cloud_image: fedora-40
 network_plugin: flannel
 container_manager: crio
--- a/tests/files/fedora41-calico-selinux.yml
+++ b/tests/files/fedora41-calico-selinux.yml
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-43
+cloud_image: fedora-41
 # Kubespray settings
 auto_renew_certificates: true
--- a/tests/files/fedora41-calico-swap-selinux.yml
+++ b/tests/files/fedora41-calico-swap-selinux.yml
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-43
+cloud_image: fedora-41
 # Kubespray settings
 auto_renew_certificates: true
--- a/tests/files/fedora41-crio.yml
+++ b/tests/files/fedora41-crio.yml
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-42
+cloud_image: fedora-41
 # Kubespray settings
 container_manager: crio
--- a/tests/files/fedora41-kube-router.yml
+++ b/tests/files/fedora41-kube-router.yml
@@ -1,5 +1,5 @@
 ---
-cloud_image: fedora-42
+cloud_image: fedora-41
 cluster_layout:
  - node_groups: ['kube_control_plane', 'etcd', 'kube_node']
  - node_groups: ['kube_node']
--- a/tests/files/fedora42-calico.yml
+++ b/tests/files/fedora42-calico.yml
@@ -7,7 +7,3 @@ auto_renew_certificates: true
 # Test with SELinux in enforcing mode
 preinstall_selinux_state: enforcing
 # Test that download/container did pre-load the image on the nodes
 k8s_image_pull_policy: Never
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -1,4 +1,4 @@
 -r ../requirements.txt
 distlib==0.4.0 # required for building collections
-molecule==26.4.0
+molecule==26.3.0
 pytest-testinfra==10.2.2