build(deps): bump cryptography from 49.0.0 to 50.0.0

Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/49.0.0...50.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/advanced-issue-labeler.yml

@@ -0,0 +1,54 @@
+---
+policy:
+  - section:
+      - id: [os]
+        block-list: []
+        label:
+          - name: 'RHEL 9'
+            keys: ['RHEL 9']
+          - name: 'RHEL 8'
+            keys: ['RHEL 8']
+          - name: 'Fedora 40'
+            keys: ['Fedora 40']
+          - name: 'Ubuntu 24'
+            keys: ['Ubuntu 24']
+          - name: 'Ubuntu 22'
+            keys: ['Ubuntu 22']
+          - name: 'Ubuntu 20'
+            keys: ['Ubuntu 20']
+          - name: 'Debian 12'
+            keys: ['Debian 12']
+          - name: 'Debian 11'
+            keys: ['Debian 11']
+          - name: 'Flatcar Container Linux'
+            keys: ['Flatcar Container Linux']
+          - name: 'openSUSE Leap'
+            keys: ['openSUSE Leap']
+          - name: 'openSUSE Tumbleweed'
+            keys: ['openSUSE Tumbleweed']
+          - name: 'Oracle Linux 9'
+            keys: ['Oracle Linux 9']
+          - name: 'Oracle Linux 8'
+            keys: ['Oracle Linux 8']
+          - name: 'AlmaLinux 9'
+            keys: ['AlmaLinux 9']
+          - name: 'AlmaLinux 8'
+            keys: ['AlmaLinux 8']
+          - name: 'Rocky Linux 9'
+            keys: ['Rocky Linux 9']
+          - name: 'Rocky Linux 8'
+            keys: ['Rocky Linux 8']
+          - name: 'Amazon Linux 2'
+            keys: ['Amazon Linux 2']
+          - name: 'Kylin Linux Advanced Server V10'
+            keys: ['Kylin Linux Advanced Server V10']
+          - name: 'UOS Linux 20'
+            keys: ['UOS Linux 20']
+          - name: 'openEuler 24'
+            keys: ['openEuler 24']
+          - name: 'openEuler 22'
+            keys: ['openEuler 22']
+          - name: 'openEuler 20'
+            keys: ['openEuler 20']
+          - name: 'Other|Unsupported'
+            keys: ['Other|Unsupported']

.github/dependabot.yml

@@ -12,6 +12,10 @@ updates:
         patterns:
           - molecule
           - molecule-plugins*
+    ignore:
+      # Ansible major versions are upgraded manually to support multiple OS/Python versions.
+      - dependency-name: "ansible"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "github-actions"
     directory: "/"
     labels:

.github/workflows/auto-label-os.yml

@@ -13,20 +13,17 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@10dcc54158ba4c137713d9d69d70a2da63b6bda3
+        uses: stefanbuck/github-issue-parser@cb6e97157cbf851e3a393ff8d57c93a484cc323f
         id: issue-parser
         with:
           template-path: .github/ISSUE_TEMPLATE/bug-report.yaml
 
-      - name: Set labels based on OS field
+      - name: Set labels based on allowed OS values
         uses: redhat-plumbers-in-action/advanced-issue-labeler@b80ae64e3e156e9c111b075bfa04b295d54e8e2e
         with:
           issue-form: ${{ steps.issue-parser.outputs.jsonString }}
-          section: os
+          config-path: .github/advanced-issue-labeler.yml
-          block-list: |
-            None
-            Other
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/upgrade-patch-versions.yml

@@ -11,10 +11,10 @@ jobs:
   update-patch-versions:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         ref: ${{ inputs.branch }}
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.13'
         cache: 'pip'
@@ -22,7 +22,7 @@ jobs:
     - run: update-hashes
       env:
         API_KEY: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/cache@v5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         key: pre-commit-hook-propagate
         path: |

.gitlab-ci/kubevirt.yml

@@ -40,8 +40,8 @@ pr:
           - debian11-macvlan
           - debian12-cilium
           - debian13-cilium
-          - fedora39-kube-router
+          - fedora42-kube-router
-          - fedora41-kube-router
+          - fedora43-kube-router
           - fedora42-calico
           - rockylinux9-cilium
           - rockylinux10-cilium
@@ -56,7 +56,7 @@ pr:
           - ubuntu24-kube-router-sep
           - ubuntu24-kube-router-svc-proxy
           - ubuntu24-ha-separate-etcd
-          - fedora40-flannel-crio-collection-scale
+          - fedora43-flannel-crio-collection-scale
 
 # This is for flakey test so they don't disrupt the PR worklflow too much.
 # Jobs here MUST have a open issue so we don't lose sight of them
@@ -70,7 +70,6 @@ pr-flakey:
     matrix:
       - TESTCASE:
           - flatcar4081-calico # https://github.com/kubernetes-sigs/kubespray/issues/12309
-          - openeuler24-calico # https://github.com/kubernetes-sigs/kubespray/issues/12877
 
 # The ubuntu24-calico-all-in-one jobs are meant as early stages to prevent running the full CI if something is horribly broken
 ubuntu24-calico-all-in-one:
@@ -105,10 +104,11 @@ pr_full:
           - debian11-custom-cni
           - debian11-kubelet-csr-approver
           - debian12-custom-cni-helm
-          - fedora39-calico-swap-selinux
+          - fedora42-calico-swap-selinux
-          - fedora39-crio
+          - fedora42-crio
-          - fedora41-calico-swap-selinux
+          - fedora43-calico-swap-selinux
-          - fedora41-crio
+          - fedora43-crio
+          - openeuler24-calico # https://github.com/kubernetes-sigs/kubespray/issues/12877
           - ubuntu24-calico-ha-wireguard
           - ubuntu24-flannel-ha
           - ubuntu24-flannel-ha-once
@@ -166,9 +166,9 @@ periodic:
           - debian11-calico-upgrade
           - debian11-calico-upgrade-once
           - debian12-cilium-svc-proxy
-          - fedora39-calico-selinux
+          - fedora42-calico-selinux
-          - fedora40-docker-calico
+          - fedora43-calico-selinux
-          - fedora41-calico-selinux
+          - fedora43-docker-calico
           - ubuntu24-calico-etcd-kubeadm-upgrade-ha
           - ubuntu24-calico-ha-recover
           - ubuntu24-calico-ha-recover-noquorum

.gitlab-ci/molecule.yml

@@ -35,7 +35,6 @@ molecule:
       - container-engine/containerd
       - container-engine/cri-o
       - container-engine/gvisor
-      - container-engine/youki
       - adduser
       - bastion-ssh-config
       - bootstrap_os
@@ -53,3 +52,5 @@ molecule_full:
     - ROLE:
       # FIXME : tests below are perma-failing
       - container-engine/kata-containers
+      # FIXME: until youki release 0.6.1
+      - container-engine/youki

.pre-commit-config.yaml

@@ -33,6 +33,7 @@ repos:
     hooks:
       - id: ansible-lint
         additional_dependencies:
+          - ansible-core>=2.18.0,<2.19.0
           - jmespath==1.0.1
           - netaddr==1.3.0
           - distlib
@@ -49,7 +50,7 @@ repos:
         name: Build and install kubernetes-sigs.kubespray Ansible collection
         language: python
         additional_dependencies:
-          - ansible-core>=2.16.4
+          - ansible-core>=2.18.0,<2.19.0
           - distlib
         entry: tests/scripts/collection-build-install.sh
         pass_filenames: false
@@ -91,7 +92,7 @@ repos:
         name: Update static files referencing default kubespray values
         language: python
         additional_dependencies:
-          - ansible-core>=2.16.4
+          - ansible-core>=2.18.0,<2.19.0
         entry: scripts/propagate_ansible_variables.yml
         pass_filenames: false
 

Dockerfile

@@ -35,8 +35,8 @@ RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 RUN OS_ARCHITECTURE=$(dpkg --print-architecture) \
-    && curl -L "https://dl.k8s.io/release/v1.35.4/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
+    && curl -L "https://dl.k8s.io/release/v1.36.3/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
-    && echo "$(curl -L "https://dl.k8s.io/release/v1.35.4/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
+    && echo "$(curl -L "https://dl.k8s.io/release/v1.36.3/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
     && chmod a+x /usr/local/bin/kubectl
 
 COPY *.yml ./

OWNERS_ALIASES

@@ -8,6 +8,7 @@ aliases:
   kubespray-reviewers:
     - cyclinder
     - erikjiang
+    - guoard
     - mzaian
     - tico88612
     - vannten

README.md

@@ -22,7 +22,7 @@ Ensure you have installed Docker then
 ```ShellSession
 docker run --rm -it --mount type=bind,source="$(pwd)"/inventory/sample,dst=/inventory \
   --mount type=bind,source="${HOME}"/.ssh/id_rsa,dst=/root/.ssh/id_rsa \
-  quay.io/kubespray/kubespray:v2.30.0 bash
+  quay.io/kubespray/kubespray:v2.31.0 bash
 # Inside the container you may now run the kubespray playbooks:
 ansible-playbook -i /inventory/inventory.ini --private-key /root/.ssh/id_rsa cluster.yml
 ```
@@ -111,15 +111,15 @@ Note:
 <!-- BEGIN ANSIBLE MANAGED BLOCK -->
 
 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.35.4
+  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.36.3
-  - [etcd](https://github.com/etcd-io/etcd) 3.6.10
+  - [etcd](https://github.com/etcd-io/etcd) 3.6.13
   - [docker](https://www.docker.com/) 28.3
-  - [containerd](https://containerd.io/) 2.2.3
+  - [containerd](https://containerd.io/) 2.3.3
-  - [cri-o](http://cri-o.io/) 1.35.0 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [cri-o](https://cri-o.io/) 1.36.2 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
   - [cni-plugins](https://github.com/containernetworking/plugins) 1.9.1
-  - [calico](https://github.com/projectcalico/calico) 3.31.5
+  - [calico](https://github.com/projectcalico/calico) 3.31.6
-  - [cilium](https://github.com/cilium/cilium) 1.19.3
+  - [cilium](https://github.com/cilium/cilium) 1.20.0
   - [flannel](https://github.com/flannel-io/flannel) 0.28.4
   - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
   - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
@@ -127,7 +127,7 @@ Note:
   - [kube-vip](https://github.com/kube-vip/kube-vip) 1.0.3
 - Application
   - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3
-  - [coredns](https://github.com/coredns/coredns) 1.12.4
+  - [coredns](https://github.com/coredns/coredns) 1.14.2
   - [argocd](https://argoproj.github.io/) 2.14.5
   - [helm](https://helm.sh/) 3.18.4
   - [metallb](https://metallb.universe.tf/) 0.13.9

RELEASE.md

@@ -58,7 +58,7 @@ You can create a release note with:
 export GITHUB_TOKEN=<your-github-token>
 export ORG=kubernetes-sigs
 export REPO=kubespray
-release-notes --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note --required-author=""
+release-notes generate --org "${ORG}" --repo "${REPO}" --repo-path "${PWD}" --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note
 ```
 
 If the release note file(/tmp/kubespray-release-note) contains "### Uncategorized" pull requests, those pull requests don't have a valid kind label(`kind/feature`, etc.).

docs/CNI/cilium.md

@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version
 
 ```yml
-cilium_version: "1.19.3"
+cilium_version: "1.20.0"
 ```
 
 ## Add variable to config

docs/ansible/ansible.md

@@ -157,20 +157,20 @@ Example command to filter and apply only DNS configuration tasks and skip
 everything else related to host OS configuration and downloading images of containers:
 
 ```ShellSession
-ansible-playbook -i inventory/sample/hosts.ini cluster.yml --tags preinstall,facts --skip-tags=download,bootstrap_os
+ansible-playbook -i inventory/sample/inventory.ini cluster.yml --tags preinstall,facts --skip-tags=download,bootstrap_os
 ```
 
 And this play only removes the K8s cluster DNS resolver IP from hosts' /etc/resolv.conf files:
 
 ```ShellSession
-ansible-playbook -i inventory/sample/hosts.ini -e dns_mode='none' cluster.yml --tags resolvconf
+ansible-playbook -i inventory/sample/inventory.ini -e dns_mode='none' cluster.yml --tags resolvconf
 ```
 
 And this prepares all container images locally (at the ansible runner node) without installing
 or upgrading related stuff or trying to upload container to K8s cluster nodes:
 
 ```ShellSession
-ansible-playbook -i inventory/sample/hosts.ini cluster.yml \
+ansible-playbook -i inventory/sample/inventory.ini cluster.yml \
     -e download_run_once=true -e download_localhost=true \
     --tags download --skip-tags upload,upgrade
 ```

docs/cloud_controllers/vsphere.md

@@ -62,7 +62,7 @@ Once the configuration is set, you can execute the playbook again to apply the n
 
 ```ShellSession
 cd kubespray
-ansible-playbook -i inventory/sample/hosts.ini -b -v cluster.yml
+ansible-playbook -i inventory/sample/inventory.ini -b -v cluster.yml
 ```
 
 You'll find some useful examples [here](https://github.com/kubernetes/cloud-provider-vsphere/blob/master/docs/book/tutorials/kubernetes-on-vsphere-with-kubeadm.md#sample-manifests-to-test-csi-driver-functionality) to test your configuration.
@@ -82,7 +82,7 @@ If you intend to leverage the [zone and region node labeling](https://kubernetes
 
 ### Kubespray configuration (deprecated)
 
-First you must define the cloud provider in `inventory/sample/group_vars/all.yml` and set it to `vsphere`.
+First you must define the cloud provider in `inventory/sample/group_vars/all/all.yml` and set it to `vsphere`.
 
 ```yml
 cloud_provider: vsphere
@@ -128,7 +128,7 @@ Once the configuration is set, you can execute the playbook again to apply the n
 
 ```ShellSession
 cd kubespray
-ansible-playbook -i inventory/sample/hosts.ini -b -v cluster.yml
+ansible-playbook -i inventory/sample/inventory.ini -b -v cluster.yml
 ```
 
 You'll find some useful examples [here](https://github.com/kubernetes/examples/tree/master/staging/volumes/vsphere) to test your configuration.

docs/cloud_providers/cloud.md

@@ -11,5 +11,5 @@ You can deploy instances in your cloud environment in several ways. Examples inc
 With ansible-playbook command
 
 ```ShellSession
-ansible-playbook -u smana -e ansible_ssh_user=admin -e cloud_provider=[aws|gce] -b --become-user=root -i inventory/single.cfg cluster.yml
+ansible-playbook -u smana -e ansible_ssh_user=admin -e cloud_provider=[aws|gce] -b --become-user=root -i inventory/sample/inventory.ini cluster.yml
 ```

docs/developers/ci.md

@@ -11,10 +11,8 @@ amazon |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | :x: | :white_check_mark: |
 debian12 |  :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
 debian13 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
-fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
+fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora40 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
@@ -31,10 +29,8 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :white_check_mark: | :x: | :x: | :x: |
-fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
@@ -51,10 +47,8 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora39 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora41 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |

docs/getting_started/getting-started.md

@@ -15,16 +15,15 @@ and [details on the inventory structure expected by Kubespray](/docs/ansible/inv
 <your-favorite-editor> inventory/mycluster/inventory.ini
 
 # Review and change parameters under ``inventory/mycluster/group_vars``
-<your-favorite-editor> inventory/mycluster/group_vars/all.yml # for every node, including etcd
+<your-favorite-editor> inventory/mycluster/group_vars/all/all.yml # for every node, including etcd
-<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster.yml # for every node in the cluster (not etcd when it's separate)
+<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml # for every node in the cluster (not etcd when it's separate)
-<your-favorite-editor> inventory/mycluster/group_vars/kube_control_plane.yml # for the control plane
+<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster/kube_control_plane.yml # for the control plane
-<your-favorite-editor> inventory/myclsuter/group_vars/kube_node.yml # for worker nodes
 ```
 
 ## Installing the cluster
 
 ```ShellSession
-ansible-playbook -i inventory/mycluster/ cluster.yml -b -v \
+ansible-playbook -i inventory/mycluster/inventory.ini cluster.yml -b -v \
   --private-key=~/.ssh/private_key
 ```
 
@@ -36,7 +35,7 @@ You may want to add worker, control plane or etcd nodes to your existing cluster
 - Run the ansible-playbook command, substituting `cluster.yml` for `scale.yml`:
 
 ```ShellSession
-ansible-playbook -i inventory/mycluster/hosts.yml scale.yml -b -v \
+ansible-playbook -i inventory/mycluster/inventory.ini scale.yml -b -v \
   --private-key=~/.ssh/private_key
 ```
 
@@ -54,7 +53,7 @@ is not working, you can remove the node and install it again.
 Use `--extra-vars "node=<nodename>,<nodename2>"` to select the node(s) you want to delete.
 
 ```ShellSession
-ansible-playbook -i inventory/mycluster/hosts.yml remove-node.yml -b -v \
+ansible-playbook -i inventory/mycluster/inventory.ini remove-node.yml -b -v \
 --private-key=~/.ssh/private_key \
 --extra-vars "node=nodename,nodename2"
 ```
@@ -87,7 +86,7 @@ the Kubernetes [documentation](https://kubernetes.io/docs/tasks/access-applicati
 
 The main client of Kubernetes is `kubectl`. It is installed on each kube_control_plane
 host and can optionally be configured on your ansible host by setting
-`kubectl_localhost: true` and `kubeconfig_localhost: true` in the configuration:
+`kubectl_localhost: true` and `kubeconfig_localhost: true` in `inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml`:
 
 - If `kubectl_localhost` enabled, `kubectl` will download onto `/usr/local/bin/` and setup with bash completion. A helper script `inventory/mycluster/artifacts/kubectl.sh` also created for setup with below `admin.conf`.
 - If `kubeconfig_localhost` enabled `admin.conf` will appear in the `inventory/mycluster/artifacts/` directory after deployment.

docs/getting_started/setting-up-your-first-cluster.md

@@ -223,7 +223,7 @@ that controller-0, controller-1 and controller-2 in the `kube_control_plane` gro
 worker-0, worker-1 and worker-2 in the `kube_node` group. Add respective `ip` to the respective local VPC IP for each node.
 
 The main configuration for the cluster is stored in
-`inventory/mycluster/group_vars/k8s_cluster/k8s_cluster.yml`. In this file we
+`inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml`. In this file we
  will update the `supplementary_addresses_in_ssl_keys` with a list of the IP
  addresses of the controller nodes. In that way we can access the
   kubernetes API server as an administrator from outside the VPC network. You
@@ -240,7 +240,7 @@ the kubernetes cluster, just change the 'false' to 'true' for
 Now we will deploy the configuration:
 
 ```ShellSession
-ansible-playbook -i inventory/mycluster/ -u $USERNAME -b -v --private-key=~/.ssh/id_rsa cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -u $USERNAME -b -v --private-key=~/.ssh/id_rsa cluster.yml
 ```
 
 Ansible will now execute the playbook, this can take up to 20 minutes.
@@ -594,7 +594,7 @@ If you want to keep the VMs and just remove the cluster state, you can simply
  run another Ansible playbook:
 
 ```ShellSession
-ansible-playbook -i inventory/mycluster/ -u $USERNAME -b -v --private-key=~/.ssh/id_rsa reset.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -u $USERNAME -b -v --private-key=~/.ssh/id_rsa reset.yml
 ```
 
 Resetting the cluster to the VMs original state usually takes about a couple

docs/ingress/kube-vip.md

@@ -86,3 +86,12 @@ kube_vip_leaseduration: 30
 kube_vip_renewdeadline: 20
 kube_vip_retryperiod: 4
 ```
+
+To expose [Prometheus metrics](https://kube-vip.io/docs/installation/flags/#environment-variables) from the kube-vip static pod, set `kube_vip_metrics_enabled`. `kube_vip_metrics_port` is an integer; the manifest sets `prometheus_server` to `:PORT` because kube-vip passes that value to Go's HTTP listen address (see [`servePrometheusHTTPServer` in kube-vip](https://github.com/kube-vip/kube-vip/blob/main/cmd/kube-vip.go)). The manifest `ports` entry uses the same number for tooling that reads the pod spec.
+
+Kubespray defaults `kube_vip_metrics_port` to `2112`, matching upstream kube-vip's `--prometheusHTTPServer` default. Override it if your scrape config expects another port.
+
+```yaml
+kube_vip_metrics_enabled: true
+# kube_vip_metrics_port: 2112
+```

docs/operating_systems/rhel.md

@@ -35,6 +35,6 @@ If the RHEL hosts are already registered to a valid Red Hat support subscription
 
 (Experimental in Kubespray CI)
 
-The official Rocky Linux 10 cloud image does not include `kernel-module-extra`. Both Kube Proxy and CNI rely on this package, and since it relates to kernel version compatibility (which may require VM reboots, etc.), we haven't found an ideal solution.
+The official Rocky Linux 10 cloud image does not include `kernel-modules-extra`. Both Kube Proxy and CNI rely on this package, and since it relates to kernel version compatibility (which may require VM reboots, etc.), we haven't found an ideal solution.
 
 However, some users report that it doesn't affect them (minimal version). Therefore, the Kubespray CI Rocky Linux 10 image is built by Kubespray maintainers using `diskimage-builder`. For detailed methods, please refer to [the comments](https://github.com/kubernetes-sigs/kubespray/pull/12355#issuecomment-3705400093).

docs/operations/upgrades.md

@@ -26,13 +26,13 @@ If you wanted to upgrade just kube_version from v1.18.10 to v1.19.7, you could
 deploy the following way:
 
 ```ShellSession
-ansible-playbook cluster.yml -i inventory/sample/hosts.ini -e kube_version=1.18.10 -e upgrade_cluster_setup=true
+ansible-playbook cluster.yml -i inventory/sample/inventory.ini -e kube_version=1.18.10 -e upgrade_cluster_setup=true
 ```
 
 And then repeat with 1.19.7 as kube_version:
 
 ```ShellSession
-ansible-playbook cluster.yml -i inventory/sample/hosts.ini -e kube_version=1.19.7 -e upgrade_cluster_setup=true
+ansible-playbook cluster.yml -i inventory/sample/inventory.ini -e kube_version=1.19.7 -e upgrade_cluster_setup=true
 ```
 
 The var ```-e upgrade_cluster_setup=true``` is needed to be set in order to migrate the deploys of e.g kube-apiserver inside the cluster immediately which is usually only done in the graceful upgrade. (Refer to [#4139](https://github.com/kubernetes-sigs/kubespray/issues/4139) and [#4736](https://github.com/kubernetes-sigs/kubespray/issues/4736))
@@ -46,7 +46,7 @@ existing cluster. That means there must be at least 1 kube_control_plane already
 deployed.
 
 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.19.7
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.19.7
 ```
 
 After a successful upgrade, the Server Version should be updated:
@@ -60,7 +60,7 @@ Server Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.7", GitCom
 You can control how many nodes are upgraded at the same time by modifying the ansible variable named `serial`, as explained [here](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_strategies.html#setting-the-batch-size-with-serial). If you don't set this variable, it will upgrade the cluster nodes in batches of  20% of the available nodes. Setting `serial=1` would mean upgrade one node at a time.
 
 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 -e "serial=1"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 -e "serial=1"
 ```
 
 ### Pausing the upgrade
@@ -82,20 +82,20 @@ If you don't want to upgrade all nodes in one run, you can use `--limit` [patter
 Before using `--limit` run playbook `facts.yml` without the limit to refresh facts cache for all nodes:
 
 ```ShellSession
-ansible-playbook playbooks/facts.yml -b -i inventory/sample/hosts.ini
+ansible-playbook playbooks/facts.yml -b -i inventory/sample/inventory.ini
 ```
 
 After this upgrade control plane and etcd groups [#5147](https://github.com/kubernetes-sigs/kubespray/issues/5147):
 
 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "kube_control_plane:etcd"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "kube_control_plane:etcd"
 ```
 
 Now you can upgrade other nodes in any order and quantity:
 
 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "node4:node6:node7:node12"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "node4:node6:node7:node12"
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "node5*"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "node5*"
 ```
 
 ## Multiple upgrades
@@ -122,9 +122,9 @@ v2.24.0
 v2.22.0 -> v2.23.2 -> v2.24.0 : ✓
 v.22.0 -> v2.24.0 : ✕
 
-Assuming you don't explicitly define a kubernetes version in your k8s_cluster.yml, you simply check out the next tag and run the upgrade-cluster.yml playbook
+Assuming you don't explicitly define a kubernetes version in your group_vars/k8s_cluster/k8s-cluster.yml, you simply check out the next tag and run the upgrade-cluster.yml playbook
 
-* If you do define kubernetes version in your inventory (e.g. group_vars/k8s_cluster.yml) then either make sure to update it before running upgrade-cluster, or specify the new version you're upgrading to: `ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml -e kube_version=1.11.3`
+* If you do define kubernetes version in your inventory (e.g. group_vars/k8s_cluster/k8s-cluster.yml) then either make sure to update it before running upgrade-cluster, or specify the new version you're upgrading to: `ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml -e kube_version=1.11.3`
 
   Otherwise, the upgrade will leave your cluster at the same k8s version defined in your inventory vars.
 
@@ -155,7 +155,7 @@ HEAD is now at 05dabb7e Fix Bionic networking restart error #3430 (#3431)
 
 # NOTE: May need to `pip3 install -r requirements.txt` when upgrading.
 
-ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 
 ...
 
@@ -178,7 +178,7 @@ Some deprecations between versions that mean you can't just upgrade straight fro
 In this case, I set "kubeadm_enabled" to false, knowing that it is deprecated and removed by 2.9.0, to delay converting the cluster to kubeadm as long as I could.
 
 ```ShellSession
-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
     "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -196,7 +196,7 @@ $ git checkout v2.8.1
 Previous HEAD position was 9051aa52 Fix ubuntu-contiv test failed (#3808)
 HEAD is now at 2ac1c756 More Feature/2.8 backports for 2.8.1 (#3911)
 
-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
     "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -214,7 +214,7 @@ $ git checkout v2.8.2
 Previous HEAD position was 2ac1c756 More Feature/2.8 backports for 2.8.1 (#3911)
 HEAD is now at 4167807f Upgrade to 1.12.5 (#4066)
 
-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
     "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -232,7 +232,7 @@ $ git checkout v2.8.3
 Previous HEAD position was 4167807f Upgrade to 1.12.5 (#4066)
 HEAD is now at ea41fc5e backport cve-2019-5736 to release-2.8 (#4234)
 
-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
     "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -250,7 +250,7 @@ $ git checkout v2.8.4
 Previous HEAD position was ea41fc5e backport cve-2019-5736 to release-2.8 (#4234)
 HEAD is now at 3901480b go to k8s 1.12.7 (#4400)
 
-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
     "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -268,7 +268,7 @@ $ git checkout v2.8.5
 Previous HEAD position was 3901480b go to k8s 1.12.7 (#4400)
 HEAD is now at 6f97687d Release 2.8 robust san handling (#4478)
 
-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
     "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -288,14 +288,14 @@ HEAD is now at a4e65c7c Upgrade to Ansible >2.7.0 (#4471)
 ```
 
 > **Warning**
-> IMPORTANT: Some variable formats changed in the k8s_cluster.yml between 2.8.5 and 2.9.0
+> IMPORTANT: Some variable formats changed in the group_vars/k8s_cluster/k8s-cluster.yml between 2.8.5 and 2.9.0
 
 If you do not keep your inventory copy up to date, **your upgrade will fail** and your first master will be left non-functional until fixed and re-run.
 
 It is at this point the cluster was upgraded from non-kubeadm to kubeadm as per the deprecation warning.
 
 ```ShellSession
-ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 
 ...
 
@@ -320,7 +320,7 @@ $ git checkout v2.10.0
 Previous HEAD position was a4e65c7c Upgrade to Ansible >2.7.0 (#4471)
 HEAD is now at dcd9c950 Add etcd role dependency on kube user to avoid etcd role failure when running scale.yml with a fresh node. (#3240) (#4479)
 
-ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 
 ...
 
@@ -372,49 +372,49 @@ hosts.
 Upgrade docker:
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=docker
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=docker
 ```
 
 Upgrade etcd:
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=etcd
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=etcd
 ```
 
 Upgrade etcd without rotating etcd certs:
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=etcd --limit=etcd --skip-tags=etcd-secrets
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=etcd --limit=etcd --skip-tags=etcd-secrets
 ```
 
 Upgrade kubelet:
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=node --skip-tags=k8s-gen-certs
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=node --skip-tags=k8s-gen-certs
 ```
 
 Upgrade Kubernetes master components:
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=master
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=master
 ```
 
 Upgrade network plugins:
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=network
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=network
 ```
 
 Upgrade all add-ons:
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=apps
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=apps
 ```
 
 Upgrade just helm (assuming `helm_enabled` is true):
 
 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=helm
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=helm
 ```
 
 ## Migrate from Docker to Containerd
@@ -430,10 +430,12 @@ As of Kubespray 2.18.0, containerd is already the default container engine. If y
 If you want to upgrade the APT or YUM packages while the nodes are cordoned, you can use:
 
 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e system_upgrade=true
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e system_upgrade=true
 ```
 
 Nodes will be rebooted when there are package upgrades (`system_upgrade_reboot: on-upgrade`).
 This can be changed to `always` or `never`.
 
 Note: Downloads will happen twice unless `system_upgrade_reboot` is `never`.
+
+Debian based nodes can be cleaned of packages to reduce disk space usage with `system_upgrade_autoclean: true`

docs/upgrades/migrate_docker2containerd.md

@@ -28,11 +28,11 @@ Everything done here requires full root access to every node.
 Before you begin, adjust your inventory:
 
 ```yaml
-# Filename: k8s_cluster/k8s-cluster.yml
+# Filename: group_vars/k8s_cluster/k8s-cluster.yml
 resolvconf_mode: host_resolvconf
 container_manager: containerd
 
-# Filename: etcd.yml
+# Filename: group_vars/all/etcd.yml
 etcd_deployment_type: host
 ```
 
@@ -66,7 +66,7 @@ apt-get install pigz
 ### 5) Run `cluster.yml` playbook with `--limit`
 
 ```commandline
-ansible-playbook -i inventory/sample/hosts.ini cluster.yml --limit=NODENAME
+ansible-playbook -i inventory/sample/inventory.ini cluster.yml --limit=NODENAME
 ```
 
 This effectively reinstalls containerd and seems to place all config files in the right place. When this completes, kubelet will immediately pick up the new container engine and start spinning up DaemonSets and kube-system Pods.

galaxy.yml

@@ -2,7 +2,7 @@
 namespace: kubernetes_sigs
 description: Deploy a production ready Kubernetes cluster
 name: kubespray
-version: 2.31.0
+version: 2.32.0
 readme: README.md
 authors:
   - The Kubespray maintainers (https://kubernetes.slack.com/channels/kubespray)

inventory/sample/group_vars/all/offline.yml

@@ -71,7 +71,7 @@
 # skopeo_download_url: "{{ files_repo }}/github.com/lework/skopeo-binary/releases/download/v{{ skopeo_version }}/skopeo-linux-{{ image_arch }}"
 
 # [Optional] containerd: only if you set container_runtime: containerd
-# containerd_download_url: "{{ files_repo }}/github.com/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
+# containerd_download_url: "{{ files_repo }}/github.com/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ 'static-' if containerd_static_binary }}{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
 # nerdctl_download_url: "{{ files_repo }}/github.com/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
 
 # [Optional] runsc,containerd-shim-runsc: only if you set gvisor_enabled: true

inventory/sample/group_vars/all/openstack.yml

@@ -42,13 +42,13 @@
 
 ## Tags for the Cinder CSI images
 ## registry.k8s.io/sig-storage/csi-attacher
-# cinder_csi_attacher_image_tag: "v4.4.2"
+# cinder_csi_attacher_image_tag: "v4.5.1"
 ## registry.k8s.io/sig-storage/csi-provisioner
-# cinder_csi_provisioner_image_tag: "v3.6.2"
+# cinder_csi_provisioner_image_tag: "v4.0.1"
 ## registry.k8s.io/sig-storage/csi-snapshotter
-# cinder_csi_snapshotter_image_tag: "v6.3.2"
+# cinder_csi_snapshotter_image_tag: "v7.0.2"
 ## registry.k8s.io/sig-storage/csi-resizer
-# cinder_csi_resizer_image_tag: "v1.9.2"
+# cinder_csi_resizer_image_tag: "v1.10.1"
 ## registry.k8s.io/sig-storage/livenessprobe
 # cinder_csi_livenessprobe_image_tag: "v2.11.0"
 

inventory/sample/group_vars/k8s_cluster/addons.yml

@@ -201,6 +201,8 @@ kube_vip_enabled: false
 # kube_vip_lb_fwdmethod: local
 # kube_vip_bgp_sourceip:
 # kube_vip_bgp_sourceif:
+# kube_vip_metrics_enabled: false
+# kube_vip_metrics_port: 2112
 
 # Node Feature Discovery
 node_feature_discovery_enabled: false

inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml

@@ -293,7 +293,6 @@ default_kubelet_config_dir: "{{ kube_config_dir }}/dynamic_kubelet_dir"
 ## Eviction Thresholds to avoid system OOMs
 # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
 # eviction_hard: {}
-# eviction_hard_control_plane: {}
 
 # An alternative flexvolume plugin directory
 # kubelet_flexvolumes_plugins_dir: /usr/libexec/kubernetes/kubelet-plugins/volume/exec

inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml

@@ -30,6 +30,14 @@
 ## Helm repository URL
 # custom_cni_chart_repository_url: ""
 #
+## Helm repository username, if authentication is required
+## Username and password must be defined together
+# custom_cni_chart_repository_username: "<helm_repository_username>"
+#
+## Helm repository password, if authentication is required
+## Store sensitive values securely, for example using Ansible Vault
+# custom_cni_chart_repository_password: "<helm_repository_password>"
+#
 ## Helm chart reference - path to the chart in the repository
 # custom_cni_chart_ref: ""
 #

pipeline.Dockerfile

@@ -46,8 +46,8 @@ ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
 RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
     && pip install --break-system-packages --ignore-installed --no-compile --no-cache-dir pip -U \
     && pip install --break-system-packages --no-compile --no-cache-dir -r tests/requirements.txt \
-    && curl -L https://dl.k8s.io/release/v1.35.4/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
+    && curl -L https://dl.k8s.io/release/v1.36.3/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
-    && echo $(curl -L https://dl.k8s.io/release/v1.35.4/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
+    && echo $(curl -L https://dl.k8s.io/release/v1.36.3/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
     && chmod a+x /usr/local/bin/kubectl \
     # Install Vagrant
     && curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
@@ -55,5 +55,5 @@ RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
     && rm vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
     && vagrant plugin install vagrant-libvirt \
     # Install Kubernetes collections
-    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes \
+    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes==35.0.0 \
-    && ansible-galaxy collection install kubernetes.core
+    && ansible-galaxy collection install kubernetes.core:==6.4.0

playbooks/ansible_version.yml

@@ -21,13 +21,6 @@
     - name: "Check that python netaddr is installed"
       assert:
         msg: "Python netaddr is not present"
-        that: "'127.0.0.1' | ansible.utils.ipaddr"
+        that: "'127.0.0.1' | ansible.utils.ipaddr == '127.0.0.1'"
-      tags:
-        - check
-
-    - name: "Check that jinja is not too old (install via pip)"
-      assert:
-        msg: "Your Jinja version is too old, install via pip"
-        that: "{% set test %}It works{% endset %}{{ test == 'It works' }}"
       tags:
         - check

plugins/modules/kube.py

@@ -325,9 +325,8 @@ def main():
             log_level=dict(default=0, type='int'),
             state=dict(default='present', choices=['present', 'absent', 'latest', 'reloaded', 'stopped', 'exists']),
             recursive=dict(default=False, type='bool'),
-            ),
+        ),
-            mutually_exclusive=[['filename', 'list']]
+    )
-        )
 
     changed = False
 

requirements.txt

@@ -1,7 +1,11 @@
 ansible==11.13.0
+# Prevented passlib version conflicts
+bcrypt<6
 # Needed for community.crypto module
-cryptography==46.0.7
+cryptography==50.0.0
 # Needed for jinja2 json_query templating
 jmespath==1.1.0
 # Needed for ansible.utils.ipaddr
 netaddr==1.3.0
+# Needed for encrypt hash
+passlib==1.7.4

roles/bootstrap_os/tasks/centos.yml

@@ -6,7 +6,7 @@
 
 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
   community.general.ini_file:
-    path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
+    path: "{{ ((ansible_facts['distribution_major_version'] | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
     section: main
     option: proxy
     value: "{{ http_proxy | default(omit) }}"
@@ -20,28 +20,28 @@
 
 - name: Install EPEL for Oracle Linux repo package
   package:
-    name: "oracle-epel-release-el{{ ansible_distribution_major_version }}"
+    name: "oracle-epel-release-el{{ ansible_facts['distribution_major_version'] }}"
     state: present
   when:
     - use_oracle_public_repo
     - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_distribution_version | float) >= 7.6
+    - (ansible_facts['distribution_version'] | float) >= 7.6
 
 - name: Enable Oracle Linux repo
   community.general.ini_file:
-    dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_distribution_major_version }}.repo"
+    dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_facts['distribution_major_version'] }}.repo"
-    section: "ol{{ ansible_distribution_major_version }}_addons"
+    section: "ol{{ ansible_facts['distribution_major_version'] }}_addons"
     option: "{{ item.option }}"
     value: "{{ item.value }}"
     mode: "0644"
   with_items:
-    - { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
+    - { option: "name", value: "ol{{ ansible_facts['distribution_major_version'] }}_addons" }
     - { option: "enabled", value: "1" }
-    - { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_distribution_major_version }}/addons/$basearch/" }
+    - { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_facts['distribution_major_version'] }}/addons/$basearch/" }
   when:
     - use_oracle_public_repo
     - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_distribution_version | float) >= 7.6
+    - (ansible_facts['distribution_version'] | float) >= 7.6
 
 - name: Enable Centos extra repo for Oracle Linux
   community.general.ini_file:
@@ -51,15 +51,15 @@
     value: "{{ item.value }}"
     mode: "0644"
   with_items:
-    - { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" }
+    - { option: "name", value: "CentOS-{{ ansible_facts['distribution_major_version'] }} - Extras" }
     - { option: "enabled", value: "1" }
     - { option: "gpgcheck", value: "0" }
-    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_distribution_major_version }}/extras/$basearch/os/" }
+    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_facts['distribution_major_version'] }}/extras/$basearch/os/" }
   when:
     - use_oracle_public_repo
     - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_distribution_version | float) >= 7.6
+    - (ansible_facts['distribution_version'] | float) >= 7.6
-    - (ansible_distribution_version | float) < 9
+    - (ansible_facts['distribution_version'] | float) < 9
 
 # CentOS ships with python installed
 

roles/bootstrap_os/tasks/rhel.yml

@@ -6,7 +6,7 @@
 
 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
   community.general.ini_file:
-    path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
+    path: "{{ ((ansible_facts['distribution_major_version'] | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
     section: main
     option: proxy
     value: "{{ http_proxy | default(omit) }}"
@@ -71,7 +71,7 @@
       - "rhel-8-for-*-appstream-rpms"
     state: "{{ 'enabled' if (rhel_enable_repos | bool) else 'disabled' }}"
   when:
-    - ansible_distribution_major_version == "8"
+    - ansible_facts['distribution_major_version'] == "8"
     - (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)
 
 - name: Check presence of fastestmirror.conf

roles/container-engine/containerd-common/tasks/main.yml

@@ -15,14 +15,14 @@
   include_vars: "{{ item }}"
   with_first_found:
     - files:
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_os_family | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_os_family | lower }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}.yml"
         - defaults.yml
       paths:
         - ../vars

roles/container-engine/containerd/templates/config.toml.j2

@@ -1,4 +1,8 @@
+{% if containerd_version is version('2.3.0', '>=') %}
+version = 4
+{% else %}
 version = 3
+{% endif %}
 
 root = "{{ containerd_storage_dir }}"
 state = "{{ containerd_state_dir }}"

roles/container-engine/cri-o/defaults/main.yml

@@ -31,7 +31,7 @@ crio_registry_auth: []
 
 crio_seccomp_profile: ""
 crio_selinux: "{{ (preinstall_selinux_state == 'enforcing') | lower }}"
-crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
+crio_signature_policy: "{% if ansible_facts['os_family'] == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
 # Set the pull progress timeout
 crio_pull_progress_timeout: "10s"
 

roles/container-engine/cri-o/tasks/main.yaml

@@ -28,7 +28,7 @@
 
 - name: Cri-o | special handling for amazon linux
   import_tasks: "setup-amazon.yaml"
-  when: ansible_distribution in ["Amazon"]
+  when: ansible_facts['distribution'] in ["Amazon"]
 
 - name: Cri-o | build a list of crio runtimes with Katacontainers runtimes
   set_fact:
@@ -150,7 +150,7 @@
   copy:
     src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
     dest: /etc/systemd/system/crio.service
-    mode: "0755"
+    mode: "0644"
     remote_src: true
   notify: Restart crio
 
@@ -189,7 +189,7 @@
     dest: /etc/containers/mounts.conf
     mode: "0644"
   when:
-    - ansible_os_family == 'RedHat'
+    - ansible_facts['os_family'] == 'RedHat'
   notify: Restart crio
 
 - name: Cri-o | create directory for oci hooks
@@ -220,7 +220,9 @@
     dest: /etc/containers/storage.conf
     section: storage.options.overlay
     option: mountopt
-    value: '{{ ''"nodev"'' if ansible_kernel is version(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
+    value: >-
+      {{ '"nodev"' if ansible_facts['kernel'] is version(('4.18' if ansible_facts['os_family'] == 'RedHat' else '4.19'), '<')
+      else '"nodev,metacopy=on"' }}
     mode: "0644"
 
 - name: Cri-o | create directory registries configs

roles/container-engine/cri-o/tasks/reset.yml

@@ -4,8 +4,8 @@
 
 - name: CRI-O | Kubic repo name for debian os family
   set_fact:
-    crio_kubic_debian_repo_name: "{{ ((ansible_distribution == 'Ubuntu') | ternary('x', '')) ~ ansible_distribution ~ '_' ~ ansible_distribution_version }}"
+    crio_kubic_debian_repo_name: "{{ ((ansible_facts['distribution'] == 'Ubuntu') | ternary('x', '')) ~ ansible_facts['distribution'] ~ '_' ~ ansible_facts['distribution_version'] }}"
-  when: ansible_os_family == "Debian"
+  when: ansible_facts['os_family'] == "Debian"
   tags:
     - reset_crio
 
@@ -30,7 +30,7 @@
   yum_repository:
     name: devel_kubic_libcontainers_stable
     state: absent
-  when: ansible_distribution in ["Amazon"]
+  when: ansible_facts['distribution'] in ["Amazon"]
   tags:
     - reset_crio
 
@@ -39,15 +39,15 @@
     name: "devel_kubic_libcontainers_stable_cri-o_v{{ crio_version }}"
     state: absent
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
-    - ansible_distribution not in ["Amazon", "Fedora"]
+    - ansible_facts['distribution'] not in ["Amazon", "Fedora"]
   tags:
     - reset_crio
 
 - name: CRI-O | Run yum-clean-metadata
   command: yum clean metadata
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
   tags:
     - reset_crio
 

roles/container-engine/docker/defaults/main.yml

@@ -49,11 +49,11 @@ containerd_package_info:
   pkgs:
 
 # Fedora docker-ce repo
-docker_fedora_repo_base_url: 'https://download.docker.com/linux/fedora/{{ ansible_distribution_major_version }}/$basearch/stable'
+docker_fedora_repo_base_url: 'https://download.docker.com/linux/fedora/{{ ansible_facts["distribution_major_version"] }}/$basearch/stable'
 docker_fedora_repo_gpgkey: 'https://download.docker.com/linux/fedora/gpg'
 
 # CentOS/RedHat docker-ce repo
-docker_rh_repo_base_url: 'https://download.docker.com/linux/rhel/{{ ansible_distribution_major_version }}/$basearch/stable'
+docker_rh_repo_base_url: 'https://download.docker.com/linux/rhel/{{ ansible_facts["distribution_major_version"] }}/$basearch/stable'
 docker_rh_repo_gpgkey: 'https://download.docker.com/linux/rhel/gpg'
 
 # Ubuntu docker-ce repo

roles/container-engine/docker/handlers/main.yml

@@ -10,7 +10,7 @@
   service:
     name: docker.socket
     state: restarted
-  when: ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] or is_fedora_coreos
+  when: ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] or is_fedora_coreos
   listen: Restart docker
 
 

roles/container-engine/docker/tasks/main.yml

@@ -15,16 +15,16 @@
   include_vars: "{{ item }}"
   with_first_found:
     - files:
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_distribution.split(' ')[0] | lower }}.yml"
+        - "{{ ansible_facts['distribution'].split(' ')[0] | lower }}.yml"
-        - "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_os_family | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_os_family | lower }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}.yml"
         - defaults.yml
       paths:
         - ../vars
@@ -35,7 +35,7 @@
 - name: Warn about Docker version on SUSE
   debug:
     msg: "SUSE distributions always install Docker from the distro repos"
-  when: ansible_pkg_mgr == 'zypper'
+  when: ansible_facts['pkg_mgr'] == 'zypper'
 
 - name: Gather DNS facts
   include_tasks: set_facts_dns.yml
@@ -58,33 +58,33 @@
   delay: "{{ retry_stagger }}"
   with_items: "{{ docker_repo_key_info.repo_keys }}"
   environment: "{{ proxy_env }}"
-  when: ansible_pkg_mgr == 'apt'
+  when: ansible_facts['pkg_mgr'] == 'apt'
 
 # ref to https://github.com/kubernetes-sigs/kubespray/issues/11086 & 12424
 - name: Convert -backports sources to archive.debian.org for bullseye and older
   replace:
     path: "{{ item }}"
-    regexp: '^(deb(?:-src)?\s+)(?:https?://)?(?:[^ ]+debian\.org)?([^ ]*/debian)(\s+{{ ansible_distribution_release }}-backports\b.*)'
+    regexp: '^(deb(?:-src)?\s+)(?:https?://)?(?:[^ ]+debian\.org)?([^ ]*/debian)(\s+{{ ansible_facts["distribution_release"] }}-backports\b.*)'
     replace: '\1http://archive.debian.org/debian\3'
     backup: true
   loop: "{{ query('fileglob', '/etc/apt/sources.list') }}"
   when:
-    - ansible_os_family == 'Debian'
+    - ansible_facts['os_family'] == 'Debian'
-    - ansible_distribution_release in ['bullseye', 'buster']
+    - ansible_facts['distribution_release'] in ['bullseye', 'buster']
 
 - name: Ensure docker-ce repository is enabled
   apt_repository:
     repo: "{{ item }}"
     state: present
   with_items: "{{ docker_repo_info.repos }}"
-  when: ansible_pkg_mgr == 'apt'
+  when: ansible_facts['pkg_mgr'] == 'apt'
 
 - name: Configure docker repository on Fedora
   template:
     src: "fedora_docker.repo.j2"
     dest: "{{ yum_repo_dir }}/docker.repo"
     mode: "0644"
-  when: ansible_distribution == "Fedora" and not is_ostree
+  when: ansible_facts['distribution'] == "Fedora" and not is_ostree
 
 - name: Configure docker repository on RedHat/CentOS/OracleLinux/AlmaLinux/KylinLinux
   template:
@@ -92,15 +92,15 @@
     dest: "{{ yum_repo_dir }}/docker-ce.repo"
     mode: "0644"
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
-    - ansible_distribution != "Fedora"
+    - ansible_facts['distribution'] != "Fedora"
     - not is_ostree
 
 - name: Remove dpkg hold
   dpkg_selections:
     name: "{{ item }}"
     selection: install
-  when: ansible_pkg_mgr == 'apt'
+  when: ansible_facts['pkg_mgr'] == 'apt'
   register: ret
   changed_when: false
   failed_when:
@@ -131,7 +131,7 @@
   delay: "{{ retry_stagger }}"
   notify: Restart docker
   when:
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
     - not is_ostree
     - docker_package_info.pkgs | length > 0
 
@@ -140,7 +140,7 @@
   dpkg_selections:
     name: "{{ item }}"
     selection: hold
-  when: ansible_pkg_mgr == 'apt'
+  when: ansible_facts['pkg_mgr'] == 'apt'
   changed_when: false
   with_items:
     - "{{ containerd_package }}"

roles/container-engine/docker/tasks/pre-upgrade.yml

@@ -4,7 +4,7 @@
     path: "{{ yum_repo_dir }}/docker.repo"
     state: absent
   when:
-    - ansible_os_family == 'RedHat'
+    - ansible_facts['os_family'] == 'RedHat'
     - not is_ostree
 
 - name: Ensure old versions of Docker are not installed. | Debian
@@ -12,7 +12,7 @@
     name: '{{ docker_remove_packages_apt }}'
     state: absent
   when:
-    - ansible_os_family == 'Debian'
+    - ansible_facts['os_family'] == 'Debian'
     - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
 
 
@@ -21,7 +21,7 @@
     name: '{{ podman_remove_packages_yum }}'
     state: absent
   when:
-    - ansible_os_family == 'RedHat'
+    - ansible_facts['os_family'] == 'RedHat'
     - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
     - not is_ostree
 
@@ -31,6 +31,6 @@
     name: '{{ docker_remove_packages_yum }}'
     state: absent
   when:
-    - ansible_os_family == 'RedHat'
+    - ansible_facts['os_family'] == 'RedHat'
     - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
     - not is_ostree

roles/container-engine/docker/tasks/reset.yml

@@ -46,7 +46,7 @@
   dpkg_selections:
     name: "{{ item }}"
     selection: install
-  when: ansible_pkg_mgr == 'apt'
+  when: ansible_facts['pkg_mgr'] == 'apt'
   changed_when: false
   with_items:
     - "{{ docker_packages_list }}"
@@ -61,7 +61,7 @@
     - "{{ docker_packages_list }}"
     - "{{ containerd_package }}"
   when:
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
     - not is_ostree
     - docker_packages_list | length > 0
 
@@ -70,21 +70,21 @@
     repo: "{{ item }}"
     state: absent
   with_items: "{{ docker_repo_info.repos }}"
-  when: ansible_pkg_mgr == 'apt'
+  when: ansible_facts['pkg_mgr'] == 'apt'
 
 - name: Docker | Remove docker repository on Fedora
   file:
     name: "{{ yum_repo_dir }}/docker.repo"
     state: absent
-  when: ansible_distribution == "Fedora" and not is_ostree
+  when: ansible_facts['distribution'] == "Fedora" and not is_ostree
 
 - name: Docker | Remove docker repository on RedHat/CentOS/Oracle/AlmaLinux Linux
   file:
     name: "{{ yum_repo_dir }}/docker-ce.repo"
     state: absent
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
-    - ansible_distribution != "Fedora"
+    - ansible_facts['distribution'] != "Fedora"
     - not is_ostree
 
 - name: Docker | Remove docker configuration files

roles/container-engine/docker/tasks/systemd.yml

@@ -21,7 +21,7 @@
   register: docker_service_file
   notify: Restart docker
   when:
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
     - not is_fedora_coreos
 
 - name: Write docker options systemd drop-in

roles/container-engine/docker/templates/docker-options.conf.j2

@@ -4,7 +4,7 @@ Environment="DOCKER_OPTS={{ docker_options|default('') }} --iptables={{ docker_i
 {% for i in docker_insecure_registries %}--insecure-registry={{ i }} {% endfor %} \
 {% for i in docker_registry_mirrors %}--registry-mirror={{ i }} {% endfor %} \
 --data-root={{ docker_daemon_graph }} \
-{% if ansible_os_family not in ["openSUSE Leap", "openSUSE Tumbleweed", "Suse"] %}{{ docker_log_opts }}{% endif %}"
+{% if ansible_facts['os_family'] not in ["openSUSE Leap", "openSUSE Tumbleweed", "Suse"] %}{{ docker_log_opts }}{% endif %}"
 
 {% if docker_mount_flags is defined and docker_mount_flags != "" %}
 MountFlags={{ docker_mount_flags }}

roles/container-engine/docker/templates/docker.service.j2

@@ -2,7 +2,7 @@
 Description=Docker Application Container Engine
 Documentation=http://docs.docker.com
 After=network.target docker.socket containerd.service lvm2-monitor.service SuSEfirewall2.service
-{% if ansible_os_family != "Suse" %}
+{% if ansible_facts['os_family'] != "Suse" %}
 BindsTo=containerd.service
 {% endif %}
 Wants=docker.socket
@@ -17,7 +17,7 @@ ExecReload=/bin/kill -s HUP $MAINPID
 Delegate=yes
 KillMode=process
 ExecStart={{ docker_bin_dir }}/dockerd \
-{% if ansible_os_family == "Suse" %}
+{% if ansible_facts['os_family'] == "Suse" %}
           --add-runtime oci=/usr/sbin/docker-runc \
 {% endif %}
           $DOCKER_OPTS \

roles/container-engine/docker/vars/debian.yml

@@ -42,49 +42,49 @@ containerd_versioned_pkg:
 # https://download.docker.com/linux/debian/
 docker_versioned_pkg:
   'latest': docker-ce
-  '18.09': docker-ce=5:18.09.9~3-0~debian-{{ ansible_distribution_release | lower }}
+  '18.09': docker-ce=5:18.09.9~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce=5:19.03.15~3-0~debian-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce=5:19.03.15~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce=5:27.5.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce=5:28.0.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce=5:28.1.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce=5:28.1.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce=5:28.2.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce=5:28.2.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'stable': docker-ce=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'edge': docker-ce=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
-  '18.09': docker-ce-cli=5:18.09.9~3-0~debian-{{ ansible_distribution_release | lower }}
+  '18.09': docker-ce-cli=5:18.09.9~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce-cli=5:19.03.15~3-0~debian-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce-cli=5:19.03.15~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce-cli=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce-cli=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce-cli=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce-cli=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce-cli=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce-cli=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce-cli=5:27.5.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce-cli=5:28.0.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce-cli=5:28.1.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce-cli=5:28.1.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce-cli=5:28.2.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce-cli=5:28.2.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'stable': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'edge': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
 
 docker_package_info:
   pkgs:
@@ -101,5 +101,5 @@ docker_repo_info:
   repos:
     - >
       deb {{ docker_debian_repo_base_url }}
-      {{ ansible_distribution_release | lower }}
+      {{ ansible_facts['distribution_release'] | lower }}
       stable

roles/container-engine/docker/vars/fedora.yml

@@ -2,87 +2,87 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
   'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.fc{{ ansible_distribution_major_version }}"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  'stable': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  'edge': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
 
 # https://docs.docker.com/install/linux/docker-ce/fedora/
 # https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/
 docker_versioned_pkg:
   'latest': docker-ce
-  '19.03': docker-ce-19.03.15-3.fc{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-19.03.15-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-20.10.20-3.fc{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-20.10.20-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-3:26.1.4-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-3:27.0.3-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-3:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-3:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-3:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-3:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-3:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-3:28.0.4-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-3:28.1.1-1.fc{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-3:28.1.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-3:28.2.2-1.fc{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-3:28.2.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-3:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-3:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-3:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-3:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
 
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
-  '19.03': docker-ce-cli-19.03.15-3.fc{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-cli-19.03.15-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-cli-1:26.1.4-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-cli-1:27.0.3-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-cli-1:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-cli-1:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-cli-1:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-cli-1:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-cli-1:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-cli-1:28.0.4-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-cli-1:28.1.1-1.fc{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-cli-1:28.1.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-cli-1:28.2.2-1.fc{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-cli-1:28.2.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-cli-1:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-cli-1:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-cli-1:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-cli-1:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
 
 docker_package_info:
   enablerepo: "docker-ce"

roles/container-engine/docker/vars/redhat.yml

@@ -2,42 +2,42 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
   'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_distribution_major_version }}"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'stable': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'edge': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_facts['distribution_major_version'] }}"
 
 # https://docs.docker.com/engine/installation/linux/rhel/#install-from-a-package
 # https://download.docker.com/linux/rhel/<rhel_version>>/x86_64/stable/Packages/
@@ -45,46 +45,46 @@ containerd_versioned_pkg:
 docker_versioned_pkg:
   'latest': docker-ce
   '18.09': docker-ce-3:18.09.9-3.el7
-  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-3:20.10.24-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-3:20.10.24-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-3:26.1.4-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-3:27.0.3-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-3:27.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-3:27.2.1-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-3:27.3.1-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-3:27.4.1-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-3:27.5.1-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-3:28.0.4-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-3:28.1.1-1.el{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-3:28.1.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-3:28.2.2-1.el{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-3:28.2.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-3:28.3.3-1.el{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-3:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-3:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-3:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
   '18.09': docker-ce-cli-1:18.09.9-3.el7
-  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-cli-1:20.10.24-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-cli-1:20.10.24-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-cli-1:26.1.4-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-cli-1:27.0.3-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-cli-1:27.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-cli-1:27.2.1-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-cli-1:27.3.1-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-cli-1:27.4.1-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-cli-1:27.5.1-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-cli-1:28.0.4-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-cli-1:28.1.1-1.el{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-cli-1:28.1.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-cli-1:28.2.2-1.el{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-cli-1:28.2.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-cli-1:28.3.3-1.el{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-cli-1:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-cli-1:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-cli-1:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
 
 docker_package_info:
   enablerepo: "docker-ce"

roles/container-engine/docker/vars/ubuntu.yml

@@ -35,45 +35,45 @@ containerd_versioned_pkg:
 # https://download.docker.com/linux/ubuntu/
 docker_versioned_pkg:
   'latest': docker-ce
-  '18.09': docker-ce=5:18.09.9~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '18.09': docker-ce=5:18.09.9~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce=5:19.03.15~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce=5:19.03.15~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce=5:28.0.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce=5:28.1.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce=5:28.1.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce=5:28.2.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce=5:28.2.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
-  '18.09': docker-ce-cli=5:18.09.9~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '18.09': docker-ce-cli=5:18.09.9~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce-cli=5:19.03.15~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce-cli=5:19.03.15~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce-cli=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce-cli=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce-cli=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce-cli=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce-cli=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce-cli=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce-cli=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce-cli=5:28.0.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce-cli=5:28.1.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce-cli=5:28.1.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce-cli=5:28.2.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce-cli=5:28.2.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'stable': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'edge': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
 
 docker_package_info:
   pkgs:
@@ -90,5 +90,5 @@ docker_repo_info:
   repos:
     - >
       deb [arch={{ host_architecture }}] {{ docker_ubuntu_repo_base_url }}
-      {{ ansible_distribution_release | lower }}
+      {{ ansible_facts['distribution_release'] | lower }}
       stable

roles/container-engine/docker/vars/uniontech.yml

@@ -2,28 +2,28 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
   'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_distribution_major_version }}"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
 
 docker_version: 19.03
 docker_cli_version: 19.03
@@ -34,22 +34,22 @@ docker_cli_version: 19.03
 docker_versioned_pkg:
   'latest': docker-ce
   '18.09': docker-ce-3:18.09.9-3.el7
-  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-3:20.10.17-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-3:20.10.17-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
 
 docker_cli_versioned_pkg:
   'latest': docker-ce-cli
   '18.09': docker-ce-cli-1:18.09.9-3.el7
-  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-cli-1:20.10.17-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-cli-1:20.10.17-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
 
 docker_package_info:
   enablerepo: "docker-ce"

roles/container-engine/kata-containers/defaults/main.yml

@@ -3,7 +3,7 @@ kata_containers_dir: /opt/kata
 kata_containers_config_dir: /etc/kata-containers
 kata_containers_containerd_bin_dir: /usr/local/bin
 
-kata_containers_qemu_default_memory: "{{ ansible_memtotal_mb }}"
+kata_containers_qemu_default_memory: "{{ ansible_facts['memtotal_mb'] }}"
 kata_containers_qemu_debug: 'false'
 kata_containers_qemu_sandbox_cgroup_only: 'true'
 kata_containers_qemu_enable_mem_prealloc: 'false'

roles/container-engine/kata-containers/molecule/default/verify.yml

@@ -9,7 +9,7 @@
     failed_when: >
       version is failed or
       'kata-runtime' not in version.stdout
-  - name: Test version
+  - name: Test version check
     command: "/opt/kata/bin/kata-runtime check"
     register: check
     failed_when: >

roles/container-engine/runc/tasks/main.yml

@@ -14,8 +14,8 @@
 - name: Runc | Uninstall runc package managed by package manager
   when:
     - not is_ostree
-    - ansible_distribution != "Flatcar Container Linux by Kinvolk"
+    - ansible_facts['distribution'] != "Flatcar Container Linux by Kinvolk"
-    - ansible_distribution != "Flatcar"
+    - ansible_facts['distribution'] != "Flatcar"
   block:
     - name: Runc | Remove package
       package:

roles/container-engine/skopeo/tasks/main.yml

@@ -16,7 +16,7 @@
     name: skopeo
     state: absent
   when:
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
+    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
   ignore_errors: true  # noqa ignore-errors
 
 - name: Skopeo | Download skopeo binary

roles/container-engine/validate-container-engine/tasks/main.yml

@@ -76,7 +76,7 @@
   vars:
     service_name: containerd.service
   when:
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
+    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
     - container_manager != "containerd"
     - docker_installed.matched == 0
     - containerd_installed.matched > 0
@@ -104,7 +104,7 @@
   vars:
     service_name: docker.service
   when:
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
+    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
     - container_manager != "docker"
     - docker_installed.matched > 0
     - ansible_facts.services[service_name]['state'] == 'running'
@@ -130,7 +130,7 @@
   vars:
     service_name: crio.service
   when:
-    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
+    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
     - container_manager != "crio"
     - crio_installed.matched > 0
     - ansible_facts.services[service_name]['state'] == 'running'

roles/download/tasks/download_container.yml

@@ -74,7 +74,6 @@
       delegate_to: "{{ download_delegate }}"
       delegate_facts: false
       register: container_save_status
-      failed_when: container_save_status.stderr
       run_once: true
       become: "{{ user_can_become_root | default(false) or not download_localhost }}"
       when:

roles/download/tasks/main.yml

@@ -2,7 +2,7 @@
 - name: Download | Prepare working directories and variables
   import_tasks: prep_download.yml
   when:
-    - not skip_downloads | default(false)
+    - not skip_downloads
   tags:
     - download
     - upload
@@ -10,7 +10,7 @@
 - name: Download | Get kubeadm binary and list of required images
   include_tasks: prep_kubeadm_images.yml
   when:
-    - not skip_downloads | default(false)
+    - not skip_downloads
     - ('kube_control_plane' in group_names)
   tags:
     - download
@@ -23,8 +23,8 @@
     download: "{{ download_defaults | combine(item.value) }}"
     include_file: "download_{% if download.container %}container{% else %}file{% endif %}.yml"
   when:
-    - not skip_downloads | default(false)
+    - not skip_downloads
     - download.enabled
     - item.value.enabled
-    - (not (item.value.container | default(false))) or (item.value.container and download_container)
+    - (not download.container) or (download.container and download_container)
     - (download_run_once and inventory_hostname == download_delegate) or (group_names | intersect(download.groups) | length)

roles/etcd/tasks/check_certs.yml

@@ -13,6 +13,8 @@
     sync_certs: false
     gen_certs: false
     etcd_secret_changed: false
+    etcd_member_requires_sync: false
+    kubernetes_host_requires_sync: false
 
 - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
   stat:
@@ -128,7 +130,7 @@
   set_fact:
     sync_certs: true
   when:
-    - etcd_member_requires_sync | default(false) or
+    - etcd_member_requires_sync or
-      kubernetes_host_requires_sync | default(false) or
+      kubernetes_host_requires_sync or
       'gen_master_certs_True' in group_names or
       'gen_node_certs_True' in group_names

roles/etcd/tasks/configure.yml

@@ -93,7 +93,7 @@
     name: etcd-events
     state: started
     enabled: true
-  ignore_errors: "{{ etcd_events_cluster_is_healthy.rc != 0 }}"  # noqa ignore-errors
+  ignore_errors: "{{ etcd_events_cluster_is_healthy.rc == 0 }}"  # noqa ignore-errors
   when:
     - ('etcd' in group_names)
     - etcd_events_cluster_setup

roles/etcd/tasks/gen_certs_script.yml

@@ -24,7 +24,7 @@
   run_once: true
   delegate_to: "{{ groups['etcd'][0] }}"
   when:
-    - gen_certs | default(false)
+    - gen_certs
     - inventory_hostname == groups['etcd'][0]
 
 - name: Gen_certs | copy certs generation script
@@ -43,7 +43,7 @@
     HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['kube_control_plane']) | join(' ') }}"
   run_once: true
   delegate_to: "{{ groups['etcd'][0] }}"
-  when: gen_certs | default(false)
+  when: gen_certs
   notify: Set etcd_secret_changed
 
 - name: Gen_certs | run cert generation script for all clients
@@ -55,7 +55,7 @@
   when:
     - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
     - kube_network_plugin != "calico" or calico_datastore == "etcd"
-    - gen_certs | default(false)
+    - gen_certs
   notify: Set etcd_secret_changed
 
 - name: Gen_certs | Gather etcd member/admin and kube_control_plane client certs from first etcd node
@@ -78,7 +78,7 @@
   delegate_to: "{{ groups['etcd'][0] }}"
   when:
     - ('etcd' in group_names)
-    - sync_certs | default(false)
+    - sync_certs
     - inventory_hostname != groups['etcd'][0]
   notify: Set etcd_secret_changed
 
@@ -92,7 +92,7 @@
   with_items: "{{ etcd_master_certs.results }}"
   when:
     - ('etcd' in group_names)
-    - sync_certs | default(false)
+    - sync_certs
     - inventory_hostname != groups['etcd'][0]
   loop_control:
     label: "{{ item.item }}"
@@ -134,7 +134,7 @@
   include_tasks: gen_nodes_certs_script.yml
   when:
     - ('kube_control_plane' in group_names) and
-        sync_certs | default(false) and inventory_hostname not in groups['etcd']
+        sync_certs and inventory_hostname not in groups['etcd']
 
 - name: Gen_certs | Generate etcd certs on nodes if needed
   include_tasks: gen_nodes_certs_script.yml
@@ -142,7 +142,7 @@
     - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
     - kube_network_plugin != "calico" or calico_datastore == "etcd"
     - ('k8s_cluster' in group_names) and
-        sync_certs | default(false) and inventory_hostname not in groups['etcd']
+        sync_certs and inventory_hostname not in groups['etcd']
 
 # This is a hack around the fact kubeadm expect the same certs path on all kube_control_plane
 # TODO: fix certs generation to have the same file everywhere

roles/etcd/tasks/main.yml

@@ -84,7 +84,7 @@
   when:
     - ('etcd' in group_names)
     - etcd_cluster_setup
-    - etcd_secret_changed | default(false)
+    - etcd_secret_changed
 
 - name: Restart etcd-events if certs changed
   command: /bin/true
@@ -92,7 +92,7 @@
   when:
     - ('etcd' in group_names)
     - etcd_events_cluster_setup
-    - etcd_secret_changed | default(false)
+    - etcd_secret_changed
 
 # After etcd cluster is assembled, make sure that
 # initial state of the cluster is in `existing`

roles/helm-apps/tasks/main.yml

@@ -1,9 +1,11 @@
 ---
 - name: Add Helm repositories
+  environment: "{{ proxy_env }}"
   kubernetes.core.helm_repository: "{{ helm_repository_defaults | combine(item) }}"  # noqa args[module]
   loop: "{{ repositories }}"
 
 - name: Update Helm repositories
+  environment: "{{ proxy_env }}"
   kubernetes.core.helm:
     state: absent
     binary_path: "{{ bin_dir }}/helm"
@@ -15,5 +17,6 @@
     - helm_update
 
 - name: Install Helm Applications
+  environment: "{{ proxy_env }}"
   kubernetes.core.helm: "{{ helm_defaults | combine(release_common_opts, item) }}"  # noqa args[module]
   loop: "{{ releases }}"

roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2

@@ -39,8 +39,6 @@ spec:
           type: RuntimeDefault
         supplementalGroups: [ 65534 ]
         fsGroup: 65534
-      nodeSelector:
-        kubernetes.io/os: linux
       tolerations:
         - effect: NoSchedule
           key: node-role.kubernetes.io/control-plane

roles/kubernetes-apps/container_engine_accelerator/nvidia_gpu/tasks/main.yml

@@ -4,11 +4,11 @@
   include_vars: "{{ item }}"
   with_first_found:
     - files:
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_os_family | lower }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}.yml"
       skip: true
 
 - name: Container Engine Acceleration Nvidia GPU | Set fact of download url Tesla

roles/kubernetes-apps/csi_driver/cinder/defaults/main.yml

@@ -1,8 +1,8 @@
 ---
-cinder_csi_attacher_image_tag: "v4.4.2"
+cinder_csi_attacher_image_tag: "v4.5.1"
-cinder_csi_provisioner_image_tag: "v3.6.2"
+cinder_csi_provisioner_image_tag: "v4.0.1"
-cinder_csi_snapshotter_image_tag: "v6.3.2"
+cinder_csi_snapshotter_image_tag: "v7.0.2"
-cinder_csi_resizer_image_tag: "v1.9.2"
+cinder_csi_resizer_image_tag: "v1.10.1"
 cinder_csi_livenessprobe_image_tag: "v2.11.0"
 
 # To access Cinder, the CSI controller will need credentials to access

roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2

@@ -24,7 +24,7 @@ spec:
         - start
         - --config
         - /etc/config/config.json
-{% if local_path_provisioner_debug | default(false) %}
+{% if local_path_provisioner_debug %}
         - --debug
 {% endif %}
         volumeMounts:

roles/kubernetes-apps/helm/tasks/main.yml

@@ -3,11 +3,11 @@
   include_vars: "{{ item }}"
   with_first_found:
     - files:
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
-        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_os_family | lower }}.yml"
+        - "{{ ansible_facts['os_family'] | lower }}.yml"
         - defaults.yml
       paths:
         - ../vars
@@ -21,7 +21,7 @@
 
 - name: Helm | Install PyYaml [flatcar]
   include_tasks: pyyaml-flatcar.yml
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
 
 - name: Helm | Download helm
   include_tasks: "../../../download/tasks/download_file.yml"

roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml

@@ -4,9 +4,7 @@ dependencies:
     when:
       - inventory_hostname == groups['kube_control_plane'][0]
       - kubelet_csr_approver_enabled
-    environment:
+    environment: "{{ proxy_env }}"
-      http_proxy: "{{ http_proxy | default('') }}"
-      https_proxy: "{{ https_proxy | default('') }}"
     release_common_opts: {}
     releases:
       - name: kubelet-csr-approver

roles/kubernetes-apps/metallb/tasks/main.yml

@@ -3,7 +3,8 @@
   fail:
     msg: "MetalLB require kube_proxy_strict_arp = true, see https://github.com/danderson/metallb/issues/153#issuecomment-518651132"
   when:
-    - "kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp"
+    - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
+    - not kube_proxy_remove
 
 - name: Kubernetes Apps | Check that the deprecated 'matallb_auto_assign' variable is not used anymore
   fail:

roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2

@@ -26,7 +26,7 @@ spec:
     spec:
       priorityClassName: system-cluster-critical
       serviceAccountName: metrics-server
-      hostNetwork: {{ metrics_server_host_network | default(false) }}
+      hostNetwork: {{ metrics_server_host_network }}
       containers:
       - name: metrics-server
         image: {{ metrics_server_image_repo }}:{{ metrics_server_image_tag }}

roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2

@@ -71,6 +71,7 @@ rules:
       - blockaffinities
       - ipamblocks
       - ipamhandles
+      - ipamconfigs
       - tiers
     verbs:
       - get
@@ -124,4 +125,12 @@ rules:
       - list
       - update
       - watch
+  # Namespaces are watched for LoadBalancer IP allocation with namespace selector support
+  - apiGroups: [""]
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
 {% endif %}

roles/kubernetes/control-plane/defaults/main/main.yml

@@ -41,6 +41,9 @@ control_plane_health_retries: 60  # Default retries for apiserver, scheduler, co
 kube_controller_manager_leader_elect_lease_duration: 15s
 kube_controller_manager_leader_elect_renew_deadline: 10s
 
+# Controls whether or not the kube_controller_manager allocates subnets for the node object
+kube_controller_manager_allocate_node_cidrs: true
+
 # discovery_timeout modifies the discovery timeout
 discovery_timeout: 5m0s
 

roles/kubernetes/control-plane/meta/main.yml

@@ -5,6 +5,6 @@ dependencies:
     user: "{{ addusers.etcd }}"
     when:
       - etcd_deployment_type == "kubeadm"
-      - not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
+      - not (ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
   - role: network_plugin/calico_defaults
   - role: etcd_defaults

roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml

@@ -84,23 +84,49 @@
     - not kubeadm_already_run.stat.exists
 
 - name: Joining control plane node to the cluster.
-  command: >-
-    {{ bin_dir }}/kubeadm join
-    --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
-    --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
-    --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
-  environment:
-    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
-  register: kubeadm_join_control_plane
-  retries: 3
-  throttle: 1
-  until: kubeadm_join_control_plane is succeeded
   when:
     - inventory_hostname != first_kube_control_plane
     - kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
+  environment:
+    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
+  block:
+    - name: Joining control plane node to the cluster. (1st try)
+      command: >-
+        {{ bin_dir }}/kubeadm join
+        --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
+        --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
+        --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
+      register: kubeadm_join_control_plane
+      throttle: 1
+  rescue:
+    - name: Reset cert directory before retrying control plane join
+      command: "{{ bin_dir }}/kubeadm reset -f --cert-dir {{ kube_cert_dir }}"
+      environment:
+        PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
+    - name: Joining control plane node to the cluster. (retry)
+      command: >-
+        {{ bin_dir }}/kubeadm join
+        --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
+        --ignore-preflight-errors={{ _ignore_errors | flatten | join(',') }}
+        --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
+      vars:
+        _errors_from_first_try:
+          - 'FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml'
+          - 'FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml'
+          - 'FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml'
+          - 'Port-10250'
+        _ignore_errors:
+          - "{{ kubeadm_ignore_preflight_errors }}"
+          - "{{ _errors_from_first_try if 'all' not in kubeadm_ignore_preflight_errors else [] }}"
+      register: kubeadm_join_control_plane
+      retries: 2
+      until: kubeadm_join_control_plane is succeeded
+      throttle: 1
 
 - name: Wait for new control plane nodes to be Ready
-  when: kubeadm_already_run.stat.exists
+  when:
+    - kubeadm_already_run.stat.exists
+    - kube_network_plugin not in ['cni', 'none']
   run_once: true
   command: >
     {{ kubectl }} get nodes --selector node-role.kubernetes.io/control-plane

roles/kubernetes/control-plane/tasks/main.yml

@@ -68,7 +68,7 @@
 
 - name: Install kubectl bash completion
   shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
-  when: ansible_os_family in ["Debian","RedHat", "Suse"]
+  when: ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
   tags:
     - kubectl
   ignore_errors: true  # noqa ignore-errors
@@ -79,7 +79,7 @@
     owner: root
     group: root
     mode: "0755"
-  when: ansible_os_family in ["Debian","RedHat", "Suse"]
+  when: ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
   tags:
     - kubectl
     - upgrade
@@ -98,7 +98,7 @@
     state: present
     marker: "# Ansible entries {mark}"
   when:
-    - ansible_os_family in ["Debian","RedHat", "Suse"]
+    - ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
     - kubectl_alias is defined and kubectl_alias != ""
   tags:
     - kubectl

roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2

@@ -156,8 +156,6 @@ apiServer:
   - name: disable-admission-plugins
     value: "{{ kube_apiserver_disable_admission_plugins | join(',') }}"
 {% endif %}
-  - name: apiserver-count
-    value: "{{ kube_apiserver_count }}"
   - name: endpoint-reconciler-type
     value: lease
 {% if etcd_events_cluster_enabled %}
@@ -365,7 +363,17 @@ controllerManager:
 {% endif %}
   - name: service-cluster-ip-range
     value: "{{ kube_service_subnets }}"
-{% if kube_network_plugin is defined and kube_network_plugin == "calico" and not calico_ipam_host_local %}
+{% if not kube_controller_manager_allocate_node_cidrs
+  or kube_network_plugin is defined and (
+    (
+      kube_network_plugin == "calico" and
+      not calico_ipam_host_local
+    ) or (
+      kube_network_plugin == "cilium" and
+      cilium_ipam_mode == "cluster-pool"
+    )
+  )
+%}
   - name: allocate-node-cidrs
     value: "false"
 {% else %}
@@ -578,9 +586,18 @@ clusterDNS:
 {% for dns_address in kubelet_cluster_dns %}
 - {{ dns_address }}
 {% endfor %}
-{% if kubelet_feature_gates or kube_feature_gates %}
+{% set disable_websockets_to_kubelet = (container_manager == 'docker' and kube_version is version('1.36.0', '>=')) %}
 {% set feature_gates = ( kubelet_feature_gates | default(kube_feature_gates, true) ) %}
+{% if disable_websockets_to_kubelet %}
+{% set feature_gates = feature_gates | reject('search', '^ExtendWebSocketsToKubelet=') | list %}
+{% endif %}
+{% if feature_gates or disable_websockets_to_kubelet %}
 featureGates:
+{%   if disable_websockets_to_kubelet %}
+  # cri-dockerd does not support WebSocket streaming
+  # https://github.com/kubernetes-sigs/kubespray/issues/13360
+  ExtendWebSocketsToKubelet: false
+{%   endif %}
 {%   for feature in feature_gates %}
   {{ feature | replace("=", ": ") }}
 {%   endfor %}

roles/kubernetes/node/defaults/main.yml

@@ -56,7 +56,6 @@ system_pid_reserved: 1000
 ## Eviction Thresholds to avoid system OOMs
 # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
 eviction_hard: {}
-eviction_hard_control_plane: {}
 
 kubelet_status_update_frequency: 10s
 
@@ -88,6 +87,9 @@ kube_vip_retryperiod: 1
 kube_vip_enable_node_labeling: false
 kube_vip_bgp_sourceip:
 kube_vip_bgp_sourceif:
+kube_vip_metrics_enabled: false
+# TCP port for kube-vip Prometheus metrics; manifest sets prometheus_server to :PORT (same as kube-vip upstream default, see cmd/kube-vip.go).
+kube_vip_metrics_port: 2112
 
 # Requests for load balancer app
 loadbalancer_apiserver_memory_requests: 32M

roles/kubernetes/node/tasks/facts.yml

@@ -54,9 +54,9 @@
   include_vars: "{{ item }}"
   with_first_found:
   - files:
-    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
-    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-    - "{{ ansible_distribution | lower }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}.yml"
-    - "{{ ansible_os_family | lower }}.yml"
+    - "{{ ansible_facts['os_family'] | lower }}.yml"
     skip: true

roles/kubernetes/node/tasks/kubelet.yml

@@ -33,7 +33,7 @@
     src: "kubelet.service.j2"
     dest: "/etc/systemd/system/kubelet.service"
     backup: true
-    mode: "0600"
+    mode: "0644"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250

roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml

@@ -4,6 +4,7 @@
     msg: "kube-vip require kube_proxy_strict_arp = true, see https://github.com/kube-vip/kube-vip/blob/main/docs/kubernetes/arp/index.md"
   when:
     - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
+    - not kube_proxy_remove
     - kube_vip_arp_enabled
 
 - name: Kube-vip | Check mutually exclusive BGP source settings

roles/kubernetes/node/tasks/main.yml

@@ -114,7 +114,9 @@
     state: present
     persistent: present
   loop: "{{ kube_proxy_ipvs_modules }}"
-  when: kube_proxy_mode == 'ipvs'
+  when:
+    - kube_proxy_mode == 'ipvs'
+    - not kube_proxy_remove
   tags:
     - kube-proxy
 
@@ -130,6 +132,7 @@
     - nf_conntrack_ipv4
   when:
     - kube_proxy_mode == 'ipvs'
+    - not kube_proxy_remove
     - modprobe_conntrack_module is not defined or modprobe_conntrack_module is ansible.builtin.failed  # loop until first success
   tags:
     - kube-proxy
@@ -139,7 +142,9 @@
     name: "nf_tables"
     state: present
     persistent: present
-  when: kube_proxy_mode == 'nftables'
+  when:
+    - kube_proxy_mode == 'nftables'
+    - not kube_proxy_remove
   tags:
     - kube-proxy
 

roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2

@@ -81,9 +81,19 @@ resolvConf: "{{ kube_resolv_conf }}"
 {% if kubelet_config_extra_args %}
 {{ kubelet_config_extra_args | to_nice_yaml(indent=2) }}
 {% endif %}
-{% if kubelet_feature_gates or kube_feature_gates %}
+{% set disable_websockets_to_kubelet = (container_manager == 'docker' and kube_version is version('1.36.0', '>=')) %}
+{% set kubelet_gates = (kubelet_feature_gates | default(kube_feature_gates, true)) %}
+{% if disable_websockets_to_kubelet %}
+{% set kubelet_gates = kubelet_gates | reject('search', '^ExtendWebSocketsToKubelet=') | list %}
+{% endif %}
+{% if kubelet_gates or disable_websockets_to_kubelet %}
 featureGates:
-{% for feature in (kubelet_feature_gates | default(kube_feature_gates, true)) %}
+{% if disable_websockets_to_kubelet %}
+  # cri-dockerd does not support WebSocket streaming
+  # https://github.com/kubernetes-sigs/kubespray/issues/13360
+  ExtendWebSocketsToKubelet: false
+{% endif %}
+{% for feature in kubelet_gates %}
   {{ feature | replace("=", ": ") }}
 {% endfor %}
 {% endif %}

roles/kubernetes/node/templates/loadbalancer/nginx.conf.j2

@@ -1,7 +1,7 @@
 error_log stderr notice;
 
 worker_processes 2;
-worker_rlimit_nofile 130048;
+worker_rlimit_nofile 65535;
 worker_shutdown_timeout 10s;
 
 events {

roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2

@@ -109,11 +109,21 @@ spec:
 {% if kube_vip_lb_fwdmethod %}
     - name: lb_fwdmethod
       value: {{ kube_vip_lb_fwdmethod | string | to_json }}
+{% endif %}
+{% if kube_vip_metrics_enabled %}
+    - name: prometheus_server
+      value: {{ (':' ~ (kube_vip_metrics_port | string)) | to_json }}
 {% endif %}
     image: {{ kube_vip_image_repo }}:{{ kube_vip_image_tag }}
     imagePullPolicy: {{ k8s_image_pull_policy }}
     name: kube-vip
     resources: {}
+{% if kube_vip_metrics_enabled %}
+    ports:
+    - name: metrics
+      containerPort: {{ kube_vip_metrics_port }}
+      protocol: TCP
+{% endif %}
 {% if kube_vip_lb_fwdmethod == "masquerade" %}
     securityContext:
       privileged: true

roles/kubernetes/preinstall/defaults/main.yml

@@ -8,6 +8,9 @@ cloud_resolver: []
 disable_host_nameservers: false
 # Kubespray sets this to true after clusterDNS is running to apply changes to the host resolv.conf
 dns_late: false
+# DNS resolver option timeout and retry attempts.
+dns_timeout: 2
+dns_attempts: 2
 
 # Set to true if your network does not support IPv6
 # This may be necessary for pulling Docker images from
@@ -104,7 +107,7 @@ redhat_os_family_extensions:
   - "UniontechOS"
 
 # Sets DNSStubListener=no, useful if you get "0.0.0.0:53: bind: address already in use"
-systemd_resolved_disable_stub_listener: "{{ ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
+systemd_resolved_disable_stub_listener: "{{ ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
 
 # Used to disable File Access Policy Daemon service.
 # If service is enabled, the CNI plugin installation will fail

roles/kubernetes/preinstall/handlers/main.yml

@@ -1,7 +1,7 @@
 ---
 - name: Preinstall | apply resolvconf cloud-init
   command: /usr/bin/coreos-cloudinit --from-file {{ resolveconf_cloud_init_conf }}
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
   listen: Preinstall | propagate resolvconf to k8s components
 
 - name: Preinstall | reload NetworkManager

roles/kubernetes/preinstall/tasks/0020-set_facts.yml

@@ -1,9 +1,12 @@
 ---
-- name: Set os_family fact for other redhat-based operating systems
+- name: Normalize ansible_facts for redhat-family extensions
   set_fact:
-    ansible_os_family: "RedHat"
+    ansible_facts: >-
-    ansible_distribution_major_version: "8"
+      {{ ansible_facts | combine({
-  when: ansible_distribution in redhat_os_family_extensions
+           'os_family': 'RedHat',
+           'distribution_major_version': '8'
+         }) }}
+  when: ansible_facts['distribution'] in redhat_os_family_extensions
   tags:
     - facts
 
@@ -86,12 +89,12 @@
       {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/base{%- endif -%}
     head: >-
       {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/head{%- endif -%}
-  when: not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
+  when: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
 
 - name: Target temporary resolvconf cloud init file (Flatcar Container Linux by Kinvolk / Fedora CoreOS)
   set_fact:
     resolvconffile: /tmp/resolveconf_cloud_init_conf
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos
 
 - name: Check if /etc/dhclient.conf exists
   stat:
@@ -122,12 +125,12 @@
 - name: Target dhclient hook file for Red Hat family
   set_fact:
     dhclienthookfile: /etc/dhcp/dhclient.d/zdnsupdate.sh
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts['os_family'] == "RedHat"
 
 - name: Target dhclient hook file for Debian family
   set_fact:
     dhclienthookfile: /etc/dhcp/dhclient-exit-hooks.d/zdnsupdate
-  when: ansible_os_family == "Debian"
+  when: ansible_facts['os_family'] == "Debian"
 
 - name: Set etcd vars if using kubeadm mode
   set_fact:

roles/kubernetes/preinstall/tasks/0040-verify-settings.yml

@@ -15,25 +15,25 @@
     - not ignore_assert_errors
 - name: Stop if non systemd OS type
   assert:
-    that: ansible_service_mgr == "systemd"
+    that: ansible_facts['service_mgr'] == "systemd"
   when: not ignore_assert_errors
 
 - name: Stop if the os does not support
   assert:
-    that: (allow_unsupported_distribution_setup | default(false)) or ansible_distribution in supported_os_distributions
+    that: (allow_unsupported_distribution_setup | default(false)) or ansible_facts['distribution'] in supported_os_distributions
-    msg: "{{ ansible_distribution }} is not a known OS"
+    msg: "{{ ansible_facts['distribution'] }} is not a known OS"
   when: not ignore_assert_errors
 
 - name: Stop if memory is too small for control plane nodes
   assert:
-    that: ansible_memtotal_mb >= minimal_master_memory_mb
+    that: ansible_facts['memtotal_mb'] >= minimal_master_memory_mb
   when:
     - not ignore_assert_errors
     - ('kube_control_plane' in group_names)
 
 - name: Stop if memory is too small for nodes
   assert:
-    that: ansible_memtotal_mb >= minimal_node_memory_mb
+    that: ansible_facts['memtotal_mb'] >= minimal_node_memory_mb
   when:
     - not ignore_assert_errors
     - ('kube_node' in group_names)
@@ -47,8 +47,8 @@
 
 - name: Stop if ip var does not match local ips
   assert:
-    that: (ip in ansible_all_ipv4_addresses) or (ip in ansible_all_ipv6_addresses)
+    that: (ip in ansible_facts['all_ipv4_addresses']) or (ip in ansible_facts['all_ipv6_addresses'])
-    msg: "IPv4: '{{ ansible_all_ipv4_addresses }}' and IPv6: '{{ ansible_all_ipv6_addresses }}' do not contain '{{ ip }}'"
+    msg: "IPv4: '{{ ansible_facts['all_ipv4_addresses'] }}' and IPv6: '{{ ansible_facts['all_ipv6_addresses'] }}' do not contain '{{ ip }}'"
   when:
     - not ignore_assert_errors
     - ip is defined
@@ -63,16 +63,29 @@
 
 - name: Stop if kernel version is too low for cilium
   assert:
-    that: ansible_kernel.split('-')[0] is version('4.9.17', '>=')
+    that: ansible_facts['kernel'].split('-')[0] is version('4.9.17', '>=')
+  when:
+    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
+    - not ignore_assert_errors
+
+- name: Stop if kube_owner is not root when using cilium
+  assert:
+    that: kube_owner == 'root'
+    fail_msg: |
+      kube_owner is set to '{{ kube_owner }}', but cilium requires it to be 'root'.
+      Cilium's init containers run as UID 0 with capabilities (including CAP_DAC_OVERRIDE) dropped,
+      so host paths it writes to (e.g. /opt/cni/bin) must be owned by root or it will fail with
+      a permission error. See https://github.com/kubernetes-sigs/kubespray/issues/13378
   when:
     - kube_network_plugin == 'cilium' or cilium_deploy_additionally
     - not ignore_assert_errors
 
 - name: Stop if kernel version is too low for nftables
   assert:
-    that: ansible_kernel.split('-')[0] is version('5.13', '>=')
+    that: ansible_facts['kernel'].split('-')[0] is version('5.13', '>=')
   when:
     - kube_proxy_mode == 'nftables'
+    - not kube_proxy_remove
     - not ignore_assert_errors
 
 - name: Stop if bad hostname
@@ -92,6 +105,6 @@
 
 - name: Stop if download_localhost is enabled for Flatcar Container Linux
   assert:
-    that: ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    that: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
     msg: "download_run_once not supported for Flatcar Container Linux"
   when: download_run_once or download_force_cache

roles/kubernetes/preinstall/tasks/0060-resolvconf.yml

@@ -1,7 +1,7 @@
 ---
 - name: Create temporary resolveconf cloud init file
   command: cp -f /etc/resolv.conf "{{ resolvconffile }}"
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
 
 - name: Add domain/search/nameservers/options to resolv.conf
   blockinfile:
@@ -12,7 +12,7 @@
       {% for item in nameserverentries %}
       nameserver {{ item }}
       {% endfor %}
-      options ndots:{{ ndots }} timeout:{{ dns_timeout | default('2') }} attempts:{{ dns_attempts | default('2') }}
+      options ndots:{{ ndots }} timeout:{{ dns_timeout }} attempts:{{ dns_attempts }}
     state: present
     insertbefore: BOF
     create: true
@@ -45,7 +45,7 @@
 - name: Get temporary resolveconf cloud init file content
   command: cat {{ resolvconffile }}
   register: cloud_config
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
 
 - name: Persist resolvconf cloud init file
   template:
@@ -54,4 +54,4 @@
     owner: root
     mode: "0644"
   notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml

@@ -32,7 +32,7 @@
     path: /etc/NetworkManager/conf.d/dns.conf
     section: global-dns
     option: options
-    value: "ndots:{{ ndots }},timeout:{{ dns_timeout | default('2') }},attempts:{{ dns_attempts | default('2') }}"
+    value: "ndots:{{ ndots }},timeout:{{ dns_timeout }},attempts:{{ dns_attempts }}"
     mode: '0600'
     backup: "{{ leave_etc_backup_files }}"
   notify: Preinstall | update resolvconf for networkmanager

roles/kubernetes/preinstall/tasks/0080-system-configurations.yml

@@ -7,8 +7,8 @@
     get_checksum: false
     get_mime: false
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
-    - "'Amazon' not in ansible_distribution"
+    - "'Amazon' not in ansible_facts['distribution']"
   register: slc
 
 - name: Set selinux policy
@@ -16,8 +16,8 @@
     policy: targeted
     state: "{{ preinstall_selinux_state }}"
   when:
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
-    - "'Amazon' not in ansible_distribution"
+    - "'Amazon' not in ansible_facts['distribution']"
     - slc.stat.exists
   tags:
     - bootstrap_os
@@ -32,7 +32,7 @@
     mode: "0644"
   when:
     - disable_ipv6_dns
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
   tags:
     - bootstrap_os
 

roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml

@@ -15,7 +15,7 @@
       /etc/ntp.conf
       {%- elif ntp_package == "ntpsec" -%}
       /etc/ntpsec/ntp.conf
-      {%- elif ansible_os_family in ['RedHat', 'Suse'] -%}
+      {%- elif ansible_facts['os_family'] in ['RedHat', 'Suse'] -%}
       /etc/chrony.conf
       {%- else -%}
       /etc/chrony/chrony.conf
@@ -24,7 +24,7 @@
     ntp_service_name: >-
       {% if ntp_package == "chrony" -%}
       chronyd
-      {%- elif ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
+      {%- elif ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
       ntpd
       {%- else -%}
       ntp
@@ -72,14 +72,14 @@
   when:
     - ntp_timezone
     - not is_fedora_coreos
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
 
 - name: Gather selinux facts
   ansible.builtin.setup:
     gather_subset: selinux
   when:
     - ntp_timezone
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
 
 - name: Put SELinux in permissive mode, logging actions that would be blocked.
   ansible.posix.selinux:
@@ -87,7 +87,7 @@
     state: permissive
   when:
     - ntp_timezone
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
     - ansible_facts.selinux.status == 'enabled'
     - ansible_facts.selinux.mode == 'enforcing'
 
@@ -103,5 +103,5 @@
     state: "{{ preinstall_selinux_state }}"
   when:
     - ntp_timezone
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
     - ansible_facts.selinux.status == 'enabled'

roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml

@@ -26,7 +26,7 @@
     owner: root
     mode: "0755"
   notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_os_family not in [ "RedHat", "Suse" ]
+  when: ansible_facts['os_family'] not in [ "RedHat", "Suse" ]
 
 - name: Configure dhclient hooks for resolv.conf (RH-only)
   template:
@@ -35,4 +35,4 @@
     owner: root
     mode: "0755"
   notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts['os_family'] == "RedHat"

roles/kubernetes/preinstall/tasks/main.yml

@@ -83,7 +83,7 @@
     - dns_mode != 'none'
     - resolvconf_mode == 'host_resolvconf'
     - dhclientconffile is defined
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
   tags:
     - bootstrap_os
     - resolvconf
@@ -94,7 +94,7 @@
     - dns_mode != 'none'
     - resolvconf_mode != 'host_resolvconf'
     - dhclientconffile is defined
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
   tags:
     - bootstrap_os
     - resolvconf

roles/kubernetes/preinstall/templates/dhclient_dnsupdate.sh.j2

@@ -6,7 +6,7 @@
 if [ $reason = "BOUND" ]; then
   if [ -n "$new_domain_search" -o -n "$new_domain_name_servers" ]; then
     RESOLV_CONF=$(cat /etc/resolv.conf | sed -r '/^options (timeout|attempts|ndots).*$/d')
-    OPTIONS="options timeout:{{ dns_timeout|default('2') }} attempts:{{ dns_attempts|default('2') }} ndots:{{ ndots }}"
+    OPTIONS="options timeout:{{ dns_timeout }} attempts:{{ dns_attempts }} ndots:{{ ndots }}"
 
     printf "%b\n" "$RESOLV_CONF\n$OPTIONS" > /etc/resolv.conf
   fi

roles/kubernetes/preinstall/templates/dhclient_dnsupdate_rh.sh.j2

@@ -6,7 +6,7 @@
 zdnsupdate_config() {
   if [ -n "$new_domain_search" -o -n "$new_domain_name_servers" ]; then
     RESOLV_CONF=$(cat /etc/resolv.conf | sed -r '/^options (timeout|attempts|ndots).*$/d')
-    OPTIONS="options timeout:{{ dns_timeout|default('2') }} attempts:{{ dns_attempts|default('2') }} ndots:{{ ndots }}"
+    OPTIONS="options timeout:{{ dns_timeout }} attempts:{{ dns_attempts }} ndots:{{ ndots }}"
 
     echo -e "$RESOLV_CONF\n$OPTIONS" > /etc/resolv.conf
   fi

roles/kubespray_defaults/defaults/main/download.yml

@@ -116,7 +116,7 @@ flannel_version: 0.28.4
 flannel_cni_version: 1.7.1-flannel1
 cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"
 
-cilium_version: "1.19.3"
+cilium_version: "1.20.0"
 cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
 cilium_enable_hubble: false
 
@@ -161,17 +161,17 @@ cni_download_url: "{{ github_url }}/containernetworking/plugins/releases/downloa
 calicoctl_download_url: "{{ github_url }}/projectcalico/calico/releases/download/v{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}"
 calico_crds_download_url: "{{ github_url }}/projectcalico/calico/raw/v{{ calico_version }}/manifests/crds.yaml"
 ciliumcli_download_url: "{{ github_url }}/cilium/cilium-cli/releases/download/v{{ cilium_cli_version }}/cilium-linux-{{ image_arch }}.tar.gz"
-crictl_download_url: "{{ github_url }}/kubernetes-sigs/cri-tools/releases/download/v{{ crictl_version }}/crictl-v{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
+crictl_download_url: "{{ github_url }}/kubernetes-sigs/cri-tools/releases/download/v{{ crictl_version }}/crictl-v{{ crictl_version }}-{{ ansible_facts['system'] | lower }}-{{ image_arch }}.tar.gz"
 crio_download_url: "{{ storage_googleapis_url }}/cri-o/artifacts/cri-o.{{ image_arch }}.v{{ crio_version }}.tar.gz"
 helm_download_url: "{{ get_helm_url }}/helm-v{{ helm_version }}-linux-{{ image_arch }}.tar.gz"
 runc_download_url: "{{ github_url }}/opencontainers/runc/releases/download/v{{ runc_version }}/runc.{{ image_arch }}"
 crun_download_url: "{{ github_url }}/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}"
-youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_architecture }}-gnu.tar.gz"
+youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}-gnu.tar.gz"
 kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.xz"
 # gVisor only supports amd64 and uses x86_64 to in the download link
-gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/runsc"
+gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/runsc"
-gvisor_containerd_shim_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/containerd-shim-runsc-v1"
+gvisor_containerd_shim_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/containerd-shim-runsc-v1"
-nerdctl_download_url: "{{ github_url }}/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
+nerdctl_download_url: "{{ github_url }}/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_facts['system'] | lower }}-{{ image_arch }}.tar.gz"
 containerd_download_url: "{{ github_url }}/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ 'static-' if containerd_static_binary }}{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
 cri_dockerd_download_url: "{{ github_url }}/Mirantis/cri-dockerd/releases/download/v{{ cri_dockerd_version }}/cri-dockerd-{{ cri_dockerd_version }}.{{ image_arch }}.tgz"
 skopeo_download_url: "{{ github_url }}/lework/skopeo-binary/releases/download/v{{ skopeo_version }}/skopeo-linux-{{ image_arch }}"
@@ -238,14 +238,14 @@ cilium_operator_image_repo: "{{ quay_image_repo }}/cilium/operator"
 cilium_operator_image_tag: "v{{ cilium_version }}"
 cilium_hubble_relay_image_repo: "{{ quay_image_repo }}/cilium/hubble-relay"
 cilium_hubble_relay_image_tag: "v{{ cilium_version }}"
-cilium_hubble_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
+cilium_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
-cilium_hubble_certgen_image_tag: "v0.2.4"
+cilium_certgen_image_tag: "v0.4.8"
 cilium_hubble_ui_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui"
-cilium_hubble_ui_image_tag: "v0.13.3"
+cilium_hubble_ui_image_tag: "v0.13.5"
 cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend"
-cilium_hubble_ui_backend_image_tag: "v0.13.3"
+cilium_hubble_ui_backend_image_tag: "v0.13.5"
-cilium_hubble_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
+cilium_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
-cilium_hubble_envoy_image_tag: "v1.34.10-1762597008-ff7ae7d623be00078865cff1b0672cc5d9bfc6d5"
+cilium_envoy_image_tag: "v1.37.5-1782911245-7cffc778c923f68a77954a53b1a98d6b5353f004"
 kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn"
 kube_ovn_container_image_tag: "v{{ kube_ovn_version }}"
 kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway"
@@ -263,17 +263,17 @@ kube_vip_version: 1.0.3
 kube_vip_image_repo: "{{ github_image_repo }}/kube-vip/kube-vip{{ '-iptables' if kube_vip_lb_fwdmethod == 'masquerade' else '' }}"
 kube_vip_image_tag: "v{{ kube_vip_version }}"
 nginx_image_repo: "{{ docker_image_repo }}/library/nginx"
-nginx_image_tag: 1.28.2-alpine
+nginx_image_tag: 1.30.1-alpine
 haproxy_image_repo: "{{ docker_image_repo }}/library/haproxy"
-haproxy_image_tag: 3.2.13-alpine
+haproxy_image_tag: 3.2.19-alpine
 
 # Coredns version should be supported by corefile-migration (or at least work with)
 # bundle with kubeadm; if not 'basic' upgrade can sometimes fail
 
 coredns_supported_versions:
+  '1.36': 1.14.2
   '1.35': 1.12.4
   '1.34': 1.12.1
-  '1.33': 1.12.0
 coredns_version: "{{ coredns_supported_versions[kube_major_version] }}"
 coredns_image_repo: "{{ kube_image_repo }}{{ '/coredns' if coredns_version is version('1.7.1', '>=') else '' }}/coredns"
 coredns_image_tag: "{{ 'v' if coredns_version is version('1.7.1', '>=') else '' }}{{ coredns_version }}"
@@ -314,22 +314,22 @@ cert_manager_webhook_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-we
 cert_manager_webhook_image_tag: "v{{ cert_manager_version }}"
 
 csi_attacher_image_repo: "{{ kube_image_repo }}/sig-storage/csi-attacher"
-csi_attacher_image_tag: "v4.4.2"
+csi_attacher_image_tag: "v4.5.1"
 csi_provisioner_image_repo: "{{ kube_image_repo }}/sig-storage/csi-provisioner"
-csi_provisioner_image_tag: "v3.6.2"
+csi_provisioner_image_tag: "v4.0.1"
 csi_snapshotter_image_repo: "{{ kube_image_repo }}/sig-storage/csi-snapshotter"
-csi_snapshotter_image_tag: "v6.3.2"
+csi_snapshotter_image_tag: "v7.0.2"
 csi_resizer_image_repo: "{{ kube_image_repo }}/sig-storage/csi-resizer"
-csi_resizer_image_tag: "v1.9.2"
+csi_resizer_image_tag: "v1.10.1"
 csi_node_driver_registrar_image_repo: "{{ kube_image_repo }}/sig-storage/csi-node-driver-registrar"
 csi_node_driver_registrar_image_tag: "v2.4.0"
 csi_livenessprobe_image_repo: "{{ kube_image_repo }}/sig-storage/livenessprobe"
 csi_livenessprobe_image_tag: "v2.11.0"
 
 snapshot_controller_supported_versions:
+  '1.36': "v7.0.2"
   '1.35': "v7.0.2"
   '1.34': "v7.0.2"
-  '1.33': "v7.0.2"
 snapshot_controller_image_repo: "{{ kube_image_repo }}/sig-storage/snapshot-controller"
 snapshot_controller_image_tag: "{{ snapshot_controller_supported_versions[kube_major_version] }}"
 
@@ -491,7 +491,7 @@ downloads:
   youki:
     file: true
     enabled: "{{ youki_enabled }}"
-    dest: "{{ local_release_dir }}/youki-{{ youki_version }}-{{ ansible_architecture }}.tar.gz"
+    dest: "{{ local_release_dir }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}.tar.gz"
     checksum: "{{ youki_archive_checksum }}"
     url: "{{ youki_download_url }}"
     unarchive: true
@@ -539,7 +539,7 @@ downloads:
   gvisor_runsc:
     enabled: "{{ gvisor_enabled }}"
     file: true
-    dest: "{{ local_release_dir }}/gvisor-runsc-{{ gvisor_version }}-{{ ansible_architecture }}"
+    dest: "{{ local_release_dir }}/gvisor-runsc-{{ gvisor_version }}-{{ ansible_facts['architecture'] }}"
     checksum: "{{ gvisor_runsc_binary_checksum }}"
     url: "{{ gvisor_runsc_download_url }}"
     unarchive: false
@@ -551,7 +551,7 @@ downloads:
   gvisor_containerd_shim:
     enabled: "{{ gvisor_enabled }}"
     file: true
-    dest: "{{ local_release_dir }}/gvisor-containerd-shim-runsc-v1-{{ gvisor_version }}-{{ ansible_architecture }}"
+    dest: "{{ local_release_dir }}/gvisor-containerd-shim-runsc-v1-{{ gvisor_version }}-{{ ansible_facts['architecture'] }}"
     checksum: "{{ gvisor_containerd_shim_binary_checksum }}"
     url: "{{ gvisor_containerd_shim_runsc_download_url }}"
     unarchive: false
@@ -596,7 +596,7 @@ downloads:
   cilium_operator:
     enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}"
     container: true
-    repo: "{{ cilium_operator_image_repo }}"
+    repo: "{{ cilium_operator_image_repo }}-generic"
     tag: "{{ cilium_operator_image_tag }}"
     checksum: "{{ cilium_operator_digest_checksum | default(None) }}"
     groups:
@@ -611,12 +611,12 @@ downloads:
     groups:
       - k8s_cluster
 
-  cilium_hubble_certgen:
+  cilium_certgen:
-    enabled: "{{ cilium_enable_hubble }}"
+    enabled: "{{ kube_network_plugin == 'cilium' }}"
     container: true
-    repo: "{{ cilium_hubble_certgen_image_repo }}"
+    repo: "{{ cilium_certgen_image_repo }}"
-    tag: "{{ cilium_hubble_certgen_image_tag }}"
+    tag: "{{ cilium_certgen_image_tag }}"
-    checksum: "{{ cilium_hubble_certgen_digest_checksum | default(None) }}"
+    checksum: "{{ cilium_certgen_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 
@@ -638,12 +638,12 @@ downloads:
     groups:
       - k8s_cluster
 
-  cilium_hubble_envoy:
+  cilium_envoy:
-    enabled: "{{ cilium_enable_hubble }}"
+    enabled: "{{ kube_network_plugin == 'cilium' }}"
     container: true
-    repo: "{{ cilium_hubble_envoy_image_repo }}"
+    repo: "{{ cilium_envoy_image_repo }}"
-    tag: "{{ cilium_hubble_envoy_image_tag }}"
+    tag: "{{ cilium_envoy_image_tag }}"
-    checksum: "{{ cilium_hubble_envoy_digest_checksum | default(None) }}"
+    checksum: "{{ cilium_envoy_digest_checksum | default(None) }}"
     groups:
       - k8s_cluster
 

roles/kubespray_defaults/defaults/main/main.yml

@@ -33,6 +33,10 @@ kube_version_min_required: "{{ (kubelet_checksums['amd64'] | dict2items)[-1].key
 ## Kube Proxy mode One of ['ipvs', 'iptables', 'nftables']
 kube_proxy_mode: ipvs
 
+# When true, kubeadm skips the kube-proxy addon (for example Cilium kube-proxy replacement).
+# Node and package tasks that exist only for kube-proxy also honor this (IPVS/nftables modules, ipvsadm, strict_arp checks).
+kube_proxy_remove: false
+
 # Debugging option for the kubeadm config validate command
 # Set to false only for development and testing scenarios where validation is expected to fail (pre-release Kubernetes versions, etc.)
 kubeadm_config_validate_enabled: true
@@ -233,6 +237,10 @@ cilium_deploy_additionally: false
 #   - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
 cilium_identity_allocation_mode: crd
 
+# The default IP address management mode is "Cluster Scope".
+# https://docs.cilium.io/en/stable/concepts/networking/ipam/
+cilium_ipam_mode: cluster-pool
+
 # Determines if calico_rr group exists
 peer_with_calico_rr: "{{ 'calico_rr' in groups and groups['calico_rr'] | length > 0 }}"
 
@@ -642,12 +650,12 @@ local_volume_provisioner_storage_classes: |
 
 ssl_ca_dirs: |-
   [
-  {% if ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] -%}
+  {% if ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] -%}
   '/usr/share/ca-certificates',
-  {% elif ansible_os_family == 'RedHat' -%}
+  {% elif ansible_facts['os_family'] == 'RedHat' -%}
   '/etc/pki/tls',
   '/etc/pki/ca-trust',
-  {% elif ansible_os_family == 'Debian' -%}
+  {% elif ansible_facts['os_family'] == 'Debian' -%}
   '/usr/share/ca-certificates',
   {% endif -%}
   ]
@@ -655,7 +663,6 @@ ssl_ca_dirs: |-
 # used for delegating tasks on a working control plane node
 first_kube_control_plane: "{{ groups['kube_control_plane'] | first }}"
 # Vars for pointing to kubernetes api endpoints
-kube_apiserver_count: "{{ groups['kube_control_plane'] | length }}"
 kube_apiserver_address: "{{ hostvars[inventory_hostname]['main_ip'] }}"
 kube_apiserver_access_address: "{{ hostvars[inventory_hostname]['main_access_ip'] }}"
 first_kube_control_plane_address: "{{ hostvars[groups['kube_control_plane'][0]]['main_access_ip'] }}"
@@ -748,10 +755,10 @@ _host_architecture_groups:
   aarch64: arm64
   armv7l: arm
 host_architecture: >-
-  {%- if ansible_architecture in _host_architecture_groups -%}
+  {%- if ansible_facts['architecture'] in _host_architecture_groups -%}
-  {{ _host_architecture_groups[ansible_architecture] }}
+  {{ _host_architecture_groups[ansible_facts['architecture']] }}
   {%- else -%}
-  {{ ansible_architecture }}
+  {{ ansible_facts['architecture'] }}
   {%- endif -%}
 
 _host_os_groups:
@@ -759,10 +766,10 @@ _host_os_groups:
   Darwin: darwin
   Win32NT: windows
 host_os: >-
-  {%- if ansible_system in _host_os_groups -%}
+  {%- if ansible_facts['system'] in _host_os_groups -%}
-  {{ _host_os_groups[ansible_system] }}
+  {{ _host_os_groups[ansible_facts['system']] }}
   {%- else -%}
-  {{ ansible_system }}
+  {{ ansible_facts['system'] }}
   {%- endif -%}
 
 # Sets the eventRecordQPS parameter in kubelet-config.yaml.
@@ -801,6 +808,7 @@ sysctl_ignore_unknown_keys: false
 
 system_upgrade: false
 system_upgrade_reboot: on-upgrade  # never, always
+system_upgrade_autoclean: false
 
 # Enables or disables the scheduler plugins.
 scheduler_plugins_enabled: false
@@ -816,7 +824,7 @@ ntp_enabled: false
 # The default is ntp for most platforms, or chrony on RHEL/CentOS 7 and later.
 # The ntp_package can be one of ['ntp', 'ntpsec', 'chrony']
 ntp_package: >-
-      {% if ansible_os_family == "RedHat" -%}
+      {% if ansible_facts['os_family'] == "RedHat" -%}
       chrony
       {%- else -%}
       ntp