* k8s: add hashes for 1.25.16, 1.26.12, 1.27.9

Make 1.27.9 default

* [etcd] add 3.5.10 hashes (#10566)

* Update etcd version for 1.26 and 1.27

---------

Co-authored-by: Mohamed Omar Zaian <mohamedzaian@gmail.com>

* Fix download retry when get_url has no status_code.

* Fix until clause in download role.

Co-authored-by: Romain <58464216+RomainMou@users.noreply.github.com>

* Bump galaxy.yml to next expected version

* Refactor check_galaxy + fix version (#10729)

* Remove checks for docs using exact tags

Instead use a more generic documentation for installing kubespray as a
collection from git.

* Check that we upgraded galaxy.yml to next version

This is only intented to check for human error. The version in galaxy
should be the next (which does not mean the same if we're on master or a
release branch).

* Set collection version to KUBESPRAY_NEXT_VERSION

* CI: Document the 'all-in-one' layout + small refactoring (#10725)

* Rename aio to all-in-one and document it

ADTM.
Acronyms don't tell much.

* Refactor vm_count in tests provisioning

* Add test case for calico using etcd datastore (#10722)

* Add multinode ci layout

* Add test case for calico using etcd datastore

* Fix calico-node in etcd mode (#10438)

* Calico : add ETCD endpoints to install-cni container

* Calico : remove nodename from configmap in etcd mode

---------

Co-authored-by: Olivier Levitt <olivier.levitt@gmail.com>

* Disable control plane allocating podCIDR for nodes when using calico

Calico does not use the .spec.podCIDR field for its IP address
management.
Furthermore, it can false positives from the kube controller manager if
kube_network_node_prefix and calico_pool_blocksize are unaligned, which
is the case with the default shipped by kubespray.

If the subnets obtained from using kube_network_node_prefix are bigger,
this would result at some point in the control plane thinking it does
not have subnets left for a new node, while calico will work without
problems.

Explicitely set a default value of false for calico_ipam_host_local to
facilitate its use in templates.

* Don't default to kube_network_node_prefix for calico_pool_blocksize

They have different semantics: kube_network_node_prefix is intended to
be the size of the subnet for all pods on a node, while there can be
more than on calico block of the specified size (they are allocated on
demand).

Besides, this commit does not actually change anything, because the
current code is buggy: we don't ever default to
kube_network_node_prefix, since the variable is defined in the role
defaults.

* kubernetes: add hashes for 1.27.8, 1.26.11

Make 1.27.8 default.

* Convert exoscale tf provider to new version (#10646)

This is untested. It passes terraform validate to un-broke the CI.

* Update 0040-verify-settings.yml (#10699)

remove embedded template

---------

Co-authored-by: piwinkler <9642809+piwinkler@users.noreply.github.com>

i.e when file was not modified since last download

Co-authored-by: Mathieu Parent <mathieu.parent@insee.fr>

* Migrate node-role.kubernetes.io/master to node-role.kubernetes.io/control-plane

* Migrate node-role.kubernetes.io/master to node-role.kubernetes.io/control-plane

* Migrate node-role.kubernetes.io/master to node-role.kubernetes.io/control-plane

* Migrate node-role.kubernetes.io/master to node-role.kubernetes.io/control-plane

Refactor NRI (Node Resource Interface) activation in CRI-O and
containerd. Introduce a shared variable, nri_enabled, to streamline
the process. Currently, enabling NRI requires a separate update of
defaults for each container runtime independently, without any
verification of NRI support for the specific version of containerd
or CRI-O in use.

With this commit, the previous approach is replaced. Now, a single
variable, nri_enabled, handles this functionality. Also, this commit
separates the responsibility of verifying NRI supported versions of
containerd and CRI-O from cluster administrators, and leaves it to
Ansible.

Signed-off-by: Feruzjon Muyassarov <feruzjon.muyassarov@intel.com>
(cherry picked from commit 1fd31ccc)

* [containerd] Add Configuration option for Node Resource Interface

Node Resource Interface (NRI) is a common is a common framework for
plugging domain or vendor-specific custom logic into container
runtime like containerd. With this commit, we introduce the
containerd_disable_nri configuration flag, providing cluster
administrators the flexibility to opt in or out (defaulted to 'out')
of this feature in containerd. In line with containerd's default
configuration, NRI is disabled by default in this containerd role
defaults.

Signed-off-by: Feruzjon Muyassarov <feruzjon.muyassarov@intel.com>

* [cri-o] Add configuration option for Node Resource Interface

Node Resource Interface (NRI) is a common is a common framework for
plugging domain or vendor-specific custom logic into container
runtimes like containerd/crio. With this commit, we introduce the
crio_enable_nri configuration flag, providing cluster
administrators the flexibility to opt in or out (defaulted to 'out')
of this feature in cri-o runtime. In line with crio's default
configuration, NRI is disabled by default in this cri-o role
defaults.

Signed-off-by: Feruzjon Muyassarov <feruzjon.muyassarov@intel.com>

---------

Signed-off-by: Feruzjon Muyassarov <feruzjon.muyassarov@intel.com>
(cherry picked from commit f964b343)

Co-authored-by: Toon Albers <45094749+toonalbers@users.noreply.github.com>

* Add hashes for kubernetes version 1.27.6 & 1.26.9

Signed-off-by: Boris Barnier <bozzo@users.noreply.github.com>

* Add hashes for kubernetes version 1.25.14

Signed-off-by: Boris Barnier <bozzo@users.noreply.github.com>

---------

Signed-off-by: Boris Barnier <bozzo@users.noreply.github.com>

* Add debian12 cilium testing

* Fixup recover control plane playbook

if not set owner to kube_owner in unarchive module, the owner of /opt/cni/bin will changed to root, which is inconsistent with the previous task.

Signed-off-by: hang.jiang <hang.jiang@daocloud.io>

Signed-off-by: tu1h <lihai.tu@daocloud.io>

* Add huaweicloud as external cloud controller

* Add huaweicloud example config

* Rename AK,SK to ACCESS_KEY and SECRET_KEY

* Add reference to huaweicloud

* Fix variable naming

* Fix env var name

* Update example

* Fix variable naming

* Fix cloud_config path

* Add namespace for leader election

* Revert reviewers

* Delete OWNERS

Delete owners who are not responsible here.

* Fix build validation

* Add hashes for 1.27.5 1.26.8, 1.25.13
* Address CVE-2023-3955 , CVE-2023-3676
* Make kubernetes v1.27.5 default

The following binaries has been updated:

* crio
* krew
* runc
* crun
* gvisor
* nerdctl
* skopeo
* yq

Signed-off-by: Victor Morales <chipahuac@hotmail.com>

Signed-off-by: tu1h <lihai.tu@daocloud.io>