* Update config.toml.j2

i think this commit code is not completed works

exam registry address : a.com:5000

insecure registry must be http://a.com:5000

but this code add insecure a.com:5000 (without http://)

If there is no http, containerd accesses with https even if insecure_skip_verify = true

solution is code edit

* Update config.toml.j2

* Update containerd.yml

* Update containerd.yml

* Update containerd.yml

* Update config.toml.j2

(cherry picked from commit dda557ed

)

Co-authored-by: Choi Yongbeom <59861163+mircyb@users.noreply.github.com>

Backport #8339 to 2.18-release
Cherry-pick 24f1402a



Co-authored-by: Choi Yongbeom <59861163+mircyb@users.noreply.github.com>

feat(offline): Improve generate_list.sh to generate offline file list using ansible (#8537) (#8538) (#8606)

Use jinja2 template and ansible to expand variables.

quay.io/kubespray/vagrant image is used for molecule_tests.
The tag was v2.17.1 on release-2.18 branch but the image
contains vagrant-2.2.15 which has a bug related to a virtual machine creation.
That caused kubespray CI failures.
This updates the image to use a newer vagrant.

All container image versions were defined in download/defaults/main.yml
except containerd.
The inconsistency caused the offline script(generate_list.sh) could not
output the URL of containerd image.
This moves the definition into a valid file.
In addition, this adds host_os to generate_list.sh for downloading
krew from a valid URL.

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* [kubernetes] add hashes for 1.23.2, 1.22.6, 1.21.9 and 1.20.15

* [kubernetes] make 1.22.6 the default version

Signed-off-by: Mathieu Parent <mathieu.parent@insee.fr>
(cherry picked from commit 43d12836)

This allow to workaround #8375 by using image_command_tool=crictl
when containerd_registries is used for containerd.

Also changes image_info_command_on_localhost for docker to return digests.

(cherry picked from commit cfd9873b)

The cherry-pick was adapted because nerdctl_extra_flags is not in
the release-2.18 branch (#8339).

(cherry picked from commit c11e4ba9)

See https://pypi.org/project/ruamel.yaml.clib/#history



Signed-off-by: Mathieu Parent <math.parent@gmail.com>
(cherry picked from commit 7ae00947)

* Fix container engine still installed on dedicated etcd node even if `etcd_deployment_type: host` (#8386)

(cherry picked from commit aa4a3d7a)

- Use builtin task scheduling of ansible (same task on each host)
  instead of manual looping on master

Benefits:
- One less play in remove-node.yml playbook
- Parralel node drain
- Drain parameters (timeout, grace period, retries,
  allow_ungraceful_removal) can be adjusted separately for each node
  with ansible variables

[cni-plugins] upgrade to stable 1.0.1 (#8331) using flannel cni add flannel_cni_download_url

flannel_cni_download_url offline doc update

This reverts commit 4f2e4524.

* [cni-plugins] upgrade to stable 1.0.1

* [flannel] use binary from dedicated project

* calico_pool_blocksize must be cast as string in assertion when defined

* Cast as int rather than string

* Ensure entries for 1.23 are added for supported_versions vars

* cri-o: add support for kubernetes 1.23 but still use cri-o 1.22

* kubescheduler-config: diferentiate config versions based on kube_version

"kubeadm alpha certs" command has been promoted to "kubeadm certs" command,
and "kubeadm alpha certs" has been deprecated since Kubernetes v1.20 as [1].
In addition, Kubespray supports Kubernetes v1.20+.
This delete the deprecated command for cleanup.

[1]: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#deprecation

* add support for cri-o user namespaces

* comply with yamllint rules

* nerdctl: move to 0.15.0

* nerdctl: reduce verbosity when pulling images

* download: use proxy environment when using nerdctl to download containers