Initial plan

2026-08-08 13:51:48 -02:30 · 2026-03-22 11:20:53 +00:00
146 changed files with 933 additions and 1965 deletions
--- a/.github/advanced-issue-labeler.yml
+++ b/.github/advanced-issue-labeler.yml
@@ -1,54 +0,0 @@
---
-policy:
-  - section:
-      - id: [os]
-        block-list: []
-        label:
-          - name: 'RHEL 9'
-            keys: ['RHEL 9']
-          - name: 'RHEL 8'
-            keys: ['RHEL 8']
-          - name: 'Fedora 40'
-            keys: ['Fedora 40']
-          - name: 'Ubuntu 24'
-            keys: ['Ubuntu 24']
-          - name: 'Ubuntu 22'
-            keys: ['Ubuntu 22']
-          - name: 'Ubuntu 20'
-            keys: ['Ubuntu 20']
-          - name: 'Debian 12'
-            keys: ['Debian 12']
-          - name: 'Debian 11'
-            keys: ['Debian 11']
-          - name: 'Flatcar Container Linux'
-            keys: ['Flatcar Container Linux']
-          - name: 'openSUSE Leap'
-            keys: ['openSUSE Leap']
-          - name: 'openSUSE Tumbleweed'
-            keys: ['openSUSE Tumbleweed']
-          - name: 'Oracle Linux 9'
-            keys: ['Oracle Linux 9']
-          - name: 'Oracle Linux 8'
-            keys: ['Oracle Linux 8']
-          - name: 'AlmaLinux 9'
-            keys: ['AlmaLinux 9']
-          - name: 'AlmaLinux 8'
-            keys: ['AlmaLinux 8']
-          - name: 'Rocky Linux 9'
-            keys: ['Rocky Linux 9']
-          - name: 'Rocky Linux 8'
-            keys: ['Rocky Linux 8']
-          - name: 'Amazon Linux 2'
-            keys: ['Amazon Linux 2']
-          - name: 'Kylin Linux Advanced Server V10'
-            keys: ['Kylin Linux Advanced Server V10']
-          - name: 'UOS Linux 20'
-            keys: ['UOS Linux 20']
-          - name: 'openEuler 24'
-            keys: ['openEuler 24']
-          - name: 'openEuler 22'
-            keys: ['openEuler 22']
-          - name: 'openEuler 20'
-            keys: ['openEuler 20']
-          - name: 'Other|Unsupported'
-            keys: ['Other|Unsupported']
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,10 +12,6 @@ updates:
        patterns:
          - molecule
          - molecule-plugins*
-    ignore:
-      # Ansible major versions are upgraded manually to support multiple OS/Python versions.
-      - dependency-name: "ansible"
-        update-types: ["version-update:semver-major"]
  - package-ecosystem: "github-actions"
    directory: "/"
    labels:
--- a/.github/workflows/auto-label-os.yml
+++ b/.github/workflows/auto-label-os.yml
@@ -13,17 +13,20 @@ jobs:
      issues: write

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@cb6e97157cbf851e3a393ff8d57c93a484cc323f
+        uses: stefanbuck/github-issue-parser@10dcc54158ba4c137713d9d69d70a2da63b6bda3
        id: issue-parser
        with:
          template-path: .github/ISSUE_TEMPLATE/bug-report.yaml

-      - name: Set labels based on allowed OS values
+      - name: Set labels based on OS field
        uses: redhat-plumbers-in-action/advanced-issue-labeler@b80ae64e3e156e9c111b075bfa04b295d54e8e2e
        with:
          issue-form: ${{ steps.issue-parser.outputs.jsonString }}
-          config-path: .github/advanced-issue-labeler.yml
+          section: os
+          block-list: |
+            None
+            Other
          token: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/upgrade-patch-versions.yml
+++ b/.github/workflows/upgrade-patch-versions.yml
@@ -11,10 +11,10 @@ jobs:
  update-patch-versions:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        ref: ${{ inputs.branch }}
-    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    - uses: actions/setup-python@v6
      with:
        python-version: '3.13'
        cache: 'pip'
@@ -22,14 +22,14 @@ jobs:
    - run: update-hashes
      env:
        API_KEY: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    - uses: actions/cache@v5
      with:
        key: pre-commit-hook-propagate
        path: |
          ~/.cache/pre-commit
    - run: pre-commit run --all-files propagate-ansible-variables
      continue-on-error: true
-    - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+    - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
      with:
        commit-message: Patch versions updates
        title: Patch versions updates - ${{ inputs.branch }}
--- a/.gitlab-ci/kubevirt.yml
+++ b/.gitlab-ci/kubevirt.yml
@@ -40,8 +40,8 @@ pr:
          - debian11-macvlan
          - debian12-cilium
          - debian13-cilium
-          - fedora42-kube-router
-          - fedora43-kube-router
+          - fedora39-kube-router
+          - fedora41-kube-router
          - fedora42-calico
          - rockylinux9-cilium
          - rockylinux10-cilium
@@ -56,16 +56,14 @@ pr:
          - ubuntu24-kube-router-sep
          - ubuntu24-kube-router-svc-proxy
          - ubuntu24-ha-separate-etcd
-          - fedora43-flannel-crio-collection-scale
+          - fedora40-flannel-crio-collection-scale
+          - openeuler24-calico

 # This is for flakey test so they don't disrupt the PR worklflow too much.
 # Jobs here MUST have a open issue so we don't lose sight of them
 pr-flakey:
  extends: pr
-  rules:
-    - if: $PR_LABELS =~ /.*(ci-extended|ci-full).*/
-      when: on_success
-  retry: 2
+  retry: 1
  parallel:
    matrix:
      - TESTCASE:
@@ -104,11 +102,10 @@ pr_full:
          - debian11-custom-cni
          - debian11-kubelet-csr-approver
          - debian12-custom-cni-helm
-          - fedora42-calico-swap-selinux
-          - fedora42-crio
-          - fedora43-calico-swap-selinux
-          - fedora43-crio
-          - openeuler24-calico # https://github.com/kubernetes-sigs/kubespray/issues/12877
+          - fedora39-calico-swap-selinux
+          - fedora39-crio
+          - fedora41-calico-swap-selinux
+          - fedora41-crio
          - ubuntu24-calico-ha-wireguard
          - ubuntu24-flannel-ha
          - ubuntu24-flannel-ha-once
@@ -166,9 +163,9 @@ periodic:
          - debian11-calico-upgrade
          - debian11-calico-upgrade-once
          - debian12-cilium-svc-proxy
-          - fedora42-calico-selinux
-          - fedora43-calico-selinux
-          - fedora43-docker-calico
+          - fedora39-calico-selinux
+          - fedora40-docker-calico
+          - fedora41-calico-selinux
          - ubuntu24-calico-etcd-kubeadm-upgrade-ha
          - ubuntu24-calico-ha-recover
          - ubuntu24-calico-ha-recover-noquorum
--- a/.gitlab-ci/molecule.yml
+++ b/.gitlab-ci/molecule.yml
@@ -35,6 +35,7 @@ molecule:
      - container-engine/containerd
      - container-engine/cri-o
      - container-engine/gvisor
+      - container-engine/youki
      - adduser
      - bastion-ssh-config
      - bootstrap_os
@@ -52,5 +53,3 @@ molecule_full:
    - ROLE:
      # FIXME : tests below are perma-failing
      - container-engine/kata-containers
-      # FIXME: until youki release 0.6.1
-      - container-engine/youki
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -33,7 +33,6 @@ repos:
    hooks:
      - id: ansible-lint
        additional_dependencies:
-          - ansible-core>=2.18.0,<2.19.0
          - jmespath==1.0.1
          - netaddr==1.3.0
          - distlib
@@ -50,7 +49,7 @@ repos:
        name: Build and install kubernetes-sigs.kubespray Ansible collection
        language: python
        additional_dependencies:
-          - ansible-core>=2.18.0,<2.19.0
+          - ansible-core>=2.16.4
          - distlib
        entry: tests/scripts/collection-build-install.sh
        pass_filenames: false
@@ -92,7 +91,7 @@ repos:
        name: Update static files referencing default kubespray values
        language: python
        additional_dependencies:
-          - ansible-core>=2.18.0,<2.19.0
+          - ansible-core>=2.16.4
        entry: scripts/propagate_ansible_variables.yml
        pass_filenames: false

--- a/4
+++ b/4
@@ -35,8 +35,8 @@ RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]

 RUN OS_ARCHITECTURE=$(dpkg --print-architecture) \
-    && curl -L "https://dl.k8s.io/release/v1.36.3/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
-    && echo "$(curl -L "https://dl.k8s.io/release/v1.36.3/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
+    && curl -L "https://dl.k8s.io/release/v1.35.1/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
+    && echo "$(curl -L "https://dl.k8s.io/release/v1.35.1/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl

 COPY *.yml ./
--- a/1
+++ b/1
@@ -8,7 +8,6 @@ aliases:
  kubespray-reviewers:
    - cyclinder
    - erikjiang
-    - guoard
    - mzaian
    - tico88612
    - vannten
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ Ensure you have installed Docker then
 ```ShellSession
 docker run --rm -it --mount type=bind,source="$(pwd)"/inventory/sample,dst=/inventory \
  --mount type=bind,source="${HOME}"/.ssh/id_rsa,dst=/root/.ssh/id_rsa \
-  quay.io/kubespray/kubespray:v2.31.0 bash
+  quay.io/kubespray/kubespray:v2.30.0 bash
 # Inside the container you may now run the kubespray playbooks:
 ansible-playbook -i /inventory/inventory.ini --private-key /root/.ssh/id_rsa cluster.yml
 ```
@@ -111,23 +111,23 @@ Note:
 <!-- BEGIN ANSIBLE MANAGED BLOCK -->

 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.36.3
-  - [etcd](https://github.com/etcd-io/etcd) 3.6.13
+  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.35.1
+  - [etcd](https://github.com/etcd-io/etcd) 3.6.8
  - [docker](https://www.docker.com/) 28.3
-  - [containerd](https://containerd.io/) 2.3.3
-  - [cri-o](https://cri-o.io/) 1.36.2 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [containerd](https://containerd.io/) 2.2.1
+  - [cri-o](http://cri-o.io/) 1.35.0 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
-  - [cni-plugins](https://github.com/containernetworking/plugins) 1.9.1
-  - [calico](https://github.com/projectcalico/calico) 3.31.6
-  - [cilium](https://github.com/cilium/cilium) 1.20.0
-  - [flannel](https://github.com/flannel-io/flannel) 0.28.4
+  - [cni-plugins](https://github.com/containernetworking/plugins) 1.8.0
+  - [calico](https://github.com/projectcalico/calico) 3.30.6
+  - [cilium](https://github.com/cilium/cilium) 1.19.1
+  - [flannel](https://github.com/flannel-io/flannel) 0.27.3
  - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
  - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
  - [multus](https://github.com/k8snetworkplumbingwg/multus-cni) 4.2.2
  - [kube-vip](https://github.com/kube-vip/kube-vip) 1.0.3
 - Application
  - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3
-  - [coredns](https://github.com/coredns/coredns) 1.14.2
+  - [coredns](https://github.com/coredns/coredns) 1.12.4
  - [argocd](https://argoproj.github.io/) 2.14.5
  - [helm](https://helm.sh/) 3.18.4
  - [metallb](https://metallb.universe.tf/) 0.13.9
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -58,7 +58,7 @@ You can create a release note with:
 export GITHUB_TOKEN=<your-github-token>
 export ORG=kubernetes-sigs
 export REPO=kubespray
-release-notes generate --org "${ORG}" --repo "${REPO}" --repo-path "${PWD}" --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note
+release-notes --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note --required-author=""
 ```

 If the release note file(/tmp/kubespray-release-note) contains "### Uncategorized" pull requests, those pull requests don't have a valid kind label(`kind/feature`, etc.).
--- a/contrib/terraform/openstack/README.md
+++ b/contrib/terraform/openstack/README.md
@@ -8,11 +8,6 @@ OpenStack.
 This will install a Kubernetes cluster on an OpenStack Cloud. It should work on
 most modern installs of OpenStack that support the basic services.

-## OpenStack Support Documentation
-
-For OpenStack cloud provider configuration (Octavia load balancers, Cinder CSI storage,
-network plugins like Calico), see the [main OpenStack documentation](../../../docs/cloud_controllers/openstack.md).
-
 ### Known compatible public clouds

 - [Auro](https://auro.io/)
@@ -94,8 +89,8 @@ binaries available on hyperkube v1.4.3_coreos.0 or higher.

 ## Requirements

- [Install OpenTofu](https://opentofu.org/docs/intro/install/) 1.9.0 or later
- [Install Ansible](https://docs.ansible.com/ansible/latest/intro_installation.html)
+- [Install Terraform](https://www.terraform.io/intro/getting-started/install.html) 0.14 or later
+- [Install Ansible](http://docs.ansible.com/ansible/latest/intro_installation.html)
 - you already have a suitable OS image in Glance
 - you already have a floating IP pool created
 - you have security groups enabled
@@ -134,7 +129,6 @@ Terraform will be used to provision all of the OpenStack resources with base sof
 Create an inventory directory for your cluster by copying the existing sample and linking the `hosts` script (used to build the inventory based on Terraform state):

 ```ShellSession
-CLUSTER=your-cluster-name
 cp -LRp contrib/terraform/openstack/sample-inventory inventory/$CLUSTER
 cd inventory/$CLUSTER
 ln -s ../../contrib/terraform/openstack/hosts
@@ -152,7 +146,7 @@ different OpenStack environments may support Identity API version 2 or 3.

 These are examples and may vary depending on your OpenStack cloud provider,
 for an exhaustive list on how to authenticate on OpenStack with Terraform
-please read the [OpenStack provider documentation](https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs).
+please read the [OpenStack provider documentation](https://www.terraform.io/docs/providers/openstack/).

 ##### Declarative method (recommended)

@@ -268,7 +262,6 @@ For your cluster, edit `inventory/$CLUSTER/cluster.tfvars`.
 |`image_uuid`,`image_gfs_uuid`, `image_master_uuid` | UUID of the image to use in provisioning the compute resources. Should already be loaded into glance. |
 |`ssh_user`,`ssh_user_gfs` | The username to ssh into the image with. This usually depends on the image you have selected |
 |`public_key_path` | Path on your local workstation to the public key file you wish to use in creating the key pairs |
-|`group_vars_path` | path to the inventory group vars directory, `./group_vars` by default |
 |`number_of_k8s_masters`, `number_of_k8s_masters_no_floating_ip` | Number of nodes that serve as both master and etcd. These can be provisioned with or without floating IP addresses|
 |`number_of_k8s_masters_no_etcd`, `number_of_k8s_masters_no_floating_ip_no_etcd` |  Number of nodes that serve as just master with no etcd. These can be provisioned with or without floating IP addresses |
 |`number_of_etcd` | Number of pure etcd nodes |
@@ -618,13 +611,7 @@ Edit `inventory/$CLUSTER/group_vars/all/all.yml`:
 bin_dir: /opt/bin
 ```

- **external_cloud_provider**:
-
-```yml
-external_cloud_provider: openstack
-```
-
- **Only if K8s < v1.31 - cloud_provider**:
+- and **cloud_provider**:

 ```yml
 cloud_provider: openstack
@@ -730,12 +717,6 @@ Basically you will install Gluster as
 ansible-playbook --become -i inventory/$CLUSTER/hosts ./contrib/network-storage/glusterfs/glusterfs.yml
 ```

-## Relevant Resources
-
- [HauptJ - Example cluster.tfvars using floating IPs for all Master and Nodes](https://gist.github.com/HauptJ/d72e2a8fe0698d448283a51e847a5dfa)
- [openmetal - Deploying a Kubespray cluster to OpenStack using Terraform](https://openmetal.io/docs/manuals/kubernetes-guides/deploying-a-kubespray-cluster-to-openstack-using-terraform/)
- [Guoqiang Lan - Deploy Kubernetes with Kubespray on OpenStack](https://guoqianglan.github.io/tutorial/cloud/deploy-kubernetes-with-kubespray-on-openstack/)
-
 ## What's next

 Try out your new Kubernetes cluster with the [Hello Kubernetes service](https://kubernetes.io/docs/tasks/access-application-cluster/service-access-application-cluster/).
--- a/docs/CNI/cilium.md
+++ b/docs/CNI/cilium.md
@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version

 ```yml
-cilium_version: "1.20.0"
+cilium_version: "1.19.1"
 ```

 ## Add variable to config
--- a/docs/ansible/ansible.md
+++ b/docs/ansible/ansible.md
@@ -157,20 +157,20 @@ Example command to filter and apply only DNS configuration tasks and skip
 everything else related to host OS configuration and downloading images of containers:

 ```ShellSession
-ansible-playbook -i inventory/sample/inventory.ini cluster.yml --tags preinstall,facts --skip-tags=download,bootstrap_os
+ansible-playbook -i inventory/sample/hosts.ini cluster.yml --tags preinstall,facts --skip-tags=download,bootstrap_os
 ```

 And this play only removes the K8s cluster DNS resolver IP from hosts' /etc/resolv.conf files:

 ```ShellSession
-ansible-playbook -i inventory/sample/inventory.ini -e dns_mode='none' cluster.yml --tags resolvconf
+ansible-playbook -i inventory/sample/hosts.ini -e dns_mode='none' cluster.yml --tags resolvconf
 ```

 And this prepares all container images locally (at the ansible runner node) without installing
 or upgrading related stuff or trying to upload container to K8s cluster nodes:

 ```ShellSession
-ansible-playbook -i inventory/sample/inventory.ini cluster.yml \
+ansible-playbook -i inventory/sample/hosts.ini cluster.yml \
    -e download_run_once=true -e download_localhost=true \
    --tags download --skip-tags upload,upgrade
 ```
--- a/docs/cloud_controllers/vsphere.md
+++ b/docs/cloud_controllers/vsphere.md
@@ -62,7 +62,7 @@ Once the configuration is set, you can execute the playbook again to apply the n

 ```ShellSession
 cd kubespray
-ansible-playbook -i inventory/sample/inventory.ini -b -v cluster.yml
+ansible-playbook -i inventory/sample/hosts.ini -b -v cluster.yml
 ```

 You'll find some useful examples [here](https://github.com/kubernetes/cloud-provider-vsphere/blob/master/docs/book/tutorials/kubernetes-on-vsphere-with-kubeadm.md#sample-manifests-to-test-csi-driver-functionality) to test your configuration.
@@ -82,7 +82,7 @@ If you intend to leverage the [zone and region node labeling](https://kubernetes

 ### Kubespray configuration (deprecated)

-First you must define the cloud provider in `inventory/sample/group_vars/all/all.yml` and set it to `vsphere`.
+First you must define the cloud provider in `inventory/sample/group_vars/all.yml` and set it to `vsphere`.

 ```yml
 cloud_provider: vsphere
@@ -128,7 +128,7 @@ Once the configuration is set, you can execute the playbook again to apply the n

 ```ShellSession
 cd kubespray
-ansible-playbook -i inventory/sample/inventory.ini -b -v cluster.yml
+ansible-playbook -i inventory/sample/hosts.ini -b -v cluster.yml
 ```

 You'll find some useful examples [here](https://github.com/kubernetes/examples/tree/master/staging/volumes/vsphere) to test your configuration.
--- a/docs/cloud_providers/cloud.md
+++ b/docs/cloud_providers/cloud.md
@@ -11,5 +11,5 @@ You can deploy instances in your cloud environment in several ways. Examples inc
 With ansible-playbook command

 ```ShellSession
-ansible-playbook -u smana -e ansible_ssh_user=admin -e cloud_provider=[aws|gce] -b --become-user=root -i inventory/sample/inventory.ini cluster.yml
+ansible-playbook -u smana -e ansible_ssh_user=admin -e cloud_provider=[aws|gce] -b --become-user=root -i inventory/single.cfg cluster.yml
 ```
--- a/docs/developers/ci.md
+++ b/docs/developers/ci.md
@@ -11,8 +11,10 @@ amazon |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | :x: | :white_check_mark: |
 debian12 |  :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
 debian13 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
+fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
+fedora40 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
+fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
@@ -29,8 +31,10 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :white_check_mark: | :x: | :x: | :x: |
+fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
@@ -47,8 +51,10 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora39 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora41 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
--- a/docs/getting_started/getting-started.md
+++ b/docs/getting_started/getting-started.md
@@ -15,15 +15,16 @@ and [details on the inventory structure expected by Kubespray](/docs/ansible/inv
 <your-favorite-editor> inventory/mycluster/inventory.ini

 # Review and change parameters under ``inventory/mycluster/group_vars``
-<your-favorite-editor> inventory/mycluster/group_vars/all/all.yml # for every node, including etcd
-<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml # for every node in the cluster (not etcd when it's separate)
-<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster/kube_control_plane.yml # for the control plane
+<your-favorite-editor> inventory/mycluster/group_vars/all.yml # for every node, including etcd
+<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster.yml # for every node in the cluster (not etcd when it's separate)
+<your-favorite-editor> inventory/mycluster/group_vars/kube_control_plane.yml # for the control plane
+<your-favorite-editor> inventory/myclsuter/group_vars/kube_node.yml # for worker nodes
 ```

 ## Installing the cluster

 ```ShellSession
-ansible-playbook -i inventory/mycluster/inventory.ini cluster.yml -b -v \
+ansible-playbook -i inventory/mycluster/ cluster.yml -b -v \
  --private-key=~/.ssh/private_key
 ```

@@ -35,7 +36,7 @@ You may want to add worker, control plane or etcd nodes to your existing cluster
 - Run the ansible-playbook command, substituting `cluster.yml` for `scale.yml`:

 ```ShellSession
-ansible-playbook -i inventory/mycluster/inventory.ini scale.yml -b -v \
+ansible-playbook -i inventory/mycluster/hosts.yml scale.yml -b -v \
  --private-key=~/.ssh/private_key
 ```

@@ -53,7 +54,7 @@ is not working, you can remove the node and install it again.
 Use `--extra-vars "node=<nodename>,<nodename2>"` to select the node(s) you want to delete.

 ```ShellSession
-ansible-playbook -i inventory/mycluster/inventory.ini remove-node.yml -b -v \
+ansible-playbook -i inventory/mycluster/hosts.yml remove-node.yml -b -v \
 --private-key=~/.ssh/private_key \
 --extra-vars "node=nodename,nodename2"
 ```
@@ -86,7 +87,7 @@ the Kubernetes [documentation](https://kubernetes.io/docs/tasks/access-applicati

 The main client of Kubernetes is `kubectl`. It is installed on each kube_control_plane
 host and can optionally be configured on your ansible host by setting
-`kubectl_localhost: true` and `kubeconfig_localhost: true` in `inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml`:
+`kubectl_localhost: true` and `kubeconfig_localhost: true` in the configuration:

 - If `kubectl_localhost` enabled, `kubectl` will download onto `/usr/local/bin/` and setup with bash completion. A helper script `inventory/mycluster/artifacts/kubectl.sh` also created for setup with below `admin.conf`.
 - If `kubeconfig_localhost` enabled `admin.conf` will appear in the `inventory/mycluster/artifacts/` directory after deployment.
--- a/docs/getting_started/setting-up-your-first-cluster.md
+++ b/docs/getting_started/setting-up-your-first-cluster.md
@@ -223,7 +223,7 @@ that controller-0, controller-1 and controller-2 in the `kube_control_plane` gro
 worker-0, worker-1 and worker-2 in the `kube_node` group. Add respective `ip` to the respective local VPC IP for each node.

 The main configuration for the cluster is stored in
-`inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml`. In this file we
+`inventory/mycluster/group_vars/k8s_cluster/k8s_cluster.yml`. In this file we
 will update the `supplementary_addresses_in_ssl_keys` with a list of the IP
 addresses of the controller nodes. In that way we can access the
  kubernetes API server as an administrator from outside the VPC network. You
@@ -240,7 +240,7 @@ the kubernetes cluster, just change the 'false' to 'true' for
 Now we will deploy the configuration:

 ```ShellSession
-ansible-playbook -i inventory/mycluster/inventory.ini -u $USERNAME -b -v --private-key=~/.ssh/id_rsa cluster.yml
+ansible-playbook -i inventory/mycluster/ -u $USERNAME -b -v --private-key=~/.ssh/id_rsa cluster.yml
 ```

 Ansible will now execute the playbook, this can take up to 20 minutes.
@@ -594,7 +594,7 @@ If you want to keep the VMs and just remove the cluster state, you can simply
 run another Ansible playbook:

 ```ShellSession
-ansible-playbook -i inventory/mycluster/inventory.ini -u $USERNAME -b -v --private-key=~/.ssh/id_rsa reset.yml
+ansible-playbook -i inventory/mycluster/ -u $USERNAME -b -v --private-key=~/.ssh/id_rsa reset.yml
 ```

 Resetting the cluster to the VMs original state usually takes about a couple
--- a/docs/ingress/kube-vip.md
+++ b/docs/ingress/kube-vip.md
@@ -86,12 +86,3 @@ kube_vip_leaseduration: 30
 kube_vip_renewdeadline: 20
 kube_vip_retryperiod: 4
 ```
-
-To expose [Prometheus metrics](https://kube-vip.io/docs/installation/flags/#environment-variables) from the kube-vip static pod, set `kube_vip_metrics_enabled`. `kube_vip_metrics_port` is an integer; the manifest sets `prometheus_server` to `:PORT` because kube-vip passes that value to Go's HTTP listen address (see [`servePrometheusHTTPServer` in kube-vip](https://github.com/kube-vip/kube-vip/blob/main/cmd/kube-vip.go)). The manifest `ports` entry uses the same number for tooling that reads the pod spec.
-
-Kubespray defaults `kube_vip_metrics_port` to `2112`, matching upstream kube-vip's `--prometheusHTTPServer` default. Override it if your scrape config expects another port.
-
-```yaml
-kube_vip_metrics_enabled: true
-# kube_vip_metrics_port: 2112
-```
--- a/docs/operating_systems/rhel.md
+++ b/docs/operating_systems/rhel.md
@@ -35,6 +35,6 @@ If the RHEL hosts are already registered to a valid Red Hat support subscription

 (Experimental in Kubespray CI)

-The official Rocky Linux 10 cloud image does not include `kernel-modules-extra`. Both Kube Proxy and CNI rely on this package, and since it relates to kernel version compatibility (which may require VM reboots, etc.), we haven't found an ideal solution.
+The official Rocky Linux 10 cloud image does not include `kernel-module-extra`. Both Kube Proxy and CNI rely on this package, and since it relates to kernel version compatibility (which may require VM reboots, etc.), we haven't found an ideal solution.

 However, some users report that it doesn't affect them (minimal version). Therefore, the Kubespray CI Rocky Linux 10 image is built by Kubespray maintainers using `diskimage-builder`. For detailed methods, please refer to [the comments](https://github.com/kubernetes-sigs/kubespray/pull/12355#issuecomment-3705400093).
--- a/docs/operations/offline-environment.md
+++ b/docs/operations/offline-environment.md
@@ -22,10 +22,6 @@ Then you need to setup the following services on your offline environment:
 You can get artifact lists with [generate_list.sh](/contrib/offline/generate_list.sh) script.
 In addition, you can find some tools for offline deployment under [contrib/offline](/contrib/offline/README.md).

-## Tip: use the original domains as top directories in the files_repo, i.e `github.com/`, `dl.k8s.io/`, `storage.googleapis.com/`, `get.helm.sh/`
-
-## Tip: for Cilium ensure to mirror <https://helm.cilium.io/index.yaml> and the chart cilium-1.18.2.tgz in files_repo
-
 ## Access Control

 ### Note: access controlled files_repo
@@ -48,8 +44,7 @@ files_repo: "https://{{ files_repo_user ~ ':' ~ files_repo_pass ~ '@' ~ files_re

 ### Note: access controlled registry

-Specify a "{{ registry_user }}" and "{{ registry_pass }}" for "{{ registry_addr }}",
-These are used to download the container images. Ensure to encrypt the password (if used) with ansible-vault.
+To specify a username and password for "{{ registry_host }}", used to download the container images, you can use url-encoding too.

 ```yaml
 registry_pass: !vault |
@@ -59,30 +54,7 @@ registry_pass: !vault |
          64653965663965356137333436616536643132336630313235333232336661373761643766356366
          6232353233386534380a373262313634613833623537626132633033373064336261383166323230
          3164
-```

-To enable Containerd **2+** to access the private registry:
-
-```yaml
-
-containerd_registries_mirrors:
-  - prefix: docker.io
-    mirrors:
-      - host: https://registry-1.docker.io
-        capabilities: ["pull", "resolve"]
-        skip_verify: false
-  - prefix: "{{ registry_addr }}"
-    mirrors:
-      - host: "https://{{ registry_addr }}"
-        capabilities: ["pull", "resolve"]
-        skip_verify: false
-        header:
-          Authorization: ["Basic {{ (registry_user + ':' + registry_pass) | b64encode }}"]
-```
-
-To enable Containerd **1.7** to access the private registry:
-
-```yaml
 containerd_registry_auth:
  - registry: "{{ registry_host }}"
    username: "{{ registry_user }}"
@@ -101,12 +73,25 @@ gcr_image_repo: "{{ registry_host }}"
 docker_image_repo: "{{ registry_host }}"
 quay_image_repo: "{{ registry_host }}"
 github_image_repo: "{{ registry_host }}"
-github_url: "{{ files_repo }}/github.com"
-dl_k8s_io_url: "{{ files_repo }}/dl.k8s.io"
-storage_googleapis_url: "{{ files_repo }}/storage.googleapis.com"
-get_helm_url: "{{ files_repo }}/get.helm.sh"
+
 local_path_provisioner_helper_image_repo: "{{ registry_host }}/busybox"
-# Insecure registries for containerd (see authenticated example above)
+kubeadm_download_url: "{{ files_repo }}/kubernetes/v{{ kube_version }}/kubeadm"
+kubectl_download_url: "{{ files_repo }}/kubernetes/v{{ kube_version }}/kubectl"
+kubelet_download_url: "{{ files_repo }}/kubernetes/v{{ kube_version }}/kubelet"
+# etcd is optional if you **DON'T** use etcd_deployment=host
+etcd_download_url: "{{ files_repo }}/kubernetes/etcd/etcd-v{{ etcd_version }}-linux-{{ image_arch }}.tar.gz"
+cni_download_url: "{{ files_repo }}/kubernetes/cni/cni-plugins-linux-{{ image_arch }}-v{{ cni_version }}.tgz"
+crictl_download_url: "{{ files_repo }}/kubernetes/cri-tools/crictl-v{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
+# If using Calico
+calicoctl_download_url: "{{ files_repo }}/kubernetes/calico/v{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}"
+# If using Calico with kdd
+calico_crds_download_url: "{{ files_repo }}/github.com/projectcalico/calico/raw/v{{ calico_version }}/manifests/crds.yaml"
+# Containerd
+containerd_download_url: "{{ files_repo }}/containerd-{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
+runc_download_url: "{{ files_repo }}/runc.{{ image_arch }}"
+nerdctl_download_url: "{{ files_repo }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
+get_helm_url: "{{ files_repo }}/get.helm.sh"
+# Insecure registries for containerd
 containerd_registries_mirrors:
  - prefix: "{{ registry_addr }}"
    mirrors:
@@ -114,34 +99,6 @@ containerd_registries_mirrors:
        capabilities: ["pull", "resolve"]
        skip_verify: true

-# Cilium
-cilium_install_extra_flags: "--repository {{ files_repo }}/helm.cilium.io/"
-cilium_extra_values:
-  image:
-    useDigest: false
-  hubble:
-    relay:
-      image:
-        useDigest: false
-    ui:
-      backend:
-        image:
-          useDigest: false
-      frontend:
-        image:
-          useDigest: false
-  operator:
-    image:
-      override: "{{ registry_host }}/cilium/operator-generic:v1.18.2"
-      useDigest: false
-      extension: ""
-  certgen:
-    image:
-      useDigest: false
-  envoy:
-    image:
-      useDigest: false
-
 # CentOS/Redhat/AlmaLinux/Rocky Linux
 ## Docker / Containerd
 docker_rh_repo_base_url: "{{ yum_repo }}/docker-ce/$releasever/$basearch"
--- a/docs/operations/upgrades.md
+++ b/docs/operations/upgrades.md
@@ -26,13 +26,13 @@ If you wanted to upgrade just kube_version from v1.18.10 to v1.19.7, you could
 deploy the following way:

 ```ShellSession
-ansible-playbook cluster.yml -i inventory/sample/inventory.ini -e kube_version=1.18.10 -e upgrade_cluster_setup=true
+ansible-playbook cluster.yml -i inventory/sample/hosts.ini -e kube_version=1.18.10 -e upgrade_cluster_setup=true
 ```

 And then repeat with 1.19.7 as kube_version:

 ```ShellSession
-ansible-playbook cluster.yml -i inventory/sample/inventory.ini -e kube_version=1.19.7 -e upgrade_cluster_setup=true
+ansible-playbook cluster.yml -i inventory/sample/hosts.ini -e kube_version=1.19.7 -e upgrade_cluster_setup=true
 ```

 The var ```-e upgrade_cluster_setup=true``` is needed to be set in order to migrate the deploys of e.g kube-apiserver inside the cluster immediately which is usually only done in the graceful upgrade. (Refer to [#4139](https://github.com/kubernetes-sigs/kubespray/issues/4139) and [#4736](https://github.com/kubernetes-sigs/kubespray/issues/4736))
@@ -46,7 +46,7 @@ existing cluster. That means there must be at least 1 kube_control_plane already
 deployed.

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.19.7
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.19.7
 ```

 After a successful upgrade, the Server Version should be updated:
@@ -60,7 +60,7 @@ Server Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.7", GitCom
 You can control how many nodes are upgraded at the same time by modifying the ansible variable named `serial`, as explained [here](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_strategies.html#setting-the-batch-size-with-serial). If you don't set this variable, it will upgrade the cluster nodes in batches of  20% of the available nodes. Setting `serial=1` would mean upgrade one node at a time.

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 -e "serial=1"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 -e "serial=1"
 ```

 ### Pausing the upgrade
@@ -82,20 +82,20 @@ If you don't want to upgrade all nodes in one run, you can use `--limit` [patter
 Before using `--limit` run playbook `facts.yml` without the limit to refresh facts cache for all nodes:

 ```ShellSession
-ansible-playbook playbooks/facts.yml -b -i inventory/sample/inventory.ini
+ansible-playbook playbooks/facts.yml -b -i inventory/sample/hosts.ini
 ```

 After this upgrade control plane and etcd groups [#5147](https://github.com/kubernetes-sigs/kubespray/issues/5147):

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "kube_control_plane:etcd"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "kube_control_plane:etcd"
 ```

 Now you can upgrade other nodes in any order and quantity:

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "node4:node6:node7:node12"
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "node5*"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "node4:node6:node7:node12"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "node5*"
 ```

 ## Multiple upgrades
@@ -122,9 +122,9 @@ v2.24.0
 v2.22.0 -> v2.23.2 -> v2.24.0 : ✓
 v.22.0 -> v2.24.0 : ✕

-Assuming you don't explicitly define a kubernetes version in your group_vars/k8s_cluster/k8s-cluster.yml, you simply check out the next tag and run the upgrade-cluster.yml playbook
+Assuming you don't explicitly define a kubernetes version in your k8s_cluster.yml, you simply check out the next tag and run the upgrade-cluster.yml playbook

-* If you do define kubernetes version in your inventory (e.g. group_vars/k8s_cluster/k8s-cluster.yml) then either make sure to update it before running upgrade-cluster, or specify the new version you're upgrading to: `ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml -e kube_version=1.11.3`
+* If you do define kubernetes version in your inventory (e.g. group_vars/k8s_cluster.yml) then either make sure to update it before running upgrade-cluster, or specify the new version you're upgrading to: `ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml -e kube_version=1.11.3`

  Otherwise, the upgrade will leave your cluster at the same k8s version defined in your inventory vars.

@@ -155,7 +155,7 @@ HEAD is now at 05dabb7e Fix Bionic networking restart error #3430 (#3431)

 # NOTE: May need to `pip3 install -r requirements.txt` when upgrading.

-ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml

 ...

@@ -178,7 +178,7 @@ Some deprecations between versions that mean you can't just upgrade straight fro
 In this case, I set "kubeadm_enabled" to false, knowing that it is deprecated and removed by 2.9.0, to delay converting the cluster to kubeadm as long as I could.

 ```ShellSession
-$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -196,7 +196,7 @@ $ git checkout v2.8.1
 Previous HEAD position was 9051aa52 Fix ubuntu-contiv test failed (#3808)
 HEAD is now at 2ac1c756 More Feature/2.8 backports for 2.8.1 (#3911)

-$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -214,7 +214,7 @@ $ git checkout v2.8.2
 Previous HEAD position was 2ac1c756 More Feature/2.8 backports for 2.8.1 (#3911)
 HEAD is now at 4167807f Upgrade to 1.12.5 (#4066)

-$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -232,7 +232,7 @@ $ git checkout v2.8.3
 Previous HEAD position was 4167807f Upgrade to 1.12.5 (#4066)
 HEAD is now at ea41fc5e backport cve-2019-5736 to release-2.8 (#4234)

-$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -250,7 +250,7 @@ $ git checkout v2.8.4
 Previous HEAD position was ea41fc5e backport cve-2019-5736 to release-2.8 (#4234)
 HEAD is now at 3901480b go to k8s 1.12.7 (#4400)

-$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -268,7 +268,7 @@ $ git checkout v2.8.5
 Previous HEAD position was 3901480b go to k8s 1.12.7 (#4400)
 HEAD is now at 6f97687d Release 2.8 robust san handling (#4478)

-$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -288,14 +288,14 @@ HEAD is now at a4e65c7c Upgrade to Ansible >2.7.0 (#4471)
 ```

 > **Warning**
-> IMPORTANT: Some variable formats changed in the group_vars/k8s_cluster/k8s-cluster.yml between 2.8.5 and 2.9.0
+> IMPORTANT: Some variable formats changed in the k8s_cluster.yml between 2.8.5 and 2.9.0

 If you do not keep your inventory copy up to date, **your upgrade will fail** and your first master will be left non-functional until fixed and re-run.

 It is at this point the cluster was upgraded from non-kubeadm to kubeadm as per the deprecation warning.

 ```ShellSession
-ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml

 ...

@@ -320,7 +320,7 @@ $ git checkout v2.10.0
 Previous HEAD position was a4e65c7c Upgrade to Ansible >2.7.0 (#4471)
 HEAD is now at dcd9c950 Add etcd role dependency on kube user to avoid etcd role failure when running scale.yml with a fresh node. (#3240) (#4479)

-ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml

 ...

@@ -372,49 +372,49 @@ hosts.
 Upgrade docker:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=docker
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=docker
 ```

 Upgrade etcd:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=etcd
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=etcd
 ```

 Upgrade etcd without rotating etcd certs:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=etcd --limit=etcd --skip-tags=etcd-secrets
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=etcd --limit=etcd --skip-tags=etcd-secrets
 ```

 Upgrade kubelet:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=node --skip-tags=k8s-gen-certs
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=node --skip-tags=k8s-gen-certs
 ```

 Upgrade Kubernetes master components:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=master
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=master
 ```

 Upgrade network plugins:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=network
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=network
 ```

 Upgrade all add-ons:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=apps
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=apps
 ```

 Upgrade just helm (assuming `helm_enabled` is true):

 ```ShellSession
-ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=helm
+ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=helm
 ```

 ## Migrate from Docker to Containerd
@@ -430,12 +430,10 @@ As of Kubespray 2.18.0, containerd is already the default container engine. If y
 If you want to upgrade the APT or YUM packages while the nodes are cordoned, you can use:

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e system_upgrade=true
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e system_upgrade=true
 ```

 Nodes will be rebooted when there are package upgrades (`system_upgrade_reboot: on-upgrade`).
 This can be changed to `always` or `never`.

 Note: Downloads will happen twice unless `system_upgrade_reboot` is `never`.
-
-Debian based nodes can be cleaned of packages to reduce disk space usage with `system_upgrade_autoclean: true`
--- a/docs/upgrades/migrate_docker2containerd.md
+++ b/docs/upgrades/migrate_docker2containerd.md
@@ -28,11 +28,11 @@ Everything done here requires full root access to every node.
 Before you begin, adjust your inventory:

 ```yaml
-# Filename: group_vars/k8s_cluster/k8s-cluster.yml
+# Filename: k8s_cluster/k8s-cluster.yml
 resolvconf_mode: host_resolvconf
 container_manager: containerd

-# Filename: group_vars/all/etcd.yml
+# Filename: etcd.yml
 etcd_deployment_type: host
 ```

@@ -66,7 +66,7 @@ apt-get install pigz
 ### 5) Run `cluster.yml` playbook with `--limit`

 ```commandline
-ansible-playbook -i inventory/sample/inventory.ini cluster.yml --limit=NODENAME
+ansible-playbook -i inventory/sample/hosts.ini cluster.yml --limit=NODENAME
 ```

 This effectively reinstalls containerd and seems to place all config files in the right place. When this completes, kubelet will immediately pick up the new container engine and start spinning up DaemonSets and kube-system Pods.
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -2,7 +2,7 @@
 namespace: kubernetes_sigs
 description: Deploy a production ready Kubernetes cluster
 name: kubespray
-version: 2.32.0
+version: 2.31.0
 readme: README.md
 authors:
  - The Kubespray maintainers (https://kubernetes.slack.com/channels/kubespray)
--- a/inventory/sample/group_vars/all/offline.yml
+++ b/inventory/sample/group_vars/all/offline.yml
@@ -71,7 +71,7 @@
 # skopeo_download_url: "{{ files_repo }}/github.com/lework/skopeo-binary/releases/download/v{{ skopeo_version }}/skopeo-linux-{{ image_arch }}"

 # [Optional] containerd: only if you set container_runtime: containerd
-# containerd_download_url: "{{ files_repo }}/github.com/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ 'static-' if containerd_static_binary }}{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
+# containerd_download_url: "{{ files_repo }}/github.com/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ containerd_version }}-linux-{{ image_arch }}.tar.gz"
 # nerdctl_download_url: "{{ files_repo }}/github.com/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"

 # [Optional] runsc,containerd-shim-runsc: only if you set gvisor_enabled: true
--- a/inventory/sample/group_vars/all/openstack.yml
+++ b/inventory/sample/group_vars/all/openstack.yml
@@ -42,13 +42,13 @@

 ## Tags for the Cinder CSI images
 ## registry.k8s.io/sig-storage/csi-attacher
-# cinder_csi_attacher_image_tag: "v4.5.1"
+# cinder_csi_attacher_image_tag: "v4.4.2"
 ## registry.k8s.io/sig-storage/csi-provisioner
-# cinder_csi_provisioner_image_tag: "v4.0.1"
+# cinder_csi_provisioner_image_tag: "v3.6.2"
 ## registry.k8s.io/sig-storage/csi-snapshotter
-# cinder_csi_snapshotter_image_tag: "v7.0.2"
+# cinder_csi_snapshotter_image_tag: "v6.3.2"
 ## registry.k8s.io/sig-storage/csi-resizer
-# cinder_csi_resizer_image_tag: "v1.10.1"
+# cinder_csi_resizer_image_tag: "v1.9.2"
 ## registry.k8s.io/sig-storage/livenessprobe
 # cinder_csi_livenessprobe_image_tag: "v2.11.0"

--- a/inventory/sample/group_vars/k8s_cluster/addons.yml
+++ b/inventory/sample/group_vars/k8s_cluster/addons.yml
@@ -201,8 +201,6 @@ kube_vip_enabled: false
 # kube_vip_lb_fwdmethod: local
 # kube_vip_bgp_sourceip:
 # kube_vip_bgp_sourceif:
-# kube_vip_metrics_enabled: false
-# kube_vip_metrics_port: 2112

 # Node Feature Discovery
 node_feature_discovery_enabled: false
--- a/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
@@ -53,21 +53,6 @@ credentials_dir: "{{ inventory_dir }}/credentials"
 # kube_oidc_groups_claim: groups
 # kube_oidc_groups_prefix: 'oidc:'

-## Structured AuthenticationConfiguration https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration
-## Note: --authentication-config and --oidc-* flags are mutually exclusive
-# kube_apiserver_use_authentication_config_file: false
-# kube_apiserver_authentication_config_jwt:
-#   - issuer:
-#       url: https://issuer.example.com
-#       audiences:
-#       - my-audience
-#     claimMappings:
-#       username:
-#         expression: 'claims.sub'
-# kube_apiserver_authentication_config_anonymous:
-#   enabled: "{{ kube_api_anonymous_auth }}"
-#   conditions: []
-
 ## Variables to control webhook authn/authz
 # kube_webhook_token_auth: false
 # kube_webhook_token_auth_url: https://...
@@ -293,6 +278,7 @@ default_kubelet_config_dir: "{{ kube_config_dir }}/dynamic_kubelet_dir"
 ## Eviction Thresholds to avoid system OOMs
 # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
 # eviction_hard: {}
+# eviction_hard_control_plane: {}

 # An alternative flexvolume plugin directory
 # kubelet_flexvolumes_plugins_dir: /usr/libexec/kubernetes/kubelet-plugins/volume/exec
--- a/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml
@@ -30,14 +30,6 @@
 ## Helm repository URL
 # custom_cni_chart_repository_url: ""
 #
-## Helm repository username, if authentication is required
-## Username and password must be defined together
-# custom_cni_chart_repository_username: "<helm_repository_username>"
-#
-## Helm repository password, if authentication is required
-## Store sensitive values securely, for example using Ansible Vault
-# custom_cni_chart_repository_password: "<helm_repository_password>"
-#
 ## Helm chart reference - path to the chart in the repository
 # custom_cni_chart_ref: ""
 #
--- a/pipeline.Dockerfile
+++ b/pipeline.Dockerfile
@@ -46,8 +46,8 @@ ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
 RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
    && pip install --break-system-packages --ignore-installed --no-compile --no-cache-dir pip -U \
    && pip install --break-system-packages --no-compile --no-cache-dir -r tests/requirements.txt \
-    && curl -L https://dl.k8s.io/release/v1.36.3/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
-    && echo $(curl -L https://dl.k8s.io/release/v1.36.3/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
+    && curl -L https://dl.k8s.io/release/v1.35.1/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
+    && echo $(curl -L https://dl.k8s.io/release/v1.35.1/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl \
    # Install Vagrant
    && curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
@@ -55,5 +55,5 @@ RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
    && rm vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
    && vagrant plugin install vagrant-libvirt \
    # Install Kubernetes collections
-    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes==35.0.0 \
-    && ansible-galaxy collection install kubernetes.core:==6.4.0
+    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes \
+    && ansible-galaxy collection install kubernetes.core
--- a/playbooks/ansible_version.yml
+++ b/playbooks/ansible_version.yml
@@ -21,6 +21,13 @@
    - name: "Check that python netaddr is installed"
      assert:
        msg: "Python netaddr is not present"
-        that: "'127.0.0.1' | ansible.utils.ipaddr == '127.0.0.1'"
+        that: "'127.0.0.1' | ansible.utils.ipaddr"
+      tags:
+        - check
+
+    - name: "Check that jinja is not too old (install via pip)"
+      assert:
+        msg: "Your Jinja version is too old, install via pip"
+        that: "{% set test %}It works{% endset %}{{ test == 'It works' }}"
      tags:
        - check
--- a/plugins/modules/kube.py
+++ b/plugins/modules/kube.py
@@ -325,8 +325,9 @@ def main():
            log_level=dict(default=0, type='int'),
            state=dict(default='present', choices=['present', 'absent', 'latest', 'reloaded', 'stopped', 'exists']),
            recursive=dict(default=False, type='bool'),
-        ),
-    )
+            ),
+            mutually_exclusive=[['filename', 'list']]
+        )

    changed = False

--- a/requirements.txt
+++ b/requirements.txt
@@ -1,11 +1,7 @@
 ansible==11.13.0
-# Prevented passlib version conflicts
-bcrypt<6
 # Needed for community.crypto module
-cryptography==49.0.0
+cryptography==46.0.5
 # Needed for jinja2 json_query templating
 jmespath==1.1.0
 # Needed for ansible.utils.ipaddr
 netaddr==1.3.0
-# Needed for encrypt hash
-passlib==1.7.4
--- a/roles/bootstrap_os/defaults/main.yml
+++ b/roles/bootstrap_os/defaults/main.yml
@@ -20,10 +20,6 @@ openeuler_metalink_enabled: false
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true

-## RHEL specific variables
-# Enable RHEL subscription repos
-rhel_enable_repos: true
-
 ## Ubuntu specific variables
 # Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
 ubuntu_kernel_unattended_upgrades_disabled: false
--- a/roles/bootstrap_os/tasks/centos.yml
+++ b/roles/bootstrap_os/tasks/centos.yml
@@ -6,7 +6,7 @@

 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
  community.general.ini_file:
-    path: "{{ ((ansible_facts['distribution_major_version'] | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
+    path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
    section: main
    option: proxy
    value: "{{ http_proxy | default(omit) }}"
@@ -20,28 +20,28 @@

 - name: Install EPEL for Oracle Linux repo package
  package:
-    name: "oracle-epel-release-el{{ ansible_facts['distribution_major_version'] }}"
+    name: "oracle-epel-release-el{{ ansible_distribution_major_version }}"
    state: present
  when:
-    - use_oracle_public_repo
+    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_facts['distribution_version'] | float) >= 7.6
+    - (ansible_distribution_version | float) >= 7.6

 - name: Enable Oracle Linux repo
  community.general.ini_file:
-    dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_facts['distribution_major_version'] }}.repo"
-    section: "ol{{ ansible_facts['distribution_major_version'] }}_addons"
+    dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_distribution_major_version }}.repo"
+    section: "ol{{ ansible_distribution_major_version }}_addons"
    option: "{{ item.option }}"
    value: "{{ item.value }}"
    mode: "0644"
  with_items:
-    - { option: "name", value: "ol{{ ansible_facts['distribution_major_version'] }}_addons" }
+    - { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
    - { option: "enabled", value: "1" }
-    - { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_facts['distribution_major_version'] }}/addons/$basearch/" }
+    - { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_distribution_major_version }}/addons/$basearch/" }
  when:
-    - use_oracle_public_repo
+    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_facts['distribution_version'] | float) >= 7.6
+    - (ansible_distribution_version | float) >= 7.6

 - name: Enable Centos extra repo for Oracle Linux
  community.general.ini_file:
@@ -51,15 +51,15 @@
    value: "{{ item.value }}"
    mode: "0644"
  with_items:
-    - { option: "name", value: "CentOS-{{ ansible_facts['distribution_major_version'] }} - Extras" }
+    - { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" }
    - { option: "enabled", value: "1" }
    - { option: "gpgcheck", value: "0" }
-    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_facts['distribution_major_version'] }}/extras/$basearch/os/" }
+    - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_distribution_major_version }}/extras/$basearch/os/" }
  when:
-    - use_oracle_public_repo
+    - use_oracle_public_repo | default(true)
    - '''ID="ol"'' in os_release.stdout_lines'
-    - (ansible_facts['distribution_version'] | float) >= 7.6
-    - (ansible_facts['distribution_version'] | float) < 9
+    - (ansible_distribution_version | float) >= 7.6
+    - (ansible_distribution_version | float) < 9

 # CentOS ships with python installed

--- a/roles/bootstrap_os/tasks/openEuler.yml
+++ b/roles/bootstrap_os/tasks/openEuler.yml
@@ -2,25 +2,6 @@
 - name: Import CentOS bootstrap for openEuler
  ansible.builtin.import_tasks: centos.yml

- name: Read openEuler release string
-  ansible.builtin.command: cat /etc/openEuler-release
-  register: _openeuler_release_raw
-  changed_when: false
-  check_mode: false
-  become: true
-  when: openeuler_metalink_enabled
-
-# /etc/openEuler-release contains e.g. "openEuler release 24.03 (LTS)"
-# The metalink server expects "24.03LTS" (no spaces/parens/dashes),
-# but DNF's $releasever resolves to just "24.03", causing "invalid repo or arch".
- name: Set openEuler metalink releasever
-  ansible.builtin.set_fact:
-    _openeuler_releasever: >-
-      {{ _openeuler_release_raw.stdout
-         | regex_replace('.*release\s+', '')
-         | regex_replace('[() -]', '') }}
-  when: openeuler_metalink_enabled
-
 - name: Get existing openEuler repo sections
  ansible.builtin.shell:
    cmd: "set -o pipefail && grep '^\\[' /etc/yum.repos.d/openEuler.repo | tr -d '[]'"
@@ -46,16 +27,16 @@
  register: _openeuler_metalink_result
  vars:
    _openeuler_metalink_repos:
-      OS: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/OS&arch=$basearch"
-      everything: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/everything&arch=$basearch"
-      EPOL: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/EPOL/main&arch=$basearch"
-      debuginfo: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/debuginfo&arch=$basearch"
-      source: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}&arch=source"
-      update: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/update&arch=$basearch"
-      update-source: "https://mirrors.openeuler.org/metalink?repo={{ _openeuler_releasever }}/update&arch=source"
+      OS: "https://mirrors.openeuler.org/metalink?repo=$releasever/OS&arch=$basearch"
+      everything: "https://mirrors.openeuler.org/metalink?repo=$releasever/everything&arch=$basearch"
+      EPOL: "https://mirrors.openeuler.org/metalink?repo=$releasever/EPOL/main&arch=$basearch"
+      debuginfo: "https://mirrors.openeuler.org/metalink?repo=$releasever/debuginfo&arch=$basearch"
+      source: "https://mirrors.openeuler.org/metalink?repo=$releasever&arch=source"
+      update: "https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=$basearch"
+      update-source: "https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=source"

- name: Clean dnf metadata cache to apply metalink mirror selection
-  ansible.builtin.command: dnf clean metadata
+- name: Clean dnf cache to apply metalink mirror selection
+  ansible.builtin.command: dnf clean all
  become: true
  when:
    - openeuler_metalink_enabled
--- a/roles/bootstrap_os/tasks/rhel.yml
+++ b/roles/bootstrap_os/tasks/rhel.yml
@@ -6,7 +6,7 @@

 - name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
  community.general.ini_file:
-    path: "{{ ((ansible_facts['distribution_major_version'] | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
+    path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
    section: main
    option: proxy
    value: "{{ http_proxy | default(omit) }}"
@@ -69,9 +69,9 @@
    name:
      - "rhel-8-for-*-baseos-rpms"
      - "rhel-8-for-*-appstream-rpms"
-    state: "{{ 'enabled' if (rhel_enable_repos | bool) else 'disabled' }}"
+    state: "{{ 'enabled' if (rhel_enable_repos | default(True) | bool) else 'disabled' }}"
  when:
-    - ansible_facts['distribution_major_version'] == "8"
+    - ansible_distribution_major_version == "8"
    - (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)

 - name: Check presence of fastestmirror.conf
--- a/roles/container-engine/containerd-common/tasks/main.yml
+++ b/roles/container-engine/containerd-common/tasks/main.yml
@@ -15,14 +15,14 @@
  include_vars: "{{ item }}"
  with_first_found:
    - files:
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_facts['os_family'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_facts['os_family'] | lower }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_os_family | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_os_family | lower }}.yml"
        - defaults.yml
      paths:
        - ../vars
--- a/roles/container-engine/containerd/templates/config.toml.j2
+++ b/roles/container-engine/containerd/templates/config.toml.j2
@@ -1,8 +1,4 @@
-{% if containerd_version is version('2.3.0', '>=') %}
-version = 4
-{% else %}
 version = 3
-{% endif %}

 root = "{{ containerd_storage_dir }}"
 state = "{{ containerd_state_dir }}"
--- a/roles/container-engine/cri-o/defaults/main.yml
+++ b/roles/container-engine/cri-o/defaults/main.yml
@@ -31,7 +31,7 @@ crio_registry_auth: []

 crio_seccomp_profile: ""
 crio_selinux: "{{ (preinstall_selinux_state == 'enforcing') | lower }}"
-crio_signature_policy: "{% if ansible_facts['os_family'] == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
+crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
 # Set the pull progress timeout
 crio_pull_progress_timeout: "10s"

--- a/roles/container-engine/cri-o/tasks/main.yaml
+++ b/roles/container-engine/cri-o/tasks/main.yaml
@@ -28,7 +28,7 @@

 - name: Cri-o | special handling for amazon linux
  import_tasks: "setup-amazon.yaml"
-  when: ansible_facts['distribution'] in ["Amazon"]
+  when: ansible_distribution in ["Amazon"]

 - name: Cri-o | build a list of crio runtimes with Katacontainers runtimes
  set_fact:
@@ -150,7 +150,7 @@
  copy:
    src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
    dest: /etc/systemd/system/crio.service
-    mode: "0644"
+    mode: "0755"
    remote_src: true
  notify: Restart crio

@@ -189,7 +189,7 @@
    dest: /etc/containers/mounts.conf
    mode: "0644"
  when:
-    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_os_family == 'RedHat'
  notify: Restart crio

 - name: Cri-o | create directory for oci hooks
@@ -220,9 +220,7 @@
    dest: /etc/containers/storage.conf
    section: storage.options.overlay
    option: mountopt
-    value: >-
-      {{ '"nodev"' if ansible_facts['kernel'] is version(('4.18' if ansible_facts['os_family'] == 'RedHat' else '4.19'), '<')
-      else '"nodev,metacopy=on"' }}
+    value: '{{ ''"nodev"'' if ansible_kernel is version(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
    mode: "0644"

 - name: Cri-o | create directory registries configs
--- a/roles/container-engine/cri-o/tasks/reset.yml
+++ b/roles/container-engine/cri-o/tasks/reset.yml
@@ -4,8 +4,8 @@

 - name: CRI-O | Kubic repo name for debian os family
  set_fact:
-    crio_kubic_debian_repo_name: "{{ ((ansible_facts['distribution'] == 'Ubuntu') | ternary('x', '')) ~ ansible_facts['distribution'] ~ '_' ~ ansible_facts['distribution_version'] }}"
-  when: ansible_facts['os_family'] == "Debian"
+    crio_kubic_debian_repo_name: "{{ ((ansible_distribution == 'Ubuntu') | ternary('x', '')) ~ ansible_distribution ~ '_' ~ ansible_distribution_version }}"
+  when: ansible_os_family == "Debian"
  tags:
    - reset_crio

@@ -30,7 +30,7 @@
  yum_repository:
    name: devel_kubic_libcontainers_stable
    state: absent
-  when: ansible_facts['distribution'] in ["Amazon"]
+  when: ansible_distribution in ["Amazon"]
  tags:
    - reset_crio

@@ -39,15 +39,15 @@
    name: "devel_kubic_libcontainers_stable_cri-o_v{{ crio_version }}"
    state: absent
  when:
-    - ansible_facts['os_family'] == "RedHat"
-    - ansible_facts['distribution'] not in ["Amazon", "Fedora"]
+    - ansible_os_family == "RedHat"
+    - ansible_distribution not in ["Amazon", "Fedora"]
  tags:
    - reset_crio

 - name: CRI-O | Run yum-clean-metadata
  command: yum clean metadata
  when:
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
  tags:
    - reset_crio

--- a/roles/container-engine/docker/defaults/main.yml
+++ b/roles/container-engine/docker/defaults/main.yml
@@ -49,11 +49,11 @@ containerd_package_info:
  pkgs:

 # Fedora docker-ce repo
-docker_fedora_repo_base_url: 'https://download.docker.com/linux/fedora/{{ ansible_facts["distribution_major_version"] }}/$basearch/stable'
+docker_fedora_repo_base_url: 'https://download.docker.com/linux/fedora/{{ ansible_distribution_major_version }}/$basearch/stable'
 docker_fedora_repo_gpgkey: 'https://download.docker.com/linux/fedora/gpg'

 # CentOS/RedHat docker-ce repo
-docker_rh_repo_base_url: 'https://download.docker.com/linux/rhel/{{ ansible_facts["distribution_major_version"] }}/$basearch/stable'
+docker_rh_repo_base_url: 'https://download.docker.com/linux/rhel/{{ ansible_distribution_major_version }}/$basearch/stable'
 docker_rh_repo_gpgkey: 'https://download.docker.com/linux/rhel/gpg'

 # Ubuntu docker-ce repo
--- a/roles/container-engine/docker/handlers/main.yml
+++ b/roles/container-engine/docker/handlers/main.yml
@@ -10,7 +10,7 @@
  service:
    name: docker.socket
    state: restarted
-  when: ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] or is_fedora_coreos
+  when: ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] or is_fedora_coreos
  listen: Restart docker


--- a/roles/container-engine/docker/tasks/main.yml
+++ b/roles/container-engine/docker/tasks/main.yml
@@ -15,16 +15,16 @@
  include_vars: "{{ item }}"
  with_first_found:
    - files:
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] | lower }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_facts['distribution'].split(' ')[0] | lower }}.yml"
-        - "{{ ansible_facts['os_family'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['os_family'] | lower }}-{{ host_architecture }}.yml"
-        - "{{ ansible_facts['os_family'] | lower }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_distribution.split(' ')[0] | lower }}.yml"
+        - "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_os_family | lower }}-{{ host_architecture }}.yml"
+        - "{{ ansible_os_family | lower }}.yml"
        - defaults.yml
      paths:
        - ../vars
@@ -35,7 +35,7 @@
 - name: Warn about Docker version on SUSE
  debug:
    msg: "SUSE distributions always install Docker from the distro repos"
-  when: ansible_facts['pkg_mgr'] == 'zypper'
+  when: ansible_pkg_mgr == 'zypper'

 - name: Gather DNS facts
  include_tasks: set_facts_dns.yml
@@ -58,33 +58,33 @@
  delay: "{{ retry_stagger }}"
  with_items: "{{ docker_repo_key_info.repo_keys }}"
  environment: "{{ proxy_env }}"
-  when: ansible_facts['pkg_mgr'] == 'apt'
+  when: ansible_pkg_mgr == 'apt'

 # ref to https://github.com/kubernetes-sigs/kubespray/issues/11086 & 12424
 - name: Convert -backports sources to archive.debian.org for bullseye and older
  replace:
    path: "{{ item }}"
-    regexp: '^(deb(?:-src)?\s+)(?:https?://)?(?:[^ ]+debian\.org)?([^ ]*/debian)(\s+{{ ansible_facts["distribution_release"] }}-backports\b.*)'
+    regexp: '^(deb(?:-src)?\s+)(?:https?://)?(?:[^ ]+debian\.org)?([^ ]*/debian)(\s+{{ ansible_distribution_release }}-backports\b.*)'
    replace: '\1http://archive.debian.org/debian\3'
    backup: true
  loop: "{{ query('fileglob', '/etc/apt/sources.list') }}"
  when:
-    - ansible_facts['os_family'] == 'Debian'
-    - ansible_facts['distribution_release'] in ['bullseye', 'buster']
+    - ansible_os_family == 'Debian'
+    - ansible_distribution_release in ['bullseye', 'buster']

 - name: Ensure docker-ce repository is enabled
  apt_repository:
    repo: "{{ item }}"
    state: present
  with_items: "{{ docker_repo_info.repos }}"
-  when: ansible_facts['pkg_mgr'] == 'apt'
+  when: ansible_pkg_mgr == 'apt'

 - name: Configure docker repository on Fedora
  template:
    src: "fedora_docker.repo.j2"
    dest: "{{ yum_repo_dir }}/docker.repo"
    mode: "0644"
-  when: ansible_facts['distribution'] == "Fedora" and not is_ostree
+  when: ansible_distribution == "Fedora" and not is_ostree

 - name: Configure docker repository on RedHat/CentOS/OracleLinux/AlmaLinux/KylinLinux
  template:
@@ -92,15 +92,15 @@
    dest: "{{ yum_repo_dir }}/docker-ce.repo"
    mode: "0644"
  when:
-    - ansible_facts['os_family'] == "RedHat"
-    - ansible_facts['distribution'] != "Fedora"
+    - ansible_os_family == "RedHat"
+    - ansible_distribution != "Fedora"
    - not is_ostree

 - name: Remove dpkg hold
  dpkg_selections:
    name: "{{ item }}"
    selection: install
-  when: ansible_facts['pkg_mgr'] == 'apt'
+  when: ansible_pkg_mgr == 'apt'
  register: ret
  changed_when: false
  failed_when:
@@ -131,7 +131,7 @@
  delay: "{{ retry_stagger }}"
  notify: Restart docker
  when:
-    - not ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
    - not is_ostree
    - docker_package_info.pkgs | length > 0

@@ -140,7 +140,7 @@
  dpkg_selections:
    name: "{{ item }}"
    selection: hold
-  when: ansible_facts['pkg_mgr'] == 'apt'
+  when: ansible_pkg_mgr == 'apt'
  changed_when: false
  with_items:
    - "{{ containerd_package }}"
--- a/roles/container-engine/docker/tasks/pre-upgrade.yml
+++ b/roles/container-engine/docker/tasks/pre-upgrade.yml
@@ -4,7 +4,7 @@
    path: "{{ yum_repo_dir }}/docker.repo"
    state: absent
  when:
-    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_os_family == 'RedHat'
    - not is_ostree

 - name: Ensure old versions of Docker are not installed. | Debian
@@ -12,7 +12,7 @@
    name: '{{ docker_remove_packages_apt }}'
    state: absent
  when:
-    - ansible_facts['os_family'] == 'Debian'
+    - ansible_os_family == 'Debian'
    - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))


@@ -21,7 +21,7 @@
    name: '{{ podman_remove_packages_yum }}'
    state: absent
  when:
-    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_os_family == 'RedHat'
    - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
    - not is_ostree

@@ -31,6 +31,6 @@
    name: '{{ docker_remove_packages_yum }}'
    state: absent
  when:
-    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_os_family == 'RedHat'
    - (docker_versioned_pkg[docker_version | string] is search('docker-ce'))
    - not is_ostree
--- a/roles/container-engine/docker/tasks/reset.yml
+++ b/roles/container-engine/docker/tasks/reset.yml
@@ -46,7 +46,7 @@
  dpkg_selections:
    name: "{{ item }}"
    selection: install
-  when: ansible_facts['pkg_mgr'] == 'apt'
+  when: ansible_pkg_mgr == 'apt'
  changed_when: false
  with_items:
    - "{{ docker_packages_list }}"
@@ -61,7 +61,7 @@
    - "{{ docker_packages_list }}"
    - "{{ containerd_package }}"
  when:
-    - not ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
    - not is_ostree
    - docker_packages_list | length > 0

@@ -70,21 +70,21 @@
    repo: "{{ item }}"
    state: absent
  with_items: "{{ docker_repo_info.repos }}"
-  when: ansible_facts['pkg_mgr'] == 'apt'
+  when: ansible_pkg_mgr == 'apt'

 - name: Docker | Remove docker repository on Fedora
  file:
    name: "{{ yum_repo_dir }}/docker.repo"
    state: absent
-  when: ansible_facts['distribution'] == "Fedora" and not is_ostree
+  when: ansible_distribution == "Fedora" and not is_ostree

 - name: Docker | Remove docker repository on RedHat/CentOS/Oracle/AlmaLinux Linux
  file:
    name: "{{ yum_repo_dir }}/docker-ce.repo"
    state: absent
  when:
-    - ansible_facts['os_family'] == "RedHat"
-    - ansible_facts['distribution'] != "Fedora"
+    - ansible_os_family == "RedHat"
+    - ansible_distribution != "Fedora"
    - not is_ostree

 - name: Docker | Remove docker configuration files
--- a/roles/container-engine/docker/tasks/systemd.yml
+++ b/roles/container-engine/docker/tasks/systemd.yml
@@ -21,7 +21,7 @@
  register: docker_service_file
  notify: Restart docker
  when:
-    - not ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
    - not is_fedora_coreos

 - name: Write docker options systemd drop-in
--- a/roles/container-engine/docker/templates/docker-options.conf.j2
+++ b/roles/container-engine/docker/templates/docker-options.conf.j2
@@ -4,7 +4,7 @@ Environment="DOCKER_OPTS={{ docker_options|default('') }} --iptables={{ docker_i
 {% for i in docker_insecure_registries %}--insecure-registry={{ i }} {% endfor %} \
 {% for i in docker_registry_mirrors %}--registry-mirror={{ i }} {% endfor %} \
 --data-root={{ docker_daemon_graph }} \
-{% if ansible_facts['os_family'] not in ["openSUSE Leap", "openSUSE Tumbleweed", "Suse"] %}{{ docker_log_opts }}{% endif %}"
+{% if ansible_os_family not in ["openSUSE Leap", "openSUSE Tumbleweed", "Suse"] %}{{ docker_log_opts }}{% endif %}"

 {% if docker_mount_flags is defined and docker_mount_flags != "" %}
 MountFlags={{ docker_mount_flags }}
--- a/roles/container-engine/docker/templates/docker.service.j2
+++ b/roles/container-engine/docker/templates/docker.service.j2
@@ -2,7 +2,7 @@
 Description=Docker Application Container Engine
 Documentation=http://docs.docker.com
 After=network.target docker.socket containerd.service lvm2-monitor.service SuSEfirewall2.service
-{% if ansible_facts['os_family'] != "Suse" %}
+{% if ansible_os_family != "Suse" %}
 BindsTo=containerd.service
 {% endif %}
 Wants=docker.socket
@@ -17,7 +17,7 @@ ExecReload=/bin/kill -s HUP $MAINPID
 Delegate=yes
 KillMode=process
 ExecStart={{ docker_bin_dir }}/dockerd \
-{% if ansible_facts['os_family'] == "Suse" %}
+{% if ansible_os_family == "Suse" %}
          --add-runtime oci=/usr/sbin/docker-runc \
 {% endif %}
          $DOCKER_OPTS \
--- a/roles/container-engine/docker/vars/debian.yml
+++ b/roles/container-engine/docker/vars/debian.yml
@@ -42,49 +42,49 @@ containerd_versioned_pkg:
 # https://download.docker.com/linux/debian/
 docker_versioned_pkg:
  'latest': docker-ce
-  '18.09': docker-ce=5:18.09.9~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce=5:19.03.15~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce=5:26.1.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce=5:27.0.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce=5:27.1.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce=5:27.2.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce=5:27.3.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce=5:27.4.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce=5:27.5.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce=5:28.0.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce=5:28.1.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce=5:28.2.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'stable': docker-ce=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'edge': docker-ce=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
+  '18.09': docker-ce=5:18.09.9~3-0~debian-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce=5:19.03.15~3-0~debian-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce=5:28.1.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce=5:28.2.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
-  '18.09': docker-ce-cli=5:18.09.9~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce-cli=5:19.03.15~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce-cli=5:26.1.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce-cli=5:27.0.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce-cli=5:27.1.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce-cli=5:27.2.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce-cli=5:27.3.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce-cli=5:27.4.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce-cli=5:27.5.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce-cli=5:28.0.4-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce-cli=5:28.1.1-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce-cli=5:28.2.2-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'stable': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'edge': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_facts['distribution_major_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
+  '18.09': docker-ce-cli=5:18.09.9~3-0~debian-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce-cli=5:19.03.15~3-0~debian-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce-cli=5:28.1.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce-cli=5:28.2.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.3.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}

 docker_package_info:
  pkgs:
@@ -101,5 +101,5 @@ docker_repo_info:
  repos:
    - >
      deb {{ docker_debian_repo_base_url }}
-      {{ ansible_facts['distribution_release'] | lower }}
+      {{ ansible_distribution_release | lower }}
      stable
--- a/roles/container-engine/docker/vars/fedora.yml
+++ b/roles/container-engine/docker/vars/fedora.yml
@@ -2,87 +2,87 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
  'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  'stable': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
-  'edge': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_facts['distribution_major_version'] }}"
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.fc{{ ansible_distribution_major_version }}"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.fc{{ ansible_distribution_major_version }}"
+  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.27-3.1.fc{{ ansible_distribution_major_version }}"

 # https://docs.docker.com/install/linux/docker-ce/fedora/
 # https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/
 docker_versioned_pkg:
  'latest': docker-ce
-  '19.03': docker-ce-19.03.15-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-20.10.20-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-3:26.1.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-3:27.0.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-3:27.1.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-3:27.2.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-3:27.3.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-3:27.4.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-3:27.5.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-3:28.0.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-3:28.1.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-3:28.2.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-3:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-3:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-3:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
+  '19.03': docker-ce-19.03.15-3.fc{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-20.10.20-3.fc{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.4-1.fc{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-3:28.1.1-1.fc{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-3:28.2.2-1.fc{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-3:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.3.3-1.fc{{ ansible_distribution_major_version }}


 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
-  '19.03': docker-ce-cli-19.03.15-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-cli-1:26.1.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-cli-1:27.0.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-cli-1:27.1.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-cli-1:27.2.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-cli-1:27.3.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-cli-1:27.4.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-cli-1:27.5.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-cli-1:28.0.4-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-cli-1:28.1.1-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-cli-1:28.2.2-1.fc{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-cli-1:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-cli-1:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-cli-1:28.3.3-1.fc{{ ansible_facts['distribution_major_version'] }}
+  '19.03': docker-ce-cli-19.03.15-3.fc{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.fc{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.fc{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.2-1.fc{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.1-1.fc{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.1-1.fc{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.1-1.fc{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.1-1.fc{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.4-1.fc{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-cli-1:28.1.1-1.fc{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-cli-1:28.2.2-1.fc{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-cli-1:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.3.3-1.fc{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.3.3-1.fc{{ ansible_distribution_major_version }}

 docker_package_info:
  enablerepo: "docker-ce"
--- a/roles/container-engine/docker/vars/redhat.yml
+++ b/roles/container-engine/docker/vars/redhat.yml
@@ -2,42 +2,42 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
  'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'stable': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'edge': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_facts['distribution_major_version'] }}"
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_distribution_major_version }}"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.33': "{{ containerd_package }}-1.6.33-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.18': "{{ containerd_package }}-1.7.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.19': "{{ containerd_package }}-1.7.19-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.20': "{{ containerd_package }}-1.7.20-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.21': "{{ containerd_package }}-1.7.21-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.22': "{{ containerd_package }}-1.7.22-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.23': "{{ containerd_package }}-1.7.23-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.24': "{{ containerd_package }}-1.7.24-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.25': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.26': "{{ containerd_package }}-1.7.26-3.1.el{{ ansible_distribution_major_version }}"
+  '1.7.27': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.7.27-3.1.el{{ ansible_distribution_major_version }}"

 # https://docs.docker.com/engine/installation/linux/rhel/#install-from-a-package
 # https://download.docker.com/linux/rhel/<rhel_version>>/x86_64/stable/Packages/
@@ -45,46 +45,46 @@ containerd_versioned_pkg:
 docker_versioned_pkg:
  'latest': docker-ce
  '18.09': docker-ce-3:18.09.9-3.el7
-  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-3:20.10.24-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-3:26.0.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-3:26.1.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-3:27.0.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-3:27.1.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-3:27.2.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-3:27.3.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-3:27.4.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-3:27.5.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-3:28.0.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-3:28.1.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-3:28.2.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-3:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-3:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-3:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
+  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-3:20.10.24-3.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-3:26.1.4-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-3:27.0.3-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-3:27.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-3:27.2.1-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-3:27.3.1-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-3:27.4.1-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-3:27.5.1-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-3:28.0.4-1.el{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-3:28.1.1-1.el{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-3:28.2.2-1.el{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-3:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:28.3.3-1.el{{ ansible_distribution_major_version }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
  '18.09': docker-ce-cli-1:18.09.9-3.el7
-  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-cli-1:20.10.24-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '26.1': docker-ce-cli-1:26.1.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.0': docker-ce-cli-1:27.0.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.1': docker-ce-cli-1:27.1.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.2': docker-ce-cli-1:27.2.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.3': docker-ce-cli-1:27.3.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.4': docker-ce-cli-1:27.4.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '27.5': docker-ce-cli-1:27.5.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.0': docker-ce-cli-1:28.0.4-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.1': docker-ce-cli-1:28.1.1-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.2': docker-ce-cli-1:28.2.2-1.el{{ ansible_facts['distribution_major_version'] }}
-  '28.3': docker-ce-cli-1:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-cli-1:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-cli-1:28.3.3-1.el{{ ansible_facts['distribution_major_version'] }}
+  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-cli-1:20.10.24-3.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }}
+  '26.1': docker-ce-cli-1:26.1.4-1.el{{ ansible_distribution_major_version }}
+  '27.0': docker-ce-cli-1:27.0.3-1.el{{ ansible_distribution_major_version }}
+  '27.1': docker-ce-cli-1:27.1.2-1.el{{ ansible_distribution_major_version }}
+  '27.2': docker-ce-cli-1:27.2.1-1.el{{ ansible_distribution_major_version }}
+  '27.3': docker-ce-cli-1:27.3.1-1.el{{ ansible_distribution_major_version }}
+  '27.4': docker-ce-cli-1:27.4.1-1.el{{ ansible_distribution_major_version }}
+  '27.5': docker-ce-cli-1:27.5.1-1.el{{ ansible_distribution_major_version }}
+  '28.0': docker-ce-cli-1:28.0.4-1.el{{ ansible_distribution_major_version }}
+  '28.1': docker-ce-cli-1:28.1.1-1.el{{ ansible_distribution_major_version }}
+  '28.2': docker-ce-cli-1:28.2.2-1.el{{ ansible_distribution_major_version }}
+  '28.3': docker-ce-cli-1:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:28.3.3-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:28.3.3-1.el{{ ansible_distribution_major_version }}

 docker_package_info:
  enablerepo: "docker-ce"
--- a/roles/container-engine/docker/vars/ubuntu.yml
+++ b/roles/container-engine/docker/vars/ubuntu.yml
@@ -35,45 +35,45 @@ containerd_versioned_pkg:
 # https://download.docker.com/linux/ubuntu/
 docker_versioned_pkg:
  'latest': docker-ce
-  '18.09': docker-ce=5:18.09.9~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce=5:19.03.15~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce=5:26.1.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce=5:27.0.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce=5:27.1.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce=5:27.2.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce=5:27.3.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce=5:27.4.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce=5:27.5.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce=5:28.0.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce=5:28.1.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce=5:28.2.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
+  '18.09': docker-ce=5:18.09.9~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce=5:19.03.15~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce=5:28.0.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce=5:28.1.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce=5:28.2.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
-  '18.09': docker-ce-cli=5:18.09.9~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '19.03': docker-ce-cli=5:19.03.15~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_facts['distribution_release'] | lower }}
-  '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '26.1': docker-ce-cli=5:26.1.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.0': docker-ce-cli=5:27.0.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.1': docker-ce-cli=5:27.1.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.2': docker-ce-cli=5:27.2.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.3': docker-ce-cli=5:27.3.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.4': docker-ce-cli=5:27.4.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '27.5': docker-ce-cli=5:27.5.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.0': docker-ce-cli=5:28.0.4-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.1': docker-ce-cli=5:28.1.1-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.2': docker-ce-cli=5:28.2.2-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  '28.3': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'stable': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
-  'edge': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_facts['distribution_version'] }}~{{ ansible_facts['distribution_release'] | lower }}
+  '18.09': docker-ce-cli=5:18.09.9~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '19.03': docker-ce-cli=5:19.03.15~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
+  '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '26.1': docker-ce-cli=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.0': docker-ce-cli=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.1': docker-ce-cli=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.2': docker-ce-cli=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.3': docker-ce-cli=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.4': docker-ce-cli=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '27.5': docker-ce-cli=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.0': docker-ce-cli=5:28.0.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.1': docker-ce-cli=5:28.1.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.2': docker-ce-cli=5:28.2.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  '28.3': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'stable': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
+  'edge': docker-ce-cli=5:28.3.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}

 docker_package_info:
  pkgs:
@@ -90,5 +90,5 @@ docker_repo_info:
  repos:
    - >
      deb [arch={{ host_architecture }}] {{ docker_ubuntu_repo_base_url }}
-      {{ ansible_facts['distribution_release'] | lower }}
+      {{ ansible_distribution_release | lower }}
      stable
--- a/roles/container-engine/docker/vars/uniontech.yml
+++ b/roles/container-engine/docker/vars/uniontech.yml
@@ -2,28 +2,28 @@
 # containerd versions are only relevant for docker
 containerd_versioned_pkg:
  'latest': "{{ containerd_package }}"
-  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
-  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_facts['distribution_major_version'] }}"
+  '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_distribution_major_version }}"
+  '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_distribution_major_version }}"
+  '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
+  '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
+  'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"

 docker_version: 19.03
 docker_cli_version: 19.03
@@ -34,22 +34,22 @@ docker_cli_version: 19.03
 docker_versioned_pkg:
  'latest': docker-ce
  '18.09': docker-ce-3:18.09.9-3.el7
-  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-3:20.10.17-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-3:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
+  '19.03': docker-ce-3:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-3:20.10.17-3.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}

 docker_cli_versioned_pkg:
  'latest': docker-ce-cli
  '18.09': docker-ce-cli-1:18.09.9-3.el7
-  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_facts['distribution_major_version'] }}
-  '20.10': docker-ce-cli-1:20.10.17-3.el{{ ansible_facts['distribution_major_version'] }}
-  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_facts['distribution_major_version'] }}
-  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
-  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_facts['distribution_major_version'] }}
+  '19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_distribution_major_version }}
+  '20.10': docker-ce-cli-1:20.10.17-3.el{{ ansible_distribution_major_version }}
+  '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
+  '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
+  'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}

 docker_package_info:
  enablerepo: "docker-ce"
--- a/roles/container-engine/kata-containers/defaults/main.yml
+++ b/roles/container-engine/kata-containers/defaults/main.yml
@@ -3,7 +3,7 @@ kata_containers_dir: /opt/kata
 kata_containers_config_dir: /etc/kata-containers
 kata_containers_containerd_bin_dir: /usr/local/bin

-kata_containers_qemu_default_memory: "{{ ansible_facts['memtotal_mb'] }}"
+kata_containers_qemu_default_memory: "{{ ansible_memtotal_mb }}"
 kata_containers_qemu_debug: 'false'
 kata_containers_qemu_sandbox_cgroup_only: 'true'
 kata_containers_qemu_enable_mem_prealloc: 'false'
--- a/roles/container-engine/kata-containers/molecule/default/verify.yml
+++ b/roles/container-engine/kata-containers/molecule/default/verify.yml
@@ -9,7 +9,7 @@
    failed_when: >
      version is failed or
      'kata-runtime' not in version.stdout
-  - name: Test version check
+  - name: Test version
    command: "/opt/kata/bin/kata-runtime check"
    register: check
    failed_when: >
--- a/roles/container-engine/kata-containers/templates/configuration-qemu.toml.j2
+++ b/roles/container-engine/kata-containers/templates/configuration-qemu.toml.j2
@@ -678,16 +678,6 @@ experimental=[]
 # (default: false)
 # enable_pprof = true

-{% if kata_containers_version is version('3.4.0', '>=') %}
-# Indicates the CreateContainer request timeout needed for the workload(s)
-# It using guest_pull this includes the time to pull the image inside the guest
-# Defaults to 60 second(s)
-# Note: The effective timeout is determined by the lesser of two values: runtime-request-timeout from kubelet config
-# (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout) and create_container_timeout.
-# In essence, the timeout used for guest pull=runtime-request-timeout<create_container_timeout?runtime-request-timeout:create_container_timeout.
-create_container_timeout = 60
-{% endif %}
-
 # WARNING: All the options in the following section have not been implemented yet.
 # This section was added as a placeholder. DO NOT USE IT!
 [image]
--- a/roles/container-engine/runc/tasks/main.yml
+++ b/roles/container-engine/runc/tasks/main.yml
@@ -14,8 +14,8 @@
 - name: Runc | Uninstall runc package managed by package manager
  when:
    - not is_ostree
-    - ansible_facts['distribution'] != "Flatcar Container Linux by Kinvolk"
-    - ansible_facts['distribution'] != "Flatcar"
+    - ansible_distribution != "Flatcar Container Linux by Kinvolk"
+    - ansible_distribution != "Flatcar"
  block:
    - name: Runc | Remove package
      package:
--- a/roles/container-engine/skopeo/tasks/main.yml
+++ b/roles/container-engine/skopeo/tasks/main.yml
@@ -16,7 +16,7 @@
    name: skopeo
    state: absent
  when:
-    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
+    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
  ignore_errors: true  # noqa ignore-errors

 - name: Skopeo | Download skopeo binary
--- a/roles/container-engine/validate-container-engine/tasks/main.yml
+++ b/roles/container-engine/validate-container-engine/tasks/main.yml
@@ -76,7 +76,7 @@
  vars:
    service_name: containerd.service
  when:
-    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
+    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
    - container_manager != "containerd"
    - docker_installed.matched == 0
    - containerd_installed.matched > 0
@@ -104,7 +104,7 @@
  vars:
    service_name: docker.service
  when:
-    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
+    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
    - container_manager != "docker"
    - docker_installed.matched > 0
    - ansible_facts.services[service_name]['state'] == 'running'
@@ -130,7 +130,7 @@
  vars:
    service_name: crio.service
  when:
-    - not (is_ostree or (ansible_facts['distribution'] == "Flatcar Container Linux by Kinvolk") or (ansible_facts['distribution'] == "Flatcar"))
+    - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
    - container_manager != "crio"
    - crio_installed.matched > 0
    - ansible_facts.services[service_name]['state'] == 'running'
--- a/roles/download/tasks/download_container.yml
+++ b/roles/download/tasks/download_container.yml
@@ -74,6 +74,7 @@
      delegate_to: "{{ download_delegate }}"
      delegate_facts: false
      register: container_save_status
+      failed_when: container_save_status.stderr
      run_once: true
      become: "{{ user_can_become_root | default(false) or not download_localhost }}"
      when:
--- a/roles/download/tasks/main.yml
+++ b/roles/download/tasks/main.yml
@@ -2,7 +2,7 @@
 - name: Download | Prepare working directories and variables
  import_tasks: prep_download.yml
  when:
-    - not skip_downloads
+    - not skip_downloads | default(false)
  tags:
    - download
    - upload
@@ -10,7 +10,7 @@
 - name: Download | Get kubeadm binary and list of required images
  include_tasks: prep_kubeadm_images.yml
  when:
-    - not skip_downloads
+    - not skip_downloads | default(false)
    - ('kube_control_plane' in group_names)
  tags:
    - download
@@ -23,8 +23,8 @@
    download: "{{ download_defaults | combine(item.value) }}"
    include_file: "download_{% if download.container %}container{% else %}file{% endif %}.yml"
  when:
-    - not skip_downloads
+    - not skip_downloads | default(false)
    - download.enabled
    - item.value.enabled
-    - (not download.container) or (download.container and download_container)
+    - (not (item.value.container | default(false))) or (item.value.container and download_container)
    - (download_run_once and inventory_hostname == download_delegate) or (group_names | intersect(download.groups) | length)
--- a/roles/etcd/tasks/check_certs.yml
+++ b/roles/etcd/tasks/check_certs.yml
@@ -13,8 +13,6 @@
    sync_certs: false
    gen_certs: false
    etcd_secret_changed: false
-    etcd_member_requires_sync: false
-    kubernetes_host_requires_sync: false

 - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
  stat:
@@ -130,7 +128,7 @@
  set_fact:
    sync_certs: true
  when:
-    - etcd_member_requires_sync or
-      kubernetes_host_requires_sync or
+    - etcd_member_requires_sync | default(false) or
+      kubernetes_host_requires_sync | default(false) or
      'gen_master_certs_True' in group_names or
      'gen_node_certs_True' in group_names
--- a/roles/etcd/tasks/configure.yml
+++ b/roles/etcd/tasks/configure.yml
@@ -93,7 +93,7 @@
    name: etcd-events
    state: started
    enabled: true
-  ignore_errors: "{{ etcd_events_cluster_is_healthy.rc == 0 }}"  # noqa ignore-errors
+  ignore_errors: "{{ etcd_events_cluster_is_healthy.rc != 0 }}"  # noqa ignore-errors
  when:
    - ('etcd' in group_names)
    - etcd_events_cluster_setup
--- a/roles/etcd/tasks/gen_certs_script.yml
+++ b/roles/etcd/tasks/gen_certs_script.yml
@@ -24,7 +24,7 @@
  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
-    - gen_certs
+    - gen_certs | default(false)
    - inventory_hostname == groups['etcd'][0]

 - name: Gen_certs | copy certs generation script
@@ -43,7 +43,7 @@
    HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['kube_control_plane']) | join(' ') }}"
  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
-  when: gen_certs
+  when: gen_certs | default(false)
  notify: Set etcd_secret_changed

 - name: Gen_certs | run cert generation script for all clients
@@ -55,7 +55,7 @@
  when:
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
-    - gen_certs
+    - gen_certs | default(false)
  notify: Set etcd_secret_changed

 - name: Gen_certs | Gather etcd member/admin and kube_control_plane client certs from first etcd node
@@ -78,7 +78,7 @@
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
    - ('etcd' in group_names)
-    - sync_certs
+    - sync_certs | default(false)
    - inventory_hostname != groups['etcd'][0]
  notify: Set etcd_secret_changed

@@ -92,7 +92,7 @@
  with_items: "{{ etcd_master_certs.results }}"
  when:
    - ('etcd' in group_names)
-    - sync_certs
+    - sync_certs | default(false)
    - inventory_hostname != groups['etcd'][0]
  loop_control:
    label: "{{ item.item }}"
@@ -134,7 +134,7 @@
  include_tasks: gen_nodes_certs_script.yml
  when:
    - ('kube_control_plane' in group_names) and
-        sync_certs and inventory_hostname not in groups['etcd']
+        sync_certs | default(false) and inventory_hostname not in groups['etcd']

 - name: Gen_certs | Generate etcd certs on nodes if needed
  include_tasks: gen_nodes_certs_script.yml
@@ -142,7 +142,7 @@
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
    - ('k8s_cluster' in group_names) and
-        sync_certs and inventory_hostname not in groups['etcd']
+        sync_certs | default(false) and inventory_hostname not in groups['etcd']

 # This is a hack around the fact kubeadm expect the same certs path on all kube_control_plane
 # TODO: fix certs generation to have the same file everywhere
--- a/roles/etcd/tasks/main.yml
+++ b/roles/etcd/tasks/main.yml
@@ -84,7 +84,7 @@
  when:
    - ('etcd' in group_names)
    - etcd_cluster_setup
-    - etcd_secret_changed
+    - etcd_secret_changed | default(false)

 - name: Restart etcd-events if certs changed
  command: /bin/true
@@ -92,7 +92,7 @@
  when:
    - ('etcd' in group_names)
    - etcd_events_cluster_setup
-    - etcd_secret_changed
+    - etcd_secret_changed | default(false)

 # After etcd cluster is assembled, make sure that
 # initial state of the cluster is in `existing`
--- a/roles/helm-apps/tasks/main.yml
+++ b/roles/helm-apps/tasks/main.yml
@@ -1,11 +1,9 @@
 ---
 - name: Add Helm repositories
-  environment: "{{ proxy_env }}"
  kubernetes.core.helm_repository: "{{ helm_repository_defaults | combine(item) }}"  # noqa args[module]
  loop: "{{ repositories }}"

 - name: Update Helm repositories
-  environment: "{{ proxy_env }}"
  kubernetes.core.helm:
    state: absent
    binary_path: "{{ bin_dir }}/helm"
@@ -17,6 +15,5 @@
    - helm_update

 - name: Install Helm Applications
-  environment: "{{ proxy_env }}"
  kubernetes.core.helm: "{{ helm_defaults | combine(release_common_opts, item) }}"  # noqa args[module]
  loop: "{{ releases }}"
--- a/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
@@ -39,6 +39,8 @@ spec:
          type: RuntimeDefault
        supplementalGroups: [ 65534 ]
        fsGroup: 65534
+      nodeSelector:
+        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
--- a/roles/kubernetes-apps/container_engine_accelerator/nvidia_gpu/tasks/main.yml
+++ b/roles/kubernetes-apps/container_engine_accelerator/nvidia_gpu/tasks/main.yml
@@ -4,11 +4,11 @@
  include_vars: "{{ item }}"
  with_first_found:
    - files:
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_facts['os_family'] | lower }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_os_family | lower }}.yml"
      skip: true

 - name: Container Engine Acceleration Nvidia GPU | Set fact of download url Tesla
--- a/roles/kubernetes-apps/csi_driver/cinder/defaults/main.yml
+++ b/roles/kubernetes-apps/csi_driver/cinder/defaults/main.yml
@@ -1,8 +1,8 @@
 ---
-cinder_csi_attacher_image_tag: "v4.5.1"
-cinder_csi_provisioner_image_tag: "v4.0.1"
-cinder_csi_snapshotter_image_tag: "v7.0.2"
-cinder_csi_resizer_image_tag: "v1.10.1"
+cinder_csi_attacher_image_tag: "v4.4.2"
+cinder_csi_provisioner_image_tag: "v3.6.2"
+cinder_csi_snapshotter_image_tag: "v6.3.2"
+cinder_csi_resizer_image_tag: "v1.9.2"
 cinder_csi_livenessprobe_image_tag: "v2.11.0"

 # To access Cinder, the CSI controller will need credentials to access
--- a/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml
+++ b/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml
@@ -20,7 +20,7 @@

 - name: External OCI Cloud Controller Manager | Get base64 cloud-config
  set_fact:
-    external_oracle_cloud_config_secret: "{{ lookup('template', 'external-oci-cloud-config.yml.j2') | b64encode }}"
+    external_oracle_cloud_config_secret: "{{ lookup('template', 'external-oci-cloud-config.j2') | b64encode }}"
  when: inventory_hostname == groups['kube_control_plane'][0]
  tags: external-oci

--- a/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2
+++ b/roles/kubernetes-apps/external_provisioner/local_path_provisioner/templates/local-path-storage-deployment.yml.j2
@@ -24,7 +24,7 @@ spec:
        - start
        - --config
        - /etc/config/config.json
-{% if local_path_provisioner_debug %}
+{% if local_path_provisioner_debug | default(false) %}
        - --debug
 {% endif %}
        volumeMounts:
--- a/roles/kubernetes-apps/helm/tasks/main.yml
+++ b/roles/kubernetes-apps/helm/tasks/main.yml
@@ -3,11 +3,11 @@
  include_vars: "{{ item }}"
  with_first_found:
    - files:
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-        - "{{ ansible_facts['distribution'] | lower }}.yml"
-        - "{{ ansible_facts['os_family'] | lower }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
+        - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+        - "{{ ansible_distribution | lower }}.yml"
+        - "{{ ansible_os_family | lower }}.yml"
        - defaults.yml
      paths:
        - ../vars
@@ -21,7 +21,7 @@

 - name: Helm | Install PyYaml [flatcar]
  include_tasks: pyyaml-flatcar.yml
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Helm | Download helm
  include_tasks: "../../../download/tasks/download_file.yml"
--- a/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml
+++ b/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml
@@ -4,7 +4,9 @@ dependencies:
    when:
      - inventory_hostname == groups['kube_control_plane'][0]
      - kubelet_csr_approver_enabled
-    environment: "{{ proxy_env }}"
+    environment:
+      http_proxy: "{{ http_proxy | default('') }}"
+      https_proxy: "{{ https_proxy | default('') }}"
    release_common_opts: {}
    releases:
      - name: kubelet-csr-approver
--- a/roles/kubernetes-apps/metallb/tasks/main.yml
+++ b/roles/kubernetes-apps/metallb/tasks/main.yml
@@ -3,8 +3,7 @@
  fail:
    msg: "MetalLB require kube_proxy_strict_arp = true, see https://github.com/danderson/metallb/issues/153#issuecomment-518651132"
  when:
-    - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
-    - not kube_proxy_remove
+    - "kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp"

 - name: Kubernetes Apps | Check that the deprecated 'matallb_auto_assign' variable is not used anymore
  fail:
--- a/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2
+++ b/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2
@@ -26,7 +26,7 @@ spec:
    spec:
      priorityClassName: system-cluster-critical
      serviceAccountName: metrics-server
-      hostNetwork: {{ metrics_server_host_network }}
+      hostNetwork: {{ metrics_server_host_network | default(false) }}
      containers:
      - name: metrics-server
        image: {{ metrics_server_image_repo }}:{{ metrics_server_image_tag }}
--- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
+++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
@@ -71,7 +71,6 @@ rules:
      - blockaffinities
      - ipamblocks
      - ipamhandles
-      - ipamconfigs
      - tiers
    verbs:
      - get
@@ -125,12 +124,4 @@ rules:
      - list
      - update
      - watch
-  # Namespaces are watched for LoadBalancer IP allocation with namespace selector support
-  - apiGroups: [""]
-    resources:
-      - namespaces
-    verbs:
-      - get
-      - list
-      - watch
 {% endif %}
--- a/roles/kubernetes/control-plane/defaults/main/main.yml
+++ b/roles/kubernetes/control-plane/defaults/main/main.yml
@@ -41,9 +41,6 @@ control_plane_health_retries: 60  # Default retries for apiserver, scheduler, co
 kube_controller_manager_leader_elect_lease_duration: 15s
 kube_controller_manager_leader_elect_renew_deadline: 10s

-# Controls whether or not the kube_controller_manager allocates subnets for the node object
-kube_controller_manager_allocate_node_cidrs: true
-
 # discovery_timeout modifies the discovery timeout
 discovery_timeout: 5m0s

--- a/roles/kubernetes/control-plane/meta/main.yml
+++ b/roles/kubernetes/control-plane/meta/main.yml
@@ -5,6 +5,6 @@ dependencies:
    user: "{{ addusers.etcd }}"
    when:
      - etcd_deployment_type == "kubeadm"
-      - not (ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
+      - not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
  - role: network_plugin/calico_defaults
  - role: etcd_defaults
--- a/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml
@@ -84,49 +84,23 @@
    - not kubeadm_already_run.stat.exists

 - name: Joining control plane node to the cluster.
+  command: >-
+    {{ bin_dir }}/kubeadm join
+    --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
+    --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
+    --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
+  environment:
+    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
+  register: kubeadm_join_control_plane
+  retries: 3
+  throttle: 1
+  until: kubeadm_join_control_plane is succeeded
  when:
    - inventory_hostname != first_kube_control_plane
    - kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
-  environment:
-    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
-  block:
-    - name: Joining control plane node to the cluster. (1st try)
-      command: >-
-        {{ bin_dir }}/kubeadm join
-        --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
-        --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
-        --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
-      register: kubeadm_join_control_plane
-      throttle: 1
-  rescue:
-    - name: Reset cert directory before retrying control plane join
-      command: "{{ bin_dir }}/kubeadm reset -f --cert-dir {{ kube_cert_dir }}"
-      environment:
-        PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
-    - name: Joining control plane node to the cluster. (retry)
-      command: >-
-        {{ bin_dir }}/kubeadm join
-        --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
-        --ignore-preflight-errors={{ _ignore_errors | flatten | join(',') }}
-        --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
-      vars:
-        _errors_from_first_try:
-          - 'FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml'
-          - 'FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml'
-          - 'FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml'
-          - 'Port-10250'
-        _ignore_errors:
-          - "{{ kubeadm_ignore_preflight_errors }}"
-          - "{{ _errors_from_first_try if 'all' not in kubeadm_ignore_preflight_errors else [] }}"
-      register: kubeadm_join_control_plane
-      retries: 2
-      until: kubeadm_join_control_plane is succeeded
-      throttle: 1

 - name: Wait for new control plane nodes to be Ready
-  when:
-    - kubeadm_already_run.stat.exists
-    - kube_network_plugin not in ['cni', 'none']
+  when: kubeadm_already_run.stat.exists
  run_once: true
  command: >
    {{ kubectl }} get nodes --selector node-role.kubernetes.io/control-plane
--- a/roles/kubernetes/control-plane/tasks/main.yml
+++ b/roles/kubernetes/control-plane/tasks/main.yml
@@ -18,19 +18,6 @@
    mode: "0640"
  when: kube_webhook_authorization | default(false)

- name: Create structured AuthenticationConfiguration file
-  copy:
-    content: "{{ authn_config | to_nice_yaml(indent=2, sort_keys=false) }}"
-    dest: "{{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml"
-    mode: "0640"
-  vars:
-    authn_config:
-      apiVersion: apiserver.config.k8s.io/{{ kube_apiserver_authentication_config_api_version }}
-      kind: AuthenticationConfiguration
-      jwt: "{{ kube_apiserver_authentication_config_jwt }}"
-      anonymous: "{{ kube_apiserver_authentication_config_anonymous }}"
-  when: kube_apiserver_use_authentication_config_file
-
 - name: Create structured AuthorizationConfiguration file
  copy:
    content: "{{ authz_config | to_nice_yaml(indent=2, sort_keys=false) }}"
@@ -68,7 +55,7 @@

 - name: Install kubectl bash completion
  shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
-  when: ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
+  when: ansible_os_family in ["Debian","RedHat", "Suse"]
  tags:
    - kubectl
  ignore_errors: true  # noqa ignore-errors
@@ -79,7 +66,7 @@
    owner: root
    group: root
    mode: "0755"
-  when: ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
+  when: ansible_os_family in ["Debian","RedHat", "Suse"]
  tags:
    - kubectl
    - upgrade
@@ -98,7 +85,7 @@
    state: present
    marker: "# Ansible entries {mark}"
  when:
-    - ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
+    - ansible_os_family in ["Debian","RedHat", "Suse"]
    - kubectl_alias is defined and kubectl_alias != ""
  tags:
    - kubectl
@@ -112,13 +99,6 @@
  include_tasks: kubeadm-etcd.yml
  when: etcd_deployment_type == "kubeadm"

- name: Cleanup unused AuthenticationConfiguration file versions
-  file:
-    path: "{{ kube_config_dir }}/apiserver-authentication-config-{{ item }}.yaml"
-    state: absent
-  loop: "{{ ['v1alpha1', 'v1beta1', 'v1'] | reject('equalto', kube_apiserver_authentication_config_api_version) | list }}"
-  when: kube_apiserver_use_authentication_config_file
-
 - name: Cleanup unused AuthorizationConfiguration file versions
  file:
    path: "{{ kube_config_dir }}/apiserver-authorization-config-{{ item }}.yaml"
--- a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
+++ b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
@@ -131,7 +131,8 @@ apiServer:
    value: "{{ kube_apiserver_pod_eviction_not_ready_timeout_seconds }}"
  - name: default-unreachable-toleration-seconds
    value: "{{ kube_apiserver_pod_eviction_unreachable_timeout_seconds }}"
-{% if kube_api_anonymous_auth is defined and not kube_apiserver_use_authentication_config_file %}
+{% if kube_api_anonymous_auth is defined %}
+{# TODO: rework once suppport for structured auth lands #}
  - name: anonymous-auth
    value: "{{ kube_api_anonymous_auth }}"
 {% endif %}
@@ -156,6 +157,8 @@ apiServer:
  - name: disable-admission-plugins
    value: "{{ kube_apiserver_disable_admission_plugins | join(',') }}"
 {% endif %}
+  - name: apiserver-count
+    value: "{{ kube_apiserver_count }}"
  - name: endpoint-reconciler-type
    value: lease
 {% if etcd_events_cluster_enabled %}
@@ -178,7 +181,7 @@ apiServer:
  - name: service-account-lookup
    value: "{{ kube_apiserver_service_account_lookup }}"
 {% endif %}
-{% if kube_oidc_auth and kube_oidc_url is defined and kube_oidc_client_id is defined and not kube_apiserver_use_authentication_config_file %}
+{% if kube_oidc_auth and kube_oidc_url is defined and kube_oidc_client_id is defined %}
  - name: oidc-issuer-url
    value: "{{ kube_oidc_url }}"
  - name: oidc-client-id
@@ -204,10 +207,6 @@ apiServer:
    value: "{{ kube_oidc_groups_prefix }}"
 {%   endif %}
 {% endif %}
-{% if kube_apiserver_use_authentication_config_file %}
-  - name: authentication-config
-    value: "{{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml"
-{% endif %}
 {% if kube_webhook_token_auth %}
  - name: authentication-token-webhook-config-file
    value: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
@@ -280,7 +279,7 @@ apiServer:
  - name: tracing-config-file
    value: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml"
 {% endif %}
-{% if kubernetes_audit or kube_token_auth or kube_webhook_token_auth or kube_apiserver_use_authorization_config_file or kube_apiserver_use_authentication_config_file or apiserver_extra_volumes or ssl_ca_dirs | length %}
+{% if kubernetes_audit or kube_token_auth or kube_webhook_token_auth or apiserver_extra_volumes or ssl_ca_dirs | length %}
  extraVolumes:
 {% if kube_token_auth %}
  - name: token-auth-config
@@ -302,11 +301,6 @@ apiServer:
    hostPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml
    mountPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml
 {% endif %}
-{% if kube_apiserver_use_authentication_config_file %}
-  - name: authentication-config
-    hostPath: {{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml
-    mountPath: {{ kube_config_dir }}/apiserver-authentication-config-{{ kube_apiserver_authentication_config_api_version }}.yaml
-{% endif %}
 {% if kubernetes_audit or kubernetes_audit_webhook %}
  - name: {{ audit_policy_name }}
    hostPath: {{ audit_policy_hostpath }}
@@ -363,17 +357,7 @@ controllerManager:
 {% endif %}
  - name: service-cluster-ip-range
    value: "{{ kube_service_subnets }}"
-{% if not kube_controller_manager_allocate_node_cidrs
-  or kube_network_plugin is defined and (
-    (
-      kube_network_plugin == "calico" and
-      not calico_ipam_host_local
-    ) or (
-      kube_network_plugin == "cilium" and
-      cilium_ipam_mode == "cluster-pool"
-    )
-  )
-%}
+{% if kube_network_plugin is defined and kube_network_plugin == "calico" and not calico_ipam_host_local %}
  - name: allocate-node-cidrs
    value: "false"
 {% else %}
@@ -586,18 +570,9 @@ clusterDNS:
 {% for dns_address in kubelet_cluster_dns %}
 - {{ dns_address }}
 {% endfor %}
-{% set disable_websockets_to_kubelet = (container_manager == 'docker' and kube_version is version('1.36.0', '>=')) %}
+{% if kubelet_feature_gates or kube_feature_gates %}
 {% set feature_gates = ( kubelet_feature_gates | default(kube_feature_gates, true) ) %}
-{% if disable_websockets_to_kubelet %}
-{% set feature_gates = feature_gates | reject('search', '^ExtendWebSocketsToKubelet=') | list %}
-{% endif %}
-{% if feature_gates or disable_websockets_to_kubelet %}
 featureGates:
-{%   if disable_websockets_to_kubelet %}
-  # cri-dockerd does not support WebSocket streaming
-  # https://github.com/kubernetes-sigs/kubespray/issues/13360
-  ExtendWebSocketsToKubelet: false
-{%   endif %}
 {%   for feature in feature_gates %}
  {{ feature | replace("=", ": ") }}
 {%   endfor %}
--- a/roles/kubernetes/node/defaults/main.yml
+++ b/roles/kubernetes/node/defaults/main.yml
@@ -56,6 +56,7 @@ system_pid_reserved: 1000
 ## Eviction Thresholds to avoid system OOMs
 # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
 eviction_hard: {}
+eviction_hard_control_plane: {}

 kubelet_status_update_frequency: 10s

@@ -87,9 +88,6 @@ kube_vip_retryperiod: 1
 kube_vip_enable_node_labeling: false
 kube_vip_bgp_sourceip:
 kube_vip_bgp_sourceif:
-kube_vip_metrics_enabled: false
-# TCP port for kube-vip Prometheus metrics; manifest sets prometheus_server to :PORT (same as kube-vip upstream default, see cmd/kube-vip.go).
-kube_vip_metrics_port: 2112

 # Requests for load balancer app
 loadbalancer_apiserver_memory_requests: 32M
--- a/roles/kubernetes/node/tasks/facts.yml
+++ b/roles/kubernetes/node/tasks/facts.yml
@@ -54,9 +54,9 @@
  include_vars: "{{ item }}"
  with_first_found:
  - files:
-    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
-    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
-    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
-    - "{{ ansible_facts['distribution'] | lower }}.yml"
-    - "{{ ansible_facts['os_family'] | lower }}.yml"
+    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
+    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
+    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
+    - "{{ ansible_distribution | lower }}.yml"
+    - "{{ ansible_os_family | lower }}.yml"
    skip: true
--- a/roles/kubernetes/node/tasks/kubelet.yml
+++ b/roles/kubernetes/node/tasks/kubelet.yml
@@ -33,7 +33,7 @@
    src: "kubelet.service.j2"
    dest: "/etc/systemd/system/kubelet.service"
    backup: true
-    mode: "0644"
+    mode: "0600"
    validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
    # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
    # Remove once we drop support for systemd < 250
--- a/roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml
+++ b/roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml
@@ -4,7 +4,6 @@
    msg: "kube-vip require kube_proxy_strict_arp = true, see https://github.com/kube-vip/kube-vip/blob/main/docs/kubernetes/arp/index.md"
  when:
    - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
-    - not kube_proxy_remove
    - kube_vip_arp_enabled

 - name: Kube-vip | Check mutually exclusive BGP source settings
--- a/roles/kubernetes/node/tasks/main.yml
+++ b/roles/kubernetes/node/tasks/main.yml
@@ -114,9 +114,7 @@
    state: present
    persistent: present
  loop: "{{ kube_proxy_ipvs_modules }}"
-  when:
-    - kube_proxy_mode == 'ipvs'
-    - not kube_proxy_remove
+  when: kube_proxy_mode == 'ipvs'
  tags:
    - kube-proxy

@@ -132,7 +130,6 @@
    - nf_conntrack_ipv4
  when:
    - kube_proxy_mode == 'ipvs'
-    - not kube_proxy_remove
    - modprobe_conntrack_module is not defined or modprobe_conntrack_module is ansible.builtin.failed  # loop until first success
  tags:
    - kube-proxy
@@ -142,9 +139,7 @@
    name: "nf_tables"
    state: present
    persistent: present
-  when:
-    - kube_proxy_mode == 'nftables'
-    - not kube_proxy_remove
+  when: kube_proxy_mode == 'nftables'
  tags:
    - kube-proxy

--- a/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2
+++ b/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2
@@ -81,19 +81,9 @@ resolvConf: "{{ kube_resolv_conf }}"
 {% if kubelet_config_extra_args %}
 {{ kubelet_config_extra_args | to_nice_yaml(indent=2) }}
 {% endif %}
-{% set disable_websockets_to_kubelet = (container_manager == 'docker' and kube_version is version('1.36.0', '>=')) %}
-{% set kubelet_gates = (kubelet_feature_gates | default(kube_feature_gates, true)) %}
-{% if disable_websockets_to_kubelet %}
-{% set kubelet_gates = kubelet_gates | reject('search', '^ExtendWebSocketsToKubelet=') | list %}
-{% endif %}
-{% if kubelet_gates or disable_websockets_to_kubelet %}
+{% if kubelet_feature_gates or kube_feature_gates %}
 featureGates:
-{% if disable_websockets_to_kubelet %}
-  # cri-dockerd does not support WebSocket streaming
-  # https://github.com/kubernetes-sigs/kubespray/issues/13360
-  ExtendWebSocketsToKubelet: false
-{% endif %}
-{% for feature in kubelet_gates %}
+{% for feature in (kubelet_feature_gates | default(kube_feature_gates, true)) %}
  {{ feature | replace("=", ": ") }}
 {% endfor %}
 {% endif %}
--- a/roles/kubernetes/node/templates/loadbalancer/nginx.conf.j2
+++ b/roles/kubernetes/node/templates/loadbalancer/nginx.conf.j2
@@ -1,7 +1,7 @@
 error_log stderr notice;

 worker_processes 2;
-worker_rlimit_nofile 65535;
+worker_rlimit_nofile 130048;
 worker_shutdown_timeout 10s;

 events {
--- a/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2
+++ b/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2
@@ -109,21 +109,11 @@ spec:
 {% if kube_vip_lb_fwdmethod %}
    - name: lb_fwdmethod
      value: {{ kube_vip_lb_fwdmethod | string | to_json }}
-{% endif %}
-{% if kube_vip_metrics_enabled %}
-    - name: prometheus_server
-      value: {{ (':' ~ (kube_vip_metrics_port | string)) | to_json }}
 {% endif %}
    image: {{ kube_vip_image_repo }}:{{ kube_vip_image_tag }}
    imagePullPolicy: {{ k8s_image_pull_policy }}
    name: kube-vip
    resources: {}
-{% if kube_vip_metrics_enabled %}
-    ports:
-    - name: metrics
-      containerPort: {{ kube_vip_metrics_port }}
-      protocol: TCP
-{% endif %}
 {% if kube_vip_lb_fwdmethod == "masquerade" %}
    securityContext:
      privileged: true
--- a/roles/kubernetes/preinstall/defaults/main.yml
+++ b/roles/kubernetes/preinstall/defaults/main.yml
@@ -8,9 +8,6 @@ cloud_resolver: []
 disable_host_nameservers: false
 # Kubespray sets this to true after clusterDNS is running to apply changes to the host resolv.conf
 dns_late: false
-# DNS resolver option timeout and retry attempts.
-dns_timeout: 2
-dns_attempts: 2

 # Set to true if your network does not support IPv6
 # This may be necessary for pulling Docker images from
@@ -107,7 +104,7 @@ redhat_os_family_extensions:
  - "UniontechOS"

 # Sets DNSStubListener=no, useful if you get "0.0.0.0:53: bind: address already in use"
-systemd_resolved_disable_stub_listener: "{{ ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
+systemd_resolved_disable_stub_listener: "{{ ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"

 # Used to disable File Access Policy Daemon service.
 # If service is enabled, the CNI plugin installation will fail
--- a/roles/kubernetes/preinstall/handlers/main.yml
+++ b/roles/kubernetes/preinstall/handlers/main.yml
@@ -1,8 +1,8 @@
 ---
 - name: Preinstall | apply resolvconf cloud-init
  command: /usr/bin/coreos-cloudinit --from-file {{ resolveconf_cloud_init_conf }}
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
-  listen: Preinstall | propagate resolvconf to k8s components
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  listen: Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk

 - name: Preinstall | reload NetworkManager
  service:
@@ -24,6 +24,7 @@
  when: not dns_early | bool
  listen:
    - Preinstall | propagate resolvconf to k8s components
+    - Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk
    - Preinstall | update resolvconf for networkmanager

 # FIXME(mattymo): Also restart for kubeadm mode
@@ -118,6 +119,7 @@
    - ('kube_control_plane' in group_names)
    - dns_mode != 'none'
    - resolvconf_mode == 'host_resolvconf'
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
  listen: Preinstall | propagate resolvconf to k8s components

 - name: Preinstall | Restart systemd-resolved
--- a/roles/kubernetes/preinstall/tasks/0020-set_facts.yml
+++ b/roles/kubernetes/preinstall/tasks/0020-set_facts.yml
@@ -1,12 +1,9 @@
 ---
- name: Normalize ansible_facts for redhat-family extensions
+- name: Set os_family fact for other redhat-based operating systems
  set_fact:
-    ansible_facts: >-
-      {{ ansible_facts | combine({
-           'os_family': 'RedHat',
-           'distribution_major_version': '8'
-         }) }}
-  when: ansible_facts['distribution'] in redhat_os_family_extensions
+    ansible_os_family: "RedHat"
+    ansible_distribution_major_version: "8"
+  when: ansible_distribution in redhat_os_family_extensions
  tags:
    - facts

@@ -89,12 +86,12 @@
      {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/base{%- endif -%}
    head: >-
      {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/head{%- endif -%}
-  when: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
+  when: not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos

 - name: Target temporary resolvconf cloud init file (Flatcar Container Linux by Kinvolk / Fedora CoreOS)
  set_fact:
    resolvconffile: /tmp/resolveconf_cloud_init_conf
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos

 - name: Check if /etc/dhclient.conf exists
  stat:
@@ -125,12 +122,12 @@
 - name: Target dhclient hook file for Red Hat family
  set_fact:
    dhclienthookfile: /etc/dhcp/dhclient.d/zdnsupdate.sh
-  when: ansible_facts['os_family'] == "RedHat"
+  when: ansible_os_family == "RedHat"

 - name: Target dhclient hook file for Debian family
  set_fact:
    dhclienthookfile: /etc/dhcp/dhclient-exit-hooks.d/zdnsupdate
-  when: ansible_facts['os_family'] == "Debian"
+  when: ansible_os_family == "Debian"

 - name: Set etcd vars if using kubeadm mode
  set_fact:
--- a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
+++ b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
@@ -15,25 +15,25 @@
    - not ignore_assert_errors
 - name: Stop if non systemd OS type
  assert:
-    that: ansible_facts['service_mgr'] == "systemd"
+    that: ansible_service_mgr == "systemd"
  when: not ignore_assert_errors

 - name: Stop if the os does not support
  assert:
-    that: (allow_unsupported_distribution_setup | default(false)) or ansible_facts['distribution'] in supported_os_distributions
-    msg: "{{ ansible_facts['distribution'] }} is not a known OS"
+    that: (allow_unsupported_distribution_setup | default(false)) or ansible_distribution in supported_os_distributions
+    msg: "{{ ansible_distribution }} is not a known OS"
  when: not ignore_assert_errors

 - name: Stop if memory is too small for control plane nodes
  assert:
-    that: ansible_facts['memtotal_mb'] >= minimal_master_memory_mb
+    that: ansible_memtotal_mb >= minimal_master_memory_mb
  when:
    - not ignore_assert_errors
    - ('kube_control_plane' in group_names)

 - name: Stop if memory is too small for nodes
  assert:
-    that: ansible_facts['memtotal_mb'] >= minimal_node_memory_mb
+    that: ansible_memtotal_mb >= minimal_node_memory_mb
  when:
    - not ignore_assert_errors
    - ('kube_node' in group_names)
@@ -47,8 +47,8 @@

 - name: Stop if ip var does not match local ips
  assert:
-    that: (ip in ansible_facts['all_ipv4_addresses']) or (ip in ansible_facts['all_ipv6_addresses'])
-    msg: "IPv4: '{{ ansible_facts['all_ipv4_addresses'] }}' and IPv6: '{{ ansible_facts['all_ipv6_addresses'] }}' do not contain '{{ ip }}'"
+    that: (ip in ansible_all_ipv4_addresses) or (ip in ansible_all_ipv6_addresses)
+    msg: "IPv4: '{{ ansible_all_ipv4_addresses }}' and IPv6: '{{ ansible_all_ipv6_addresses }}' do not contain '{{ ip }}'"
  when:
    - not ignore_assert_errors
    - ip is defined
@@ -63,29 +63,16 @@

 - name: Stop if kernel version is too low for cilium
  assert:
-    that: ansible_facts['kernel'].split('-')[0] is version('4.9.17', '>=')
-  when:
-    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
-    - not ignore_assert_errors
-
- name: Stop if kube_owner is not root when using cilium
-  assert:
-    that: kube_owner == 'root'
-    fail_msg: |
-      kube_owner is set to '{{ kube_owner }}', but cilium requires it to be 'root'.
-      Cilium's init containers run as UID 0 with capabilities (including CAP_DAC_OVERRIDE) dropped,
-      so host paths it writes to (e.g. /opt/cni/bin) must be owned by root or it will fail with
-      a permission error. See https://github.com/kubernetes-sigs/kubespray/issues/13378
+    that: ansible_kernel.split('-')[0] is version('4.9.17', '>=')
  when:
    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
    - not ignore_assert_errors

 - name: Stop if kernel version is too low for nftables
  assert:
-    that: ansible_facts['kernel'].split('-')[0] is version('5.13', '>=')
+    that: ansible_kernel.split('-')[0] is version('5.13', '>=')
  when:
    - kube_proxy_mode == 'nftables'
-    - not kube_proxy_remove
    - not ignore_assert_errors

 - name: Stop if bad hostname
@@ -105,6 +92,6 @@

 - name: Stop if download_localhost is enabled for Flatcar Container Linux
  assert:
-    that: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    that: ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
    msg: "download_run_once not supported for Flatcar Container Linux"
  when: download_run_once or download_force_cache
--- a/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml
+++ b/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml
@@ -1,7 +1,7 @@
 ---
 - name: Create temporary resolveconf cloud init file
  command: cp -f /etc/resolv.conf "{{ resolvconffile }}"
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Add domain/search/nameservers/options to resolv.conf
  blockinfile:
@@ -12,7 +12,7 @@
      {% for item in nameserverentries %}
      nameserver {{ item }}
      {% endfor %}
-      options ndots:{{ ndots }} timeout:{{ dns_timeout }} attempts:{{ dns_attempts }}
+      options ndots:{{ ndots }} timeout:{{ dns_timeout | default('2') }} attempts:{{ dns_attempts | default('2') }}
    state: present
    insertbefore: BOF
    create: true
@@ -45,7 +45,7 @@
 - name: Get temporary resolveconf cloud init file content
  command: cat {{ resolvconffile }}
  register: cloud_config
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Persist resolvconf cloud init file
  template:
@@ -53,5 +53,5 @@
    src: resolvconf.j2
    owner: root
    mode: "0644"
-  notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  notify: Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk
+  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
--- a/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml
+++ b/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml
@@ -32,7 +32,7 @@
    path: /etc/NetworkManager/conf.d/dns.conf
    section: global-dns
    option: options
-    value: "ndots:{{ ndots }},timeout:{{ dns_timeout }},attempts:{{ dns_attempts }}"
+    value: "ndots:{{ ndots }},timeout:{{ dns_timeout | default('2') }},attempts:{{ dns_attempts | default('2') }}"
    mode: '0600'
    backup: "{{ leave_etc_backup_files }}"
  notify: Preinstall | update resolvconf for networkmanager
--- a/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml
+++ b/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml
@@ -7,8 +7,8 @@
    get_checksum: false
    get_mime: false
  when:
-    - ansible_facts['os_family'] == "RedHat"
-    - "'Amazon' not in ansible_facts['distribution']"
+    - ansible_os_family == "RedHat"
+    - "'Amazon' not in ansible_distribution"
  register: slc

 - name: Set selinux policy
@@ -16,8 +16,8 @@
    policy: targeted
    state: "{{ preinstall_selinux_state }}"
  when:
-    - ansible_facts['os_family'] == "RedHat"
-    - "'Amazon' not in ansible_facts['distribution']"
+    - ansible_os_family == "RedHat"
+    - "'Amazon' not in ansible_distribution"
    - slc.stat.exists
  tags:
    - bootstrap_os
@@ -32,7 +32,7 @@
    mode: "0644"
  when:
    - disable_ipv6_dns
-    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  tags:
    - bootstrap_os

@@ -125,27 +125,6 @@
    - { name: vm.panic_on_oom, value: 0 }
  when: kubelet_protect_kernel_defaults | bool

- name: Read current sysctl values
-  command: sysctl -n {{ item.key }}
-  register: sysctl_settings
-  changed_when: false
-  vars:
-    # For integer sysctls only
-    sysctl_minimum_values:
-      fs.inotify.max_user_instances: 8192
-  loop: "{{ sysctl_minimum_values | dict2items }}"
-
- name: Increase sysctl value if lower than minimum
-  ansible.posix.sysctl:
-    sysctl_file: "{{ sysctl_file_path }}"
-    name: "{{ item.item.key }}"
-    value: "{{ item.item.value }}"
-    state: present
-    reload: true
-    ignoreerrors: "{{ sysctl_ignore_unknown_keys }}"
-  when: item.stdout | int < item.item.value
-  loop: "{{ sysctl_settings.results }}"
-
 - name: Check dummy module
  community.general.modprobe:
    name: dummy
--- a/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
+++ b/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
@@ -15,7 +15,7 @@
      /etc/ntp.conf
      {%- elif ntp_package == "ntpsec" -%}
      /etc/ntpsec/ntp.conf
-      {%- elif ansible_facts['os_family'] in ['RedHat', 'Suse'] -%}
+      {%- elif ansible_os_family in ['RedHat', 'Suse'] -%}
      /etc/chrony.conf
      {%- else -%}
      /etc/chrony/chrony.conf
@@ -24,7 +24,7 @@
    ntp_service_name: >-
      {% if ntp_package == "chrony" -%}
      chronyd
-      {%- elif ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
+      {%- elif ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
      ntpd
      {%- else -%}
      ntp
@@ -72,14 +72,14 @@
  when:
    - ntp_timezone
    - not is_fedora_coreos
-    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Gather selinux facts
  ansible.builtin.setup:
    gather_subset: selinux
  when:
    - ntp_timezone
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"

 - name: Put SELinux in permissive mode, logging actions that would be blocked.
  ansible.posix.selinux:
@@ -87,7 +87,7 @@
    state: permissive
  when:
    - ntp_timezone
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
    - ansible_facts.selinux.status == 'enabled'
    - ansible_facts.selinux.mode == 'enforcing'

@@ -103,5 +103,5 @@
    state: "{{ preinstall_selinux_state }}"
  when:
    - ntp_timezone
-    - ansible_facts['os_family'] == "RedHat"
+    - ansible_os_family == "RedHat"
    - ansible_facts.selinux.status == 'enabled'
--- a/Show More
+++ b/Show More