* kubeadm: do not ignore preflight errors blindly

The "ignoring all errors" seems to date back to the inception of the
kubeadm support (it was --skip-preflight-check before).

This can mask real errors and prevent users from seeing them.

Do not ignore any errors by default and make the set of ignored errors
configurable.

* download/kubeadm: remove redundant task

The mode is already set by the previous `copy` task.

* Validate kubeadm configs

This should help to fail early when we have invalid kubeadm configs (from
a kubespray bug or a misconfiguration).

* kubeadm-upgrade: remove unnecessary bool cast

* Convert kubeadm join discovery timeout to v1beta4 config

* CI: Ignore kubeadm:Mem errors on some setup.

timeoutForControlPlane has been removed from v1beta4, instead remplaced
by https://kubernetes.io/docs/reference/config-api/kubeadm-config.v1beta4/#kubeadm-k8s-io-v1beta4-Timeouts

The default for the new value are close enough that there is no need to
override them.

* remove nameless extraArgs entry

Signed-off-by: Andreas Gravgaard Andersen <andreasga22@gmail.com>

* fix template name

Signed-off-by: Andreas Gravgaard Andersen <andreasga22@gmail.com>

---------

Signed-off-by: Andreas Gravgaard Andersen <andreasga22@gmail.com>

- Lookup was not returning a list, making the difference filter spit out
  garbage -> query always return a list
- hostvars is a dictionnary, so convert to list before selectattr and
  map back to only get keys

Currently there is not much difference between the files, if there are more changes in the future,
please use different files to distinguish them (you can use the kubeadm_config_api_version variable)

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Remove kubeadm api version condition.
Currently there is not much difference between the files, if there are more changes in the future,
please use different files to distinguish them (you can use the kubeadm_config_api_version variable)

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

I added the kubeadm_config_api_version variable in the previous commit,
and remove kubeadm api version condition.

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

v1beta4 has changed a lot in this file (e.g. ExtraArgs etc.), so it was implemented in separate files.

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

conntrack -> conntrack-tools
device-mapper-libs -> device-mapper

Since a2019c1c (Add a JSON schema describing the packages install
structure, 2024-04-25), we use a custom structure to select which
packages should be installed on a particular host OS.

This has proven too rigid in practice, and the query is pretty
complicated.

Replace this by simply using an array of jinja conditions for the
packages, which should be easier to understand for everyone and more
flexible.

Also remove the associated schema and validation which are no longer
needed.

For this change, `external_cloud_provider` set default value to empty
string.

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

For this change, `cloud_provider` change the default value to empty
string.

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

This should prevent confusing errors with undefined variables

The fallback_ips tasks are essentially serializing the gathering of one
fact on all the hosts, which can have dramatic performance implications
on large clusters (several minutes).

This is essentially a reversal of 35f248df
Being able to run without refreshing the cache facts is not worth it.

We keep fallback_ip for now, simply changing the access to a normal
hostvars variable instead of a custom dictionnary.

Testing with group_names does not require the groups to exist.

k8s_cluster = kube_control_plane + kube_node

Nodes to api-server relies by default certificates, and bootstrap
tokens, and there should be no need to generate tokens for every nodes,
even when enabling static token auth.

Testing for group membership with group names makes Kubespray more
tolerant towards the structure of the inventory.
Where 'inventory_hostname in groups["some_group"] would fail if
"some_group" is not defined, '"some_group" in group_names' would not.

The `--container-runtime-endpoint` kubelet argument is deprecated in
favor of the config file alternative.

Specifying one directory for kubeadm patches is not ideal:
1. It does not allow working with multiples inventories easily
2. No ansible templating of the patch
3. Ansible path searching can sometimes be confusing

Instead, provide the patch directly in a variable, and add some quality
of life to handle components targeting and patch ordering more
explicitly (`target` and `type` which are translated to the kubeadm
scheme which is based on the file name)

kubernetes/control-plane and kubernetes/kubeadm roles both push kubeadm
patches in the same way.
Extract that code and make it a dependency of both.
This is safe because it's only configuration for kubeadm, which only
takes effect when kubeadm is run.

There is no need to have an extra variables for this, just use different
values per host (using Ansible group_vars, for example)

Remove system|kube_master_<resource>_reserved variables.
Those variables are unnecessary because users can simply use the
variables in group_vars if they which to differentiate control plane
nodes from other nodes.

Set conservative defaults for ephemeral-storage and pids for both kube
and system reserved resources.

The default value is used across kubespray but only defined in
kubernetes/node.
Move it to kubespray-defaults

K8s is moving away from the "master" terminology, so kubespray should follow the same naming conventions. See https://github.com/kubernetes/community/blob/65d886bb3029e73d9729e1d4f27422a7985233ed/sig-architecture/naming/recommendations/001-master-control-plane.md

* Simplify docker systemd unit

systemd handles missing unit by ignoring the dependency so we don't need
to template them.

* Remove RHEL 7/CentOS 7 support

- remove ref in kubespray roles
- move CI from centos 7 to 8
- remove docs related to centos7

* Remove container-storage-setup

Only used for RHEL 7 and CentOS 7

We can't mix some options with --config for kubeadm upgrade.
The --config on upgrade is deprecated, and should be removed.

Consistent boolean values in ansible playbooks

This is already handled by the previous task.

Makes easier diff when adding or removing plugins.