Signed-off-by: KubeKyrie <shaolong.qin@daocloud.io>

* Feat: bump CoreDNS version to v1.11.3

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

* Docs: update README.md CoreDNS version to v1.11.3

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

---------

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

#11594

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

If we don't, existing installation would not pick up fix to that script,
such as dc33a197.

Simplify registry mirror rendering in config.toml.
The map filter can extract the host list from mirrors so we can
just unique them and render them without needing to construct vars
for it.
For the registry mirror tls section, we can first extract mirrors
from the dict then filter on only the ones having skip_veridy defined
first and then filter on the ones having true (as the dict might not
have skip_verify defined and that would cause errors of undefined var).

This will speed up and simply the templating.

Signed-off-by: Seena Fallah <seenafallah@gmail.com>

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>

Fix Flatcar bug #11268 missing default value for ansible_interpreter_python_fallback variable (#11270)

Signed-off-by: KubeKyrie <shaolong.qin@daocloud.io>

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

variables cilium_enable_host_firewall and cilium_policy_audit_mode for configmap/cilium-config (#11230)

capitalise values for Host Firewall and Policy Audit Mode
fix missing quotes

* Update cluster-role for cilium to prevent errors in agent startup

ciliumloadbalancerippools permissions exists in the cilium helm chart for version 1.13.0
https://github.com/cilium/cilium/blob/v1.13.0/install/kubernetes/cilium/templates/cilium-agent/clusterrole.yaml#L71

The agent also needs permissions to read/watch secrets for bgp auth secrets when using CiliumBGPPeeringPolicy with a secret.

* Remove list/watch permissions for secrets

* Remove secrets from list/watch permissions

* [kubernetes] Add hashes for kubernetes 1.29.8, 1.29.9, 1.30.5

* Update checksums.yml

reintroduce --- for yaml

* [etcd] make etcd 3.5.16 default

* Update etcd binary checksums for version 3.5.16 and lower

The old repository for these has been deleted, leaving the previous
configuration not possible to deploy, and even currently running clusters
fail after a restart as the DeameonSet has ImagePullPolicy: Always. More
details can be found here: kubernetes-sigs/vsphere-csi-driver#3053

As of writing, only CSI driver versions 3.1.2 to 3.3.1 is available in
this registry. This "officially" supports Kubernetes 1.26 to 1.30. Since
older drivers are not available, I have removed some feature-gating for
those unavailable versions while I was at it. For the cloud provider,
the `latest` image is now missing, and only 1.28.0 to 1.31.0 are
available. I've set the latest of these as the new default.

I also updated the documented default versions, as they were all out of
date and not aligned with actual code defaults.

Testing with group_names does not require the groups to exist.

There is no harm on having unneeded toleration when control-plane node
are not tainted, so simplify the template to always use the toleration.

k8s_cluster = kube_control_plane + kube_node

Remove unnecessary error handling. If the node ip is not defined, is
does not change anything whether we fail early of late.