* CSI: update CSI snapshot CRDs

* CSI: update snapshot controller tag version with kubernetes specific versions

* CSI: allow enabling csi_snapshot_controller independent of Cinder CSI

* CSI: Align csi-snapshot-controller with upstream and use a Deployment instead of a StatefulSet

* cri-o registry auth support

* yaml lint for comments

* crio_registry_auth from registry_auth

* crio_registry_auth as defaults

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

`cluster_name` defaults to `dns_domain` value (see [here][1] and [here][2])
but they could have different values.

`dns_domain` should be used here instead of `cluster_name` because the DNS
resolution is configured to use `dns_domain`.

[1]: https://github.com/kubernetes-sigs/kubespray/blob/0ef7af76bc234efa06183e7329e557df87f9c0ee/roles/kubespray-defaults/defaults/main.yaml#L104
[2]: https://github.com/kubernetes-sigs/kubespray/blob/1afdb05ea9e1678b97e0224191d0a9341ce84f41/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml#L196

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

When using Calico with:

- `calico_network_backend: vxlan`,
- `calico_ipip_mode: "Never"`,
- `calico_vxlan_mode: "Always"`,

the `FelixConfiguration` object has `ipipEnabled: true`, when it should be false:

This is caused by an error in the `| bool` conversion in the install task:
when `calico_ipip_mode` is `Never`,
`{{ calico_ipip_mode != 'Never' | bool }}` evaluates to `true`:

* During pre-upgrade add a flag to always cordon

* empty

* empty

* empty

* Better default val

- Use python3-apt instead because python-apt was removed in Debian 11
- Add gnupg (fix "container-engine/containerd : ensure containerd repository public key is installed" task failed)
- Remove aufs-tools

Signed-off-by: rtsp <git@rtsp.us>

* Fedora and RHEL use etc_t and the convention is <type_name>_t

* Docs: specify all values for preinstall_selinux_state

* CI: Add Fedora 34 with SELinux in enforcing mode

Related pip bug: https://stackoverflow.com/questions/68687029/unable-to-build-kubespray-container-from-dockerfile
Proposed workaround in comment: https://github.com/pypa/pip/issues/10219#issuecomment-887337037
Setting LANG only prior to launching pip fixes the issue with a successful build

Although these errors are not important, they affect the code specification.

using --no-cache-dir flag in pip install ,make sure downloaded packages
by pip don't cached on system . This is a best practice which make sure
to fetch from repo instead of using local cached one . Further , in case
of Docker Containers , by restricting caching , we can reduce image size.
In term of stats , it depends upon the number of python packages
multiplied by their respective size . e.g for heavy packages with a lot
of dependencies it reduce a lot by don't caching pip packages.

Further , more detail information can be found at

https://medium.com/sciforce/strategies-of-docker-images-optimization-2ca9cc5719b6



Signed-off-by: Pratik Raj <rajpratik71@gmail.com>

Bump calico version to 3.19.2 due to adding 3.20.0 earlier

Fix task 'Cert Manager | Wait for Webhook pods become ready' failed due to webhook pods don't exist yet by using `retries..until` trick like kubernetes-sigs/kubespray#7842

This fix should be removed in the future if the kubernetes/kubernetes#83242 is resolved.

Signed-off-by: rtsp <git@rtsp.us>

* feat(containerd): auth support

* fix(registry-auth): rename variable