* calico VXLAN mode

* check vars if calico backend defined

* Upgrade etcd to 3.3.18

* Try with etcd 3.3.15 (kubeadm 1.16.7 default)

* Back to square one

* Try with 3.3.11

* Upgrade etcd to 3.3.18 (take 2)

* Try with 3.3.12

* Add resources needed to deploy 1.6.4

* Use cilium v1.6.4

* Change deprecated option name

* Add update crd to clusterrole cilium

* Cilium 1.6.4 -> 1.6.5

* Make monitor-aggregation config configurable as a variable

* Change monitor-aggregation default none->medium

* Cilium 1.6.5 -> 1.6.6

* Update to 1.7.0

* v1.7.0->v1.7.1

* install cinder-csi before upgrading nodes

* Only run the Cinder CSI when enabled

https://github.com/containerd/containerd/releases/tag/v1.2.11
CVE-2019-16884 / CVE-2019-17596

https://github.com/containerd/containerd/releases/tag/v1.2.12
CVE-2019-19921 / CVE-2019-16884 / CVE-2019-11253

https://github.com/containerd/containerd/releases/tag/v1.2.13



Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

+ use more secure `command` instead of `shell`
+ read-only command doesn't change state - make idempotent
+ multi-line long string

* Added playbook to migrate openstack cloud provider

* remove old cloud provider config

* Rewrite provisioned-by annotation on Cinder PVs

* update indents

Co-authored-by: Jonathan Süssemilch Poulain <jonathan@sofiero.net>

* run external cloud provider setup during upgrade

* change name of taskt to better reflect what it does

* fix typo

* add documentation for how to upgrade to the new external cloud provider

* add migrate_openstack_provider playbook

* fix codeblock syntax highligth

* make docs for migrating cloud provider better

* update grammar

* fix typo

* Make sure the code is correct markdown

* remove Fenced code blocks

* fix markdown syntax

* remove extra lines and fix trailing spaces

Bumps [ansible](https://github.com/ansible/ansible) from 2.7.12 to 2.7.16.
- [Release notes](https://github.com/ansible/ansible/releases)
- [Commits](https://github.com/ansible/ansible/compare/v2.7.12...v2.7.16

)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Make etcdctl connect to localhost out of the box

* etcdctl envs: use admin-.pem instead of member-.pem

* download file

* download containers

* fix push image to nodes

* pull if none image on host

* fix

* improve docker image tag checks.
do not pull already cached images

* rebase fix merge conflict

* add support download_run_once when upgrade and scale cluster
add some test with download_run_once

* set default values to temp flag for every download cycle

* add save,load abilty for containerd and crio when download_run_once=true

* return redefine image save/load command to  set_docker_image_facts.yml

* move set command to set_container_facts

* ctr in containerd_bin_dir

* fix order of ctr image export arguments

* temporary disable download_run_once for containerd and crio
due https://github.com/containerd/containerd/issues/4075

* remove unused files

* fix strict yaml linter warning and errors

* refactor logical conditions to pull and cache container images

* remove comment due lint check

* document role

* remove image_load_on_localhost, because cached images are always loaded to docker on remote sites

* remove XXX from debug output

Ref: kubernetes/kubeadm/issues/2051

See: https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/kubernetes-sig-release/ew-k9PEBckQ/T7dFepHdCAAJ



Signed-off-by: Nguyen Hai Truong <truongnh@vn.fujitsu.com>

* Add metrics exporting in containerd config

* Add containerd.yml with containerd configuration example to the sample group_vars

Signed-off-by: Arthur Outhenin-Chalandre <arthur@cri.epita.fr>

exists role kubernetes/preinstall and not exists role container-engine

 error 'yum_repo_dir' is undefined

* Run 'container-engine' after drain.

Move possibly disruptive role 'container-engine' to run after the node
is drained.

As that role have to be run on non-cluster nodes as well (etcd and
calico-rr), and those nodes are not drained, add play for that case.

* Check if api is up before upgrade.

If container engine is restarted in previous role, api controller can
take some time to start. This check ensures api is up before upgrade.

- Add support for manage-security-groups flag
- Add support for internal-lb flag

* make cinder csi topology aware

* change feature description do better reflect whats being done

* remove sameas true since it isn't required

Although it is spelling mistakes, it might make affect while reading.

Signed-off-by: Nguyen Hai Truong <truongnh@vn.fujitsu.com>

When kube-router is used as cni, rules might be added to the mangle table
to support external IPs. Therefore, mangle table should be flushed during
reset as well.

This 38688a44 change replaces the
value for dockerproject_.+_repo_.+ docker variables but their new
value was previously defined in other variables. This change removes
the dockerproject_.+_repo_.+ docker variables in favor of the older
ones.

* Fix HAproxy config to avoid client offered only unsupported versions error

* Add HAproxy SSL check interval

* Fix ha mode document markdown

* Fix incorrect assertion comparison for kube_network_node_prefix

* Ignore assertion comparison for kube_network_node_prefix when using calico

* Adding more var docs description for kube_network_node_prefix

* Fixing trailing whitespaces

Replace deprecated callback plugin `skippy` with `default`, which
also supports ignoring skipped hosts.