diff --git a/README.md b/README.md
index 2565680a71327774f3d41ac36f2a684b1f10709f..897e58505aa0e66a3d07477486605b172f1b9788 100644
--- a/README.md
+++ b/README.md
@@ -160,11 +160,11 @@ Note: Upstart/SysV init based OS types are not supported.
## Supported Components
- Core
- - [kubernetes](https://github.com/kubernetes/kubernetes) v1.28.6
+ - [kubernetes](https://github.com/kubernetes/kubernetes) v1.29.1
- [etcd](https://github.com/etcd-io/etcd) v3.5.10
- [docker](https://www.docker.com/) v20.10 (see note)
- [containerd](https://containerd.io/) v1.7.11
- - [cri-o](http://cri-o.io/) v1.27 (experimental: see [CRI-O Note](docs/cri-o.md). Only on fedora, ubuntu and centos based OS)
+ - [cri-o](http://cri-o.io/) v1.29.1 (experimental: see [CRI-O Note](docs/cri-o.md). Only on fedora, ubuntu and centos based OS)
- Network Plugin
- [cni-plugins](https://github.com/containernetworking/plugins) v1.2.0
- [calico](https://github.com/projectcalico/calico) v3.26.4
diff --git a/docs/hardening.md b/docs/hardening.md
index fe2f3a568a876969b7a1fdfdf0695c01bdbb7cf2..8623bdc30e5876312fa6913050f047f8325cc254 100644
--- a/docs/hardening.md
+++ b/docs/hardening.md
@@ -97,7 +97,7 @@ kubelet_event_record_qps: 1
kubelet_rotate_certificates: true
kubelet_streaming_connection_idle_timeout: "5m"
kubelet_make_iptables_util_chains: true
-kubelet_feature_gates: ["RotateKubeletServerCertificate=true", "SeccompDefault=true"]
+kubelet_feature_gates: ["RotateKubeletServerCertificate=true"]
kubelet_seccomp_default: true
kubelet_systemd_hardening: true
# In case you have multiple interfaces in your
diff --git a/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml b/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
index 68233b4c8cb8af4f54742cd627565ea0dabfb38f..37ef5e2caa15d99220fa8b684b00f5e89476094b 100644
--- a/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
@@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
kube_api_anonymous_auth: true
## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.28.6
+kube_version: v1.29.1
# Where the binaries will be downloaded.
# Note: ensure that you've enough disk space (about 1G)
diff --git a/roles/container-engine/cri-o/defaults/main.yml b/roles/container-engine/cri-o/defaults/main.yml
index f20108f86bf7b5122bec4cfeda98296096ac45a3..6bc0d72380eaeb22c60abd5a7992fcb75f8be728 100644
--- a/roles/container-engine/cri-o/defaults/main.yml
+++ b/roles/container-engine/cri-o/defaults/main.yml
@@ -78,13 +78,6 @@ crio_subuid_length: 16777216
crio_subgid_start: 2130706432
crio_subgid_length: 16777216
-# cri-o binary files
-crio_bin_files:
- - conmon
- - crio
- - crio-status
- - pinns
-
# cri-o manual files
crio_man_files:
5:
diff --git a/roles/container-engine/cri-o/tasks/load_vars.yml b/roles/container-engine/cri-o/tasks/load_vars.yml
new file mode 100644
index 0000000000000000000000000000000000000000..8a5daa392bb2afaaeda3876464e42336ed0af2b9
--- /dev/null
+++ b/roles/container-engine/cri-o/tasks/load_vars.yml
@@ -0,0 +1,8 @@
+---
+- name: Cri-o | include vars/v1.28.yml
+ include_vars: v1.28.yml
+ when: crio_version is version("v1.29.0", operator="<")
+
+- name: Cri-o | include vars/v1.29.yml
+ include_vars: v1.29.yml
+ when: crio_version is version("v1.29.0", operator=">=")
diff --git a/roles/container-engine/cri-o/tasks/main.yaml b/roles/container-engine/cri-o/tasks/main.yaml
index 60c818a55f74ce7f342961e960a0d1ecc1bfb5db..99a3ed278ca8c580a9a6421fce26b70c2b5826d7 100644
--- a/roles/container-engine/cri-o/tasks/main.yaml
+++ b/roles/container-engine/cri-o/tasks/main.yaml
@@ -1,4 +1,7 @@
---
+- name: Cri-o | load vars
+ import_tasks: load_vars.yml
+
- name: Cri-o | check if fedora coreos
stat:
path: /run/ostree-booted
@@ -203,7 +206,7 @@
- not service_start.changed
- name: Cri-o | verify that crio is running
- command: "{{ bin_dir }}/crio-status info"
+ command: "{{ bin_dir }}/{{ crio_status_command }} info"
register: get_crio_info
until: get_crio_info is succeeded
changed_when: false
diff --git a/roles/container-engine/cri-o/tasks/reset.yml b/roles/container-engine/cri-o/tasks/reset.yml
index 1bae013acb1f28c3d38e37ef9a32eb0a5aadc28e..53d47143477727324087e7f42e1a33d712d21d81 100644
--- a/roles/container-engine/cri-o/tasks/reset.yml
+++ b/roles/container-engine/cri-o/tasks/reset.yml
@@ -1,4 +1,7 @@
---
+- name: Cri-o | load vars
+ import_tasks: load_vars.yml
+
- name: CRI-O | Kubic repo name for debian os family
set_fact:
crio_kubic_debian_repo_name: "{{ ((ansible_distribution == 'Ubuntu') | ternary('x', '')) ~ ansible_distribution ~ '_' ~ ansible_distribution_version }}"
diff --git a/roles/container-engine/cri-o/vars/v1.28.yml b/roles/container-engine/cri-o/vars/v1.28.yml
new file mode 100644
index 0000000000000000000000000000000000000000..a6a8b673da8173b7e9d17f8c21975784eb49740b
--- /dev/null
+++ b/roles/container-engine/cri-o/vars/v1.28.yml
@@ -0,0 +1,9 @@
+---
+# cri-o binary files
+crio_bin_files:
+ - conmon
+ - crio
+ - crio-status
+ - pinns
+
+crio_status_command: crio-status
diff --git a/roles/container-engine/cri-o/vars/v1.29.yml b/roles/container-engine/cri-o/vars/v1.29.yml
new file mode 100644
index 0000000000000000000000000000000000000000..bc25e2e56a2497cfd373daaf390c7914050790f3
--- /dev/null
+++ b/roles/container-engine/cri-o/vars/v1.29.yml
@@ -0,0 +1,9 @@
+---
+# cri-o binary files
+crio_bin_files:
+ - conmon
+ - conmonrs
+ - crio
+ - pinns
+
+crio_status_command: crio status
diff --git a/roles/kubernetes/node/tasks/facts.yml b/roles/kubernetes/node/tasks/facts.yml
index 156d748d24537f8db3ab9d19d4334f42baf0ab07..0aaa11d60a78c7d7c2baa2482c155404cba5be2d 100644
--- a/roles/kubernetes/node/tasks/facts.yml
+++ b/roles/kubernetes/node/tasks/facts.yml
@@ -18,7 +18,7 @@
when: container_manager == 'crio'
block:
- name: Look up crio cgroup driver
- shell: "set -o pipefail && {{ bin_dir }}/crio-status info | grep 'cgroup driver' | awk -F': ' '{ print $2; }'"
+ shell: "set -o pipefail && {{ bin_dir }}/{{ crio_status_command }} info | grep 'cgroup driver' | awk -F': ' '{ print $2; }'"
args:
executable: /bin/bash
register: crio_cgroup_driver_result
diff --git a/roles/kubespray-defaults/defaults/main/download.yml b/roles/kubespray-defaults/defaults/main/download.yml
index cc8d676f75cc85e5945ade1c1d3dc4505efa5078..000954c30d47dd770aba75f959a2e2a7a462caa3 100644
--- a/roles/kubespray-defaults/defaults/main/download.yml
+++ b/roles/kubespray-defaults/defaults/main/download.yml
@@ -133,9 +133,9 @@ skopeo_version: "v1.13.2"
kube_major_version: "{{ kube_version | regex_replace('^v([0-9])+\\.([0-9]+)\\.[0-9]+', 'v\\1.\\2') }}"
pod_infra_supported_versions:
+ v1.29: "3.9"
v1.28: "3.9"
v1.27: "3.9"
- v1.26: "3.9"
pod_infra_version: "{{ pod_infra_supported_versions[kube_major_version] }}"
etcd_supported_versions:
@@ -158,9 +158,9 @@ crio_version: "{{ crio_supported_versions[kube_major_version] }}"
# Scheduler plugins doesn't build for K8s 1.28 yet
scheduler_plugins_supported_versions:
+ v1.29: 0
v1.28: 0
v1.27: v0.27.8
- v1.26: v0.26.7
scheduler_plugins_version: "{{ scheduler_plugins_supported_versions[kube_major_version] }}"
yq_version: "v4.35.2"
diff --git a/roles/kubespray-defaults/defaults/main/main.yml b/roles/kubespray-defaults/defaults/main/main.yml
index f7eb5b37345e00060128e7be2f3315f6c1ffe426..114668ac5cbe0d434f5ce9eaa07cd3085da90ce5 100644
--- a/roles/kubespray-defaults/defaults/main/main.yml
+++ b/roles/kubespray-defaults/defaults/main/main.yml
@@ -16,7 +16,7 @@ kubelet_fail_swap_on: true
kubelet_swap_behavior: LimitedSwap
## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.28.6
+kube_version: v1.29.1
## The minimum version working
kube_version_min_required: v1.27.0
diff --git a/tests/files/packet_ubuntu20-calico-all-in-one-hardening.yml b/tests/files/packet_ubuntu20-calico-all-in-one-hardening.yml
index d8dcc1f8e6d0a788fe0fd3f015a08e667a3d4d48..55cbd506374eb9057b3ef5f36801b6cd7f19a24f 100644
--- a/tests/files/packet_ubuntu20-calico-all-in-one-hardening.yml
+++ b/tests/files/packet_ubuntu20-calico-all-in-one-hardening.yml
@@ -86,7 +86,7 @@ kubelet_event_record_qps: 1
kubelet_rotate_certificates: true
kubelet_streaming_connection_idle_timeout: "5m"
kubelet_make_iptables_util_chains: true
-kubelet_feature_gates: ["RotateKubeletServerCertificate=true", "SeccompDefault=true"]
+kubelet_feature_gates: ["RotateKubeletServerCertificate=true"]
kubelet_seccomp_default: true
kubelet_systemd_hardening: true
# In case you have multiple interfaces in your