Signed-off-by: tico88612 <17496418+tico88612@users.noreply.github.com>

Signed-off-by: tu1h <lihai.tu@daocloud.io>

#10844 Copy node instead of move

Also nerdctl limitation is now removed as we use /etc/containerd/certs.d/

Signed-off-by: bmelbourne <barry.melbourne0@gmail.com>

See https://github.com/kubernetes-sigs/kubespray/pull/11016

* feat: add user facing variable with default

* feat: remove rolebinding to anonymous users after init and upgrade

* feat: use file discovery for secondary control plane nodes

* feat: use file discovery for nodes

* fix: do not fail if rolebinding does not exist

* docs: add warning about kube_api_anonymous_auth

* style: improve readability of delegate_to parameter

* refactor: rename discovery kubeconfig file

* test: enable new variable in hardening and upgrade test cases

* docs: add option to config parameters

* test: multiple instances and upgrade

Signed-off-by: KubeKyrie <shaolong.qin@daocloud.io>

* upgrade ansible version

Needed for with_first_found to work correctly:
https://github.com/ansible/ansible/issues/70772 fixed in 2.16

* Remove unused google cloud cloud_playbook

* Fix dpkg_selection on non-existing packages

Needed since ansible-core>2.16, see:
https://github.com/ansible/ansible/commit/f10d11bcdc54c9b7edc0111eb38c59a88e396d0a

* [kubernetes] Make kubernetes 1.29.1 default

* [cri-o]: support cri-o 1.29

Use "crio status" instead of "crio-status" for cri-o >=1.29.0

* Remove GAed feature gates SecCompDefault

The SecCompDefault feature gate was removed since k8s 1.29
https://github.com/kubernetes/kubernetes/pull/121246

* Update upgrades.md

 modify env serial to have real rolling upgrades

* Update upgrades.md

change section for serial

* Update docs/upgrades.md

Co-authored-by: Kundan Kumar <kundan.kumar@india.nec.com>

---------

Co-authored-by: Kundan Kumar <kundan.kumar@india.nec.com>

Handle all old dns domains:
- for nodelocaldns: in the same server block as the current dns_domain
- for coredns: uffix rewrite of each of the old dns domains to the
  current one

Signed-off-by: Maxime Leroy <19607336+maxime1907@users.noreply.github.com>

Signed-off-by: tu1h <lihai.tu@daocloud.io>

Signed-off-by: serge Hartmann <serge.hartmann@gmail.com>

* ignore_unreachable for etcd dir cleanup

ignore_errors ignores errors occur within "file" module. However, when
the target node is offline, the playbook will still fail at this task
with node "unreachable" state. Setting "ignore_unreachable: true" allows
the playbook to bypass offline nodes and move on to proceed recovery
tasks on remaining online nodes.

* Re-arrange control plane recovery runbook steps

* Remove suggestion to manually update IP addresses

The suggestion was added in 48a18284 4
years ago. But a new task added 2 years ago, in
ee0f1e9d, automatically update API
server arg with updated etcd node ip addresses. This suggestion is no
longer needed.

* ci: redefine multinode to node-etcd-client

This should allow to catch several class of problem rather than just
one -> from network plugin such as calico or cilium talking directly to
the etcd.

* Dynamically define etcd host range

This has two benefits:
- We don't play the etcd role twice for no reason
- We have access to the whole cluster (if needed) to use things like
  group_by.

* Remove checks for docs using exact tags

Instead use a more generic documentation for installing kubespray as a
collection from git.

* Check that we upgraded galaxy.yml to next version

This is only intented to check for human error. The version in galaxy
should be the next (which does not mean the same if we're on master or a
release branch).

* Set collection version to KUBESPRAY_NEXT_VERSION

Signed-off-by: tu1h <lihai.tu@daocloud.io>

* Add multinode ci layout

* Add test case for calico using etcd datastore

This is removed from kubernetes since 1.25, time to cut some dead code.

* Rename aio to all-in-one and document it

ADTM.
Acronyms don't tell much.

* Refactor vm_count in tests provisioning