* feat: add kubelet systemd service hardening option

* refactor: move variable name to kubelet_secure_addresses

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* docs: add diagram about kubelet_secure_addresses variable

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* fix-kube-vip-strict-arp

* fix-kube-vip-strict-arp

* docs(hardening): add SeccompDefault admission plugin to kubelet feature gates

* fix(kubelet-config): enable config through kubelet_feature_gates

* feat(kubelet): add kubelet_seccomp_default variable

* extra admission controls now don't have a version in their file names
  eventratelimit.v1beta2.yaml.j2 -> eventratelimit.yaml.j2
* cri_socket variable includes the unix:// prefix to be conformat with
  upstream

[docker] use cri-dockerd instead of dockershim for any kubernetes version deployed with docker as the container_manager

* Fix: set fallback value of kubelet ip6 (#8858)

* Prune the spurious comma in the end of kubelet_address

- Update `roles/kubernetes/node/defaults/main.yml`

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* Fix: set fallback value of kubelet ip6 (#8858)

- Apply the lint: https://github.com/kubernetes-sigs/kubespray/pull/8926/commits/132606368e31bdb992fe45df80bd74d524b8ed89



Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

This reverts commit e3756786.

The workaround of explicitly specifying root for the kubelet unit was
for pulling images from private registry. Kubernetes now have a
dedicated mechanism with imagePullSecret.

Current Kubespray supports the Kubernetes version 1.21 or upper with
`kube_version_min_required: v1.21.0`

Then kube_version v1.20- related code is not used at all.
This deletes those code for cleanup.

* add Feature synchronized time checking

* fix-invalid-kube-vip-manifest

feat: add variables to manage makeIPTablesUtilChains and streamingConnectionIdleTimeout kubelet parameters (#8796)

Signed-off-by: Mathieu Parent <math.parent@gmail.com>

this is not complete -- there are almost certainly more instances of
this issue

If kubelet is run with systemd (as it always is when using kubespray),
it starts in systemd's /system.slice/kubelet.service cgroup.

This commit prevents a creation and usage of a second unrelated cgroup.

Signed-off-by: Cyril Corbon <corboncyril@gmail.com>

* Update loadbalancers versions

* fix haproxy_config_dir mode

* if bind-address is not set to 0.0.0.0

* Update docs and left comments

* fix yamllist check: remove space

* Alpha-NodeSwap: allow nodes to use swap

* CI: Add Fedora 35 with experimental swap job

* Add Fedora 35 image, support and CI

* Cleanup tests and allow_failure for vagrant

Author:    lmercl <lubos.mercl@gmail.com>
Date:      Wed Nov 10 15:30:04 2021 +0000

fix markdown

to remove deprecation warning:

> Flag --feature-gates has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag.

Closes https://github.com/kubernetes-sigs/kubespray/issues/8028



Signed-off-by: Iago Santos <iago.santos.pardo@adfinis.com>

* Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA

* Add check for dynamic_kubelet_configuration with kube >= 1.22

* Fedora and RHEL use etc_t and the convention is <type_name>_t

* Docs: specify all values for preinstall_selinux_state

* CI: Add Fedora 34 with SELinux in enforcing mode

* Ansible: move to Ansible 3.4.0 which uses ansible-base 2.10.10

* Docs: add a note about ansible upgrade post 2.9.x

* CI: ensure ansible is removed before ansible 3.x is installed to avoid pip failures

* Ansible: use newer ansible-lint

* Fix ansible-lint 5.0.11 found issues

* syntax issues
* risky-file-permissions
* var-naming
* role-name
* molecule tests

* Mitogen: use 0.3.0rc1 which adds support for ansible 2.10+

* Pin ansible-base to 2.10.11 to get package fix on RHEL8