Fine grained OS packages installation

Some packages requirements depends on inventory variables
(`kube_proxy_mode` in that case but it could apply to others).

As the case seems pretty rare, instead of adding complexity to pkgs, we
add an escape hatch to use jinja conditions.
That should be revisited if we find ourselves shoehorning lots of logic
in this later on.

The empty dict means that packages will always be installed on the host.

Uses the logic introduced in the previous patch to convert all
kubernetes/preinstall/vars/* os specific files to the `pkgs`
dictionary.

Some niceties for devs:
- always validate the `pkgs` variable to catch mistakes in CI.
- ensure that `pkgs` is always sorted. This makes it easier to find the
  packages you're looking for.

Adds infrastructure to install OS packages depending not only on OS
(family, versions, etc) but on groups.
All the informations related to a particular package should reside in
the `pkgs` dictionnary, which takes inspiration from the `downloads`
dictionary structure.

Since the structure we're setting in place for installing packages has
some complexity, add a JSON schema to avoid frustrating errors when
modifying the informations (adding/removing packages install).

openssl 1.1.1 is EOL since 12 September 2023, so just use the default
version on tumbleweed like we do on other distributions.

Also nerdctl limitation is now removed as we use /etc/containerd/certs.d/

This reverts commit 4b0a134b.

The mentionned PR break scale.yml. This goes back to the status quo
until a proper fix can be provided, at which point we'll reapply the
PR.

* ntp: add config to set which interface ntp should listen

* Fixed config to only have one variable

* Feat: dependabot initial config

Signed-off-by: tico88612 <17496418+tico88612@users.noreply.github.com>

* Feat: ignore yaml lint check .github path

Signed-off-by: tico88612 <17496418+tico88612@users.noreply.github.com>

---------

Signed-off-by: tico88612 <17496418+tico88612@users.noreply.github.com>

Signed-off-by: tu1h <lihai.tu@daocloud.io>

* [containerd/tracing]: add distributed tracing config flags

Signed-off-by: Ugur Ozturk <ugurozturk918@gmail.com>

* [containerd/tracing]: add distributed tracing config flags -fix

Signed-off-by: Ugur Ozturk <ugurozturk918@gmail.com>

---------

Signed-off-by: Ugur Ozturk <ugurozturk918@gmail.com>

To configure node asNumber for per node peering service account
calico-cni-plugin need nodes/status update rights

✅ Closes: 11076

Signed-off-by: MatthieuFin <matthieu2717@gmail.com>

* set default containerd_version to v1.7.15 and add checksums for v1.7.14 and v1.7.15

* update containerd version in README.md

Signed-off-by: Abhishek Jain <jain.abhishek1991@gmail.com>

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

Signed-off-by: KubeKyrie <shaolong.qin@daocloud.io>

Signed-off-by: bmelbourne <barry.melbourne0@gmail.com>

Upgrade Snapshot controller installed for all supported Kubernetes
versions to v7.0.2. Also update the manifests used to deploy the
Snapshot controller.

Signed-off-by: bmelbourne <barry.melbourne0@gmail.com>

As upstream

Signed-off-by: KubeKyrie <shaolong.qin@daocloud.io>

See https://github.com/kubernetes-sigs/kubespray/pull/11016

* Prevent upgrade-ipam for host-local IPAM

Otherwise, the init container upgrade-ipam would clear the state of the host-local plugin, potentially causing it to reassign IPs that are still in use.

* USE_POD_CIDR required for host-local

https://github.com/projectcalico/calico/blob/4efd1bfd914b0c59086531c8c5a5ac5b593c18b1/charts/calico/templates/calico-node.yaml#L279
https://github.com/projectcalico/calico/blob/4efd1bfd914b0c59086531c8c5a5ac5b593c18b1/charts/calico/templates/calico-typha.yaml#L133

* feat: add user facing variable with default

* feat: remove rolebinding to anonymous users after init and upgrade

* feat: use file discovery for secondary control plane nodes

* feat: use file discovery for nodes

* fix: do not fail if rolebinding does not exist

* docs: add warning about kube_api_anonymous_auth

* style: improve readability of delegate_to parameter

* refactor: rename discovery kubeconfig file

* test: enable new variable in hardening and upgrade test cases

* docs: add option to config parameters

* test: multiple instances and upgrade

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

[etcd] make etcd 3.5.12 default

* Move fedora ansible python install to bootstrap-os

* /bin/dir is set in bootstrap-os

* Removing ansible_os_family workarounds

Support for these distributions was merged in Ansible, no need to
override it ourselves now.
https://github.com/ansible/ansible/pull/69324 openEuler
https://github.com/ansible/ansible/pull/77275/ UnionTech OS Server 20
https://github.com/ansible/ansible/pull/78232/ Kylin

* Don't unconditionnaly set VARIANT_ID=coreos in os-release

WTF, this is so wrong.
Furthermore, is_fedora_coreos is already handled in boostrap-os

* Handle Clearlinux generically

Followup of 4eec302e (since we're using
package module anyway, let's get rid of the custom task)