* Decouple role kubespray-defaults from download

Avoids doing re-importing the download role on every invocation of
kubespray-defaults (and skipping everything).

This has a measurable effect on playbook performance.

* Update docs refering to moved download defaults

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

Signed-off-by: Boris Barnier <bozzo@users.noreply.github.com>

Signed-off-by: Boris Barnier <bozzo@users.noreply.github.com>

* [calico] Make version 3.26.1 default

* [calico] Separate calico-node and calico-cni-plugin service accounts

See: https://github.com/projectcalico/calico/pull/7106

* [kubernetes] support 1.28.0/1.28.1 (#10376)

* [kubernetes] Make 1.28.1 default (#10376)

The following binaries has been updated:

* crio
* krew
* runc
* crun
* gvisor
* nerdctl
* skopeo
* yq

Signed-off-by: Victor Morales <chipahuac@hotmail.com>

* Fix containerd_registries in config_path for mirrors and remove nerdctl global insecure_registry setting

* Make containerd hosts.toml mode 0640

* Add containerd_registries_mirrors and keep containerd_registries to pass packet_debian11-calico-upgrade

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

The following applications have been upgraded:

* helm
* skopeo
* yq

Signed-off-by: tu1h <lihai.tu@daocloud.io>