* [calico] make vxlan encapsulation the default

* don't enable ipip encapsulation by default
* set calico_network_backend by default to vxlan
* update sample inventory and documentation

* [CI] pin default calico parameters for upgrade tests to ensure proper upgrade

* [CI] improve netchecker connectivity testing

* [CI] show logs for tests

* [calico] tweak task name

* [CI] Don't run the provisioner from vagrant since we run it in testcases_run.sh

* [CI] move kube-router tests to vagrant to avoid network connectivity issues during netchecker check

* service proxy mode still fails connectivity tests so keeping it manual mode

* [kube-router] account for containerd use-case

* Sketch of helm-apps role interface

* helm-apps: Early implementation and settings

* helm-apps: Fix README.md example playbook

* fixup! Sketch of helm-apps role interface

* Make the argument specs more explicit

* Remove exposed options from hardcoded default

* Simplify example playbook in README.md

- Define directly the roles parameters
- Add an example of option override for one chart only

* Use release instead of charts

Make explicit that the role is mananing releases, not charts.
Simplify parameters naming

[systemd-resolved] Fix DNS configuration according to docs/dns-stack.md and during reset of cluster (#8560) (#8561)

This adds a unit test for the function.

Signed-off-by: Mac Chaffee <me@macchaffee.com>

* Add epoch to docker-ce and docker-ce-cli packages to ensure docker upgrade

* Split container-engine redhat vars to support legacy RHEL 7 version management

* Support ansible_distribution_major_version when disvering vars with ansible_os_family

Signed-off-by: Toni Tauro <toni.tauro@adfinis.com>

Entering any value causes the play to proceed, e.g., entering "no<Enter>". (This is simply how Ansible's pause module behaves.)

* Update ansible-lint to 5.4.0 (#8607)

It seems that the Rich version 11.0.0 has a breaking change.
So need to update ansible-lint to 5.3.2 or later.

* Fix for ansible-lint no-changed-when rule (#8607)

* There is an issue with etcd v3.5.0 where it resurrects ancient members see: https://github.com/etcd-io/etcd/issues/13196
This issue is clearly fixed in etcd v3.5.2

* Just keep the checksums

* [containerd] add hashes for 1.6.1

* [contained] make 1.6.1 the default

* [containerd] add hashes for 1.5.10

* [containerd] add hashes for 1.4.13

* [nerdct] bump to 0.17.1

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

Also, do not create unneeded resources (target pools are charged and should
only be created when needed).

[containerd] Upgrade containerd to 1.6.0 and re-enable arm64 architecture with default options (#8555)

* [containerd] add checksums for 1.6.0

* [containerd] promote 1.6.0 as the new default

* [runc] promote 1.1.0 as the new default to allow arm deployments out of the box

* [nerdctl] bump to 0.17.0 to align with containerd 1.6.0

* [reset] allow crictl stopp and rmp commands to fail

This reverts commit 41718024.

this is not complete -- there are almost certainly more instances of
this issue

Signed-off-by: Cyril Corbon <corboncyril@gmail.com>

As far as I can tell this is simply a typo that has existed from the beginning. Having it this way around (`etcd` group as a child and thus subset of `k8s_cluster`) mirrors what is written in the preceeding sentence.

Signed-off-by: Mac Chaffee <me@macchaffee.com>

fix: regex

fix: wrong regex_replace usage

* change default value for Encrypting Secret Data at Rest to secretbox, remove experimental flag and add documentation

* fix MD012/no-multiple-blanks

and fix the one with side effect.

Also removes `notify` from this task as the task has `changed_when: false`
and notify is not going to fire.