build(deps): bump cryptography from 49.0.0 to 50.0.0

Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Upgrade cilium from 1.19.6 to 1.20.0 (#13401 )
2026-08-10 14:51:48 -02:30 · 2026-08-10 03:14:16 +00:00 · 2026-08-06 13:26:54 +00:00 · 2026-08-06 13:22:55 +00:00 · 2026-08-03 07:21:29 +00:00 · 2026-08-03 04:33:24 +00:00
52 changed files with 374 additions and 142 deletions
--- a/.github/advanced-issue-labeler.yml
+++ b/.github/advanced-issue-labeler.yml
@@ -0,0 +1,54 @@
+---
+policy:
+  - section:
+      - id: [os]
+        block-list: []
+        label:
+          - name: 'RHEL 9'
+            keys: ['RHEL 9']
+          - name: 'RHEL 8'
+            keys: ['RHEL 8']
+          - name: 'Fedora 40'
+            keys: ['Fedora 40']
+          - name: 'Ubuntu 24'
+            keys: ['Ubuntu 24']
+          - name: 'Ubuntu 22'
+            keys: ['Ubuntu 22']
+          - name: 'Ubuntu 20'
+            keys: ['Ubuntu 20']
+          - name: 'Debian 12'
+            keys: ['Debian 12']
+          - name: 'Debian 11'
+            keys: ['Debian 11']
+          - name: 'Flatcar Container Linux'
+            keys: ['Flatcar Container Linux']
+          - name: 'openSUSE Leap'
+            keys: ['openSUSE Leap']
+          - name: 'openSUSE Tumbleweed'
+            keys: ['openSUSE Tumbleweed']
+          - name: 'Oracle Linux 9'
+            keys: ['Oracle Linux 9']
+          - name: 'Oracle Linux 8'
+            keys: ['Oracle Linux 8']
+          - name: 'AlmaLinux 9'
+            keys: ['AlmaLinux 9']
+          - name: 'AlmaLinux 8'
+            keys: ['AlmaLinux 8']
+          - name: 'Rocky Linux 9'
+            keys: ['Rocky Linux 9']
+          - name: 'Rocky Linux 8'
+            keys: ['Rocky Linux 8']
+          - name: 'Amazon Linux 2'
+            keys: ['Amazon Linux 2']
+          - name: 'Kylin Linux Advanced Server V10'
+            keys: ['Kylin Linux Advanced Server V10']
+          - name: 'UOS Linux 20'
+            keys: ['UOS Linux 20']
+          - name: 'openEuler 24'
+            keys: ['openEuler 24']
+          - name: 'openEuler 22'
+            keys: ['openEuler 22']
+          - name: 'openEuler 20'
+            keys: ['openEuler 20']
+          - name: 'Other|Unsupported'
+            keys: ['Other|Unsupported']
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,10 @@ updates:
        patterns:
          - molecule
          - molecule-plugins*
+    ignore:
+      # Ansible major versions are upgraded manually to support multiple OS/Python versions.
+      - dependency-name: "ansible"
+        update-types: ["version-update:semver-major"]
  - package-ecosystem: "github-actions"
    directory: "/"
    labels:
--- a/.github/workflows/auto-label-os.yml
+++ b/.github/workflows/auto-label-os.yml
@@ -13,7 +13,7 @@ jobs:
      issues: write

    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Parse issue form
        uses: stefanbuck/github-issue-parser@cb6e97157cbf851e3a393ff8d57c93a484cc323f
@@ -21,12 +21,9 @@ jobs:
        with:
          template-path: .github/ISSUE_TEMPLATE/bug-report.yaml

-      - name: Set labels based on OS field
+      - name: Set labels based on allowed OS values
        uses: redhat-plumbers-in-action/advanced-issue-labeler@b80ae64e3e156e9c111b075bfa04b295d54e8e2e
        with:
          issue-form: ${{ steps.issue-parser.outputs.jsonString }}
-          section: os
-          block-list: |
-            None
-            Other
+          config-path: .github/advanced-issue-labeler.yml
          token: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/upgrade-patch-versions.yml
+++ b/.github/workflows/upgrade-patch-versions.yml
@@ -11,10 +11,10 @@ jobs:
  update-patch-versions:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        ref: ${{ inputs.branch }}
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: '3.13'
        cache: 'pip'
@@ -22,7 +22,7 @@ jobs:
    - run: update-hashes
      env:
        API_KEY: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        key: pre-commit-hook-propagate
        path: |
--- a/.gitlab-ci/kubevirt.yml
+++ b/.gitlab-ci/kubevirt.yml
@@ -70,7 +70,6 @@ pr-flakey:
    matrix:
      - TESTCASE:
          - flatcar4081-calico # https://github.com/kubernetes-sigs/kubespray/issues/12309
-          - openeuler24-calico # https://github.com/kubernetes-sigs/kubespray/issues/12877

 # The ubuntu24-calico-all-in-one jobs are meant as early stages to prevent running the full CI if something is horribly broken
 ubuntu24-calico-all-in-one:
@@ -109,6 +108,7 @@ pr_full:
          - fedora42-crio
          - fedora43-calico-swap-selinux
          - fedora43-crio
+          - openeuler24-calico # https://github.com/kubernetes-sigs/kubespray/issues/12877
          - ubuntu24-calico-ha-wireguard
          - ubuntu24-flannel-ha
          - ubuntu24-flannel-ha-once
--- a/4
+++ b/4
@@ -35,8 +35,8 @@ RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]

 RUN OS_ARCHITECTURE=$(dpkg --print-architecture) \
-    && curl -L "https://dl.k8s.io/release/v1.36.2/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
-    && echo "$(curl -L "https://dl.k8s.io/release/v1.36.2/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
+    && curl -L "https://dl.k8s.io/release/v1.36.3/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
+    && echo "$(curl -L "https://dl.k8s.io/release/v1.36.3/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl

 COPY *.yml ./
--- a/README.md
+++ b/README.md
@@ -111,15 +111,15 @@ Note:
 <!-- BEGIN ANSIBLE MANAGED BLOCK -->

 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.36.2
-  - [etcd](https://github.com/etcd-io/etcd) 3.6.12
+  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.36.3
+  - [etcd](https://github.com/etcd-io/etcd) 3.6.13
  - [docker](https://www.docker.com/) 28.3
-  - [containerd](https://containerd.io/) 2.3.1
-  - [cri-o](https://cri-o.io/) 1.36.1 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [containerd](https://containerd.io/) 2.3.3
+  - [cri-o](https://cri-o.io/) 1.36.2 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
  - [cni-plugins](https://github.com/containernetworking/plugins) 1.9.1
-  - [calico](https://github.com/projectcalico/calico) 3.31.5
-  - [cilium](https://github.com/cilium/cilium) 1.19.4
+  - [calico](https://github.com/projectcalico/calico) 3.31.6
+  - [cilium](https://github.com/cilium/cilium) 1.20.0
  - [flannel](https://github.com/flannel-io/flannel) 0.28.4
  - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
  - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
--- a/docs/CNI/cilium.md
+++ b/docs/CNI/cilium.md
@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version

 ```yml
-cilium_version: "1.19.4"
+cilium_version: "1.20.0"
 ```

 ## Add variable to config
--- a/docs/developers/ci.md
+++ b/docs/developers/ci.md
@@ -30,7 +30,7 @@ debian11 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :white_check_mark: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
--- a/docs/operating_systems/rhel.md
+++ b/docs/operating_systems/rhel.md
@@ -35,6 +35,6 @@ If the RHEL hosts are already registered to a valid Red Hat support subscription

 (Experimental in Kubespray CI)

-The official Rocky Linux 10 cloud image does not include `kernel-module-extra`. Both Kube Proxy and CNI rely on this package, and since it relates to kernel version compatibility (which may require VM reboots, etc.), we haven't found an ideal solution.
+The official Rocky Linux 10 cloud image does not include `kernel-modules-extra`. Both Kube Proxy and CNI rely on this package, and since it relates to kernel version compatibility (which may require VM reboots, etc.), we haven't found an ideal solution.

 However, some users report that it doesn't affect them (minimal version). Therefore, the Kubespray CI Rocky Linux 10 image is built by Kubespray maintainers using `diskimage-builder`. For detailed methods, please refer to [the comments](https://github.com/kubernetes-sigs/kubespray/pull/12355#issuecomment-3705400093).
--- a/docs/operations/upgrades.md
+++ b/docs/operations/upgrades.md
@@ -437,3 +437,5 @@ Nodes will be rebooted when there are package upgrades (`system_upgrade_reboot:
 This can be changed to `always` or `never`.

 Note: Downloads will happen twice unless `system_upgrade_reboot` is `never`.
+
+Debian based nodes can be cleaned of packages to reduce disk space usage with `system_upgrade_autoclean: true`
--- a/inventory/sample/group_vars/all/openstack.yml
+++ b/inventory/sample/group_vars/all/openstack.yml
@@ -42,13 +42,13 @@

 ## Tags for the Cinder CSI images
 ## registry.k8s.io/sig-storage/csi-attacher
-# cinder_csi_attacher_image_tag: "v4.4.2"
+# cinder_csi_attacher_image_tag: "v4.5.1"
 ## registry.k8s.io/sig-storage/csi-provisioner
-# cinder_csi_provisioner_image_tag: "v3.6.2"
+# cinder_csi_provisioner_image_tag: "v4.0.1"
 ## registry.k8s.io/sig-storage/csi-snapshotter
-# cinder_csi_snapshotter_image_tag: "v6.3.2"
+# cinder_csi_snapshotter_image_tag: "v7.0.2"
 ## registry.k8s.io/sig-storage/csi-resizer
-# cinder_csi_resizer_image_tag: "v1.9.2"
+# cinder_csi_resizer_image_tag: "v1.10.1"
 ## registry.k8s.io/sig-storage/livenessprobe
 # cinder_csi_livenessprobe_image_tag: "v2.11.0"

--- a/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
@@ -293,7 +293,6 @@ default_kubelet_config_dir: "{{ kube_config_dir }}/dynamic_kubelet_dir"
 ## Eviction Thresholds to avoid system OOMs
 # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
 # eviction_hard: {}
-# eviction_hard_control_plane: {}

 # An alternative flexvolume plugin directory
 # kubelet_flexvolumes_plugins_dir: /usr/libexec/kubernetes/kubelet-plugins/volume/exec
--- a/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml
@@ -30,6 +30,14 @@
 ## Helm repository URL
 # custom_cni_chart_repository_url: ""
 #
+## Helm repository username, if authentication is required
+## Username and password must be defined together
+# custom_cni_chart_repository_username: "<helm_repository_username>"
+#
+## Helm repository password, if authentication is required
+## Store sensitive values securely, for example using Ansible Vault
+# custom_cni_chart_repository_password: "<helm_repository_password>"
+#
 ## Helm chart reference - path to the chart in the repository
 # custom_cni_chart_ref: ""
 #
--- a/pipeline.Dockerfile
+++ b/pipeline.Dockerfile
@@ -46,8 +46,8 @@ ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
 RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
    && pip install --break-system-packages --ignore-installed --no-compile --no-cache-dir pip -U \
    && pip install --break-system-packages --no-compile --no-cache-dir -r tests/requirements.txt \
-    && curl -L https://dl.k8s.io/release/v1.36.2/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
-    && echo $(curl -L https://dl.k8s.io/release/v1.36.2/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
+    && curl -L https://dl.k8s.io/release/v1.36.3/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
+    && echo $(curl -L https://dl.k8s.io/release/v1.36.3/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl \
    # Install Vagrant
    && curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
--- a/playbooks/ansible_version.yml
+++ b/playbooks/ansible_version.yml
@@ -24,10 +24,3 @@
        that: "'127.0.0.1' | ansible.utils.ipaddr == '127.0.0.1'"
      tags:
        - check
-
-    - name: "Check that jinja is not too old (install via pip)"
-      assert:
-        msg: "Your Jinja version is too old, install via pip"
-        that: "{% set test %}It works{% endset %}{{ test == 'It works' }}"
-      tags:
-        - check
--- a/plugins/modules/kube.py
+++ b/plugins/modules/kube.py
@@ -325,9 +325,8 @@ def main():
            log_level=dict(default=0, type='int'),
            state=dict(default='present', choices=['present', 'absent', 'latest', 'reloaded', 'stopped', 'exists']),
            recursive=dict(default=False, type='bool'),
-            ),
-            mutually_exclusive=[['filename', 'list']]
-        )
+        ),
+    )

    changed = False

--- a/requirements.txt
+++ b/requirements.txt
@@ -1,8 +1,8 @@
 ansible==11.13.0
 # Prevented passlib version conflicts
-bcrypt<5
+bcrypt<6
 # Needed for community.crypto module
-cryptography==49.0.0
+cryptography==50.0.0
 # Needed for jinja2 json_query templating
 jmespath==1.1.0
 # Needed for ansible.utils.ipaddr
--- a/roles/bootstrap_os/tasks/centos.yml
+++ b/roles/bootstrap_os/tasks/centos.yml
@@ -6,7 +6,7 @@

 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
  community.general.ini_file:
-    path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
+    path: "{{ ((ansible_facts['distribution_major_version'] | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
    section: main
    option: proxy
    value: "{{ http_proxy | default(omit) }}"
@@ -20,28 +20,28 @@

 - name: Install EPEL for Oracle Linux repo package
  package:
-    name: "oracle-epel-release-el{{ ansible_distribution_major_version }}"
+    name: "oracle-epel-release-el{{ ansible_facts['distribution_major_version'] }}"
    state: present
  when:
    - use_oracle_public_repo
    - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_distribution_version | float) >= 7.6
+    - (ansible_facts['distribution_version'] | float) >= 7.6

 - name: Enable Oracle Linux repo
  community.general.ini_file:
-    dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_distribution_major_version }}.repo"
-    section: "ol{{ ansible_distribution_major_version }}_addons"
+    dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_facts['distribution_major_version'] }}.repo"
+    section: "ol{{ ansible_facts['distribution_major_version'] }}_addons"
    option: "{{ item.option }}"
    value: "{{ item.value }}"
    mode: "0644"
  with_items:
-    - { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
+    - { option: "name", value: "ol{{ ansible_facts['distribution_major_version'] }}_addons" }
    - { option: "enabled", value: "1" }
-    - { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_distribution_major_version }}/addons/$basearch/" }
+    - { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_facts['distribution_major_version'] }}/addons/$basearch/" }
  when:
    - use_oracle_public_repo
    - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_distribution_version | float) >= 7.6
+    - (ansible_facts['distribution_version'] | float) >= 7.6

 - name: Enable Centos extra repo for Oracle Linux
  community.general.ini_file:
@@ -51,15 +51,15 @@
    value: "{{ item.value }}"
    mode: "0644"
  with_items:
-    - { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" }
+    - { option: "name", value: "CentOS-{{ ansible_facts['distribution_major_version'] }} - Extras" }
    - { option: "enabled", value: "1" }
    - { option: "gpgcheck", value: "0" }
-    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_distribution_major_version }}/extras/$basearch/os/" }
+    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_facts['distribution_major_version'] }}/extras/$basearch/os/" }
  when:
    - use_oracle_public_repo
    - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_distribution_version | float) >= 7.6
-    - (ansible_distribution_version | float) < 9
+    - (ansible_facts['distribution_version'] | float) >= 7.6
+    - (ansible_facts['distribution_version'] | float) < 9

 # CentOS ships with python installed

--- a/roles/bootstrap_os/tasks/rhel.yml
+++ b/roles/bootstrap_os/tasks/rhel.yml
@@ -6,7 +6,7 @@

 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
  community.general.ini_file:
-    path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
+    path: "{{ ((ansible_facts['distribution_major_version'] | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
    section: main
    option: proxy
    value: "{{ http_proxy | default(omit) }}"
@@ -71,7 +71,7 @@
      - "rhel-8-for-*-appstream-rpms"
    state: "{{ 'enabled' if (rhel_enable_repos | bool) else 'disabled' }}"
  when:
-    - ansible_distribution_major_version == "8"
+    - ansible_facts['distribution_major_version'] == "8"
    - (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)

 - name: Check presence of fastestmirror.conf
--- a/roles/container-engine/cri-o/tasks/main.yaml
+++ b/roles/container-engine/cri-o/tasks/main.yaml
@@ -150,7 +150,7 @@
  copy:
    src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
    dest: /etc/systemd/system/crio.service
-    mode: "0755"
+    mode: "0644"
    remote_src: true
  notify: Restart crio

--- a/roles/download/tasks/download_container.yml
+++ b/roles/download/tasks/download_container.yml
@@ -74,7 +74,6 @@
      delegate_to: "{{ download_delegate }}"
      delegate_facts: false
      register: container_save_status
-      failed_when: container_save_status.stderr
      run_once: true
      become: "{{ user_can_become_root | default(false) or not download_localhost }}"
      when:
--- a/roles/etcd/tasks/configure.yml
+++ b/roles/etcd/tasks/configure.yml
@@ -93,7 +93,7 @@
    name: etcd-events
    state: started
    enabled: true
-  ignore_errors: "{{ etcd_events_cluster_is_healthy.rc != 0 }}"  # noqa ignore-errors
+  ignore_errors: "{{ etcd_events_cluster_is_healthy.rc == 0 }}"  # noqa ignore-errors
  when:
    - ('etcd' in group_names)
    - etcd_events_cluster_setup
--- a/roles/kubernetes-apps/container_engine_accelerator/nvidia_gpu/tasks/main.yml
+++ b/roles/kubernetes-apps/container_engine_accelerator/nvidia_gpu/tasks/main.yml
@@ -4,11 +4,11 @@
  include_vars: "{{ item }}"
  with_first_found:
    - files:
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}.yml"
-        - "{{ ansible_os_family | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}.yml"
      skip: true

 - name: Container Engine Acceleration Nvidia GPU | Set fact of download url Tesla
--- a/roles/kubernetes-apps/csi_driver/cinder/defaults/main.yml
+++ b/roles/kubernetes-apps/csi_driver/cinder/defaults/main.yml
@@ -1,8 +1,8 @@
 ---
-cinder_csi_attacher_image_tag: "v4.4.2"
-cinder_csi_provisioner_image_tag: "v3.6.2"
-cinder_csi_snapshotter_image_tag: "v6.3.2"
-cinder_csi_resizer_image_tag: "v1.9.2"
+cinder_csi_attacher_image_tag: "v4.5.1"
+cinder_csi_provisioner_image_tag: "v4.0.1"
+cinder_csi_snapshotter_image_tag: "v7.0.2"
+cinder_csi_resizer_image_tag: "v1.10.1"
 cinder_csi_livenessprobe_image_tag: "v2.11.0"

 # To access Cinder, the CSI controller will need credentials to access
--- a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2
+++ b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2
@@ -24,7 +24,7 @@ spec:
        - start
        - --config
        - /etc/config/config.json
-{% if local_path_provisioner_debug | default(false) %}
+{% if local_path_provisioner_debug %}
        - --debug
 {% endif %}
        volumeMounts:
--- a/roles/kubernetes-apps/helm/tasks/main.yml
+++ b/roles/kubernetes-apps/helm/tasks/main.yml
@@ -3,11 +3,11 @@
  include_vars: "{{ item }}"
  with_first_found:
    - files:
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}.yml"
-        - "{{ ansible_os_family | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}.yml"
        - defaults.yml
      paths:
        - ../vars
@@ -21,7 +21,7 @@

 - name: Helm | Install PyYaml [flatcar]
  include_tasks: pyyaml-flatcar.yml
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Helm | Download helm
  include_tasks: "../../../download/tasks/download_file.yml"
--- a/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2
+++ b/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2
@@ -26,7 +26,7 @@ spec:
    spec:
      priorityClassName: system-cluster-critical
      serviceAccountName: metrics-server
-      hostNetwork: {{ metrics_server_host_network | default(false) }}
+      hostNetwork: {{ metrics_server_host_network }}
      containers:
      - name: metrics-server
        image: {{ metrics_server_image_repo }}:{{ metrics_server_image_tag }}
--- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
+++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
@@ -71,6 +71,7 @@ rules:
      - blockaffinities
      - ipamblocks
      - ipamhandles
+      - ipamconfigs
      - tiers
    verbs:
      - get
@@ -124,4 +125,12 @@ rules:
      - list
      - update
      - watch
+  # Namespaces are watched for LoadBalancer IP allocation with namespace selector support
+  - apiGroups: [""]
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
 {% endif %}
--- a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
+++ b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
@@ -586,9 +586,18 @@ clusterDNS:
 {% for dns_address in kubelet_cluster_dns %}
 - {{ dns_address }}
 {% endfor %}
-{% if kubelet_feature_gates or kube_feature_gates %}
+{% set disable_websockets_to_kubelet = (container_manager == 'docker' and kube_version is version('1.36.0', '>=')) %}
 {% set feature_gates = ( kubelet_feature_gates | default(kube_feature_gates, true) ) %}
+{% if disable_websockets_to_kubelet %}
+{% set feature_gates = feature_gates | reject('search', '^ExtendWebSocketsToKubelet=') | list %}
+{% endif %}
+{% if feature_gates or disable_websockets_to_kubelet %}
 featureGates:
+{%   if disable_websockets_to_kubelet %}
+  # cri-dockerd does not support WebSocket streaming
+  # https://github.com/kubernetes-sigs/kubespray/issues/13360
+  ExtendWebSocketsToKubelet: false
+{%   endif %}
 {%   for feature in feature_gates %}
  {{ feature | replace("=", ": ") }}
 {%   endfor %}
--- a/roles/kubernetes/node/defaults/main.yml
+++ b/roles/kubernetes/node/defaults/main.yml
@@ -56,7 +56,6 @@ system_pid_reserved: 1000
 ## Eviction Thresholds to avoid system OOMs
 # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
 eviction_hard: {}
-eviction_hard_control_plane: {}

 kubelet_status_update_frequency: 10s

--- a/roles/kubernetes/node/tasks/kubelet.yml
+++ b/roles/kubernetes/node/tasks/kubelet.yml
@@ -33,7 +33,7 @@
    src: "kubelet.service.j2"
    dest: "/etc/systemd/system/kubelet.service"
    backup: true
-    mode: "0600"
+    mode: "0644"
    validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
    # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
    # Remove once we drop support for systemd < 250
--- a/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2
+++ b/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2
@@ -81,9 +81,19 @@ resolvConf: "{{ kube_resolv_conf }}"
 {% if kubelet_config_extra_args %}
 {{ kubelet_config_extra_args | to_nice_yaml(indent=2) }}
 {% endif %}
-{% if kubelet_feature_gates or kube_feature_gates %}
+{% set disable_websockets_to_kubelet = (container_manager == 'docker' and kube_version is version('1.36.0', '>=')) %}
+{% set kubelet_gates = (kubelet_feature_gates | default(kube_feature_gates, true)) %}
+{% if disable_websockets_to_kubelet %}
+{% set kubelet_gates = kubelet_gates | reject('search', '^ExtendWebSocketsToKubelet=') | list %}
+{% endif %}
+{% if kubelet_gates or disable_websockets_to_kubelet %}
 featureGates:
-{% for feature in (kubelet_feature_gates | default(kube_feature_gates, true)) %}
+{% if disable_websockets_to_kubelet %}
+  # cri-dockerd does not support WebSocket streaming
+  # https://github.com/kubernetes-sigs/kubespray/issues/13360
+  ExtendWebSocketsToKubelet: false
+{% endif %}
+{% for feature in kubelet_gates %}
  {{ feature | replace("=", ": ") }}
 {% endfor %}
 {% endif %}
--- a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
+++ b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
@@ -68,6 +68,18 @@
    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
    - not ignore_assert_errors

+- name: Stop if kube_owner is not root when using cilium
+  assert:
+    that: kube_owner == 'root'
+    fail_msg: |
+      kube_owner is set to '{{ kube_owner }}', but cilium requires it to be 'root'.
+      Cilium's init containers run as UID 0 with capabilities (including CAP_DAC_OVERRIDE) dropped,
+      so host paths it writes to (e.g. /opt/cni/bin) must be owned by root or it will fail with
+      a permission error. See https://github.com/kubernetes-sigs/kubespray/issues/13378
+  when:
+    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
+    - not ignore_assert_errors
+
 - name: Stop if kernel version is too low for nftables
  assert:
    that: ansible_facts['kernel'].split('-')[0] is version('5.13', '>=')
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -116,7 +116,7 @@ flannel_version: 0.28.4
 flannel_cni_version: 1.7.1-flannel1
 cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"

-cilium_version: "1.19.4"
+cilium_version: "1.20.0"
 cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
 cilium_enable_hubble: false

@@ -161,17 +161,17 @@ cni_download_url: "{{ github_url }}/containernetworking/plugins/releases/downloa
 calicoctl_download_url: "{{ github_url }}/projectcalico/calico/releases/download/v{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}"
 calico_crds_download_url: "{{ github_url }}/projectcalico/calico/raw/v{{ calico_version }}/manifests/crds.yaml"
 ciliumcli_download_url: "{{ github_url }}/cilium/cilium-cli/releases/download/v{{ cilium_cli_version }}/cilium-linux-{{ image_arch }}.tar.gz"
-crictl_download_url: "{{ github_url }}/kubernetes-sigs/cri-tools/releases/download/v{{ crictl_version }}/crictl-v{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
+crictl_download_url: "{{ github_url }}/kubernetes-sigs/cri-tools/releases/download/v{{ crictl_version }}/crictl-v{{ crictl_version }}-{{ ansible_facts['system'] | lower }}-{{ image_arch }}.tar.gz"
 crio_download_url: "{{ storage_googleapis_url }}/cri-o/artifacts/cri-o.{{ image_arch }}.v{{ crio_version }}.tar.gz"
 helm_download_url: "{{ get_helm_url }}/helm-v{{ helm_version }}-linux-{{ image_arch }}.tar.gz"
 runc_download_url: "{{ github_url }}/opencontainers/runc/releases/download/v{{ runc_version }}/runc.{{ image_arch }}"
 crun_download_url: "{{ github_url }}/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}"
-youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_architecture }}-gnu.tar.gz"
+youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}-gnu.tar.gz"
 kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.xz"
 # gVisor only supports amd64 and uses x86_64 to in the download link
-gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/runsc"
-gvisor_containerd_shim_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/containerd-shim-runsc-v1"
-nerdctl_download_url: "{{ github_url }}/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
+gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/runsc"
+gvisor_containerd_shim_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/containerd-shim-runsc-v1"
+nerdctl_download_url: "{{ github_url }}/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_facts['system'] | lower }}-{{ image_arch }}.tar.gz"
 containerd_download_url: "{{ github_url }}/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ 'static-' if containerd_static_binary }}{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
 cri_dockerd_download_url: "{{ github_url }}/Mirantis/cri-dockerd/releases/download/v{{ cri_dockerd_version }}/cri-dockerd-{{ cri_dockerd_version }}.{{ image_arch }}.tgz"
 skopeo_download_url: "{{ github_url }}/lework/skopeo-binary/releases/download/v{{ skopeo_version }}/skopeo-linux-{{ image_arch }}"
@@ -238,14 +238,14 @@ cilium_operator_image_repo: "{{ quay_image_repo }}/cilium/operator"
 cilium_operator_image_tag: "v{{ cilium_version }}"
 cilium_hubble_relay_image_repo: "{{ quay_image_repo }}/cilium/hubble-relay"
 cilium_hubble_relay_image_tag: "v{{ cilium_version }}"
-cilium_hubble_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
-cilium_hubble_certgen_image_tag: "v0.4.3"
+cilium_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
+cilium_certgen_image_tag: "v0.4.8"
 cilium_hubble_ui_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui"
 cilium_hubble_ui_image_tag: "v0.13.5"
 cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend"
 cilium_hubble_ui_backend_image_tag: "v0.13.5"
-cilium_hubble_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
-cilium_hubble_envoy_image_tag: "v1.37.2-1778236003-7c2f6580d32e50f1a6866c12122662856f54eec2"
+cilium_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
+cilium_envoy_image_tag: "v1.37.5-1782911245-7cffc778c923f68a77954a53b1a98d6b5353f004"
 kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn"
 kube_ovn_container_image_tag: "v{{ kube_ovn_version }}"
 kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway"
@@ -314,13 +314,13 @@ cert_manager_webhook_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-we
 cert_manager_webhook_image_tag: "v{{ cert_manager_version }}"

 csi_attacher_image_repo: "{{ kube_image_repo }}/sig-storage/csi-attacher"
-csi_attacher_image_tag: "v4.4.2"
+csi_attacher_image_tag: "v4.5.1"
 csi_provisioner_image_repo: "{{ kube_image_repo }}/sig-storage/csi-provisioner"
-csi_provisioner_image_tag: "v3.6.2"
+csi_provisioner_image_tag: "v4.0.1"
 csi_snapshotter_image_repo: "{{ kube_image_repo }}/sig-storage/csi-snapshotter"
-csi_snapshotter_image_tag: "v6.3.2"
+csi_snapshotter_image_tag: "v7.0.2"
 csi_resizer_image_repo: "{{ kube_image_repo }}/sig-storage/csi-resizer"
-csi_resizer_image_tag: "v1.9.2"
+csi_resizer_image_tag: "v1.10.1"
 csi_node_driver_registrar_image_repo: "{{ kube_image_repo }}/sig-storage/csi-node-driver-registrar"
 csi_node_driver_registrar_image_tag: "v2.4.0"
 csi_livenessprobe_image_repo: "{{ kube_image_repo }}/sig-storage/livenessprobe"
@@ -491,7 +491,7 @@ downloads:
  youki:
    file: true
    enabled: "{{ youki_enabled }}"
-    dest: "{{ local_release_dir }}/youki-{{ youki_version }}-{{ ansible_architecture }}.tar.gz"
+    dest: "{{ local_release_dir }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}.tar.gz"
    checksum: "{{ youki_archive_checksum }}"
    url: "{{ youki_download_url }}"
    unarchive: true
@@ -539,7 +539,7 @@ downloads:
  gvisor_runsc:
    enabled: "{{ gvisor_enabled }}"
    file: true
-    dest: "{{ local_release_dir }}/gvisor-runsc-{{ gvisor_version }}-{{ ansible_architecture }}"
+    dest: "{{ local_release_dir }}/gvisor-runsc-{{ gvisor_version }}-{{ ansible_facts['architecture'] }}"
    checksum: "{{ gvisor_runsc_binary_checksum }}"
    url: "{{ gvisor_runsc_download_url }}"
    unarchive: false
@@ -551,7 +551,7 @@ downloads:
  gvisor_containerd_shim:
    enabled: "{{ gvisor_enabled }}"
    file: true
-    dest: "{{ local_release_dir }}/gvisor-containerd-shim-runsc-v1-{{ gvisor_version }}-{{ ansible_architecture }}"
+    dest: "{{ local_release_dir }}/gvisor-containerd-shim-runsc-v1-{{ gvisor_version }}-{{ ansible_facts['architecture'] }}"
    checksum: "{{ gvisor_containerd_shim_binary_checksum }}"
    url: "{{ gvisor_containerd_shim_runsc_download_url }}"
    unarchive: false
@@ -596,7 +596,7 @@ downloads:
  cilium_operator:
    enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}"
    container: true
-    repo: "{{ cilium_operator_image_repo }}"
+    repo: "{{ cilium_operator_image_repo }}-generic"
    tag: "{{ cilium_operator_image_tag }}"
    checksum: "{{ cilium_operator_digest_checksum | default(None) }}"
    groups:
@@ -611,12 +611,12 @@ downloads:
    groups:
      - k8s_cluster

-  cilium_hubble_certgen:
-    enabled: "{{ cilium_enable_hubble }}"
+  cilium_certgen:
+    enabled: "{{ kube_network_plugin == 'cilium' }}"
    container: true
-    repo: "{{ cilium_hubble_certgen_image_repo }}"
-    tag: "{{ cilium_hubble_certgen_image_tag }}"
-    checksum: "{{ cilium_hubble_certgen_digest_checksum | default(None) }}"
+    repo: "{{ cilium_certgen_image_repo }}"
+    tag: "{{ cilium_certgen_image_tag }}"
+    checksum: "{{ cilium_certgen_digest_checksum | default(None) }}"
    groups:
      - k8s_cluster

@@ -638,12 +638,12 @@ downloads:
    groups:
      - k8s_cluster

-  cilium_hubble_envoy:
-    enabled: "{{ cilium_enable_hubble }}"
+  cilium_envoy:
+    enabled: "{{ kube_network_plugin == 'cilium' }}"
    container: true
-    repo: "{{ cilium_hubble_envoy_image_repo }}"
-    tag: "{{ cilium_hubble_envoy_image_tag }}"
-    checksum: "{{ cilium_hubble_envoy_digest_checksum | default(None) }}"
+    repo: "{{ cilium_envoy_image_repo }}"
+    tag: "{{ cilium_envoy_image_tag }}"
+    checksum: "{{ cilium_envoy_digest_checksum | default(None) }}"
    groups:
      - k8s_cluster

--- a/roles/kubespray_defaults/defaults/main/main.yml
+++ b/roles/kubespray_defaults/defaults/main/main.yml
@@ -650,12 +650,12 @@ local_volume_provisioner_storage_classes: |

 ssl_ca_dirs: |-
  [
-  {% if ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] -%}
+  {% if ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] -%}
  '/usr/share/ca-certificates',
-  {% elif ansible_os_family == 'RedHat' -%}
+  {% elif ansible_facts['os_family'] == 'RedHat' -%}
  '/etc/pki/tls',
  '/etc/pki/ca-trust',
-  {% elif ansible_os_family == 'Debian' -%}
+  {% elif ansible_facts['os_family'] == 'Debian' -%}
  '/usr/share/ca-certificates',
  {% endif -%}
  ]
@@ -755,10 +755,10 @@ _host_architecture_groups:
  aarch64: arm64
  armv7l: arm
 host_architecture: >-
-  {%- if ansible_architecture in _host_architecture_groups -%}
-  {{ _host_architecture_groups[ansible_architecture] }}
+  {%- if ansible_facts['architecture'] in _host_architecture_groups -%}
+  {{ _host_architecture_groups[ansible_facts['architecture']] }}
  {%- else -%}
-  {{ ansible_architecture }}
+  {{ ansible_facts['architecture'] }}
  {%- endif -%}

 _host_os_groups:
@@ -766,10 +766,10 @@ _host_os_groups:
  Darwin: darwin
  Win32NT: windows
 host_os: >-
-  {%- if ansible_system in _host_os_groups -%}
-  {{ _host_os_groups[ansible_system] }}
+  {%- if ansible_facts['system'] in _host_os_groups -%}
+  {{ _host_os_groups[ansible_facts['system']] }}
  {%- else -%}
-  {{ ansible_system }}
+  {{ ansible_facts['system'] }}
  {%- endif -%}

 # Sets the eventRecordQPS parameter in kubelet-config.yaml.
@@ -808,6 +808,7 @@ sysctl_ignore_unknown_keys: false

 system_upgrade: false
 system_upgrade_reboot: on-upgrade  # never, always
+system_upgrade_autoclean: false

 # Enables or disables the scheduler plugins.
 scheduler_plugins_enabled: false
@@ -823,7 +824,7 @@ ntp_enabled: false
 # The default is ntp for most platforms, or chrony on RHEL/CentOS 7 and later.
 # The ntp_package can be one of ['ntp', 'ntpsec', 'chrony']
 ntp_package: >-
-      {% if ansible_os_family == "RedHat" -%}
+      {% if ansible_facts['os_family'] == "RedHat" -%}
      chrony
      {%- else -%}
      ntp
--- a/roles/kubespray_defaults/vars/main/checksums.yml
+++ b/roles/kubespray_defaults/vars/main/checksums.yml
@@ -17,13 +17,16 @@ crictl_checksums:
    1.33.0: sha256:4224acfef4d1deba2ba456b7d93fa98feb0a96063ef66024375294f1de2b064f
 crio_archive_checksums:
  arm64:
+    1.36.2: sha256:06a0e57c33bdb08db5b8f8027b6c85239fb1119400cd2c390e8128f22ce8fb98
    1.36.1: sha256:133eb38d40cd5904b89635c5b30aa41ecf1c8fba56f98a05e067cb6a591ca35e
    1.36.0: sha256:b9d32392f2c7db6b72e917b8473e12f5d1b9da9d7d9f8d037ab9f19fab2f8ddd
+    1.35.5: sha256:de9f9351296fe43cb87ce04b7c4bf326ea839c7923e95268e3996c82b9f9a3e3
    1.35.4: sha256:0d7def689e10db62dbc4c03555e55d4c5d11c25055a68838092045a349ad37ec
    1.35.3: sha256:ba8a300eaa93224190bb3dabfcdf6bd264a0c5cbd6f86cec1bb9ff00a3727d32
    1.35.2: sha256:c51d0a78afa0b267fcadf49ad481f35cce3728a7d09ebd05db7c8fb8417f9ef0
    1.35.1: sha256:15fe5c7b87c985a3a78324227b920a01f3309fd1aa5eadfaa38fd48a4dd96d17
    1.35.0: sha256:e57175a4d00387b78adfbe248d087d8127bed625afb529e34b2c90d08cfdaf87
+    1.34.10: sha256:216c54a46f841ae65ea35650b3a7dabc5c7d19e268e4a15c119d38dc11c5b868
    1.34.9: sha256:e619468ed0aa06b60bc7f6493f7ff36d00010faf8a7b8a8f6e3d7e029ba64413
    1.34.8: sha256:a868ea0459a36b52ac183d830cc589d99b5c8b0f9ed9299922453bbf3758c3fd
    1.34.7: sha256:5c25e7084f8369f540e236be1a1a7e830fd1fa6256422466d414c2fc20aa0e86
@@ -35,13 +38,16 @@ crio_archive_checksums:
    1.34.1: sha256:41a71cab6a61ae429ec447d572fd1cdea0a7e33d62aaa58c3b07467665b50b9f
    1.34.0: sha256:3006658270477c5fb1e88e9124e40982d2ba7b34495fcc12f0fecd33bbab9a5a
  amd64:
+    1.36.2: sha256:d589b80090c7d38f730db9c841b0f9894d8665306e199aa9e6019c6bcaa96933
    1.36.1: sha256:d4130449e5b74eede2448864efbca233b819ad0df92a7227780a7b9e4400b2c4
    1.36.0: sha256:7fc7a2cca25b4cf2de01660bc730fad92b6bcbecd47751e76be3d6ae545c56cd
+    1.35.5: sha256:55f60635a95c0b02b8d9283a7bcfde996ef6e54866a1f1291d5bc95ab5a4dcc6
    1.35.4: sha256:9a6fe982fc36efa9111c31ef65125dff09b1c9c1303b9e0616b9cd436d3b02bb
    1.35.3: sha256:ab7362f76bf7c908c486a2f36d1587c98aeedb8f6ad4bd6731a708b9b44033f6
    1.35.2: sha256:d38771791f2bae086b24400a1e04cffed4eba6c8e9d30b03c625f8aea70921a9
    1.35.1: sha256:cd819546f01ae9dddd4a85b82f220518b37596053555a85e4b4a3d200a6e9354
    1.35.0: sha256:55b6d3e9fc9a5864ab5cdf0b24d54b1dcbaf6d4919274b3b9eb37bfc4b0b8cb5
+    1.34.10: sha256:d8d1d2d7f71e3f96561492cd1cf84fc3f1e210cc2b060b29fcbbb3ece6802193
    1.34.9: sha256:e9a09b774c4bf0c4ff7b7b135da959fbc449165c55841ab8e4455da798424fa8
    1.34.8: sha256:b1828dd21446fb1d60d5ce8d8d45db1930e02b0ae404c01c94136bc23d45d39e
    1.34.7: sha256:8e1d625f6137ee08f669db6ce361cecbd7c5bb52e8e3e314e82999d738570dfa
@@ -53,13 +59,16 @@ crio_archive_checksums:
    1.34.1: sha256:22c1e4d68d9339aa58a1b0f1b40a8944102934a7505105abe461dc8a7e3de540
    1.34.0: sha256:5a8bc5c3b8072cb9bde1cf025d5597f75bf21018712c5b72d5cb0657948595c8
  ppc64le:
+    1.36.2: sha256:6ea0da3e370b333c4574fc7ef13e534277c5e23d3729bec5c7db43845d1f877b
    1.36.1: sha256:782291fcc9cc3873ef86ffc35f336e9333e517aac7f62356ca580e4125f96a5f
    1.36.0: sha256:0fbf8502f1e289316bc0cb19915c7765bd3cfce8fd880e19f9ba343e2c5ab3ea
+    1.35.5: sha256:e27acaba58bea4400cb3a0b399d627f619c93e5cf26e12a7ad055c974982589a
    1.35.4: sha256:c572b9aa3dfc7a1acce94ed807f56da6f2f6a3615c93da303570df0e5ebb16cd
    1.35.3: sha256:bd95d3aa3b41f173312bd1a0c8a4398c37d08d5a65d63f773f2f4635ccb769bc
    1.35.2: sha256:aff7a251a0a8f57c7ce4794d8d28465baa43e49990cd5c9d5958da22e958d5eb
    1.35.1: sha256:b4a23e9f70297f01da2840f94b82adf2ac67a4017e1d93f0c20526637df282ca
    1.35.0: sha256:081ab73a6970ac3c68893dea9a03b0732ca22ab44a2aa8794fddac0bd4dfa749
+    1.34.10: sha256:9409937ecbd3b5ba06a1b797bd95afc18bca7e26c6be3e4f99a1aa40306fa969
    1.34.9: sha256:98a09845d21190458fc0ade893be272f1d979605da5085fda6db57bf1982741d
    1.34.8: sha256:092e501730611d5161052b9248e42003bd158890f4597282c00242346fecc5c8
    1.34.7: sha256:9d8c7660d6e4d03f059aa90aba762b94d7b481fff603247b2a8ed9ca8c477c05
@@ -72,9 +81,11 @@ crio_archive_checksums:
    1.34.0: sha256:e9e41d14439db0ca88cf2cd8533038203f379c25cd612f37635c17908e050ebf
 kubelet_checksums:
  arm64:
+    1.36.3: sha256:57205a5daf5883873d87b4914e1e00bdd7707acd075714788cfb0fc1f60bc414
    1.36.2: sha256:b0b45db96f0e6bf996780b8a2b8d868bf538dc7c3a60cf604cf0ea2d65c24b06
    1.36.1: sha256:bf274dd3affbf2543d20465dee1f763f668f78c6fbd56197794f81337a49d687
    1.36.0: sha256:049d95107361583e64f3ac9b8c9bdaf73fc7e512a838972b13b423a33ece87e9
+    1.35.7: sha256:0dc3f53fc51f6a6c26c437ec9eded016106ef931db2dd9b3905c656796bed438
    1.35.6: sha256:b45c8b2b8a46a92028fcd68571aa38c839b64e38e199da23e1f37dcbe9f3399b
    1.35.5: sha256:a100cfe89d7dd7a49a07164c6ccb78df02563483ef5b37330e1150e37e8868b3
    1.35.4: sha256:d710eef03bb4ad164bb77af9be5b11b44f874e2fc08153c7d383420d685f73e8
@@ -82,6 +93,7 @@ kubelet_checksums:
    1.35.2: sha256:eaf11f9c20c385624775671662e127b083c9b5d0b451fd613f9468e09ca5656c
    1.35.1: sha256:73475c6db8fd8a9780b1b378fa2f917875e6146166c24603c1abc6eafd4493a8
    1.35.0: sha256:aa658d077348b43d238f50966a583f4244b2a7d45590c77b3b165b7d44983ab8
+    1.34.10: sha256:8f9305c7c639056e9544af4d360119af03c43cec470b2fb28ddaca26525b2564
    1.34.9: sha256:fd348a9bf8b796b6672fd864606af38e68e788dd62976a3a6b4d95333e406424
    1.34.8: sha256:5d8d62d15f18c18998af09fcab83420b9cbccc2be7fede2a0b26f4a3f523c6b5
    1.34.7: sha256:07658e949e5a089faf36da7ae4e7242a4d2a97fa8eaace0980fd9705d23143a8
@@ -93,9 +105,11 @@ kubelet_checksums:
    1.34.1: sha256:6a66bc08d6c637fcea50c19063cf49e708fde1630a7f1d4ceca069a45a87e6f1
    1.34.0: sha256:e45a7795391cd62ee226666039153832d3096c0f892266cd968936e18b2b40b0
  amd64:
+    1.36.3: sha256:46707a53209f826ad0f0d62371ac69cd00e78fd9a8176cf5f6f87f18f7f8b718
    1.36.2: sha256:3ba68cb4f0906053c08ab843131d5cec559cf8c718dbd679950a078b306abbb4
    1.36.1: sha256:7efa1780c73d9fb3a464002864e582eb2d15aa691e475eaae323093d08feae14
    1.36.0: sha256:d857082946c28493e8fdc52227feabd962e0e0900b6c6e4f6510168043b79dd4
+    1.35.7: sha256:e48cbb9c62351aa95f455bdae3c9a9e9d7d644027c231ade7a67b868b2be3258
    1.35.6: sha256:f320e9485cdb8fd190ab45efd3c3e29f6fcf4ad1a4c610a058d8f0b6bcd34a3a
    1.35.5: sha256:4ba1f892bd52fdae7cd2abb1b1111054ff274c71f88af0a85fd9f1107e8d46c8
    1.35.4: sha256:983a6ba5a49823dcdd745c674e5e2416377dd27d6ad1b42d2befa0fb961a19f6
@@ -103,6 +117,7 @@ kubelet_checksums:
    1.35.2: sha256:20887f461c0de96b0cb14c7af6b897f92d424ac078f8642f98e83ef52a0bf03e
    1.35.1: sha256:e7343310e03ff0d424df4397bdfa4468947d6d1f0f93dac586c1e8d6e4086d5d
    1.35.0: sha256:2f4ed7778681649b81244426c29c5d98df60ccabf83d561d69e61c1cbb943ddf
+    1.34.10: sha256:59669fd1233989fda877aa8a785bd56d4c73e739afcd90596c62e0172af2738c
    1.34.9: sha256:d4ce6d8d7e2d762894b13bbed90dbb56fbe8fa01414a68cc2988e070d8676b94
    1.34.8: sha256:117ff5f6923c9ab4af7fa4e995a2bdc48b4b0f84d00017b4d7368e1e861e84f2
    1.34.7: sha256:1bc50f574e2f365513c07055e007d284d5e93322282ed288d27e81c2b4356d8c
@@ -114,9 +129,11 @@ kubelet_checksums:
    1.34.1: sha256:5a72c596c253ea0b0e5bcc6f29903fd41d1d542a7cadf3700c165a2a041a8d82
    1.34.0: sha256:5c0d28cea2a3a5c91861dda088a29d56c1b027e184dae1d792686f0710750076
  ppc64le:
+    1.36.3: sha256:6934c38bfdbdd5c0e6ad57746bac2d13d80c102281504fabf1a124734b76d598
    1.36.2: sha256:c7dfa4c1ba776f87bb837a50747461076cdd8319bc5e6948411fd49f94cf4481
    1.36.1: sha256:98b63a44b87fb78ceca06918b5a0b5d01ab581fb12fbed9a2f7e8998fca64e8a
    1.36.0: sha256:761a1f6d3570fd4f25b151ec7570d061629320931c10e57f93f3924a490738eb
+    1.35.7: sha256:dc8926156983d575e8b6bf136be5de5e3d84ab0ace2a0d63fba45446d3fe2575
    1.35.6: sha256:1d4c045b9441c42124c5d691f92b1ec3780455d2808b909c9f6182306e30bcb3
    1.35.5: sha256:96ead1e3161093f38627ebb02acfb9cb0b76e09f444dc134b5ae40ca9dbe5684
    1.35.4: sha256:2ad1490dd74092d3be53953b13bef36f6fd45d6ad5c05caeffb6afef67ac8ef7
@@ -124,6 +141,7 @@ kubelet_checksums:
    1.35.2: sha256:6516f318a3711e83c0b3b8b069514a87c7dfeda931082c1b561043a7c54e312e
    1.35.1: sha256:ec8b7f870043f711b5d73e528342af1705d6ad7f8308d7f31d74d967986b54f6
    1.35.0: sha256:f24eb1244878a3876fe180e6052822cc9998033850478b2f4776e5c3b09baecd
+    1.34.10: sha256:2b2544dc4cdec4ab0b22f36202a420c19ac1e15800d9308597ad0ee9c92b1fce
    1.34.9: sha256:9204ae953802add97340c55e8cf012ce7b3b29b6ba61e0febdb256ba3a5bcdf8
    1.34.8: sha256:4b4406352433e26c1dd245f879962d7a571c4173f84cc7f5013d89ad315648f7
    1.34.7: sha256:a63cc1b7ef2ae22ca800a6be55a316db72127d97dd19fc49457a76f28126c708
@@ -136,9 +154,11 @@ kubelet_checksums:
    1.34.0: sha256:ed663fa4ff3e305276dd889885303e07989dfab073e95ef2da931b975f6686e8
 kubectl_checksums:
  arm:
+    1.36.3: sha256:451f3f3805515f3055a4eca918bf89c9aea730bf1a7fc1f969715e5866b0b65b
    1.36.2: sha256:ded590966255c7059b9f7aa9b1ee4a16ffba79b6c4e59c464f151442c46bb63c
    1.36.1: sha256:0f5f7530e6ac3b887e01c963b5eea477cc6f590ec5e3a4e23a5485e6d9227761
    1.36.0: sha256:bd1ab1f3d3cb7dec7c46799355e82717a6519fa83708752c2be88fe5c378681f
+    1.35.7: sha256:151548c5097df802e05f1504e5da4f15e49d761f19641cdcfb1f1eec415e153a
    1.35.6: sha256:3adce98ed018c49b4da73a890be55a50eec983151d5f933003ea5a43745608ca
    1.35.5: sha256:7c3ad2c154975287027cbfaaeaeed83c2f5ec1d602e9b10646da204850d295df
    1.35.4: sha256:44093efefd9f776b352f634cea6c4e8fcf4e78378ffda7f31db23072cef97864
@@ -146,6 +166,7 @@ kubectl_checksums:
    1.35.2: sha256:02b6affb0da9837b88354e44a7a188cbe2ad522060c880c70eacd33f19944c35
    1.35.1: sha256:dbe14e5b12184d72978b17b167aedc3f42f4a1faf249180025d6359eebcd983e
    1.35.0: sha256:dca28f6af03b31ca6043baa1da7332472c7a3df743606a758534b9ac3ed7ecce
+    1.34.10: sha256:765961cedd71bad65f3b8be36b821aeb23b0a43ff51c81ab137265183a4281ac
    1.34.9: sha256:df904c7b4e76148fb689da195ebe3d1dc068d0f6a75fb81a2769374add694b86
    1.34.8: sha256:3b55edd8e01af9b9d1cf566058fb421ea5fbbea001ec66d6e0f826e11d05ccea
    1.34.7: sha256:e016e26a114941a68777b521cc92f0c9fcd2a3bcba01045822450c04d9719bf4
@@ -157,9 +178,11 @@ kubectl_checksums:
    1.34.1: sha256:ca6218ae8bf366bd8ccdcb440b756c67422a4e04936163845f74d8c056e786ee
    1.34.0: sha256:69d2ce88274caf9d9117b359cc27656fb6f9dd6517c266cfd93c6513043968b8
  arm64:
+    1.36.3: sha256:3d86f24401c41ae5a46ac50eef8865fe891d3647d324a0836f6c63757a126e62
    1.36.2: sha256:c957eb8c4bea27a3bb35b269edd9082e27f027f7b76b20b5bf4afebc726c6d3e
    1.36.1: sha256:59f7ee8e477fae658447607dc3c8790ac17a1b016c01c622c12070e969e2d4e7
    1.36.0: sha256:9f9d9c44a7b5264515ac9da5991584e2395bd50662e651132337e7b4d0c56f8f
+    1.35.7: sha256:5103d45b8881434d417694057b8ccb5ae79fd310a5c5c13e403c5e62e15909be
    1.35.6: sha256:c0f97f31c9ddc22d4951d543a1a7125a9af4b31e895ad4aa99899c4ba2a6ff0b
    1.35.5: sha256:ac69e06fd6860d69786692f5af1c3a1208ed54f8366a4d97ab15c172e99765ee
    1.35.4: sha256:6a5a4cc4e396d7626a7a693a3044b51c75520f81db30fe6816c2554e53be336f
@@ -167,6 +190,7 @@ kubectl_checksums:
    1.35.2: sha256:cd859449f54ad2cb05b491c490c13bb836cdd0886ae013c0aed3dd67ff747467
    1.35.1: sha256:706256e21a4e9192ee62d1a007ac0bfcff2b0b26e92cc7baad487a6a5d08ff82
    1.35.0: sha256:58f82f9fe796c375c5c4b8439850b0f3f4d401a52434052f2df46035a8789e25
+    1.34.10: sha256:52d3aeefea32fdfa3671ccd636be5da463ddfd0a2fc09d7bcbaedcff4c76cad5
    1.34.9: sha256:63317b16a5264af47169b54dafd1878fed29031ebc8367960dd3b88484334e04
    1.34.8: sha256:4c9fe1f717738950c638c38056130a8db5075e6413ae36d8687221a240cdf88b
    1.34.7: sha256:93d2113f1f38b5709f2955b7981fcd37d675c9aafda81702c202a63361b6093b
@@ -178,9 +202,11 @@ kubectl_checksums:
    1.34.1: sha256:420e6110e3ba7ee5a3927b5af868d18df17aae36b720529ffa4e9e945aa95450
    1.34.0: sha256:00b182d103a8a73da7a4d11e7526d0543dcf352f06cc63a1fde25ce9243f49a0
  amd64:
+    1.36.3: sha256:ebbd080e7c2e275093b55915722043257eb24004363e20acb3c4d71919f88336
    1.36.2: sha256:1e9045ec32bea85da43de85f0065358529ea7c7a152eca78154fba5b58c27d82
    1.36.1: sha256:629d3f410e09bf49b64ae7079f7f0bda1191efed311f7d37fdbab0ad5b0ec2b7
    1.36.0: sha256:123d8c8844f46b1244c547fffb3c17180c0c26dac9890589fe7e67763298748e
+    1.35.7: sha256:12e97f9d23a9f6cbb87b89becd6bd291e1a858a3379a4e11e2c822c4c1530052
    1.35.6: sha256:5d11e2ba01ea68ffd053f56e27738e2b4330013ee67f7e46c6da6c585d3c9926
    1.35.5: sha256:90f75ea6ecc9ea5633262e1c0b83a40560003b30fc94a04cb099404fcef0c224
    1.35.4: sha256:b529430df69a688fd61b64ad2299edb5fd71cb58be2a4779dba624c7d3510efd
@@ -188,6 +214,7 @@ kubectl_checksums:
    1.35.2: sha256:924eb50779153f20cb668117d141440b95df2f325a64452d78dff9469145e277
    1.35.1: sha256:36e2f4ac66259232341dd7866952d64a958846470f6a9a6a813b9117bd965207
    1.35.0: sha256:a2e984a18a0c063279d692533031c1eff93a262afcc0afdc517375432d060989
+    1.34.10: sha256:95bd70842bd11a524d24acd5b68726899e3488e153e45e2b4ae846545beda050
    1.34.9: sha256:73bb6f5063caadae1e73a39de018d8ad21755984bea35358484db817859e7634
    1.34.8: sha256:f6249132865c13abe3c9dd5038f5da65849cb86eee1608c001831504e481aa8c
    1.34.7: sha256:b46ecf2b80f76d5a7d58c296c2e11e42c85eaa1eb866ddbc1e91625f71c21000
@@ -199,9 +226,11 @@ kubectl_checksums:
    1.34.1: sha256:7721f265e18709862655affba5343e85e1980639395d5754473dafaadcaa69e3
    1.34.0: sha256:cfda68cba5848bc3b6c6135ae2f20ba2c78de20059f68789c090166d6abc3e2c
  ppc64le:
+    1.36.3: sha256:aee56eaced85e2eab925e86c05e3c222c4611ce045073d110f930abd3da8b193
    1.36.2: sha256:8afb5a81a3dbc7213c4bb36437fde5e3463758f0f18888568cd6cadcb9bdf981
    1.36.1: sha256:b6acc7be1bfd5f9a10cd6b03b8e6c25a96c0f9a127efa31932752d3ffe97d909
    1.36.0: sha256:c0a8afcb7899202969000debabcf98013c902c42765537e96c52da0e31be3032
+    1.35.7: sha256:d7a8cccd0bb6be2e7f56c341f019382084bed140c68940c277dcae8169c0b2fd
    1.35.6: sha256:20ad771389d7a27c24bd2bb2cdee89046bb56b209b9e1e13a176dcbf4df987f3
    1.35.5: sha256:152feec62929570afd0baf83aa4c75e0f1d7ef72aa643a2317a23c2763d6fcc0
    1.35.4: sha256:f342a732cd59cb390e1bbcae1262d07b5e700ff0e8447ced0ee2331ae6e39c70
@@ -209,6 +238,7 @@ kubectl_checksums:
    1.35.2: sha256:2101400af7fb53d326cee8d3411c9348e0735ac85d7059cd61514632181b8810
    1.35.1: sha256:bced44e491ce52cce11e2b4bd4bd9181f4f963ffe868438778d028d56485c5d9
    1.35.0: sha256:8989809d0ac771244dabe50ed742249ac60eeb6d385cd234ee151eb40b7c32c4
+    1.34.10: sha256:33a84b43fb16399fe390e4e991633167579a1b714c2f1eb4fe93e7c9e249325a
    1.34.9: sha256:7b72e163713b75e45cf7e28adffbc5f0bedfa2028bdc3560af24a2c225952dc4
    1.34.8: sha256:a571c1cd7106696ee8ce9a88e1fccc291fef7e7e2973a5b4acefaeb14fad4645
    1.34.7: sha256:0769c29f0f0f5d8e342e514c23ca5763d2843f93d7d9d6f1b1e4b3c267eefc6a
@@ -221,9 +251,11 @@ kubectl_checksums:
    1.34.0: sha256:1773805a0c128f4d267b2e11f4c74cac287e9a07fffaecc3f7af6df9c8aaf82c
 kubeadm_checksums:
  arm64:
+    1.36.3: sha256:276cfbdc43b10fef663288cc1ed76abf77b1b7f700e9f1c053cb5dc3115484de
    1.36.2: sha256:c638f0b4d9b216df8d5bcf41473b81e59143aa0a690392c224e97e6ec91ed3e9
    1.36.1: sha256:82fa5119d6687f721cd80cb278bac08f54cc5d3fd0320c66cef9394d42e153a9
    1.36.0: sha256:43d4ca3a9f8f49c2c2f6db2c056de1a00fa110a3dd5aa68a74fbc52e42d96c01
+    1.35.7: sha256:b8c3a1145a9875f046e9b66d5cd5810431e92ae1d5abca82f0151694cd257928
    1.35.6: sha256:b6acbcd4ab8a18759191a2d6373d84a80f3cb47ad5460603df5fe8887b139716
    1.35.5: sha256:24658203703a8bfa2813571881c1ba08f8cc4aff714a5b43bbf417af7d3cf229
    1.35.4: sha256:e8f6b5bee3e2c8b5965f4ae65c2ae04e3f9f426d2458a1e2f159e824d419d92c
@@ -231,6 +263,7 @@ kubeadm_checksums:
    1.35.2: sha256:b540b734e9eaeb134e2cb7c7803dc62160589ac3b2615d717ce41acb22bbec98
    1.35.1: sha256:80097a3c4ef824f4edfe131d2bd429772c4be3a460c42a44f2320164a917de32
    1.35.0: sha256:1dac7dc2c6a56548bbc6bf8a7ecf4734f2e733fb336d7293d84541ebe52d0e50
+    1.34.10: sha256:550f1d6d7e73b91cc77d10f89a94e745d800e49b4b7fc509c1a670ffc6401b1b
    1.34.9: sha256:892789444a830b16eb1c8d3e09a878a9ced6ac18c5765e5bb9d41123a41ce3ee
    1.34.8: sha256:7b06f4442a7a819fcb4e0697721a2e4a8acda068d66ecfb4e781f213ee804884
    1.34.7: sha256:f0ca19db42757a3612e2a20268209a3843b6eb8c1284f11c5fa7c31d40ed8c8f
@@ -242,9 +275,11 @@ kubeadm_checksums:
    1.34.1: sha256:b0dc5cf091373caf87d069dc3678e661464837e4f10156f1436bd35a9a7db06b
    1.34.0: sha256:6b7108016bb2b74132f7494e200501d6522682c01759db91892051a052079c77
  amd64:
+    1.36.3: sha256:bba1733c701bf70ec74ba1cc3fd5745404c1134a8a4b0a5f8560cc9832023421
    1.36.2: sha256:f95d1b345f97c673ce1c1347eb96bf2587850975155ae701cdfc629a5b575b70
    1.36.1: sha256:f35980333a4dae753807345ae359eca03f48f9945855e6a6a6708fe8b3b24038
    1.36.0: sha256:f962dcee1f49a51368c3b383742144d99eacff77b2132cd0a540ed8c6b30fe81
+    1.35.7: sha256:9206f531ffe9cef39e9b734bc49ee9ca965d646ff6d4536e5b3fd3ff71151512
    1.35.6: sha256:49fd320be1d6af003fc3b61ad60cf30b02838a661ab0139798e021f7e378d806
    1.35.5: sha256:cbf71fbee3a3f60edf3fae4e50994f88a35b35cddf65d373d7955b58e8785397
    1.35.4: sha256:0c0497da793f8897c14e45340da919534b615294a1aab69dc1998896c0f11145
@@ -252,6 +287,7 @@ kubeadm_checksums:
    1.35.2: sha256:a51cb85c70c98ec6868fd3413ac786af5fab4ce51438963752ec5f58e68e5452
    1.35.1: sha256:8a7ff344eef1bfba88f9a74b3fdc9ea4448c94f1b3cefb8c0aeeaf1f96e05053
    1.35.0: sha256:729e7fb34e4f1bfcf2bdaf2a14891ed64bd18c47aaab42f8cc5030875276cfed
+    1.34.10: sha256:7a75c473f72166d3081ed35e627328f3d4ce960d6beff983cb6384a3dc675bf4
    1.34.9: sha256:76802c717a6917c35124675c639e283854506fec8700e6a63c81069918845127
    1.34.8: sha256:27ec4962fc855f4e7fdc3875aa275168a66e721c27533c4953294968da96e7e5
    1.34.7: sha256:679f304e592c6f8e20bf24c424a2c5f35d8d181d171e15774cecd0cb1dffb7ba
@@ -263,9 +299,11 @@ kubeadm_checksums:
    1.34.1: sha256:20654fd7c5155057af5c30b86c52c9ba169db6229eee6ac7abab4309df4172e7
    1.34.0: sha256:aecc23726768d1753fd417f6e7395cb1a350373295e8e9d9f80e95ed3618e38e
  ppc64le:
+    1.36.3: sha256:9f20d96a2cedf95b5cedac514051e3709460f132a4a04f48580daace34cf6aef
    1.36.2: sha256:46577764cb2fe985fe1967883504446162b483703ff9fce7ac875cf560d3267b
    1.36.1: sha256:4278b80f58501b29040ec574ee5afd433e140d6f93c1697a465a9fdb215cb2bd
    1.36.0: sha256:e621bf6a3115bea05c26e8d6ef9f7946a27437934e0244bbf59dc296bdf6459e
+    1.35.7: sha256:1d13d93f8116f5d2ce5184c4206f48b7abec1b139838102c26bb84a64049b468
    1.35.6: sha256:862fbea5657d08cf9fe34dc45d93b87edfd729404a7230de3bd57ee665ea7d41
    1.35.5: sha256:26169d372ea165a01b33ad15259bf9d298ab1f66e326ab83ae0a942c6f3a43df
    1.35.4: sha256:3da9884894da6a6c1083f00c6a837b52084dca9275114694bdc387ba66bff474
@@ -273,6 +311,7 @@ kubeadm_checksums:
    1.35.2: sha256:8a3800d88070679a09d2c5cd5dd479d70539dce84415623e876cbaf366d94043
    1.35.1: sha256:eec12948cfabc18115636c44aca894bf9abef3b2ea73cba180314ee3c218dcca
    1.35.0: sha256:77a466e1b6a8e28362a729541269de0a7c4a6b9e7770cccefcd745502e656b90
+    1.34.10: sha256:71976e925442617d2e2d17c625df5502a31a662d6e898eb611d0d5ce99d0be9f
    1.34.9: sha256:71bfbbd8e1be693a5817d4e867125eb5608063efc261965540d262bd93657e84
    1.34.8: sha256:6e52f5fadeaee1fd5218021a47e33864b6a6cb40c7f98b7bef606c5f734d08e5
    1.34.7: sha256:c433c4f7f4193125265b57ea2e99c5dae51a6213db9902558507a2c675ff1131
@@ -285,6 +324,7 @@ kubeadm_checksums:
    1.34.0: sha256:7201ba36f44187f408a036c4a545e2a3cd12943b1297092687bb66c9a1a9fed6
 etcd_binary_checksums:
  arm64:
+    3.6.13: sha256:5ab53ff70301fa9d782fa4b59fdfc1fae49ffdf427a0afb3cd313a93449800fc
    3.6.12: sha256:147afc710e164fa342ad8561bcca8903f3913bd9fb9ae0c83c857b1d868189cc
    3.6.11: sha256:5302f1a6157c34eb0568c75fba9d06da98353576df04399f08645bef634acd2d
    3.6.10: sha256:e40dc34b7a512b99c651f7700c1014e9b76e02415e2e24365b248966b173524c
@@ -298,6 +338,7 @@ etcd_binary_checksums:
    3.6.2: sha256:79d0a2488967aa07ecfde79158b1dab458158522f834810c2827eecac4695a31
    3.6.1: sha256:5f8ed6e314df44128c218decbf0d146cf882583d05c6f6d9023ce905d232aaec
    3.6.0: sha256:81477b120ef66ff338fe7de63d894e5feec17e6e1f1d98507676832e089d9b58
+    3.5.32: sha256:89f3ec49bc026c77ab5862c34f0623f09b48ec75e659082c92829669c6e36b3c
    3.5.31: sha256:1fc441acb75486c076db0900470b18da61ee529a5d54df7c619dfc12dd13b984
    3.5.30: sha256:4d19473d2567a58e1dbf556e0813b91d506666e58d23bfd5370660c67639eb5e
    3.5.29: sha256:10817d916de91fdab373947977682e083f0a1ac7f37650c1b690c2a746e4c269
@@ -325,6 +366,7 @@ etcd_binary_checksums:
    3.5.7: sha256:1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51
    3.5.6: sha256:888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87
  amd64:
+    3.6.13: sha256:b4928654aed84d90952620c7144555e4186d795e1e7414e65fe0cf6265fd0465
    3.6.12: sha256:d2564bb50b58e52fbaf3bde4a9561a1d04e20cdc761f795580e4d615d5d41355
    3.6.11: sha256:8756f7a4eaf921668a83de0bf13c0f65cae9186a165696e3ae8396afe6f557ed
    3.6.10: sha256:ed579fafab5701e3aaa95509969e7bc74776a4ae5269d32e3928408b406456ec
@@ -338,6 +380,7 @@ etcd_binary_checksums:
    3.6.2: sha256:4b5d55d61e2218fab7c1cc1c00b341c469159ecde8cedd575fa858683f67e9f4
    3.6.1: sha256:1324664bfe56d178d1362a57462ca5a7b26a6d2cbe9e1c94b6820e32cb82d673
    3.6.0: sha256:42305b0dcbba7b6fdff0382d0c7b99c42026c88c44847a619ab58cde216725d9
+    3.5.32: sha256:83532f9290ee89106c4c9d0467220f65623c1faadaab800d727f7beccce4d7dd
    3.5.31: sha256:e76b75c73b10196dfeb1c52fcdf9f4014e51f3082f65f28fb2e69a7bec1f916b
    3.5.30: sha256:a495115162845640be08c6cda069ff961260dbced53207c5a83b1b006ff2ea8e
    3.5.29: sha256:7692f812db0bfeee3a731c45046864cf729e552bad82ce7cb5b507053d033267
@@ -365,6 +408,7 @@ etcd_binary_checksums:
    3.5.7: sha256:a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396
    3.5.6: sha256:4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb
  ppc64le:
+    3.6.13: sha256:9ce0405b83fa4c2fb92727ab6b46f011078057b28b3381c8ec6f42697eed33bd
    3.6.12: sha256:2888e1a443dfe2294b463fb1e735c0e57de9dc6cd02397ce1596ddf3ba78242d
    3.6.11: sha256:4031a332e71c263ed054a9149761d77dfd57f1bcc301b2aa0e2b1b6079af7095
    3.6.10: sha256:2892716d2826deed1ea392c91651ebabe1da35c5e71964d842fdcd424adb71c1
@@ -378,6 +422,7 @@ etcd_binary_checksums:
    3.6.2: sha256:bf79b9d4c7e9f86e611e73de9fe54a195bc0ad54aeb17200b1c8bda3c4119705
    3.6.1: sha256:bb87fcd0ea4b9fabf502703512c416ca1d9f4082679cb7f6dbc34bed3dfc13f6
    3.6.0: sha256:1180d06e3a3787ab65078d9a488f778a4712c59cc82d614abde80c5d06efe38f
+    3.5.32: sha256:fdf4f4878c23f16982cf38e5d9994f30808807613105c5fed1b1a70da089b076
    3.5.31: sha256:adf8f35410b6e95ad988cb31c61dcac37363dc2fe1beaa7bb7f9cba3a4dec67f
    3.5.30: sha256:5f5412fb68aa87df05c5c6e75ffca458ee43e00f23ae43122e81201eaf0187fc
    3.5.29: sha256:3c198d0a0a5e76c0828568c34c1b8811c29830ca62c64043e18474b2625ecadb
@@ -431,6 +476,7 @@ cni_binary_checksums:
    1.6.0: sha256:d8d4bd74247407c8c73de057bc00adac28bb1ed2d2ee60a9dda278e3b398bcc2
 calicoctl_binary_checksums:
  arm64:
+    3.31.6: sha256:3d4908f9ea98f1d9cc122ff1408f0932e2546b47eb1f9bb3acdfaa4f504ec963
    3.31.5: sha256:8d9dbdba4a41e490238f01223a768df1858cc19e563562b314489657d1eb5eef
    3.31.4: sha256:460af7c6dd1b34d0c0f3a3d036ccd0e4d71bd505bb28cbb90aac918232fb2cf2
    3.31.3: sha256:3cb41949679c963ac42a39c30024b225b53485985b9fb7f1eb6177e86a0ec564
@@ -454,6 +500,7 @@ calicoctl_binary_checksums:
    3.29.1: sha256:6f662d316a267854dc5487242ca7ec8ca70c35b52bed258aafb76c2d113643c2
    3.29.0: sha256:ab23afb283fcdffcf0e1156cdced68d05b6c2b70fd4ea2cbc3189d0ecd43bdfd
  amd64:
+    3.31.6: sha256:45feb54e37713741b095afdc84a354238284b9060b7efd29c5ccb8f5c248f02f
    3.31.5: sha256:d1dd3a3fb2f5640987eab589dc1dcb03c47c11b32bc19a65c45c39421cd887d2
    3.31.4: sha256:f3a3fe9a7452844be851ca3f804fd616b7df06de741dd40b35331d4503bef76e
    3.31.3: sha256:dc920efee0045d352780c73cfdd3f6fbd6eab9fdb0675897095c755715a8fc8d
@@ -477,6 +524,7 @@ calicoctl_binary_checksums:
    3.29.1: sha256:2ac849181cb1fb40c61c06d075711025cdb909d80562d078cc548d50a0edcd3d
    3.29.0: sha256:df5048549d72a1f7ea4f61c655699d3b16d8a45873f28c3855c39597b73e8a3d
  ppc64le:
+    3.31.6: sha256:9576f5ace9da03bcbf4509f157fb0015f35eb8d47ac1b77f9be712a076b8f30f
    3.31.5: sha256:6592de001ec48307c805d00a678f54674473cddd64cf946e34fc644ef2e5f537
    3.31.4: sha256:5a89e5bea3ddb83ce311c7f149b755889e82d50c5db5987dc48b264e7637faa2
    3.31.3: sha256:d7682534cee144c72eeb363798f750f8c44e40dac1ddc20a85b3e10dd164b2cf
@@ -501,6 +549,13 @@ calicoctl_binary_checksums:
    3.29.0: sha256:c9c2a29a349c6f681aa79b5f5d6aee738305d95aa7f158b6217f487808758e53
 ciliumcli_binary_checksums:
  arm64:
+    0.19.7: sha256:9482937f14061fb239f2dbb2f97f4103de1b101f5d5defbff319f294f9bd540f
+    0.19.6: sha256:fe8140aaaa561b7d59d8c0e7eef169c298b2d558924934c95aab8bb81382296f
+    0.19.5: sha256:5498defafc248160ca44a38be39f5ba090769ef112f9ec34a19e72dfa7e7eb25
+    0.19.4: sha256:866c86683aa63c943a94ca2af5dc2b0db3483d1c3ed8c72baeeabd13061a7e42
+    0.19.2: sha256:205ad0eba18a105e4542a5ff41fea74929f8cb4af831d35c0fac591bfe48bbf1
+    0.19.1: sha256:a0726d4f7e3ed4a86d503ce40b3d6532729393f5d850d97eae0250900a7bf537
+    0.19.0: sha256:483a80607a37f6346866a89285b1c722dae9626f8388c250c4360f3b9e0be0f9
    0.18.9: sha256:eaa2b3570d3737592ec912505a247173e25fc7bca92d16b32d72b3aca94a743f
    0.18.8: sha256:44e6dd188336b9168986945c99f8e0882ec4e54a4b6422d44d8e36ec449ba929
    0.18.7: sha256:dbaa2ab4b1969f4402adf430d6a1bd914c5ab52475ec68f50b3af6fa7fe2fecc
@@ -538,6 +593,13 @@ ciliumcli_binary_checksums:
    0.16.1: sha256:07f3f2ba4d772140e46004ee7fa239134acc27afc4f79fc301ee7037617babc1
    0.16.0: sha256:fe16bcd447fc6fe764ca75712f5832d7504845e9f782684ff09c9f52548237fe
  amd64:
+    0.19.7: sha256:cd15e0983bf0acc7946cd05d453d1e58376ea92dec2642e745212df2b07d8852
+    0.19.6: sha256:65ae7592ab873acc0b242b8e679e0a0a856255e34fdd0082e7b048b6285a9842
+    0.19.5: sha256:67e59489b7ad17dea8eb8cc930435105dff3a4575643ad62567fb2c5ae80d246
+    0.19.4: sha256:98ecd554591a592b0ee32f5d73871133bcee06639619f1c032bcba339340dc26
+    0.19.2: sha256:aa25cd2542614051573008ed18adb7d697fd78e4b0345db83d1650cdaf4492de
+    0.19.1: sha256:57dd16923c6f3bbc7acfa87238fd034dff8139344a28d4650a20c9f91333540c
+    0.19.0: sha256:590ed39488371bc02e1d71ae85f1f99d7d73d2a660465dd00e32846fa7ff4734
    0.18.9: sha256:15978aaf82373b0682aa87ab217848b3fb6e3cd80adad365d34696fe92543923
    0.18.8: sha256:422940f0b7eb6eabc1e126945d1772e3f824c3f4f9fbb0df0dbbf00a271311ba
    0.18.7: sha256:7f5ff96f1793ee389ef77435a72debf122f5ec253d41418fca99d2c21472016a
@@ -576,6 +638,7 @@ ciliumcli_binary_checksums:
    0.16.0: sha256:da98675f961833d4ffd68b1046d907b228a7d394ded2abd70a50b20eaca171c4
 calico_crds_checksums:
  no_arch:
+    3.31.6: sha256:1d6d5e523f92ee1e8227a48c016229c668f94035431b82f19139affeb45dbeff
    3.31.5: sha256:1d6d5e523f92ee1e8227a48c016229c668f94035431b82f19139affeb45dbeff
    3.31.4: sha256:93422c69713a91fd2bbaeb6f33003e1957cb4a95522b26b9d19dd1d6ed897c5e
    3.31.3: sha256:476bc19de0408520d6aee0790d51d5a0f31f56ced5c45386779c302717b3493d
@@ -657,6 +720,7 @@ helm_archive_checksums:
    3.16.0: sha256:d13a4b87b31a5b50c8d93dd9988dfb312a61e56504102f466a4004e5a3ab8e9e
 cri_dockerd_archive_checksums:
  arm64:
+    0.3.26: sha256:d33e46e0d7ce28b22fdf7fa6327961cf0220ec3814fd7cc482f8cb77e7fd986a
    0.3.25: sha256:7eda6e815ed80ddf28095587038a8c48cb9af2060f7b45f9d8e68603c42caa67
    0.3.24: sha256:c783a03735887c4a8fc894bd4cf7a1c0defef3ecf50a4d79ff31eed45c26b17e
    0.3.23: sha256:a78037d2d2e9c52c48372a5cbba7b94b1c57be5759449beef29cfe03cbe6f14b
@@ -678,6 +742,7 @@ cri_dockerd_archive_checksums:
    0.3.6: sha256:793b8f57cecf734c47bface10387a8e90994c570b516cb755900f21ebd0a663b
    0.3.5: sha256:c20014dc5a71e6991a3bd7e1667c744e3807b5675b1724b26bb7c70093582cfe
  amd64:
+    0.3.26: sha256:87f31c964d974cdce9c883c79b69e355c3c323e51d3a7d36cda140e6df7b8d5a
    0.3.25: sha256:adb9b9785dc10fe49107f5d9e6a62c4271d268a214b9813f5dce251afc9d78ff
    0.3.24: sha256:dd4b7f514c248a3aaca398f467430a4c58aae9a77ea8b96a2f5b5d6fba0948d1
    0.3.23: sha256:c7fe5db7f9396186193b58ded0e62a31eca7b3c58ad8691d57017986f96482ee
@@ -1134,13 +1199,18 @@ nerdctl_archive_checksums:
    1.7.0: sha256:e421ae655ff68461bad04b4a1a0ffe40c6f0fcfb0847d5730d66cd95a7fd10cd
 containerd_archive_checksums:
  arm64:
+    2.3.3: sha256:9cc708f13c31588a2fbdbd13553d963356e990d50e9b95a2d6120f4ff2067910
+    2.3.2: sha256:6874adea935300402b7782d63bf58f1bd59a3323d76a9f22f27686001fb8997a
    2.3.1: sha256:46a83603a850f3916ca7c942310daaf82ed17773a85b1d431e92d4a541e46d0d
    2.3.0: sha256:06623dc8719b30d06303420f7eae91b0a9ade4e71243a4102f6375e585fb0a42
+    2.2.6: sha256:0b05746d09e86ac1098a3ecf4bc67d146873d668819aeb8216c39fcf369e8a51
+    2.2.5: sha256:ad3f7aec168ebbae8d24c412fdd2e8806d96599757f6032e38997d62a108158a
    2.2.4: sha256:d0897c8e27c96a7b7d4c73e9b278ea9f559dda619d497d88b323a528bd1412c3
    2.2.3: sha256:2942d72435b18610f7b69c1ddb74f99cef5c549425ff80d3e74f04e5e80db6a4
    2.2.2: sha256:cb102473d6e353beb604178879d51cc456da0cdf368d9437d8d404ed01baf674
    2.2.1: sha256:dac15a0d412a24be8bfe6a40cec8f51829062725169f1e72ac7d120a891ef5b6
    2.2.0: sha256:8805c2123d3b7c7ee2030e9f8fc07a1167d8a3f871d6a7d7ec5d1deb0b51a4a7
+    2.1.9: sha256:2fbc3053b09812092f6bf316a509d849960eb0cb9332ec88c2f49676d648fd67
    2.1.8: sha256:c7c3d64fafbaccb4fb0143c82402db7d6c781e776d818a60fa0df94807814149
    2.1.7: sha256:5e6a05fc6990912f856fab297bee13b6ba83ff4e9b6b3bc507da33da8c1f5b5f
    2.1.6: sha256:88d6e32348c36628c8500a630c6dd4b3cb8c680b1d18dc8d1d19041f67757c6e
@@ -1150,6 +1220,8 @@ containerd_archive_checksums:
    2.1.2: sha256:57fa4005ed3bb648f4a2ff3ef2f9ce12b27ee1397225626e3165b9ef4af45530
    2.1.1: sha256:4e3c8c0c2e61438bb393a9ea6bb94f8f56b559ec3243d7b1a2943117bca4dcb4
    2.1.0: sha256:f6c3972347848177805eed8a9c282fca6aaec0e6fd28701579e63cb20bdbce07
+    2.0.11: sha256:a8261bd5cc78cc46f01bbc229320b9781f8c03dcfedcbff25dfd4f12e43e5d74
+    2.0.10: sha256:656180fb5666a373d2df87331752f155953a5c95a0d6de94dd5e1db4d446c389
    2.0.9: sha256:fa582638e396f6182348142d642ce65d2efd68f01751d16310446fc8f15fddb2
    2.0.8: sha256:ce4708163e0b6a8787a6480c588569d3440865bbd37f455d50a6736d6dfff78f
    2.0.7: sha256:e590e39956a451ff692454ea991961b08627c514dcc253e8845d2a57f9a78e2f
@@ -1160,6 +1232,8 @@ containerd_archive_checksums:
    2.0.2: sha256:14a2a9f7f75f73e5bcfb8b183d0b84830c54b98ef8c5f6ed70e51f1a230c673e
    2.0.1: sha256:b07120ae227b52edfdb54131d44b13b987b39e8c1f740b0c969b7701e0fad4fa
    2.0.0: sha256:2a00b1553f38aa9e716d61316b661961c2fbfbb7aad7bd73b377be5725ecc0f1
+    1.7.34: sha256:824cbd16af3bdfc1b1836338350630ae1b6a58c7466636a4bed10549790090ab
+    1.7.33: sha256:483c738a322494014a23035febd51aa090843f6a5618a1d18e80d432f72dba9c
    1.7.32: sha256:631e7079dba58806e5a03158773030e4ac63c69343afe02e5419fb848485569c
    1.7.31: sha256:d375de285eaaa5a3a58c0b03d92aff6bfa7987657781bce8cd5d30335f9aa2a6
    1.7.30: sha256:a09c3b01b3b6935e839c8a9588b5528c57ebfca4747d816654a7d1e7575c0a63
@@ -1194,13 +1268,18 @@ containerd_archive_checksums:
    1.7.1: sha256:1f828dc063e3c24b0840b284c5635b5a11b1197d564c97f9e873b220bab2b41b
    1.7.0: sha256:e7e5be2d9c92e076f1e2e15c9f0a6e0609ddb75f7616999b843cba92d01e4da2
  amd64:
+    2.3.3: sha256:ebf6e710056312628eaf6fb4a1c32f0a4ae5f812568321be4029389d66fc7c7c
+    2.3.2: sha256:75625e6f6595bb95f3fb9c8123a60534af4a8d9b52d7617065967bcefe71a17a
    2.3.1: sha256:628448bd973610c656c1cbea8e88b32fafd85b23cc1aa4a3372eb7198478c054
    2.3.0: sha256:4cb83e7100a5e73fcb626207d0b5bcfd1294e26aeddfe075dcfb38f375c5f887
+    2.2.6: sha256:f001b58b63206da25aa5accdb2eb1211aec19c28ec418b4d953b87d0c1ee7eb6
+    2.2.5: sha256:d4031557773a8e969d604b4ee809c64ed3c6cd024d38d521d93984fa17d37b89
    2.2.4: sha256:62e77f6294e432dca5b56ad7e7d6085b5bbb526ebba0a51d832714f9b04cfdfd
    2.2.3: sha256:ca26ef5138f17b847bbeeec36d4bf5e002b54d25858197a870c125d57f44d32f
    2.2.2: sha256:2c08c99cbde73b3388c6d5da68e0bcaebc70c9174f2b14d785695e4401b3ede0
    2.2.1: sha256:f5d8e90ecb6c1c7e33ecddf8cc268a93b9e5b54e0e850320d765511d76624f41
    2.2.0: sha256:b9626a94ab93b00bcbcbf13d98deef972c6fb064690e57940632df54ad39ee71
+    2.1.9: sha256:0083d2a4c2e77eeb20e55b6d955822fb957ff386c0c23959c8b27f598317586c
    2.1.8: sha256:ad2ed5bca4839109ec271e3ee0285abf36bec450956c5d59a31f1a980e8d71a9
    2.1.7: sha256:a04a39607d6a54f467c93fcd0b78ee31a1f4a3b90e76938dcfe9005ccf6a5f36
    2.1.6: sha256:4793dc5c1f34ebf8402990d0050f3c294aa3c794cd5a4baa403c1cf10602326d
@@ -1210,6 +1289,8 @@ containerd_archive_checksums:
    2.1.2: sha256:87c18b2686f38ee6f738492d04fc849f80567b7849d0710ee9d19fac3454adc4
    2.1.1: sha256:918e88fd393c28c89424e6535df0546ca36c1dfa7d8a5d685dee70b449380a9b
    2.1.0: sha256:0e5359e957b66b679be807563a543c7416e305e3aafcf56bad90ef87a917014d
+    2.0.11: sha256:249457e108b64f8c44bcf5928acc1d3300253c922414f5a8329a754303019d50
+    2.0.10: sha256:256aa8219fa9fa05798482d72b8cb6a5e5c795947fedbbb2dc5826f58181a7fe
    2.0.9: sha256:3d2dc5e1f47888b4f8fa30fabf7f1b8ea20e1572c85e20557a3bb8bab81a54a3
    2.0.8: sha256:3507e6205867331660e881cdf9bd5fea83eed67b4ba50074be1d82296fdc4de2
    2.0.7: sha256:6dc663cd245d19c3e68260ca86247469563a31decac925087b62a2a819dfcbee
@@ -1220,6 +1301,8 @@ containerd_archive_checksums:
    2.0.2: sha256:9bd5b6a1bdf505d520d9a329c520258ed0a17faa9fe3db12712ee858ad59aae3
    2.0.1: sha256:85061a5ce1b306292d5a64f85d5cd3aff93d0982737a1069d370dd6cb7bbfd09
    2.0.0: sha256:6f8da716941f7e89315cefaa6e5a8f1ff10b323ff46611313c455df7ab1ebee1
+    1.7.34: sha256:640f989745020ea4897ad0a3d7d977863a7279d3f2e132792fc62c25a45bda50
+    1.7.33: sha256:43e48ced88d12ac48dda05c7a31719b74b64fed4729a450fb04751deae606eef
    1.7.32: sha256:4db81bc7c67ec5e5e38ec43f287e1eab6962035cd1f4a904694700ca40698b03
    1.7.31: sha256:85795979166ae04c6c0681664ab54d0810d472e390cf54dde0de399ff6d54bef
    1.7.30: sha256:ca0f27e34411504acd1cd24fcbaa71b9c47d31ce9408c47c54a2dc1810ceb1df
@@ -1254,13 +1337,18 @@ containerd_archive_checksums:
    1.7.1: sha256:9504771bcb816d3b27fab37a6cf76928ee5e95a31eb41510a7d10ae726e01e85
    1.7.0: sha256:b068b05d58025dc9f2fc336674cac0e377a478930f29b48e068f97c783a423f0
  ppc64le:
+    2.3.3: sha256:248605bbedeec0d5d5ef5ce264a83cd1958b79b9c70f5c0bf3a3586596fa7dd7
+    2.3.2: sha256:bf562d89874b2850b0aaa9934135f297b4a0b028312aa5f46d1871b3f907fb0c
    2.3.1: sha256:cb5bcdb38c79fb78dc7b4e7c02d0c0e41b486446f646a49ed7e6c35c077d8d33
    2.3.0: sha256:2cdb0f1e4fce22733fee6b6887b55ea2a963dfe7436259722db98aeb4f41e051
+    2.2.6: sha256:d3d7097a4e7bc57b2aa03f74971e6200633bf384bb672a1d74633b46f438d5e6
+    2.2.5: sha256:846b5813bb040bea9d7bf8f05bc488296e02636bba1ca1e566305681475f0fda
    2.2.4: sha256:66328e683a6fe7f7267a0ee611cb9a76b2b0a9b9d9535d9564cd84dae8f38dd7
    2.2.3: sha256:95889d141444ce5845255042c8757a5ca816e895cc884f8d345e9a6d5e99e130
    2.2.2: sha256:8f7a8190f2a635cd0e5580a131408a275ba277f7a04edffba4a4005960093987
    2.2.1: sha256:3de0f215ea649952a9e99040cb3888d8059bd3d35b04edbe6afb916c763f9ea7
    2.2.0: sha256:e4ecd0b03200864e117371b25cce5335e39ce0b0a168a01d2ba6562a05020f0b
+    2.1.9: sha256:31fd4a2c405e1f8eda0aba592a2e4bc8248e6e2e63523f33f8a9196cc3c5edfd
    2.1.8: sha256:5f095acdbd4ef34a0968542aa6cd4b59fd7f8922d50d896cc7d2536d5a01513f
    2.1.7: sha256:20fd0e3740fce802a3971e242bea689800c3f128335696dcae4506d99cf6cdc3
    2.1.6: sha256:aef2b639a14ae79f2bbe43356b25e84ecfb2c7f269c87f41e41585e724073e54
@@ -1270,6 +1358,8 @@ containerd_archive_checksums:
    2.1.2: sha256:9d8a02413050ae234eeef4152fb703b3d093b5809411f0e905f098554fc066d6
    2.1.1: sha256:36c90c9993e9f2142aa014cbd352bd7d3db6b8daa2990b4a9f59e706db78deaf
    2.1.0: sha256:3e380629da9d21366c916ec3873022a2a5700584d409297a1bc183b11fcb0809
+    2.0.11: sha256:6f5a06e7c0841a4e46df2e72a9b2725325f46da9544eef1f32a397d4d863a70f
+    2.0.10: sha256:19ff4fbec55735cc6ffed75169b17779fe6cbd1c726a8d220434236b1efdc480
    2.0.9: sha256:59cae37f25ec6067d2fdf1ad76850ff45bcbf530ca176a726018d123eae447c0
    2.0.8: sha256:2980b4e80a5607d7723e9d3914d8d94533ed198c4bce4251f153906245a8ea74
    2.0.7: sha256:15186b11d555f61e495e94d5a99b2eb2c7f21a5e569eca02170c4bc12fa8c7f6
@@ -1280,6 +1370,8 @@ containerd_archive_checksums:
    2.0.2: sha256:1b19d31bb8a7f9d26d9b50675e78f397d0b01fa635c33cca456f91c412fa6df1
    2.0.1: sha256:09a25357343c7336fe519e5fd1a9dd0f22da869e9deda50c2bc61b6e8c9384be
    2.0.0: sha256:2e7f4b15ac85c22c1ced102bbb424124078248f0af3183425ff335a998079809
+    1.7.34: sha256:8e3c2d6d55c01aa01e4e661bbbe36be1574db6ee0b9a1cac89de879e92421cd9
+    1.7.33: sha256:4cbf441041d6b44eadfb301f909f8ce141c21be79d6be33c2aafc0692fc42d3e
    1.7.32: sha256:3837f3b88ecbf16bcb1b78c2af46dd2b214663c5ee6a1b5e1f751938581c7fda
    1.7.31: sha256:c0956f5975a113fa15d627ff45d7f072aa596d75e8ae6d97b8aa8ae2f3c44058
    1.7.30: sha256:2edba94f31ed0c32cde0cca2e79e4426224eece4ef4fa1f194b2df4c811417fe
@@ -1315,13 +1407,18 @@ containerd_archive_checksums:
    1.7.0: sha256:051e897d3ee5b8c8097f65be447fea2d29226b583ca5d9ed78e9aebcf4e69889
 containerd_static_archive_checksums:
  arm64:
+    2.3.3: sha256:2618fbdbf55e26897f03b4d01b78e66d6746865d19ca72469b2675c4a62e5322
+    2.3.2: sha256:331343ecdac52ff606f57e22336122f56d89afb1b319539b1895813701a61235
    2.3.1: sha256:2511a7f204fe04912acf95d6c59a65180be4491343fec79ce23b9166ac18aff3
    2.3.0: sha256:07fe31f0e54d0b4a759ca207341bb22e2a78298f127757ad7b9a6529ef397f8b
+    2.2.6: sha256:c5b28ff9a75f5cba5aaa0ca0191cf0ae78b91f184627ffc6b20f52240cf5fb09
+    2.2.5: sha256:e3b94184e26660b7cd6d50893c091f688525a1ed93628f8caaf43934c0de0cfb
    2.2.4: sha256:5f01ac0ad46caf685afee7614e36e406c48e73c1d84a71378dd4afe5d63a11d2
    2.2.3: sha256:b222c671503e7bdac671bb634463cffdea70d694d2420fcdc77b2b04df8c7864
    2.2.2: sha256:f22e03e12edd08dc49e139fec1fb0e0571950df0b6275577bbca718733acea9d
    2.2.1: sha256:6b3b011ee388638eace05ac3be0eb32dfb4a43086695c29d06e997febd336f2e
    2.2.0: sha256:5f2a7f451231ff35d8306f874c51606fc9da1e2db56048834a23260f68a78eef
+    2.1.9: sha256:f0e77d2bd29c6a4a463c593b3e9e39ce31b830ff572aba98ea544aa3b8f08be7
    2.1.8: sha256:2e9a73d9297a25449629dde0c606f86f5dad2b82d20edc5731bbc20df4705461
    2.1.7: sha256:f289ec5ec53987b6eddc5ac55d7a701cc4f5c8005983972ad44ca47f37778d4c
    2.1.6: sha256:9da292010d36d80afa3bb48cbd15f65d3bf38177217060272a1c3fd65351cfa4
@@ -1331,6 +1428,8 @@ containerd_static_archive_checksums:
    2.1.2: sha256:3f1dcd2bc02cbf9e8fde308c144551153f19e15105a26cebf213c8e232a27f5e
    2.1.1: sha256:f4525d8adc4445f8d623c6fd91e7dd750189b96539c29ede2636583ac5e4cf7b
    2.1.0: sha256:1239f60717f4ec2e06e51d2ed86c43d8a0ee10880c73131e58e1e0689e9ad049
+    2.0.11: sha256:341dad1c6b56c17303ee86c4548f7010f44befc868d55d967e866240ee59fc56
+    2.0.10: sha256:d5c3808caccde6c62fe7c91ee13dd1885ee2e5ae0c3a058437cba400bce92081
    2.0.9: sha256:8f409c39562f11a116227e833797ab421a6ebde96f92aecd88ae0409a6bf1873
    2.0.8: sha256:0e68ca38e33760ce581194933572211a2d2961dcad9a0a751258cca9a4cbf8a2
    2.0.7: sha256:cb46d915f8dea6e94fccd204f29bdb3cbe502d7deb9220a6e662cb33f29784fb
@@ -1341,6 +1440,8 @@ containerd_static_archive_checksums:
    2.0.2: sha256:da5631d38702257674da542969c285adfdbdccffc12c5ea39de4db6113de51bc
    2.0.1: sha256:6022bd160b6d83f13fccd87b1c3854b0294a940335fdf014c10c80d71b279115
    2.0.0: sha256:428cd0b08eab57003db8a98742d8404b4b69dcd335c5f0f66ceec5fe3b9b31b6
+    1.7.34: sha256:4aa54ecace7a22bc9e5dccbf06de7a0d8ad79db02fb04b348191802c8880cbc7
+    1.7.33: sha256:5d8843014386ef4e626a679c7a15e2c69d3fe6db0f8275b1c73c0438f5cd48d4
    1.7.32: sha256:1a1b9fa96e44ae4b66d0846c96d7ed9bdd2b2880e51890c74929962a5116e40c
    1.7.31: sha256:f4a329b5a97ff6241b3eed011f32a0c78969f2d7106524a628b7ee4b547896ff
    1.7.30: sha256:1458b3c4a20eb1305bb1d4680c660d0726fa7709acdd95ec7c0fd6bdd632c36a
@@ -1375,13 +1476,18 @@ containerd_static_archive_checksums:
    1.7.1: sha256:f0435e7cda3c3abc40d3f27d403a8e24bd0b927a8a893a7e4dfaec5996fa9731
    1.7.0: sha256:6e648cd832f026e23eb6998191e618da7c1ec0c0373263d503ff464e0ae3977a
  amd64:
+    2.3.3: sha256:34d418fbea898a7787edb869c17b7d3c56d3314d42226032dd6f0e62cfdd18a5
+    2.3.2: sha256:f464e184321f8b576170bdc73dc155f48e6b50931d718f3dcc945746d52138fa
    2.3.1: sha256:3e7da6f4eaab072e11fc2e88f5a2eaf6da6ffff2c6c2a8f262d3856df8e2be35
    2.3.0: sha256:d372ee3b2d272514651d65a3cecc75433dbba4bd90ae73d90d193d24d9760325
+    2.2.6: sha256:d298fe9af57d2624556baf497a1fee85b1e21f88f525775646e2ed4d295831ef
+    2.2.5: sha256:5bd824219cd44eadd050832549c969cd8413ee1f69affa68401753cbe0925c40
    2.2.4: sha256:151f0cb3de61c77f89230e276761cb0f232f0e89d9c2efca3c172282d14193ef
    2.2.3: sha256:80326f17cc35de84f652a8a633a2f14086c1d828a48b62e96720b3c42059e49c
    2.2.2: sha256:5db46232ce716f85bf1e71497a9038c87e63030574bf03f9d09557802188ad27
    2.2.1: sha256:af3e82bac6abed58d45956c653244aa2be583359a9753614278ef652012f2883
    2.2.0: sha256:2d20037947cbb0def12b8ac0c572b212284c1832bf3c921df1e58975515d1d08
+    2.1.9: sha256:d52dec99dd13e63c6a24f292936c15f929ad826be1ce39d7a77a3d840b1a2299
    2.1.8: sha256:b399462575023eeb7a9cf1450f547d918404f8557e94cee2c4b04522988282c1
    2.1.7: sha256:b6bf44cf2aa2db9ac40060e57a62b46c6622a3c49f00508c2049d225a5717749
    2.1.6: sha256:577900a5a8684c27e344aeeb1fc64e355745f58cba7f83c53649235ba25abbbf
@@ -1391,6 +1497,8 @@ containerd_static_archive_checksums:
    2.1.2: sha256:5b2b8e82c5d3e6019428db55296b5169e748b94601c0c944c1d780904aa35543
    2.1.1: sha256:9ab7df748ae3e9c2a513586668b46175c27290eda6028609223d9065eb777964
    2.1.0: sha256:e8e5da8ca6586bf2023940ec5bc5d4e949924ac8dca2a9f0dc469bb9a297146f
+    2.0.11: sha256:80c9b4afb94c21c86783d99c92b531969692a5c393c73e4735676d7caf61b1ed
+    2.0.10: sha256:ddb484b17b46d3119a3ba2ca8aac5644ed70333b2765b580d522fb8d1e1bb3f1
    2.0.9: sha256:6cd7dc915982271ab634193ad7746cf2c7ef07fb4f37cf6f662b2bdcb6678013
    2.0.8: sha256:d7857b2d4f203ac4df95b5eca805e2ae29484e2a864c95806e51b1b34918bf35
    2.0.7: sha256:23371338ea3d930f020f6ad476a608aa8196ecdd016f9f5cd511c87cf37f86b7
@@ -1401,6 +1509,8 @@ containerd_static_archive_checksums:
    2.0.2: sha256:7cd4de9c8ad37f3248a45b9d6347b7628e4d77d1c8e35c1f80343450fa47dc00
    2.0.1: sha256:22b2a7df86fe3e53e219af22a2b5e81d1b67e67d55ec3a18f89990b161fb2157
    2.0.0: sha256:e72cc69db9984a8d46a34495c302d2b50188ee2dd5c7000a7b471d0350e14ad1
+    1.7.34: sha256:8e244782bbbbe39b2213b961f0939974e88b33f68bed13c6b51f8b4c4ab8ca47
+    1.7.33: sha256:217f841c94fafd3911e4455a9706ceb4bbd81dcbe9135ced690fe0390b730f36
    1.7.32: sha256:4be406ec1ae5e1138ad9c6cd724228900d68bfbcb1f151bdd2283115cf361e6b
    1.7.31: sha256:fcefac10cab1d6d254917ca62596022fb4c3fb91984e052a3618674f75071930
    1.7.30: sha256:290eea517a7aa919aa319563f8270d284ab5197736362285da09b198b76a34b5
@@ -1435,13 +1545,18 @@ containerd_static_archive_checksums:
    1.7.1: sha256:8b4e8ed8a650ea435aa71e115fa1a70701ab98bc1836b3ed33341af35bf85a3a
    1.7.0: sha256:64ad6428cc4aca486db3a6148682052955d1e3134b69f079edf686c21d123fcd
  ppc64le:
+    2.3.3: sha256:deea137f7dc14db8e204b86d22ba3389d8b042e7e18ec8b5c06fe6c7a787b469
+    2.3.2: sha256:fb1fb184a7a6ad94ea102eb59bd066bbbd226e4b7ddab0dacb9c433029c62bc6
    2.3.1: sha256:7d853a1216b0e836cfee0964b00ba116c06f71f1b1f5fae0d73dd1c21481b9c3
    2.3.0: sha256:747101428337fd8afc996a98d23e45e7d64a1bf2dcb0dad74997356254732e85
+    2.2.6: sha256:896d098d6565ffe3f404427ecaebf5c5b9a7f4ee72956d26e7c7f19e12566dee
+    2.2.5: sha256:5ae3bfec8ce8dcb389c18018a9f01611e09cb18b6b7635be6e499ab4efc63e0d
    2.2.4: sha256:5352f7b6523d92e1d7d4a1b5288be5fe490620e104cb48623d6affab309005d6
    2.2.3: sha256:63e884ac7a25591ced974235396ed4ee98569506258672636ed55f60d4bcd66a
    2.2.2: sha256:7e3d541c578fe06bcdb36ee58140e6e36dc97e784a9228e31c3ce99937cbad10
    2.2.1: sha256:fc9235be9a3dd3005e7fe6a9d7bb80e42dbfbff4b119cdce6ea3ee66bc7ae9ca
    2.2.0: sha256:d15a4edfe689ce71df8cc5a0c1837856f54aba8d7336170600e6592c2fbf3d8d
+    2.1.9: sha256:79ce1a3b90106d75c17c1c398840c68b2a78e2ae70381d2cbb75fcb41a93eeea
    2.1.8: sha256:2145c029796ac7e70c755139dbb26c98f0a3d6d08cf2e638cda23452e312739f
    2.1.7: sha256:0454397e1179ff0c3cdc4ea8fb7816b634c6fd69a3003fdcc4008a657c4e9977
    2.1.6: sha256:c64312b87181d900452b5c3360a90578acd39ec7664d0c2e060183b24a708766
@@ -1451,6 +1566,8 @@ containerd_static_archive_checksums:
    2.1.2: sha256:4e61d5f9b5789e27c28b94fe0901552fb0070aa0c36aeaabc6e2786f3d5828ff
    2.1.1: sha256:32c307e4b5cf014b594a9e7c22c610238143da8797f2bf4058dfb94225606ad4
    2.1.0: sha256:df73c5ce713196be46f4b20d3ff081d67dabb5c730f61da7a3a65a9029b4f762
+    2.0.11: sha256:6d138b99257ad61c98a127594f2164a3e7f8038a3a1ef14489db936bec034d99
+    2.0.10: sha256:75e335f8d8aeef9116b18da375d1e7f5d8e15cfb9740b09d2de179570c3c2dfa
    2.0.9: sha256:07bf0dc2483ee86022e85003f07ef4b37bfb839a1a61452ddde530f1cf97e836
    2.0.8: sha256:b014afa514a68eabf009021ff7ad1707f628d3050eafce41f7d54d8e4f344f82
    2.0.7: sha256:3f5993c7717216ae82083ce8c96af4d471da6e55affb03bfe4b86c59c6f54781
@@ -1461,6 +1578,8 @@ containerd_static_archive_checksums:
    2.0.2: sha256:4085c490ad5afb40b34782d427130396513a7eb35a49da8a6b7ade946dd309ce
    2.0.1: sha256:6e8608e1993099f4ad44d77765be76fd67147108a6247f6886af33be08287a84
    2.0.0: sha256:c389b68c9ca7774efdbc9e479d9a3be14b71d60a2a8c23f1d8764ec9598f3d55
+    1.7.34: sha256:f6ac8036d6fde9d1fab7ac78e2c38642939321064b2444edddbc6bc88606207e
+    1.7.33: sha256:55efc1d46be79b34fe943052818e911d6ace609b29d840e27db378ebebbd91aa
    1.7.32: sha256:27090a9a77b5d1656ea95542166be6a8ac7877a76e4ebbc9a4b0b7c9bdbbae69
    1.7.31: sha256:460c276e75cb9bb205d0b4f685875c533fd6a904d91af539604d8085482e6453
    1.7.30: sha256:95f12a656977f516b257f6447c197a30bd75b8b9d494a741a7f1f486a069de8c
--- a/roles/network_plugin/cilium/tasks/install.yml
+++ b/roles/network_plugin/cilium/tasks/install.yml
@@ -1,11 +1,4 @@
 ---
- name: Cilium | Ensure BPFFS mounted
-  ansible.posix.mount:
-    fstype: bpf
-    path: /sys/fs/bpf
-    src: bpffs
-    state: mounted
-
 - name: Cilium | Create Cilium certs directory
  file:
    dest: "{{ cilium_cert_dir }}"
--- a/roles/network_plugin/cilium/templates/values.yaml.j2
+++ b/roles/network_plugin/cilium/templates/values.yaml.j2
@@ -109,6 +109,7 @@ hubble:
        tag: {{ cilium_hubble_ui_image_tag }}
  metrics:
    enabled: {{ cilium_hubble_metrics | to_json }}
+    port: {{ cilium_hubble_scrape_port }}
  export:
 {% if cilium_version is version('1.18.0', '>=') %}
    static:
@@ -156,6 +157,8 @@ operator:
    repository: {{ cilium_operator_image_repo }}
    tag: {{ cilium_operator_image_tag }}
  replicas: {{ cilium_operator_replicas }}
+  prometheus:
+    port: {{ cilium_operator_scrape_port }}
  extraArgs:
    {{ cilium_operator_extra_args | to_nice_yaml(indent=2) | indent(4) }}
  extraVolumes:
@@ -179,16 +182,17 @@ policyAuditMode: {{ cilium_policy_audit_mode | to_json }}

 prometheus:
  enabled: {{ cilium_enable_prometheus | to_json }}
+  port: {{ cilium_agent_scrape_port }}

 certgen:
  image:
-    repository: {{ cilium_hubble_certgen_image_repo }}
-    tag: {{ cilium_hubble_certgen_image_tag }}
+    repository: {{ cilium_certgen_image_repo }}
+    tag: {{ cilium_certgen_image_tag }}

 envoy:
  image:
-    repository: {{ cilium_hubble_envoy_image_repo }}
-    tag: {{ cilium_hubble_envoy_image_tag }}
+    repository: {{ cilium_envoy_image_repo }}
+    tag: {{ cilium_envoy_image_tag }}

 extraConfig:
  {{ cilium_config_extra_vars | to_yaml | indent(2) }}
--- a/roles/network_plugin/custom_cni/meta/main.yml
+++ b/roles/network_plugin/custom_cni/meta/main.yml
@@ -17,3 +17,5 @@ dependencies:
    repositories:
      - name: "{{ custom_cni_chart_repository_name }}"
        url: "{{ custom_cni_chart_repository_url }}"
+        username: "{{ custom_cni_chart_repository_username | default(omit) }}"
+        password: "{{ custom_cni_chart_repository_password | default(omit) }}"
--- a/roles/network_plugin/flannel/templates/cni-flannel.yml.j2
+++ b/roles/network_plugin/flannel/templates/cni-flannel.yml.j2
@@ -37,6 +37,9 @@ data:
 {% if ipv6_stack %}
      "EnableIPv6": true,
      "IPv6Network": "{{ kube_pods_subnet_ipv6 }}",
+{% endif %}
+{% if flannel_version is version('0.25.5', '>=') %}
+      "EnableNFTables": {{ (kube_proxy_mode == 'nftables') | bool | to_json }},
 {% endif %}
      "Backend": {
        "Type": "{{ flannel_backend_type }}"{% if flannel_backend_type == "vxlan" %},
--- a/roles/network_plugin/multus/tasks/main.yml
+++ b/roles/network_plugin/multus/tasks/main.yml
@@ -27,8 +27,8 @@
    - {name: multus-daemonset-crio, file: multus-daemonset-crio.yml, type: daemonset, engine: crio }
  register: multus_manifest_2
  vars:
-    host_query: "*|[?container_manager=='{{ container_manager }}']|[0].inventory_hostname"
-    vars_from_node: "{{ hostvars | json_query(host_query) }}"
+    host_query: "[?container_manager=='{{ container_manager }}']|[0].inventory_hostname"
+    vars_from_node: "{{ ansible_play_hosts_all | map('extract', hostvars) | list | json_query(host_query) }}"
  delegate_to: "{{ groups['kube_control_plane'][0] }}"
  when:
    - item.engine in container_manager_types
--- a/roles/reset/tasks/main.yml
+++ b/roles/reset/tasks/main.yml
@@ -443,7 +443,7 @@

 - name: Reset | Restart network
  when:
-    - ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
    - reset_restart_network | bool
  tags:
    - services
--- a/roles/upgrade/post-upgrade/tasks/main.yml
+++ b/roles/upgrade/post-upgrade/tasks/main.yml
@@ -14,7 +14,7 @@
 - name: Confirm node uncordon
  pause:
    echo: true
-    prompt: "Ready to uncordon node {{ kube_override_hostname | default(inventory_hostname) }}?"
+    prompt: "Ready to uncordon node {{ kube_override_hostname | default(inventory_hostname) }}? (Press Enter to continue or Ctrl+C for other options)"
  when:
    - upgrade_node_post_upgrade_confirm

--- a/roles/upgrade/pre-upgrade/tasks/main.yml
+++ b/roles/upgrade/pre-upgrade/tasks/main.yml
@@ -3,7 +3,7 @@
 - name: Confirm node upgrade
  pause:
    echo: true
-    prompt: "Ready to upgrade node {{ kube_override_hostname | default(inventory_hostname) }}? (Press Enter to continue or Ctrl+C for other options)"
+    prompt: "Ready to cordon and upgrade node {{ kube_override_hostname | default(inventory_hostname) }}? (Press Enter to continue or Ctrl+C for other options)"
  when:
    - upgrade_node_confirm

--- a/roles/upgrade/system-upgrade/tasks/apt.yml
+++ b/roles/upgrade/system-upgrade/tasks/apt.yml
@@ -5,10 +5,23 @@
    upgrade: dist
    autoremove: true
    dpkg_options: force-confold,force-confdef
-  register: apt_upgrade

- name: Reboot after APT Dist-Upgrade  # noqa no-handler
+- name: Check if a reboot is required
+  ansible.builtin.stat:
+    path: /var/run/reboot-required
+    get_checksum: false
+  register: reboot_required
+
+- name: Reboot server if required to apply updates
+  ansible.builtin.reboot:
+    msg: "The system is going down for reboot NOW!"
+    post_reboot_delay: 30
  when:
-  - apt_upgrade.changed or system_upgrade_reboot == 'always'
-  - system_upgrade_reboot != 'never'
-  reboot:
+    - reboot_required.stat.exists
+    - system_upgrade_reboot != 'never'
+
+- name: APT Autoclean
+  apt:
+    autoclean: true
+  when:
+    - system_upgrade_autoclean
--- a/roles/upgrade/system-upgrade/tasks/main.yml
+++ b/roles/upgrade/system-upgrade/tasks/main.yml
@@ -2,7 +2,7 @@
 - name: APT upgrade
  when:
  - system_upgrade
-  - ansible_os_family == "Debian"
+  - ansible_facts['os_family'] == "Debian"
  include_tasks: apt.yml
  tags:
  - system-upgrade-apt
@@ -10,7 +10,7 @@
 - name: YUM upgrade
  when:
  - system_upgrade
-  - ansible_os_family == "RedHat"
+  - ansible_facts['os_family'] == "RedHat"
  - not is_fedora_coreos
  include_tasks: yum.yml
  tags:
--- a/roles/validate_inventory/tasks/main.yml
+++ b/roles/validate_inventory/tasks/main.yml
@@ -11,6 +11,7 @@
    # Always remove items from this list after the release in comments
    removed_vars:
      - kubelet_static_pod_path # 2.31.0
+      - eviction_hard_control_plane # 2.31.0
    removed_vars_found: "{{ query('varnames', '^' + (removed_vars | join('|')) + '$') }}"
  assert:
    that: removed_vars_found | length == 0
--- a/tests/files/fedora43-flannel-crio-collection-scale.yml
+++ b/tests/files/fedora43-flannel-crio-collection-scale.yml
@@ -1,6 +1,6 @@
 ---
 cloud_image: fedora-43
-network_plugin: flannel
+kube_network_plugin: flannel
 container_manager: crio

 cluster_layout:
--- a/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
+++ b/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
@@ -6,6 +6,7 @@ vm_memory: 3072

 # Kubespray settings
 auto_renew_certificates: true
+system_upgrade_autoclean: true

 # Currently ipvs not available on KVM: https://packages.ubuntu.com/search?suite=focal&arch=amd64&mode=exactfilename&searchon=contents&keywords=ip_vs_sh.ko
 kube_proxy_mode: iptables
--- a/tests/files/ubuntu24-crio-upgrade.yml
+++ b/tests/files/ubuntu24-crio-upgrade.yml
@@ -7,6 +7,7 @@ vm_memory: 3072
 # Kubespray settings
 container_manager: crio
 auto_renew_certificates: true
+system_upgrade_autoclean: true

 # Currently ipvs not available on KVM: https://packages.ubuntu.com/search?suite=noble&arch=amd64&mode=exactfilename&searchon=contents&keywords=ip_vs_sh.ko
 kube_proxy_mode: iptables
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -1,4 +1,4 @@
 -r ../requirements.txt
 distlib==0.4.3 # required for building collections
-molecule==26.4.0
+molecule==26.6.0
 pytest-testinfra==10.2.2
Author	SHA1	Message	Date
dependabot[bot]	07c382f27e	build(deps): bump cryptography from 49.0.0 to 50.0.0 Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-10 03:14:16 +00:00
Ali Afsharzadeh	ace96af930	Upgrade cilium from 1.19.6 to 1.20.0 (#13401 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-08-06 13:26:54 +00:00
Shaleen Bathla	a7391a1461	kubelet, crio service: standardize unit file permissions to 0644 (#13408 ) * kubelet.service: use standard permissions systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway. * crio.service: reduce execute permission systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.	2026-08-06 13:22:55 +00:00
Nikhil Kumar	7198b21b3f	Replace injected Ansible fact variables in Remaining roles (#13383 )	2026-08-03 07:21:29 +00:00
tophac	4ee4ced065	Fix（#13396）Delete the leftover eviction_hard_control_plane variable (#13400 )	2026-08-03 04:33:24 +00:00
Debasish Mohanty	f713813c55	fix(csi): update CSI sidecar image versions (#13395 ) * feat(csi): update CSI sidecar image versions * docs(openstack): update sample Cinder CSI sidecar image tags * chore: trigger CI	2026-08-02 14:53:22 +00:00
dependabot[bot]	c0cbd079ab	build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#13398 ) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](`ece7cb06ca...5fda3b95a4`) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-27 15:31:58 +00:00
dependabot[bot]	0665be9c67	build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#13399 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](`9c091bb21b...3d3c42e5aa`) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-27 07:47:57 +00:00
R. P. Taylor	1d67dc671a	fix typo in RHEL documentation for Rocky 10 (#13394 )	2026-07-25 06:39:51 +00:00
Ali Afsharzadeh	9b092a4f49	Upgrade cilium from 1.19.5 to 1.19.6 (#13376 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-07-25 06:35:53 +00:00
Ali Afsharzadeh	8d69fb8f9a	Patch versions updates (#13393 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-07-24 07:01:52 +00:00
emma034186-stack	5d17ea45a9	fix(cilium): stop early if kube_owner is not root (#13385 ) Cilium's init containers run as UID 0 with capabilities (including CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin) must be owned by root or it will fail with a permission error. Add a pre-flight assert that fails fast with a clear message when kube_network_plugin == cilium and kube_owner != root, instead of changing CNI bin ownership defaults for all network plugins.	2026-07-22 14:17:51 +00:00
Frank	dafb54734a	fix: restrict automatic OS labels (#13386 )	2026-07-21 06:52:15 +00:00
wangsifei99	d668c509bb	fix: Unneeded bpf fstab entry added when using Cilium #13364 (#13377 )	2026-07-20 09:28:12 +00:00
Frank	27527fdb00	refactor(roles): remove redundant default filters (#13380 )	2026-07-17 16:35:28 +00:00
Toshihiko Kimura	2d8f15f95a	fix(calico): Add missing permissions in RBAC for calico-kube-controllers (#13375 ) * fix(calico): Add namespace rbac for calico-kube-controllers * fix(calico): Add missing RBAC resource for calico-kube-controllers	2026-07-17 15:19:30 +00:00
Jeroen Rijken	cbcda6ea8d	Reboot only when required, add the option to clean packages. (#13327 ) * Reboot only when required, add the option to clean packages. * Update docs to reflect only Debian based distribution can be apt autocleaned * Add apt cleanup to upgrade tests	2026-07-16 16:25:26 +00:00
somaz	0355ed62b9	fix(cilium): wire scrape port variables to Helm values template (#13370 ) Signed-off-by: somaz <genius5711@gmail.com>	2026-07-15 09:57:33 +00:00
Ali Soltaninasab	971e5f561b	Support authentication for custom CNI Helm repositories (#13294 ) * Add authentication support for custom CNI Helm repository Pass optional Helm repository username and password values to the custom CNI chart configuration. These values use default(omit) so authentication fields are only included when explicitly defined by the user. * Document custom CNI Helm repository authentication variables Add commented sample variables for configuring a username and password when the custom CNI Helm repository requires authentication. * Address Copilot documentation feedback Document paired repository credentials and secure password storage. Remove authentication placeholders from the public Cilium example.	2026-07-15 04:05:20 +00:00
Ali Afsharzadeh	648e55a379	Rename cilium certgen and envoy image variables (#13260 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-07-14 14:33:17 +00:00
ChengHao Yang	e15b1f2778	Patch versions updates (#13368 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-14 03:24:19 +00:00
Nikhil Kumar	451957822e	Replace injected Ansible fact variables in kubernetes-apps role (#13339 )	2026-07-14 02:38:18 +00:00
Adesh Deshmukh	9254afbdc7	Remove dangling 'list' from mutually_exclusive in kube.py (#13352 ) The mutually_exclusive constraint referenced 'list', a parameter that does not exist in argument_spec. Remove the dead constraint. Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>	2026-07-09 05:52:31 +00:00
Nikhil Kumar	338d288653	Replace injected Ansible fact variables in kubespray-defaults role (#13340 )	2026-07-08 10:08:29 +00:00
kubernetes-prow[bot]	0c7ccdd6cf	Merge pull request #13361 from tico88612/fix/1.36-extend-websocket fix: ExtendWebSocketsToKubelet when container_manager set docker	2026-07-07 09:18:29 +00:00
Adesh Deshmukh	63bdde2ade	Fix inverted ignore_errors condition for etcd-events service startup (#13343 ) The ignore_errors condition on the etcd-events service startup task (Configure \| Ensure etcd-events is running) uses != instead of ==, which is the inverse of the correct pattern used for the main etcd service on the line above. This was introduced in commit `7516fe142` when the # noqa ignore-errors comment was added to the line, accidentally flipping the operator.	2026-07-07 07:50:27 +00:00
ChengHao Yang	c1ee4bdef8	test: move openeuler24-calico to pr-full Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2026-07-06 22:08:20 +08:00
dependabot[bot]	cf80a0c409	build(deps): bump molecule from 26.4.0 to 26.6.0 in the molecule group (#13359 ) Bumps the molecule group with 1 update: [molecule](https://github.com/ansible-community/molecule). Updates `molecule` from 26.4.0 to 26.6.0 - [Release notes](https://github.com/ansible-community/molecule/releases) - [Commits](https://github.com/ansible-community/molecule/compare/v26.4.0...v26.6.0) --- updated-dependencies: - dependency-name: molecule dependency-version: 26.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: molecule ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-06 11:22:25 +00:00
ChengHao Yang	80b3345ed8	fix: cri-dockerd doesn't support ExtendWebSocketsToKubelet Disabled the FG ExtendWebSocketsToKubelet when `container_manager` set `docker`, let CI can passed.	2026-07-06 16:57:50 +08:00
Adesh Deshmukh	4832c44bb3	fix(tests): use kube_network_plugin in fedora43-flannel-crio test (#13350 ) * fix(tests): use kube_network_plugin in fedora43-flannel-crio test The fedora43-flannel-crio-collection-scale.yml test config set 'network_plugin: flannel', but all Kubespray roles read 'kube_network_plugin' (defaulting to 'calico'). The test silently ran Calico instead of Flannel. Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com> * Update CI matrix to reflect fedora43-flannel-crio test correctly --------- Signed-off-by: Adesh Deshmukh <adeshkd123@gmail.com>	2026-07-05 10:44:22 +00:00
Aleksandr Borisov	c263d746b6	Fix Multus manifest generation with global inventory (#13309 ) * Fix Multus manifest generation with global inventory * Update roles/network_plugin/multus/tasks/main.yml Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com> --------- Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-06-30 12:50:11 +00:00
dependabot[bot]	30e39560e5	build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#13331 ) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](`a309ff8b42...ece7cb06ca`) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-29 09:24:10 +00:00
dependabot[bot]	8f3baa4e18	build(deps): bump actions/cache from 5.0.5 to 6.1.0 (#13330 ) Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](`27d5ce7f10...55cc834586`) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-29 08:52:07 +00:00
Matthias Lohr	925f60247a	Make cordon/uncordon confirmation prompts consistent (#13313 ) Mention cordon explicitly in the pre-upgrade prompt and add the node name plus the same continue/cancel hint to the uncordon prompt so both prompts share consistent wording.	2026-06-24 11:38:21 +00:00
ICHx	60929432f5	flannel: set EnableNFTables when kube_proxy_mode use nftables (#13291 ) * flannel: set EnableNFTables when kube_proxy_mode use nftables * Clean up cni-flannel.yml.j2 by removing comments Removed commented-out environment variable for cache readiness. * update cni-flannel.yml.j2 --------- Co-authored-by: ric-mb <noreply@github.com>	2026-06-24 02:50:17 +00:00
Wren Turkal	07960e8bb6	fix: Jinja version test warning (#13322 ) The jinja version test conditional uses jinja in the condition, which is deprecated. I have removed the assertion since ansible 2.18 has a dependency on jinja2>=3.0.0.	2026-06-23 09:38:37 +00:00
Sumit Solanki	c76137d89e	dependabot: ignore ansible major version updates (#13320 ) Ansible major versions are upgraded manually to support multiple OS/Python versions. Configure Dependabot to still propose minor and patch updates while skipping semver-major bumps. Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>	2026-06-23 07:01:33 +00:00
Sumit Solanki	edeeb95f22	fix(cilium): sync operator-generic image for offline registries (#13270 ) The Cilium Helm chart appends a -generic suffix to the operator image repository for non-cloud deployments. Sync the operator-generic image to offline registries so it matches what the chart requests. Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>	2026-06-22 12:49:55 +00:00
dependabot[bot]	9dde36546c	build(deps): update bcrypt requirement from <5 to <6 (#13318 ) Updates the requirements on [bcrypt](https://github.com/pyca/bcrypt) to permit the latest version. - [Changelog](https://github.com/pyca/bcrypt/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/bcrypt/compare/v1.0.0...5.0.0) --- updated-dependencies: - dependency-name: bcrypt dependency-version: 5.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 06:21:41 +00:00
dependabot[bot]	99be103567	build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#13319 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](`df4cb1c069...9c091bb21b`) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 06:11:40 +00:00
Ali Afsharzadeh	4d8ecca4e7	Upgrade cilium from 1.19.4 to 1.19.5 (#13315 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-06-21 14:17:37 +00:00
Alejandro Macedo	8a5cfe8d77	Change failure condition for image container download (#12321 ) When installing with `download_run_once`, nerdctl will log to stderr and cause a failure even if the image was saved successfully. Instead we rely on the shell exit code to detect the failure. Signed-off-by: Alejandro Macedo <alex.macedopereira@gmail.com>	2026-06-21 10:51:41 +00:00
Nikhil Kumar	9f7ea6632c	Replace injected Ansible fact variables in bootstrap_os role (#13264 ) * Replace injected Ansible fact variables in bootstrap_os role * Restore stale setup task in opensuse role	2026-06-19 11:44:49 +05:30