* Calico: make calico_min_version check relevant

* Calico: only check currently installed version against the oldest supported version by the previous release

Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade (#7976)

* Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade

* Remove training whitespace

Modify connection_strings_etcd to only return etcd nodes - not master nodes - since this results in duplicate hosts in the generated Ansible inventory and is unnecessary.

On Debian 11, `ipset` just recommend `iptables` so on the system that apt is configured with `APT::Install-Recommends "0";` iptables will not install automatically.

additional disks

* Fix: adding new ips with inventory builder (#7577)

* moved conflig loading logic
to after checking whether the config
should be loaded, and added check for
whether the config should be loaded

* added check for removing nodes from config
if the user wants to remove a node, we
need to load the config

* Fix tox errors

* Fix missing file mode (risky-file-permissions)

Found this using ansible-lint.

Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>

* Fix another missing file mode (risky-file-permissions)

This one fixes `/etc/crio/config.json`

Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>

* Fix invalid condition for username and password inclusion

* Use length filter to test variable conditions

Add IPv6 Service Addresses to BGP advertisement when 
calico_advertise_cluster_ips is true.

* Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA

* Add check for dynamic_kubelet_configuration with kube >= 1.22

* CSI: update CSI snapshot CRDs

* CSI: update snapshot controller tag version with kubernetes specific versions

* CSI: allow enabling csi_snapshot_controller independent of Cinder CSI

* CSI: Align csi-snapshot-controller with upstream and use a Deployment instead of a StatefulSet

* cri-o registry auth support

* yaml lint for comments

* crio_registry_auth from registry_auth

* crio_registry_auth as defaults

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

`cluster_name` defaults to `dns_domain` value (see [here][1] and [here][2])
but they could have different values.

`dns_domain` should be used here instead of `cluster_name` because the DNS
resolution is configured to use `dns_domain`.

[1]: https://github.com/kubernetes-sigs/kubespray/blob/0ef7af76bc234efa06183e7329e557df87f9c0ee/roles/kubespray-defaults/defaults/main.yaml#L104
[2]: https://github.com/kubernetes-sigs/kubespray/blob/1afdb05ea9e1678b97e0224191d0a9341ce84f41/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml#L196

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

When using Calico with:

- `calico_network_backend: vxlan`,
- `calico_ipip_mode: "Never"`,
- `calico_vxlan_mode: "Always"`,

the `FelixConfiguration` object has `ipipEnabled: true`, when it should be false:

This is caused by an error in the `| bool` conversion in the install task:
when `calico_ipip_mode` is `Never`,
`{{ calico_ipip_mode != 'Never' | bool }}` evaluates to `true`: