kubespray/roles/upgrade/system-upgrade/tasks/apt.yml

---
- name: APT Dist-Upgrade
  apt:
    update_cache: true
    upgrade: dist
    autoremove: true
    dpkg_options: force-confold,force-confdef

- name: Check if a reboot is required
  ansible.builtin.stat:
    path: /var/run/reboot-required
    get_checksum: false
  register: reboot_required

- name: Reboot server if required to apply updates
  ansible.builtin.reboot:
    msg: "The system is going down for reboot NOW!"
    post_reboot_delay: 30
  when:
    - reboot_required.stat.exists or system_upgrade_reboot == 'always'
    - system_upgrade_reboot != 'never'

- name: APT Autoclean
  apt:
    autoclean: true
  when:
    - system_upgrade_autoclean