fix-absent-cni-kubeadm-join-control-planes (#13280 )

Replace injected Ansible fact variables in node and control-plane roles (#13240 )
Patch versions updates (#13283 )
2026-06-02 09:37:58 +00:00 · 2026-06-02 07:34:59 +05:30 · 2026-06-02 07:34:51 +05:30 · 2026-06-01 20:52:54 +05:30 · 2026-05-28 14:56:55 +05:30 · 2026-05-27 15:09:50 +05:30
79 changed files with 621 additions and 374 deletions
@@ -16,7 +16,7 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@10dcc54158ba4c137713d9d69d70a2da63b6bda3
+        uses: stefanbuck/github-issue-parser@cb6e97157cbf851e3a393ff8d57c93a484cc323f
        id: issue-parser
        with:
          template-path: .github/ISSUE_TEMPLATE/bug-report.yaml
@@ -14,7 +14,7 @@ jobs:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        ref: ${{ inputs.branch }}
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.13'
        cache: 'pip'
@@ -22,7 +22,7 @@ jobs:
    - run: update-hashes
      env:
        API_KEY: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/cache@v5
+    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        key: pre-commit-hook-propagate
        path: |
@@ -40,8 +40,8 @@ pr:
          - debian11-macvlan
          - debian12-cilium
          - debian13-cilium
-          - fedora39-kube-router
-          - fedora41-kube-router
+          - fedora42-kube-router
+          - fedora43-kube-router
          - fedora42-calico
          - rockylinux9-cilium
          - rockylinux10-cilium
@@ -56,7 +56,7 @@ pr:
          - ubuntu24-kube-router-sep
          - ubuntu24-kube-router-svc-proxy
          - ubuntu24-ha-separate-etcd
-          - fedora40-flannel-crio-collection-scale
+          - fedora43-flannel-crio-collection-scale

 # This is for flakey test so they don't disrupt the PR worklflow too much.
 # Jobs here MUST have a open issue so we don't lose sight of them
@@ -105,10 +105,10 @@ pr_full:
          - debian11-custom-cni
          - debian11-kubelet-csr-approver
          - debian12-custom-cni-helm
-          - fedora39-calico-swap-selinux
-          - fedora39-crio
-          - fedora41-calico-swap-selinux
-          - fedora41-crio
+          - fedora42-calico-swap-selinux
+          - fedora42-crio
+          - fedora43-calico-swap-selinux
+          - fedora43-crio
          - ubuntu24-calico-ha-wireguard
          - ubuntu24-flannel-ha
          - ubuntu24-flannel-ha-once
@@ -166,9 +166,9 @@ periodic:
          - debian11-calico-upgrade
          - debian11-calico-upgrade-once
          - debian12-cilium-svc-proxy
-          - fedora39-calico-selinux
-          - fedora40-docker-calico
-          - fedora41-calico-selinux
+          - fedora42-calico-selinux
+          - fedora43-calico-selinux
+          - fedora43-docker-calico
          - ubuntu24-calico-etcd-kubeadm-upgrade-ha
          - ubuntu24-calico-ha-recover
          - ubuntu24-calico-ha-recover-noquorum
@@ -35,7 +35,6 @@ molecule:
      - container-engine/containerd
      - container-engine/cri-o
      - container-engine/gvisor
-      - container-engine/youki
      - adduser
      - bastion-ssh-config
      - bootstrap_os
@@ -53,3 +52,5 @@ molecule_full:
    - ROLE:
      # FIXME : tests below are perma-failing
      - container-engine/kata-containers
+      # FIXME: until youki release 0.6.1
+      - container-engine/youki
@@ -33,6 +33,7 @@ repos:
    hooks:
      - id: ansible-lint
        additional_dependencies:
+          - ansible-core>=2.18.0,<2.19.0
          - jmespath==1.0.1
          - netaddr==1.3.0
          - distlib
@@ -49,7 +50,7 @@ repos:
        name: Build and install kubernetes-sigs.kubespray Ansible collection
        language: python
        additional_dependencies:
-          - ansible-core>=2.16.4
+          - ansible-core>=2.18.0,<2.19.0
          - distlib
        entry: tests/scripts/collection-build-install.sh
        pass_filenames: false
@@ -91,7 +92,7 @@ repos:
        name: Update static files referencing default kubespray values
        language: python
        additional_dependencies:
-          - ansible-core>=2.16.4
+          - ansible-core>=2.18.0,<2.19.0
        entry: scripts/propagate_ansible_variables.yml
        pass_filenames: false

@@ -35,8 +35,8 @@ RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]

 RUN OS_ARCHITECTURE=$(dpkg --print-architecture) \
-    && curl -L "https://dl.k8s.io/release/v1.35.4/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
-    && echo "$(curl -L "https://dl.k8s.io/release/v1.35.4/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
+    && curl -L "https://dl.k8s.io/release/v1.36.1/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
+    && echo "$(curl -L "https://dl.k8s.io/release/v1.36.1/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl

 COPY *.yml ./
@@ -8,6 +8,7 @@ aliases:
  kubespray-reviewers:
    - cyclinder
    - erikjiang
+    - guoard
    - mzaian
    - tico88612
    - vannten
@@ -22,7 +22,7 @@ Ensure you have installed Docker then
 ```ShellSession
 docker run --rm -it --mount type=bind,source="$(pwd)"/inventory/sample,dst=/inventory \
  --mount type=bind,source="${HOME}"/.ssh/id_rsa,dst=/root/.ssh/id_rsa \
-  quay.io/kubespray/kubespray:v2.30.0 bash
+  quay.io/kubespray/kubespray:v2.31.0 bash
 # Inside the container you may now run the kubespray playbooks:
 ansible-playbook -i /inventory/inventory.ini --private-key /root/.ssh/id_rsa cluster.yml
 ```
@@ -111,15 +111,15 @@ Note:
 <!-- BEGIN ANSIBLE MANAGED BLOCK -->

 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.35.4
-  - [etcd](https://github.com/etcd-io/etcd) 3.6.10
+  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.36.1
+  - [etcd](https://github.com/etcd-io/etcd) 3.6.11
  - [docker](https://www.docker.com/) 28.3
-  - [containerd](https://containerd.io/) 2.2.3
-  - [cri-o](http://cri-o.io/) 1.35.0 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [containerd](https://containerd.io/) 2.3.1
+  - [cri-o](https://cri-o.io/) 1.36.0 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
  - [cni-plugins](https://github.com/containernetworking/plugins) 1.9.1
  - [calico](https://github.com/projectcalico/calico) 3.31.5
-  - [cilium](https://github.com/cilium/cilium) 1.19.3
+  - [cilium](https://github.com/cilium/cilium) 1.19.4
  - [flannel](https://github.com/flannel-io/flannel) 0.28.4
  - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
  - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
@@ -127,7 +127,7 @@ Note:
  - [kube-vip](https://github.com/kube-vip/kube-vip) 1.0.3
 - Application
  - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3
-  - [coredns](https://github.com/coredns/coredns) 1.12.4
+  - [coredns](https://github.com/coredns/coredns) 1.14.2
  - [argocd](https://argoproj.github.io/) 2.14.5
  - [helm](https://helm.sh/) 3.18.4
  - [metallb](https://metallb.universe.tf/) 0.13.9
@@ -58,7 +58,7 @@ You can create a release note with:
 export GITHUB_TOKEN=<your-github-token>
 export ORG=kubernetes-sigs
 export REPO=kubespray
-release-notes --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note --required-author=""
+release-notes generate --org "${ORG}" --repo "${REPO}" --repo-path "${PWD}" --start-sha <The start commit-id> --end-sha <The end commit-id> --dependencies=false --output=/tmp/kubespray-release-note
 ```

 If the release note file(/tmp/kubespray-release-note) contains "### Uncategorized" pull requests, those pull requests don't have a valid kind label(`kind/feature`, etc.).
@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version

 ```yml
-cilium_version: "1.19.3"
+cilium_version: "1.19.4"
 ```

 ## Add variable to config
@@ -157,20 +157,20 @@ Example command to filter and apply only DNS configuration tasks and skip
 everything else related to host OS configuration and downloading images of containers:

 ```ShellSession
-ansible-playbook -i inventory/sample/hosts.ini cluster.yml --tags preinstall,facts --skip-tags=download,bootstrap_os
+ansible-playbook -i inventory/sample/inventory.ini cluster.yml --tags preinstall,facts --skip-tags=download,bootstrap_os
 ```

 And this play only removes the K8s cluster DNS resolver IP from hosts' /etc/resolv.conf files:

 ```ShellSession
-ansible-playbook -i inventory/sample/hosts.ini -e dns_mode='none' cluster.yml --tags resolvconf
+ansible-playbook -i inventory/sample/inventory.ini -e dns_mode='none' cluster.yml --tags resolvconf
 ```

 And this prepares all container images locally (at the ansible runner node) without installing
 or upgrading related stuff or trying to upload container to K8s cluster nodes:

 ```ShellSession
-ansible-playbook -i inventory/sample/hosts.ini cluster.yml \
+ansible-playbook -i inventory/sample/inventory.ini cluster.yml \
    -e download_run_once=true -e download_localhost=true \
    --tags download --skip-tags upload,upgrade
 ```
@@ -62,7 +62,7 @@ Once the configuration is set, you can execute the playbook again to apply the n

 ```ShellSession
 cd kubespray
-ansible-playbook -i inventory/sample/hosts.ini -b -v cluster.yml
+ansible-playbook -i inventory/sample/inventory.ini -b -v cluster.yml
 ```

 You'll find some useful examples [here](https://github.com/kubernetes/cloud-provider-vsphere/blob/master/docs/book/tutorials/kubernetes-on-vsphere-with-kubeadm.md#sample-manifests-to-test-csi-driver-functionality) to test your configuration.
@@ -82,7 +82,7 @@ If you intend to leverage the [zone and region node labeling](https://kubernetes

 ### Kubespray configuration (deprecated)

-First you must define the cloud provider in `inventory/sample/group_vars/all.yml` and set it to `vsphere`.
+First you must define the cloud provider in `inventory/sample/group_vars/all/all.yml` and set it to `vsphere`.

 ```yml
 cloud_provider: vsphere
@@ -128,7 +128,7 @@ Once the configuration is set, you can execute the playbook again to apply the n

 ```ShellSession
 cd kubespray
-ansible-playbook -i inventory/sample/hosts.ini -b -v cluster.yml
+ansible-playbook -i inventory/sample/inventory.ini -b -v cluster.yml
 ```

 You'll find some useful examples [here](https://github.com/kubernetes/examples/tree/master/staging/volumes/vsphere) to test your configuration.
@@ -11,5 +11,5 @@ You can deploy instances in your cloud environment in several ways. Examples inc
 With ansible-playbook command

 ```ShellSession
-ansible-playbook -u smana -e ansible_ssh_user=admin -e cloud_provider=[aws|gce] -b --become-user=root -i inventory/single.cfg cluster.yml
+ansible-playbook -u smana -e ansible_ssh_user=admin -e cloud_provider=[aws|gce] -b --become-user=root -i inventory/sample/inventory.ini cluster.yml
 ```
@@ -11,10 +11,8 @@ amazon |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | :x: | :white_check_mark: |
 debian12 |  :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: |
 debian13 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
-fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora40 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
-fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
 flatcar4081 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
@@ -31,10 +29,8 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora39 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora41 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora42 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
@@ -51,10 +47,8 @@ amazon |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian11 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian12 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 debian13 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora39 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora40 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
-fedora41 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 fedora42 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
+fedora43 |  :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
 flatcar4081 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 openeuler24 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
 rockylinux10 |  :x: | :x: | :x: | :x: | :x: | :x: | :x: |
@@ -15,16 +15,15 @@ and [details on the inventory structure expected by Kubespray](/docs/ansible/inv
 <your-favorite-editor> inventory/mycluster/inventory.ini

 # Review and change parameters under ``inventory/mycluster/group_vars``
-<your-favorite-editor> inventory/mycluster/group_vars/all.yml # for every node, including etcd
-<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster.yml # for every node in the cluster (not etcd when it's separate)
-<your-favorite-editor> inventory/mycluster/group_vars/kube_control_plane.yml # for the control plane
-<your-favorite-editor> inventory/myclsuter/group_vars/kube_node.yml # for worker nodes
+<your-favorite-editor> inventory/mycluster/group_vars/all/all.yml # for every node, including etcd
+<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml # for every node in the cluster (not etcd when it's separate)
+<your-favorite-editor> inventory/mycluster/group_vars/k8s_cluster/kube_control_plane.yml # for the control plane
 ```

 ## Installing the cluster

 ```ShellSession
-ansible-playbook -i inventory/mycluster/ cluster.yml -b -v \
+ansible-playbook -i inventory/mycluster/inventory.ini cluster.yml -b -v \
  --private-key=~/.ssh/private_key
 ```

@@ -36,7 +35,7 @@ You may want to add worker, control plane or etcd nodes to your existing cluster
 - Run the ansible-playbook command, substituting `cluster.yml` for `scale.yml`:

 ```ShellSession
-ansible-playbook -i inventory/mycluster/hosts.yml scale.yml -b -v \
+ansible-playbook -i inventory/mycluster/inventory.ini scale.yml -b -v \
  --private-key=~/.ssh/private_key
 ```

@@ -54,7 +53,7 @@ is not working, you can remove the node and install it again.
 Use `--extra-vars "node=<nodename>,<nodename2>"` to select the node(s) you want to delete.

 ```ShellSession
-ansible-playbook -i inventory/mycluster/hosts.yml remove-node.yml -b -v \
+ansible-playbook -i inventory/mycluster/inventory.ini remove-node.yml -b -v \
 --private-key=~/.ssh/private_key \
 --extra-vars "node=nodename,nodename2"
 ```
@@ -87,7 +86,7 @@ the Kubernetes [documentation](https://kubernetes.io/docs/tasks/access-applicati

 The main client of Kubernetes is `kubectl`. It is installed on each kube_control_plane
 host and can optionally be configured on your ansible host by setting
-`kubectl_localhost: true` and `kubeconfig_localhost: true` in the configuration:
+`kubectl_localhost: true` and `kubeconfig_localhost: true` in `inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml`:

 - If `kubectl_localhost` enabled, `kubectl` will download onto `/usr/local/bin/` and setup with bash completion. A helper script `inventory/mycluster/artifacts/kubectl.sh` also created for setup with below `admin.conf`.
 - If `kubeconfig_localhost` enabled `admin.conf` will appear in the `inventory/mycluster/artifacts/` directory after deployment.
@@ -223,7 +223,7 @@ that controller-0, controller-1 and controller-2 in the `kube_control_plane` gro
 worker-0, worker-1 and worker-2 in the `kube_node` group. Add respective `ip` to the respective local VPC IP for each node.

 The main configuration for the cluster is stored in
-`inventory/mycluster/group_vars/k8s_cluster/k8s_cluster.yml`. In this file we
+`inventory/mycluster/group_vars/k8s_cluster/k8s-cluster.yml`. In this file we
 will update the `supplementary_addresses_in_ssl_keys` with a list of the IP
 addresses of the controller nodes. In that way we can access the
  kubernetes API server as an administrator from outside the VPC network. You
@@ -240,7 +240,7 @@ the kubernetes cluster, just change the 'false' to 'true' for
 Now we will deploy the configuration:

 ```ShellSession
-ansible-playbook -i inventory/mycluster/ -u $USERNAME -b -v --private-key=~/.ssh/id_rsa cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -u $USERNAME -b -v --private-key=~/.ssh/id_rsa cluster.yml
 ```

 Ansible will now execute the playbook, this can take up to 20 minutes.
@@ -594,7 +594,7 @@ If you want to keep the VMs and just remove the cluster state, you can simply
 run another Ansible playbook:

 ```ShellSession
-ansible-playbook -i inventory/mycluster/ -u $USERNAME -b -v --private-key=~/.ssh/id_rsa reset.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -u $USERNAME -b -v --private-key=~/.ssh/id_rsa reset.yml
 ```

 Resetting the cluster to the VMs original state usually takes about a couple
@@ -86,3 +86,12 @@ kube_vip_leaseduration: 30
 kube_vip_renewdeadline: 20
 kube_vip_retryperiod: 4
 ```
+
+To expose [Prometheus metrics](https://kube-vip.io/docs/installation/flags/#environment-variables) from the kube-vip static pod, set `kube_vip_metrics_enabled`. `kube_vip_metrics_port` is an integer; the manifest sets `prometheus_server` to `:PORT` because kube-vip passes that value to Go's HTTP listen address (see [`servePrometheusHTTPServer` in kube-vip](https://github.com/kube-vip/kube-vip/blob/main/cmd/kube-vip.go)). The manifest `ports` entry uses the same number for tooling that reads the pod spec.
+
+Kubespray defaults `kube_vip_metrics_port` to `2112`, matching upstream kube-vip's `--prometheusHTTPServer` default. Override it if your scrape config expects another port.
+
+```yaml
+kube_vip_metrics_enabled: true
+# kube_vip_metrics_port: 2112
+```
@@ -26,13 +26,13 @@ If you wanted to upgrade just kube_version from v1.18.10 to v1.19.7, you could
 deploy the following way:

 ```ShellSession
-ansible-playbook cluster.yml -i inventory/sample/hosts.ini -e kube_version=1.18.10 -e upgrade_cluster_setup=true
+ansible-playbook cluster.yml -i inventory/sample/inventory.ini -e kube_version=1.18.10 -e upgrade_cluster_setup=true
 ```

 And then repeat with 1.19.7 as kube_version:

 ```ShellSession
-ansible-playbook cluster.yml -i inventory/sample/hosts.ini -e kube_version=1.19.7 -e upgrade_cluster_setup=true
+ansible-playbook cluster.yml -i inventory/sample/inventory.ini -e kube_version=1.19.7 -e upgrade_cluster_setup=true
 ```

 The var ```-e upgrade_cluster_setup=true``` is needed to be set in order to migrate the deploys of e.g kube-apiserver inside the cluster immediately which is usually only done in the graceful upgrade. (Refer to [#4139](https://github.com/kubernetes-sigs/kubespray/issues/4139) and [#4736](https://github.com/kubernetes-sigs/kubespray/issues/4736))
@@ -46,7 +46,7 @@ existing cluster. That means there must be at least 1 kube_control_plane already
 deployed.

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.19.7
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.19.7
 ```

 After a successful upgrade, the Server Version should be updated:
@@ -60,7 +60,7 @@ Server Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.7", GitCom
 You can control how many nodes are upgraded at the same time by modifying the ansible variable named `serial`, as explained [here](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_strategies.html#setting-the-batch-size-with-serial). If you don't set this variable, it will upgrade the cluster nodes in batches of  20% of the available nodes. Setting `serial=1` would mean upgrade one node at a time.

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 -e "serial=1"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 -e "serial=1"
 ```

 ### Pausing the upgrade
@@ -82,20 +82,20 @@ If you don't want to upgrade all nodes in one run, you can use `--limit` [patter
 Before using `--limit` run playbook `facts.yml` without the limit to refresh facts cache for all nodes:

 ```ShellSession
-ansible-playbook playbooks/facts.yml -b -i inventory/sample/hosts.ini
+ansible-playbook playbooks/facts.yml -b -i inventory/sample/inventory.ini
 ```

 After this upgrade control plane and etcd groups [#5147](https://github.com/kubernetes-sigs/kubespray/issues/5147):

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "kube_control_plane:etcd"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "kube_control_plane:etcd"
 ```

 Now you can upgrade other nodes in any order and quantity:

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "node4:node6:node7:node12"
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e kube_version=1.20.7 --limit "node5*"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "node4:node6:node7:node12"
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e kube_version=1.20.7 --limit "node5*"
 ```

 ## Multiple upgrades
@@ -122,9 +122,9 @@ v2.24.0
 v2.22.0 -> v2.23.2 -> v2.24.0 : ✓
 v.22.0 -> v2.24.0 : ✕

-Assuming you don't explicitly define a kubernetes version in your k8s_cluster.yml, you simply check out the next tag and run the upgrade-cluster.yml playbook
+Assuming you don't explicitly define a kubernetes version in your group_vars/k8s_cluster/k8s-cluster.yml, you simply check out the next tag and run the upgrade-cluster.yml playbook

-* If you do define kubernetes version in your inventory (e.g. group_vars/k8s_cluster.yml) then either make sure to update it before running upgrade-cluster, or specify the new version you're upgrading to: `ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml -e kube_version=1.11.3`
+* If you do define kubernetes version in your inventory (e.g. group_vars/k8s_cluster/k8s-cluster.yml) then either make sure to update it before running upgrade-cluster, or specify the new version you're upgrading to: `ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml -e kube_version=1.11.3`

  Otherwise, the upgrade will leave your cluster at the same k8s version defined in your inventory vars.

@@ -155,7 +155,7 @@ HEAD is now at 05dabb7e Fix Bionic networking restart error #3430 (#3431)

 # NOTE: May need to `pip3 install -r requirements.txt` when upgrading.

-ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml

 ...

@@ -178,7 +178,7 @@ Some deprecations between versions that mean you can't just upgrade straight fro
 In this case, I set "kubeadm_enabled" to false, knowing that it is deprecated and removed by 2.9.0, to delay converting the cluster to kubeadm as long as I could.

 ```ShellSession
-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -196,7 +196,7 @@ $ git checkout v2.8.1
 Previous HEAD position was 9051aa52 Fix ubuntu-contiv test failed (#3808)
 HEAD is now at 2ac1c756 More Feature/2.8 backports for 2.8.1 (#3911)

-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -214,7 +214,7 @@ $ git checkout v2.8.2
 Previous HEAD position was 2ac1c756 More Feature/2.8 backports for 2.8.1 (#3911)
 HEAD is now at 4167807f Upgrade to 1.12.5 (#4066)

-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -232,7 +232,7 @@ $ git checkout v2.8.3
 Previous HEAD position was 4167807f Upgrade to 1.12.5 (#4066)
 HEAD is now at ea41fc5e backport cve-2019-5736 to release-2.8 (#4234)

-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -250,7 +250,7 @@ $ git checkout v2.8.4
 Previous HEAD position was ea41fc5e backport cve-2019-5736 to release-2.8 (#4234)
 HEAD is now at 3901480b go to k8s 1.12.7 (#4400)

-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -268,7 +268,7 @@ $ git checkout v2.8.5
 Previous HEAD position was 3901480b go to k8s 1.12.7 (#4400)
 HEAD is now at 6f97687d Release 2.8 robust san handling (#4478)

-$ ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+$ ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml
 ...
    "msg": "DEPRECATION: non-kubeadm deployment is deprecated from v2.9. Will be removed in next release."
 ...
@@ -288,14 +288,14 @@ HEAD is now at a4e65c7c Upgrade to Ansible >2.7.0 (#4471)
 ```

 > **Warning**
-> IMPORTANT: Some variable formats changed in the k8s_cluster.yml between 2.8.5 and 2.9.0
+> IMPORTANT: Some variable formats changed in the group_vars/k8s_cluster/k8s-cluster.yml between 2.8.5 and 2.9.0

 If you do not keep your inventory copy up to date, **your upgrade will fail** and your first master will be left non-functional until fixed and re-run.

 It is at this point the cluster was upgraded from non-kubeadm to kubeadm as per the deprecation warning.

 ```ShellSession
-ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml

 ...

@@ -320,7 +320,7 @@ $ git checkout v2.10.0
 Previous HEAD position was a4e65c7c Upgrade to Ansible >2.7.0 (#4471)
 HEAD is now at dcd9c950 Add etcd role dependency on kube user to avoid etcd role failure when running scale.yml with a fresh node. (#3240) (#4479)

-ansible-playbook -i inventory/mycluster/hosts.ini -b upgrade-cluster.yml
+ansible-playbook -i inventory/mycluster/inventory.ini -b upgrade-cluster.yml

 ...

@@ -372,49 +372,49 @@ hosts.
 Upgrade docker:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=docker
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=docker
 ```

 Upgrade etcd:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=etcd
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=etcd
 ```

 Upgrade etcd without rotating etcd certs:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=etcd --limit=etcd --skip-tags=etcd-secrets
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=etcd --limit=etcd --skip-tags=etcd-secrets
 ```

 Upgrade kubelet:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=node --skip-tags=k8s-gen-certs
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=node --skip-tags=k8s-gen-certs
 ```

 Upgrade Kubernetes master components:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=master
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=master
 ```

 Upgrade network plugins:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=network
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=network
 ```

 Upgrade all add-ons:

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=apps
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=apps
 ```

 Upgrade just helm (assuming `helm_enabled` is true):

 ```ShellSession
-ansible-playbook -b -i inventory/sample/hosts.ini cluster.yml --tags=helm
+ansible-playbook -b -i inventory/sample/inventory.ini cluster.yml --tags=helm
 ```

 ## Migrate from Docker to Containerd
@@ -430,7 +430,7 @@ As of Kubespray 2.18.0, containerd is already the default container engine. If y
 If you want to upgrade the APT or YUM packages while the nodes are cordoned, you can use:

 ```ShellSession
-ansible-playbook upgrade-cluster.yml -b -i inventory/sample/hosts.ini -e system_upgrade=true
+ansible-playbook upgrade-cluster.yml -b -i inventory/sample/inventory.ini -e system_upgrade=true
 ```

 Nodes will be rebooted when there are package upgrades (`system_upgrade_reboot: on-upgrade`).
@@ -28,11 +28,11 @@ Everything done here requires full root access to every node.
 Before you begin, adjust your inventory:

 ```yaml
-# Filename: k8s_cluster/k8s-cluster.yml
+# Filename: group_vars/k8s_cluster/k8s-cluster.yml
 resolvconf_mode: host_resolvconf
 container_manager: containerd

-# Filename: etcd.yml
+# Filename: group_vars/all/etcd.yml
 etcd_deployment_type: host
 ```

@@ -66,7 +66,7 @@ apt-get install pigz
 ### 5) Run `cluster.yml` playbook with `--limit`

 ```commandline
-ansible-playbook -i inventory/sample/hosts.ini cluster.yml --limit=NODENAME
+ansible-playbook -i inventory/sample/inventory.ini cluster.yml --limit=NODENAME
 ```

 This effectively reinstalls containerd and seems to place all config files in the right place. When this completes, kubelet will immediately pick up the new container engine and start spinning up DaemonSets and kube-system Pods.
@@ -2,7 +2,7 @@
 namespace: kubernetes_sigs
 description: Deploy a production ready Kubernetes cluster
 name: kubespray
-version: 2.31.0
+version: 2.32.0
 readme: README.md
 authors:
  - The Kubespray maintainers (https://kubernetes.slack.com/channels/kubespray)
@@ -201,6 +201,8 @@ kube_vip_enabled: false
 # kube_vip_lb_fwdmethod: local
 # kube_vip_bgp_sourceip:
 # kube_vip_bgp_sourceif:
+# kube_vip_metrics_enabled: false
+# kube_vip_metrics_port: 2112

 # Node Feature Discovery
 node_feature_discovery_enabled: false
@@ -46,8 +46,8 @@ ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
 RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
    && pip install --break-system-packages --ignore-installed --no-compile --no-cache-dir pip -U \
    && pip install --break-system-packages --no-compile --no-cache-dir -r tests/requirements.txt \
-    && curl -L https://dl.k8s.io/release/v1.35.4/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
-    && echo $(curl -L https://dl.k8s.io/release/v1.35.4/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
+    && curl -L https://dl.k8s.io/release/v1.36.1/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
+    && echo $(curl -L https://dl.k8s.io/release/v1.36.1/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
    && chmod a+x /usr/local/bin/kubectl \
    # Install Vagrant
    && curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
@@ -55,5 +55,5 @@ RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
    && rm vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
    && vagrant plugin install vagrant-libvirt \
    # Install Kubernetes collections
-    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes \
-    && ansible-galaxy collection install kubernetes.core
+    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes==35.0.0 \
+    && ansible-galaxy collection install kubernetes.core:==6.4.0
@@ -1,6 +1,6 @@
 ansible==11.13.0
 # Needed for community.crypto module
-cryptography==46.0.7
+cryptography==48.0.0
 # Needed for jinja2 json_query templating
 jmespath==1.1.0
 # Needed for ansible.utils.ipaddr
@@ -9,7 +9,7 @@
    failed_when: >
      version is failed or
      'kata-runtime' not in version.stdout
-  - name: Test version
+  - name: Test version check
    command: "/opt/kata/bin/kata-runtime check"
    register: check
    failed_when: >
@@ -2,7 +2,7 @@
 - name: Download | Prepare working directories and variables
  import_tasks: prep_download.yml
  when:
-    - not skip_downloads | default(false)
+    - not skip_downloads
  tags:
    - download
    - upload
@@ -10,7 +10,7 @@
 - name: Download | Get kubeadm binary and list of required images
  include_tasks: prep_kubeadm_images.yml
  when:
-    - not skip_downloads | default(false)
+    - not skip_downloads
    - ('kube_control_plane' in group_names)
  tags:
    - download
@@ -23,8 +23,8 @@
    download: "{{ download_defaults | combine(item.value) }}"
    include_file: "download_{% if download.container %}container{% else %}file{% endif %}.yml"
  when:
-    - not skip_downloads | default(false)
+    - not skip_downloads
    - download.enabled
    - item.value.enabled
-    - (not (item.value.container | default(false))) or (item.value.container and download_container)
+    - (not download.container) or (download.container and download_container)
    - (download_run_once and inventory_hostname == download_delegate) or (group_names | intersect(download.groups) | length)
@@ -13,6 +13,8 @@
    sync_certs: false
    gen_certs: false
    etcd_secret_changed: false
+    etcd_member_requires_sync: false
+    kubernetes_host_requires_sync: false

 - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
  stat:
@@ -128,7 +130,7 @@
  set_fact:
    sync_certs: true
  when:
-    - etcd_member_requires_sync | default(false) or
-      kubernetes_host_requires_sync | default(false) or
+    - etcd_member_requires_sync or
+      kubernetes_host_requires_sync or
      'gen_master_certs_True' in group_names or
      'gen_node_certs_True' in group_names
@@ -24,7 +24,7 @@
  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
-    - gen_certs | default(false)
+    - gen_certs
    - inventory_hostname == groups['etcd'][0]

 - name: Gen_certs | copy certs generation script
@@ -43,7 +43,7 @@
    HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['kube_control_plane']) | join(' ') }}"
  run_once: true
  delegate_to: "{{ groups['etcd'][0] }}"
-  when: gen_certs | default(false)
+  when: gen_certs
  notify: Set etcd_secret_changed

 - name: Gen_certs | run cert generation script for all clients
@@ -55,7 +55,7 @@
  when:
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
-    - gen_certs | default(false)
+    - gen_certs
  notify: Set etcd_secret_changed

 - name: Gen_certs | Gather etcd member/admin and kube_control_plane client certs from first etcd node
@@ -78,7 +78,7 @@
  delegate_to: "{{ groups['etcd'][0] }}"
  when:
    - ('etcd' in group_names)
-    - sync_certs | default(false)
+    - sync_certs
    - inventory_hostname != groups['etcd'][0]
  notify: Set etcd_secret_changed

@@ -92,7 +92,7 @@
  with_items: "{{ etcd_master_certs.results }}"
  when:
    - ('etcd' in group_names)
-    - sync_certs | default(false)
+    - sync_certs
    - inventory_hostname != groups['etcd'][0]
  loop_control:
    label: "{{ item.item }}"
@@ -134,7 +134,7 @@
  include_tasks: gen_nodes_certs_script.yml
  when:
    - ('kube_control_plane' in group_names) and
-        sync_certs | default(false) and inventory_hostname not in groups['etcd']
+        sync_certs and inventory_hostname not in groups['etcd']

 - name: Gen_certs | Generate etcd certs on nodes if needed
  include_tasks: gen_nodes_certs_script.yml
@@ -142,7 +142,7 @@
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
    - ('k8s_cluster' in group_names) and
-        sync_certs | default(false) and inventory_hostname not in groups['etcd']
+        sync_certs and inventory_hostname not in groups['etcd']

 # This is a hack around the fact kubeadm expect the same certs path on all kube_control_plane
 # TODO: fix certs generation to have the same file everywhere
@@ -84,7 +84,7 @@
  when:
    - ('etcd' in group_names)
    - etcd_cluster_setup
-    - etcd_secret_changed | default(false)
+    - etcd_secret_changed

 - name: Restart etcd-events if certs changed
  command: /bin/true
@@ -92,7 +92,7 @@
  when:
    - ('etcd' in group_names)
    - etcd_events_cluster_setup
-    - etcd_secret_changed | default(false)
+    - etcd_secret_changed

 # After etcd cluster is assembled, make sure that
 # initial state of the cluster is in `existing`
@@ -1,9 +1,11 @@
 ---
 - name: Add Helm repositories
+  environment: "{{ proxy_env }}"
  kubernetes.core.helm_repository: "{{ helm_repository_defaults | combine(item) }}"  # noqa args[module]
  loop: "{{ repositories }}"

 - name: Update Helm repositories
+  environment: "{{ proxy_env }}"
  kubernetes.core.helm:
    state: absent
    binary_path: "{{ bin_dir }}/helm"
@@ -15,5 +17,6 @@
    - helm_update

 - name: Install Helm Applications
+  environment: "{{ proxy_env }}"
  kubernetes.core.helm: "{{ helm_defaults | combine(release_common_opts, item) }}"  # noqa args[module]
  loop: "{{ releases }}"
@@ -4,9 +4,7 @@ dependencies:
    when:
      - inventory_hostname == groups['kube_control_plane'][0]
      - kubelet_csr_approver_enabled
-    environment:
-      http_proxy: "{{ http_proxy | default('') }}"
-      https_proxy: "{{ https_proxy | default('') }}"
+    environment: "{{ proxy_env }}"
    release_common_opts: {}
    releases:
      - name: kubelet-csr-approver
@@ -3,7 +3,8 @@
  fail:
    msg: "MetalLB require kube_proxy_strict_arp = true, see https://github.com/danderson/metallb/issues/153#issuecomment-518651132"
  when:
-    - "kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp"
+    - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
+    - not kube_proxy_remove

 - name: Kubernetes Apps | Check that the deprecated 'matallb_auto_assign' variable is not used anymore
  fail:
@@ -41,6 +41,9 @@ control_plane_health_retries: 60  # Default retries for apiserver, scheduler, co
 kube_controller_manager_leader_elect_lease_duration: 15s
 kube_controller_manager_leader_elect_renew_deadline: 10s

+# Controls whether or not the kube_controller_manager allocates subnets for the node object
+kube_controller_manager_allocate_node_cidrs: true
+
 # discovery_timeout modifies the discovery timeout
 discovery_timeout: 5m0s

@@ -5,6 +5,6 @@ dependencies:
    user: "{{ addusers.etcd }}"
    when:
      - etcd_deployment_type == "kubeadm"
-      - not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
+      - not (ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
  - role: network_plugin/calico_defaults
  - role: etcd_defaults
@@ -84,23 +84,49 @@
    - not kubeadm_already_run.stat.exists

 - name: Joining control plane node to the cluster.
-  command: >-
-    {{ bin_dir }}/kubeadm join
-    --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
-    --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
-    --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
-  environment:
-    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
-  register: kubeadm_join_control_plane
-  retries: 3
-  throttle: 1
-  until: kubeadm_join_control_plane is succeeded
  when:
    - inventory_hostname != first_kube_control_plane
    - kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
+  environment:
+    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
+  block:
+    - name: Joining control plane node to the cluster. (1st try)
+      command: >-
+        {{ bin_dir }}/kubeadm join
+        --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
+        --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
+        --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
+      register: kubeadm_join_control_plane
+      throttle: 1
+  rescue:
+    - name: Reset cert directory before retrying control plane join
+      command: "{{ bin_dir }}/kubeadm reset -f --cert-dir {{ kube_cert_dir }}"
+      environment:
+        PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
+    - name: Joining control plane node to the cluster. (retry)
+      command: >-
+        {{ bin_dir }}/kubeadm join
+        --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
+        --ignore-preflight-errors={{ _ignore_errors | flatten | join(',') }}
+        --skip-phases={{ kubeadm_join_phases_skip | join(',') }}
+      vars:
+        _errors_from_first_try:
+          - 'FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml'
+          - 'FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml'
+          - 'FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml'
+          - 'Port-10250'
+        _ignore_errors:
+          - "{{ kubeadm_ignore_preflight_errors }}"
+          - "{{ _errors_from_first_try if 'all' not in kubeadm_ignore_preflight_errors else [] }}"
+      register: kubeadm_join_control_plane
+      retries: 2
+      until: kubeadm_join_control_plane is succeeded
+      throttle: 1

 - name: Wait for new control plane nodes to be Ready
-  when: kubeadm_already_run.stat.exists
+  when:
+    - kubeadm_already_run.stat.exists
+    - kube_network_plugin not in ['cni', 'none']
  run_once: true
  command: >
    {{ kubectl }} get nodes --selector node-role.kubernetes.io/control-plane
@@ -68,7 +68,7 @@

 - name: Install kubectl bash completion
  shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
-  when: ansible_os_family in ["Debian","RedHat", "Suse"]
+  when: ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
  tags:
    - kubectl
  ignore_errors: true  # noqa ignore-errors
@@ -79,7 +79,7 @@
    owner: root
    group: root
    mode: "0755"
-  when: ansible_os_family in ["Debian","RedHat", "Suse"]
+  when: ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
  tags:
    - kubectl
    - upgrade
@@ -98,7 +98,7 @@
    state: present
    marker: "# Ansible entries {mark}"
  when:
-    - ansible_os_family in ["Debian","RedHat", "Suse"]
+    - ansible_facts['os_family'] in ["Debian","RedHat", "Suse"]
    - kubectl_alias is defined and kubectl_alias != ""
  tags:
    - kubectl
@@ -156,8 +156,6 @@ apiServer:
  - name: disable-admission-plugins
    value: "{{ kube_apiserver_disable_admission_plugins | join(',') }}"
 {% endif %}
-  - name: apiserver-count
-    value: "{{ kube_apiserver_count }}"
  - name: endpoint-reconciler-type
    value: lease
 {% if etcd_events_cluster_enabled %}
@@ -365,7 +363,17 @@ controllerManager:
 {% endif %}
  - name: service-cluster-ip-range
    value: "{{ kube_service_subnets }}"
-{% if kube_network_plugin is defined and kube_network_plugin == "calico" and not calico_ipam_host_local %}
+{% if not kube_controller_manager_allocate_node_cidrs
+  or kube_network_plugin is defined and (
+    (
+      kube_network_plugin == "calico" and
+      not calico_ipam_host_local
+    ) or (
+      kube_network_plugin == "cilium" and
+      cilium_ipam_mode == "cluster-pool"
+    )
+  )
+%}
  - name: allocate-node-cidrs
    value: "false"
 {% else %}
@@ -88,6 +88,9 @@ kube_vip_retryperiod: 1
 kube_vip_enable_node_labeling: false
 kube_vip_bgp_sourceip:
 kube_vip_bgp_sourceif:
+kube_vip_metrics_enabled: false
+# TCP port for kube-vip Prometheus metrics; manifest sets prometheus_server to :PORT (same as kube-vip upstream default, see cmd/kube-vip.go).
+kube_vip_metrics_port: 2112

 # Requests for load balancer app
 loadbalancer_apiserver_memory_requests: 32M
@@ -54,9 +54,9 @@
  include_vars: "{{ item }}"
  with_first_found:
  - files:
-    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
-    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
-    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
-    - "{{ ansible_distribution | lower }}.yml"
-    - "{{ ansible_os_family | lower }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower | replace('/', '_') }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_release'] }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower | replace('/', '_') }}.yml"
+    - "{{ ansible_facts['distribution'] | lower }}.yml"
+    - "{{ ansible_facts['os_family'] | lower }}.yml"
    skip: true
@@ -4,6 +4,7 @@
    msg: "kube-vip require kube_proxy_strict_arp = true, see https://github.com/kube-vip/kube-vip/blob/main/docs/kubernetes/arp/index.md"
  when:
    - kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
+    - not kube_proxy_remove
    - kube_vip_arp_enabled

 - name: Kube-vip | Check mutually exclusive BGP source settings
@@ -114,7 +114,9 @@
    state: present
    persistent: present
  loop: "{{ kube_proxy_ipvs_modules }}"
-  when: kube_proxy_mode == 'ipvs'
+  when:
+    - kube_proxy_mode == 'ipvs'
+    - not kube_proxy_remove
  tags:
    - kube-proxy

@@ -130,6 +132,7 @@
    - nf_conntrack_ipv4
  when:
    - kube_proxy_mode == 'ipvs'
+    - not kube_proxy_remove
    - modprobe_conntrack_module is not defined or modprobe_conntrack_module is ansible.builtin.failed  # loop until first success
  tags:
    - kube-proxy
@@ -139,7 +142,9 @@
    name: "nf_tables"
    state: present
    persistent: present
-  when: kube_proxy_mode == 'nftables'
+  when:
+    - kube_proxy_mode == 'nftables'
+    - not kube_proxy_remove
  tags:
    - kube-proxy

@@ -1,7 +1,7 @@
 error_log stderr notice;

 worker_processes 2;
-worker_rlimit_nofile 130048;
+worker_rlimit_nofile 65535;
 worker_shutdown_timeout 10s;

 events {
@@ -109,11 +109,21 @@ spec:
 {% if kube_vip_lb_fwdmethod %}
    - name: lb_fwdmethod
      value: {{ kube_vip_lb_fwdmethod | string | to_json }}
+{% endif %}
+{% if kube_vip_metrics_enabled %}
+    - name: prometheus_server
+      value: {{ (':' ~ (kube_vip_metrics_port | string)) | to_json }}
 {% endif %}
    image: {{ kube_vip_image_repo }}:{{ kube_vip_image_tag }}
    imagePullPolicy: {{ k8s_image_pull_policy }}
    name: kube-vip
    resources: {}
+{% if kube_vip_metrics_enabled %}
+    ports:
+    - name: metrics
+      containerPort: {{ kube_vip_metrics_port }}
+      protocol: TCP
+{% endif %}
 {% if kube_vip_lb_fwdmethod == "masquerade" %}
    securityContext:
      privileged: true
@@ -8,6 +8,9 @@ cloud_resolver: []
 disable_host_nameservers: false
 # Kubespray sets this to true after clusterDNS is running to apply changes to the host resolv.conf
 dns_late: false
+# DNS resolver option timeout and retry attempts.
+dns_timeout: 2
+dns_attempts: 2

 # Set to true if your network does not support IPv6
 # This may be necessary for pulling Docker images from
@@ -104,7 +107,7 @@ redhat_os_family_extensions:
  - "UniontechOS"

 # Sets DNSStubListener=no, useful if you get "0.0.0.0:53: bind: address already in use"
-systemd_resolved_disable_stub_listener: "{{ ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
+systemd_resolved_disable_stub_listener: "{{ ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"

 # Used to disable File Access Policy Daemon service.
 # If service is enabled, the CNI plugin installation will fail
@@ -1,7 +1,7 @@
 ---
 - name: Preinstall | apply resolvconf cloud-init
  command: /usr/bin/coreos-cloudinit --from-file {{ resolveconf_cloud_init_conf }}
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  listen: Preinstall | propagate resolvconf to k8s components

 - name: Preinstall | reload NetworkManager
@@ -1,9 +1,12 @@
 ---
- name: Set os_family fact for other redhat-based operating systems
+- name: Normalize ansible_facts for redhat-family extensions
  set_fact:
-    ansible_os_family: "RedHat"
-    ansible_distribution_major_version: "8"
-  when: ansible_distribution in redhat_os_family_extensions
+    ansible_facts: >-
+      {{ ansible_facts | combine({
+           'os_family': 'RedHat',
+           'distribution_major_version': '8'
+         }) }}
+  when: ansible_facts['distribution'] in redhat_os_family_extensions
  tags:
    - facts

@@ -86,12 +89,12 @@
      {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/base{%- endif -%}
    head: >-
      {%- if resolvconf | bool -%}/etc/resolvconf/resolv.conf.d/head{%- endif -%}
-  when: not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos
+  when: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos

 - name: Target temporary resolvconf cloud init file (Flatcar Container Linux by Kinvolk / Fedora CoreOS)
  set_fact:
    resolvconffile: /tmp/resolveconf_cloud_init_conf
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos

 - name: Check if /etc/dhclient.conf exists
  stat:
@@ -122,12 +125,12 @@
 - name: Target dhclient hook file for Red Hat family
  set_fact:
    dhclienthookfile: /etc/dhcp/dhclient.d/zdnsupdate.sh
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts['os_family'] == "RedHat"

 - name: Target dhclient hook file for Debian family
  set_fact:
    dhclienthookfile: /etc/dhcp/dhclient-exit-hooks.d/zdnsupdate
-  when: ansible_os_family == "Debian"
+  when: ansible_facts['os_family'] == "Debian"

 - name: Set etcd vars if using kubeadm mode
  set_fact:
@@ -15,25 +15,25 @@
    - not ignore_assert_errors
 - name: Stop if non systemd OS type
  assert:
-    that: ansible_service_mgr == "systemd"
+    that: ansible_facts['service_mgr'] == "systemd"
  when: not ignore_assert_errors

 - name: Stop if the os does not support
  assert:
-    that: (allow_unsupported_distribution_setup | default(false)) or ansible_distribution in supported_os_distributions
-    msg: "{{ ansible_distribution }} is not a known OS"
+    that: (allow_unsupported_distribution_setup | default(false)) or ansible_facts['distribution'] in supported_os_distributions
+    msg: "{{ ansible_facts['distribution'] }} is not a known OS"
  when: not ignore_assert_errors

 - name: Stop if memory is too small for control plane nodes
  assert:
-    that: ansible_memtotal_mb >= minimal_master_memory_mb
+    that: ansible_facts['memtotal_mb'] >= minimal_master_memory_mb
  when:
    - not ignore_assert_errors
    - ('kube_control_plane' in group_names)

 - name: Stop if memory is too small for nodes
  assert:
-    that: ansible_memtotal_mb >= minimal_node_memory_mb
+    that: ansible_facts['memtotal_mb'] >= minimal_node_memory_mb
  when:
    - not ignore_assert_errors
    - ('kube_node' in group_names)
@@ -47,8 +47,8 @@

 - name: Stop if ip var does not match local ips
  assert:
-    that: (ip in ansible_all_ipv4_addresses) or (ip in ansible_all_ipv6_addresses)
-    msg: "IPv4: '{{ ansible_all_ipv4_addresses }}' and IPv6: '{{ ansible_all_ipv6_addresses }}' do not contain '{{ ip }}'"
+    that: (ip in ansible_facts['all_ipv4_addresses']) or (ip in ansible_facts['all_ipv6_addresses'])
+    msg: "IPv4: '{{ ansible_facts['all_ipv4_addresses'] }}' and IPv6: '{{ ansible_facts['all_ipv6_addresses'] }}' do not contain '{{ ip }}'"
  when:
    - not ignore_assert_errors
    - ip is defined
@@ -63,16 +63,17 @@

 - name: Stop if kernel version is too low for cilium
  assert:
-    that: ansible_kernel.split('-')[0] is version('4.9.17', '>=')
+    that: ansible_facts['kernel'].split('-')[0] is version('4.9.17', '>=')
  when:
    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
    - not ignore_assert_errors

 - name: Stop if kernel version is too low for nftables
  assert:
-    that: ansible_kernel.split('-')[0] is version('5.13', '>=')
+    that: ansible_facts['kernel'].split('-')[0] is version('5.13', '>=')
  when:
    - kube_proxy_mode == 'nftables'
+    - not kube_proxy_remove
    - not ignore_assert_errors

 - name: Stop if bad hostname
@@ -92,6 +93,6 @@

 - name: Stop if download_localhost is enabled for Flatcar Container Linux
  assert:
-    that: ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    that: ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
    msg: "download_run_once not supported for Flatcar Container Linux"
  when: download_run_once or download_force_cache
@@ -1,7 +1,7 @@
 ---
 - name: Create temporary resolveconf cloud init file
  command: cp -f /etc/resolv.conf "{{ resolvconffile }}"
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Add domain/search/nameservers/options to resolv.conf
  blockinfile:
@@ -12,7 +12,7 @@
      {% for item in nameserverentries %}
      nameserver {{ item }}
      {% endfor %}
-      options ndots:{{ ndots }} timeout:{{ dns_timeout | default('2') }} attempts:{{ dns_attempts | default('2') }}
+      options ndots:{{ ndots }} timeout:{{ dns_timeout }} attempts:{{ dns_attempts }}
    state: present
    insertbefore: BOF
    create: true
@@ -45,7 +45,7 @@
 - name: Get temporary resolveconf cloud init file content
  command: cat {{ resolvconffile }}
  register: cloud_config
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Persist resolvconf cloud init file
  template:
@@ -54,4 +54,4 @@
    owner: root
    mode: "0644"
  notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+  when: ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
@@ -32,7 +32,7 @@
    path: /etc/NetworkManager/conf.d/dns.conf
    section: global-dns
    option: options
-    value: "ndots:{{ ndots }},timeout:{{ dns_timeout | default('2') }},attempts:{{ dns_attempts | default('2') }}"
+    value: "ndots:{{ ndots }},timeout:{{ dns_timeout }},attempts:{{ dns_attempts }}"
    mode: '0600'
    backup: "{{ leave_etc_backup_files }}"
  notify: Preinstall | update resolvconf for networkmanager
@@ -7,8 +7,8 @@
    get_checksum: false
    get_mime: false
  when:
-    - ansible_os_family == "RedHat"
-    - "'Amazon' not in ansible_distribution"
+    - ansible_facts['os_family'] == "RedHat"
+    - "'Amazon' not in ansible_facts['distribution']"
  register: slc

 - name: Set selinux policy
@@ -16,8 +16,8 @@
    policy: targeted
    state: "{{ preinstall_selinux_state }}"
  when:
-    - ansible_os_family == "RedHat"
-    - "'Amazon' not in ansible_distribution"
+    - ansible_facts['os_family'] == "RedHat"
+    - "'Amazon' not in ansible_facts['distribution']"
    - slc.stat.exists
  tags:
    - bootstrap_os
@@ -32,7 +32,7 @@
    mode: "0644"
  when:
    - disable_ipv6_dns
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  tags:
    - bootstrap_os

@@ -15,7 +15,7 @@
      /etc/ntp.conf
      {%- elif ntp_package == "ntpsec" -%}
      /etc/ntpsec/ntp.conf
-      {%- elif ansible_os_family in ['RedHat', 'Suse'] -%}
+      {%- elif ansible_facts['os_family'] in ['RedHat', 'Suse'] -%}
      /etc/chrony.conf
      {%- else -%}
      /etc/chrony/chrony.conf
@@ -24,7 +24,7 @@
    ntp_service_name: >-
      {% if ntp_package == "chrony" -%}
      chronyd
-      {%- elif ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
+      {%- elif ansible_facts['os_family'] in ["Flatcar", "Flatcar Container Linux by Kinvolk", "RedHat", "Suse"] -%}
      ntpd
      {%- else -%}
      ntp
@@ -72,14 +72,14 @@
  when:
    - ntp_timezone
    - not is_fedora_coreos
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

 - name: Gather selinux facts
  ansible.builtin.setup:
    gather_subset: selinux
  when:
    - ntp_timezone
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"

 - name: Put SELinux in permissive mode, logging actions that would be blocked.
  ansible.posix.selinux:
@@ -87,7 +87,7 @@
    state: permissive
  when:
    - ntp_timezone
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
    - ansible_facts.selinux.status == 'enabled'
    - ansible_facts.selinux.mode == 'enforcing'

@@ -103,5 +103,5 @@
    state: "{{ preinstall_selinux_state }}"
  when:
    - ntp_timezone
-    - ansible_os_family == "RedHat"
+    - ansible_facts['os_family'] == "RedHat"
    - ansible_facts.selinux.status == 'enabled'
@@ -26,7 +26,7 @@
    owner: root
    mode: "0755"
  notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_os_family not in [ "RedHat", "Suse" ]
+  when: ansible_facts['os_family'] not in [ "RedHat", "Suse" ]

 - name: Configure dhclient hooks for resolv.conf (RH-only)
  template:
@@ -35,4 +35,4 @@
    owner: root
    mode: "0755"
  notify: Preinstall | propagate resolvconf to k8s components
-  when: ansible_os_family == "RedHat"
+  when: ansible_facts['os_family'] == "RedHat"
@@ -83,7 +83,7 @@
    - dns_mode != 'none'
    - resolvconf_mode == 'host_resolvconf'
    - dhclientconffile is defined
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  tags:
    - bootstrap_os
    - resolvconf
@@ -94,7 +94,7 @@
    - dns_mode != 'none'
    - resolvconf_mode != 'host_resolvconf'
    - dhclientconffile is defined
-    - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
+    - ansible_facts['os_family'] not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
  tags:
    - bootstrap_os
    - resolvconf
@@ -6,7 +6,7 @@
 if [ $reason = "BOUND" ]; then
  if [ -n "$new_domain_search" -o -n "$new_domain_name_servers" ]; then
    RESOLV_CONF=$(cat /etc/resolv.conf | sed -r '/^options (timeout|attempts|ndots).*$/d')
-    OPTIONS="options timeout:{{ dns_timeout|default('2') }} attempts:{{ dns_attempts|default('2') }} ndots:{{ ndots }}"
+    OPTIONS="options timeout:{{ dns_timeout }} attempts:{{ dns_attempts }} ndots:{{ ndots }}"

    printf "%b\n" "$RESOLV_CONF\n$OPTIONS" > /etc/resolv.conf
  fi
@@ -6,7 +6,7 @@
 zdnsupdate_config() {
  if [ -n "$new_domain_search" -o -n "$new_domain_name_servers" ]; then
    RESOLV_CONF=$(cat /etc/resolv.conf | sed -r '/^options (timeout|attempts|ndots).*$/d')
-    OPTIONS="options timeout:{{ dns_timeout|default('2') }} attempts:{{ dns_attempts|default('2') }} ndots:{{ ndots }}"
+    OPTIONS="options timeout:{{ dns_timeout }} attempts:{{ dns_attempts }} ndots:{{ ndots }}"

    echo -e "$RESOLV_CONF\n$OPTIONS" > /etc/resolv.conf
  fi
@@ -116,7 +116,7 @@ flannel_version: 0.28.4
 flannel_cni_version: 1.7.1-flannel1
 cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"

-cilium_version: "1.19.3"
+cilium_version: "1.19.4"
 cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
 cilium_enable_hubble: false

@@ -239,13 +239,13 @@ cilium_operator_image_tag: "v{{ cilium_version }}"
 cilium_hubble_relay_image_repo: "{{ quay_image_repo }}/cilium/hubble-relay"
 cilium_hubble_relay_image_tag: "v{{ cilium_version }}"
 cilium_hubble_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
-cilium_hubble_certgen_image_tag: "v0.2.4"
+cilium_hubble_certgen_image_tag: "v0.4.3"
 cilium_hubble_ui_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui"
-cilium_hubble_ui_image_tag: "v0.13.3"
+cilium_hubble_ui_image_tag: "v0.13.5"
 cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend"
-cilium_hubble_ui_backend_image_tag: "v0.13.3"
+cilium_hubble_ui_backend_image_tag: "v0.13.5"
 cilium_hubble_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
-cilium_hubble_envoy_image_tag: "v1.34.10-1762597008-ff7ae7d623be00078865cff1b0672cc5d9bfc6d5"
+cilium_hubble_envoy_image_tag: "v1.37.2-1778236003-7c2f6580d32e50f1a6866c12122662856f54eec2"
 kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn"
 kube_ovn_container_image_tag: "v{{ kube_ovn_version }}"
 kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway"
@@ -263,17 +263,17 @@ kube_vip_version: 1.0.3
 kube_vip_image_repo: "{{ github_image_repo }}/kube-vip/kube-vip{{ '-iptables' if kube_vip_lb_fwdmethod == 'masquerade' else '' }}"
 kube_vip_image_tag: "v{{ kube_vip_version }}"
 nginx_image_repo: "{{ docker_image_repo }}/library/nginx"
-nginx_image_tag: 1.28.2-alpine
+nginx_image_tag: 1.30.1-alpine
 haproxy_image_repo: "{{ docker_image_repo }}/library/haproxy"
-haproxy_image_tag: 3.2.13-alpine
+haproxy_image_tag: 3.2.19-alpine

 # Coredns version should be supported by corefile-migration (or at least work with)
 # bundle with kubeadm; if not 'basic' upgrade can sometimes fail

 coredns_supported_versions:
+  '1.36': 1.14.2
  '1.35': 1.12.4
  '1.34': 1.12.1
-  '1.33': 1.12.0
 coredns_version: "{{ coredns_supported_versions[kube_major_version] }}"
 coredns_image_repo: "{{ kube_image_repo }}{{ '/coredns' if coredns_version is version('1.7.1', '>=') else '' }}/coredns"
 coredns_image_tag: "{{ 'v' if coredns_version is version('1.7.1', '>=') else '' }}{{ coredns_version }}"
@@ -327,9 +327,9 @@ csi_livenessprobe_image_repo: "{{ kube_image_repo }}/sig-storage/livenessprobe"
 csi_livenessprobe_image_tag: "v2.11.0"

 snapshot_controller_supported_versions:
+  '1.36': "v7.0.2"
  '1.35': "v7.0.2"
  '1.34': "v7.0.2"
-  '1.33': "v7.0.2"
 snapshot_controller_image_repo: "{{ kube_image_repo }}/sig-storage/snapshot-controller"
 snapshot_controller_image_tag: "{{ snapshot_controller_supported_versions[kube_major_version] }}"

@@ -33,6 +33,10 @@ kube_version_min_required: "{{ (kubelet_checksums['amd64'] | dict2items)[-1].key
 ## Kube Proxy mode One of ['ipvs', 'iptables', 'nftables']
 kube_proxy_mode: ipvs

+# When true, kubeadm skips the kube-proxy addon (for example Cilium kube-proxy replacement).
+# Node and package tasks that exist only for kube-proxy also honor this (IPVS/nftables modules, ipvsadm, strict_arp checks).
+kube_proxy_remove: false
+
 # Debugging option for the kubeadm config validate command
 # Set to false only for development and testing scenarios where validation is expected to fail (pre-release Kubernetes versions, etc.)
 kubeadm_config_validate_enabled: true
@@ -233,6 +237,10 @@ cilium_deploy_additionally: false
 #   - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
 cilium_identity_allocation_mode: crd

+# The default IP address management mode is "Cluster Scope".
+# https://docs.cilium.io/en/stable/concepts/networking/ipam/
+cilium_ipam_mode: cluster-pool
+
 # Determines if calico_rr group exists
 peer_with_calico_rr: "{{ 'calico_rr' in groups and groups['calico_rr'] | length > 0 }}"

@@ -655,7 +663,6 @@ ssl_ca_dirs: |-
 # used for delegating tasks on a working control plane node
 first_kube_control_plane: "{{ groups['kube_control_plane'] | first }}"
 # Vars for pointing to kubernetes api endpoints
-kube_apiserver_count: "{{ groups['kube_control_plane'] | length }}"
 kube_apiserver_address: "{{ hostvars[inventory_hostname]['main_ip'] }}"
 kube_apiserver_access_address: "{{ hostvars[inventory_hostname]['main_access_ip'] }}"
 first_kube_control_plane_address: "{{ hostvars[groups['kube_control_plane'][0]]['main_access_ip'] }}"
@@ -1,79 +1,77 @@
 ---
 crictl_checksums:
  arm64:
+    1.36.0: sha256:68328594ccf780a80ae2b092d9f6ce484eec7cf540c275242e8fd954bfd95332
    1.35.0: sha256:519071de89b64c43e2a1661bb5489c6c3fd5e9e5fcef75e50e542b0c891f1118
    1.34.0: sha256:c31d252e203df5f4cf37f314bd3092eb79087e791631c1e607087c74b6d0423f
    1.33.0: sha256:e1f34918d77d5b4be85d48f5d713ca617698a371b049ea1486000a5e86ab1ff3
  amd64:
+    1.36.0: sha256:83855e114566a8a8c44c548d515670f51de3a5e1da8b2effb59870e2f10c25a3
    1.35.0: sha256:2e141e5b22cb189c40365a11807d69b76b9b3caced89fac2f4ec879408ce2177
    1.34.0: sha256:a8ff2a3edb37a98daf3aba7c3b284fe0aa5bff24166d896ab9ef64c8913c9f51
    1.33.0: sha256:8307399e714626e69d1213a4cd18c8dec3d0201ecdac009b1802115df8973f0f
  ppc64le:
+    1.36.0: sha256:43c696ef906f072f4733203809a0c9a5ec0902422ecbfa18bba92248ff1d3f20
    1.35.0: sha256:786522b14d684604c8b435312a310972bc1b460cddb1bb216a298098cd86b22e
    1.34.0: sha256:1da50181f2f6f6f6332b9dbc7d7cc020457ccd542620167953c0e288535acc93
    1.33.0: sha256:4224acfef4d1deba2ba456b7d93fa98feb0a96063ef66024375294f1de2b064f
 crio_archive_checksums:
  arm64:
+    1.36.0: sha256:b9d32392f2c7db6b72e917b8473e12f5d1b9da9d7d9f8d037ab9f19fab2f8ddd
+    1.35.3: sha256:ba8a300eaa93224190bb3dabfcdf6bd264a0c5cbd6f86cec1bb9ff00a3727d32
+    1.35.2: sha256:c51d0a78afa0b267fcadf49ad481f35cce3728a7d09ebd05db7c8fb8417f9ef0
+    1.35.1: sha256:15fe5c7b87c985a3a78324227b920a01f3309fd1aa5eadfaa38fd48a4dd96d17
    1.35.0: sha256:e57175a4d00387b78adfbe248d087d8127bed625afb529e34b2c90d08cfdaf87
+    1.34.8: sha256:a868ea0459a36b52ac183d830cc589d99b5c8b0f9ed9299922453bbf3758c3fd
+    1.34.7: sha256:5c25e7084f8369f540e236be1a1a7e830fd1fa6256422466d414c2fc20aa0e86
+    1.34.6: sha256:ac189974bcc1cb6829e7b61a39bc3f34fc27a32e5c9d2628bdfc74f88edb6988
    1.34.5: sha256:999a5dc2dc9854222aeff8a20897e0b34f0ba02c9b260b611d66c62e00e279e0
    1.34.4: sha256:d176f6256d606a3fc279f9f2994ef4a4c4cbaaa0601f4d1bba1a19bec5674ce9
    1.34.3: sha256:314595247054b53767a736e24bc3030a5f7c17552944c62b2e190c9e95fe4ca6
    1.34.2: sha256:ac7530f7fc9d531a87bfdfcae9cf8bf81a8bbdb75e63a046ed96911aa7b68ebd
    1.34.1: sha256:41a71cab6a61ae429ec447d572fd1cdea0a7e33d62aaa58c3b07467665b50b9f
    1.34.0: sha256:3006658270477c5fb1e88e9124e40982d2ba7b34495fcc12f0fecd33bbab9a5a
-    1.33.9: sha256:bfcd534db3d1a9380dd7007d623e1eb3250ba64f7c4657e79e9e99b1d874f8f1
-    1.33.8: sha256:59c91726535dcadd0372df0c6aa8595e4d59590994b598b2d97ea2510b216359
-    1.33.7: sha256:af3ea22d3d6944c9a907c6c13d77e9fc4dbcf3972ffbde18dd6f37f1c2ffbd0d
-    1.33.6: sha256:6ee49e746d1a5be1a664a6f801c68b169cb181a9aaf12218eed121e2b151bfdb
-    1.33.5: sha256:ef1b5e2162b0f55722e0966db0cfe387f3ba7cb91d6a803f627121733132792d
-    1.33.4: sha256:6a04cb1ab2020508927d7237ff1174bb330211a1076683417b30642a9c8e4996
-    1.33.3: sha256:39cfbb196326952e554e0fb5f95ebcb6cc1735cf6d56a88b8ecd17d89fbc6c26
-    1.33.2: sha256:0a161cb1437a50fbdb04bf5ca11dbec8bfc567871d0597a5676737278a945a36
-    1.33.1: sha256:6bf135db438937f0ab7a533af64564a0fb1d2079a43723ce9255ecbf9556ae05
-    1.33.0: sha256:8a0dbee2879495d5b33e6fdeac32e5d86c356897bdcf3a94cd602851620ce8b5
  amd64:
+    1.36.0: sha256:7fc7a2cca25b4cf2de01660bc730fad92b6bcbecd47751e76be3d6ae545c56cd
+    1.35.3: sha256:ab7362f76bf7c908c486a2f36d1587c98aeedb8f6ad4bd6731a708b9b44033f6
+    1.35.2: sha256:d38771791f2bae086b24400a1e04cffed4eba6c8e9d30b03c625f8aea70921a9
+    1.35.1: sha256:cd819546f01ae9dddd4a85b82f220518b37596053555a85e4b4a3d200a6e9354
    1.35.0: sha256:55b6d3e9fc9a5864ab5cdf0b24d54b1dcbaf6d4919274b3b9eb37bfc4b0b8cb5
+    1.34.8: sha256:b1828dd21446fb1d60d5ce8d8d45db1930e02b0ae404c01c94136bc23d45d39e
+    1.34.7: sha256:8e1d625f6137ee08f669db6ce361cecbd7c5bb52e8e3e314e82999d738570dfa
+    1.34.6: sha256:9f17d9a7dc8d8c4fc16eccca65fe5db8177392f26156335dc6318a14215a5cd1
    1.34.5: sha256:d6606fb6d686b8f814dfec801f0f3cf2ded974c194fa90facefda36075b6fab2
    1.34.4: sha256:f6348a781c34b433fe1c5150da3408e51e828b610eacbe734405e9c31136d810
    1.34.3: sha256:e269914f3bc4f36ac87cd593d74daaa43c390571994062180019248be32cc6f7
    1.34.2: sha256:3a0012938ed389e9270a208bb73b250062d5f1be5798472b1728403d55ddc1da
    1.34.1: sha256:22c1e4d68d9339aa58a1b0f1b40a8944102934a7505105abe461dc8a7e3de540
    1.34.0: sha256:5a8bc5c3b8072cb9bde1cf025d5597f75bf21018712c5b72d5cb0657948595c8
-    1.33.9: sha256:81c20a12866d9a7c08c6e381ed326141c917454b696a05b46ae27665fe3c5cfa
-    1.33.8: sha256:537adda39074377893f1f650a71b576ba487b3c4d2ee55e9b22f4e95fc188594
-    1.33.7: sha256:e2999436a272c77370241a4f962c80737698dd8c2400fe75e5c7cf2142c96001
-    1.33.6: sha256:4d0d446f73d9db6d5bf2c03ecdc39d9d702836886f4715886c15dc2f461cc810
-    1.33.5: sha256:b8883e51837ee7fd45c88c762f37ca4b96d80ec6a7b46ec989381089e762aa7f
-    1.33.4: sha256:8f6d14828659b85da7c83bad798d50c2f7e0311742615fb7ed305f77bab54e50
-    1.33.3: sha256:2ee843fd1bbdf32607015771a2e1320b46829f22516e559a49dc7c4e29bb756e
-    1.33.2: sha256:6e82739bbbeae12d571a277a88d85e8a0e23dbc87529414a91ee5f2e23792dcf
-    1.33.1: sha256:036063194028d24c75b9ce080e475ad97bacc955de796b7c895845294db8edbf
-    1.33.0: sha256:dad0cec9e09368b37b35ce824b0ef517a1b33365c4bb164fe82310c73c886f7e
  ppc64le:
+    1.36.0: sha256:0fbf8502f1e289316bc0cb19915c7765bd3cfce8fd880e19f9ba343e2c5ab3ea
+    1.35.3: sha256:bd95d3aa3b41f173312bd1a0c8a4398c37d08d5a65d63f773f2f4635ccb769bc
+    1.35.2: sha256:aff7a251a0a8f57c7ce4794d8d28465baa43e49990cd5c9d5958da22e958d5eb
+    1.35.1: sha256:b4a23e9f70297f01da2840f94b82adf2ac67a4017e1d93f0c20526637df282ca
    1.35.0: sha256:081ab73a6970ac3c68893dea9a03b0732ca22ab44a2aa8794fddac0bd4dfa749
+    1.34.8: sha256:092e501730611d5161052b9248e42003bd158890f4597282c00242346fecc5c8
+    1.34.7: sha256:9d8c7660d6e4d03f059aa90aba762b94d7b481fff603247b2a8ed9ca8c477c05
+    1.34.6: sha256:395a475c0181a0c82e89e6dd8e258c6c0529f889a7fc9d0a54da3218b76f58f4
    1.34.5: sha256:3a10d4c1406df01bd9ab88750eabc1273964e9c5f24c7d4a0b719ae77e6cfec2
    1.34.4: sha256:dca59a28fe9b0b9163418eca1545c9ed01cf514179f108d14e462c6074fd103c
    1.34.3: sha256:4dd782484eeb460b9a95e6e2e07474216fc02ad45a27ba871799d18f2b6ee0ae
    1.34.2: sha256:d4c3c9ba24b1b0eabf3c11ddec98801dda7a87b0529706e9ede18b8cc9e4182a
    1.34.1: sha256:cba0ac74e7202fe28cf8aa895b83f7a30d78b148666add78e19215259f629bb0
    1.34.0: sha256:e9e41d14439db0ca88cf2cd8533038203f379c25cd612f37635c17908e050ebf
-    1.33.9: sha256:c0a9e60800f66f85c70615128fec5a8358ffde0f715a4058163707dbcca8eb94
-    1.33.8: sha256:1d69c01512e8ebdd51fc70fc64473a31d492e8db095c0ee5d3ee58722048150c
-    1.33.7: sha256:076e7519bfff72a43fb1121ce836eee3cc1fec5bb5a59a11747c514e9d162d26
-    1.33.6: sha256:3643eefe295604288f5b652fb9c672a60f96dc803e63edaf9ee64ed4047a50dd
-    1.33.5: sha256:cf85062f39d755418da0ee4f869c7a4817bf95daee6e35df53010ad29be37c88
-    1.33.4: sha256:2b1594dad9af944e29ee74e788a8d28e1304e3f435f2efb61e5c38f20c2106f7
-    1.33.3: sha256:4293bc74f348db58adb0b0dd6affb918abee999cbaf0e42ea8a33427b8d278a5
-    1.33.2: sha256:8ed65404a57262a9f8eb75b61afa37fcec134472eb1a6d81f1889a74ff32c651
-    1.33.1: sha256:12646aca33f65fe335c27d3af582c599584d3f51185f01044e7ddd0668bb2b4c
-    1.33.0: sha256:b4fa46b25538d8145197f8bf2e935486392c0ca2a9fa609aedd02b9f106d37a6
 kubelet_checksums:
  arm64:
+    1.36.1: sha256:bf274dd3affbf2543d20465dee1f763f668f78c6fbd56197794f81337a49d687
+    1.36.0: sha256:049d95107361583e64f3ac9b8c9bdaf73fc7e512a838972b13b423a33ece87e9
+    1.35.5: sha256:a100cfe89d7dd7a49a07164c6ccb78df02563483ef5b37330e1150e37e8868b3
    1.35.4: sha256:d710eef03bb4ad164bb77af9be5b11b44f874e2fc08153c7d383420d685f73e8
    1.35.3: sha256:58496a5d16d4316b18397735190d2d41e0c368169ecb458d91b09f4cd1e03c80
    1.35.2: sha256:eaf11f9c20c385624775671662e127b083c9b5d0b451fd613f9468e09ca5656c
    1.35.1: sha256:73475c6db8fd8a9780b1b378fa2f917875e6146166c24603c1abc6eafd4493a8
    1.35.0: sha256:aa658d077348b43d238f50966a583f4244b2a7d45590c77b3b165b7d44983ab8
+    1.34.8: sha256:5d8d62d15f18c18998af09fcab83420b9cbccc2be7fede2a0b26f4a3f523c6b5
    1.34.7: sha256:07658e949e5a089faf36da7ae4e7242a4d2a97fa8eaace0980fd9705d23143a8
    1.34.6: sha256:6b30975e2a582367b5048ffdf9ae26e05442cc18faaf29b5dbd9c6a6b556fa26
    1.34.5: sha256:a4cd54fa5af5ed6b4ed14cf172d30f53fd1f197d7d3f43af733b54b19cc87ac5
@@ -82,24 +80,16 @@ kubelet_checksums:
    1.34.2: sha256:3e31b1bee9ab32264a67af8a19679777cd372b1c3a04b5d7621289cf137b357c
    1.34.1: sha256:6a66bc08d6c637fcea50c19063cf49e708fde1630a7f1d4ceca069a45a87e6f1
    1.34.0: sha256:e45a7795391cd62ee226666039153832d3096c0f892266cd968936e18b2b40b0
-    1.33.11: sha256:047641f9094195384b4ade77c8ba2f0d3cee30a9f0ed6c9b649d387c7a5858ee
-    1.33.10: sha256:1e808ecedd61198887190bf472f1352004f97016b273fba827dd95f7efead806
-    1.33.9: sha256:c5719223cf378ac6bdd6a7ed79a75ba428bdc4468da70e641b2d4f73f70de6e0
-    1.33.8: sha256:e835f15be6d8b7b27b963a46c4a054f7663c26741f17e003bfcb8271350cf882
-    1.33.7: sha256:3035c44e0d429946d6b4b66c593d371cf5bbbfc85df39d7e2a03c422e4fe404a
-    1.33.6: sha256:7d8b7c63309cfe2da2331a1ae13cce070b9ba01e487099e7881a4281667c131d
-    1.33.5: sha256:c6ad0510c089d49244eede2638b4a4ff125258fd29a0649e7eef05c7f79c737f
-    1.33.4: sha256:623329b1a5f4858e3a5406d3947807b75144f4e71dde11ef1a71362c3a8619cc
-    1.33.3: sha256:3f69bb32debfaf25fce91aa5e7181e1e32f3550f3257b93c17dfb37bed621a9c
-    1.33.2: sha256:0fa15aca9b90fe7aef1ed3aad31edd1d9944a8c7aae34162963a6aaaf726e065
-    1.33.1: sha256:10540261c311ae005b9af514d83c02694e12614406a8524fd2d0bad75296f70d
-    1.33.0: sha256:ae5a4fc6d733fc28ff198e2d80334e21fcb5c34e76b411c50fff9cb25accf05a
  amd64:
+    1.36.1: sha256:7efa1780c73d9fb3a464002864e582eb2d15aa691e475eaae323093d08feae14
+    1.36.0: sha256:d857082946c28493e8fdc52227feabd962e0e0900b6c6e4f6510168043b79dd4
+    1.35.5: sha256:4ba1f892bd52fdae7cd2abb1b1111054ff274c71f88af0a85fd9f1107e8d46c8
    1.35.4: sha256:983a6ba5a49823dcdd745c674e5e2416377dd27d6ad1b42d2befa0fb961a19f6
    1.35.3: sha256:28d570423eaad5f1f5658a646bd8c015c786c95d62ffaf14bf35fa0c4326fa05
    1.35.2: sha256:20887f461c0de96b0cb14c7af6b897f92d424ac078f8642f98e83ef52a0bf03e
    1.35.1: sha256:e7343310e03ff0d424df4397bdfa4468947d6d1f0f93dac586c1e8d6e4086d5d
    1.35.0: sha256:2f4ed7778681649b81244426c29c5d98df60ccabf83d561d69e61c1cbb943ddf
+    1.34.8: sha256:117ff5f6923c9ab4af7fa4e995a2bdc48b4b0f84d00017b4d7368e1e861e84f2
    1.34.7: sha256:1bc50f574e2f365513c07055e007d284d5e93322282ed288d27e81c2b4356d8c
    1.34.6: sha256:603e15187e0a909a2f104b17b3ea1d927514eae9fe1e96cd8a05b015cf1ee82c
    1.34.5: sha256:660c7da5cca02dcd83ba21bb3df95a8983bb1c0169af396a8cc234a6d6e7297f
@@ -108,24 +98,16 @@ kubelet_checksums:
    1.34.2: sha256:9c5e717b774ee9b9285ce47e7d2150c29e84837eb19a7eaa24b60b1543c9d58f
    1.34.1: sha256:5a72c596c253ea0b0e5bcc6f29903fd41d1d542a7cadf3700c165a2a041a8d82
    1.34.0: sha256:5c0d28cea2a3a5c91861dda088a29d56c1b027e184dae1d792686f0710750076
-    1.33.11: sha256:4a3d265ee760ee4490b55989e5c3d87deffefa86a6f100f2a7453d353a1ae255
-    1.33.10: sha256:ae9cc2e8603f53aedf922c989f3be262d443a6fb19f87e590b5edadbabbc9b07
-    1.33.9: sha256:d0cec9b15e1ba1b4e3595754aa2d5200d1c8c704892ac07afe5b04b44bdf288c
-    1.33.8: sha256:1caa69c5328cfa774218f75f0621a6f10a1b97e095af85015f468aeb8fdf956a
-    1.33.7: sha256:2cea40c8c6929330e799f8fc73233a4b61e63f208739669865e2a23a39c3a007
-    1.33.6: sha256:10cd08fe1f9169fd7520123bcdfff87e37b8a4e21c39481faa382f00355b6973
-    1.33.5: sha256:8f6106b970259486c5af5cbee404d4f23406d96d99dfb92a6965b299c2a4db0e
-    1.33.4: sha256:109bd2607b054a477ede31c55ae814eae8e75543126dc4cea40b04424d843489
-    1.33.3: sha256:37f9093ed2b4669cccf5474718e43ec412833e1267c84b01e662df2c4e5d7aaa
-    1.33.2: sha256:77fa5d29995653fe7e2855759a909caf6869c88092e2f147f0b84cbdba98c8f3
-    1.33.1: sha256:f7224648451dd4f9f2c4f79416f9874223c286ce41727788965fd0341ddb59c4
-    1.33.0: sha256:dd416d94850c342226d3dcdce838518b040ccea16548bfeaf2595934af88ef60
  ppc64le:
+    1.36.1: sha256:98b63a44b87fb78ceca06918b5a0b5d01ab581fb12fbed9a2f7e8998fca64e8a
+    1.36.0: sha256:761a1f6d3570fd4f25b151ec7570d061629320931c10e57f93f3924a490738eb
+    1.35.5: sha256:96ead1e3161093f38627ebb02acfb9cb0b76e09f444dc134b5ae40ca9dbe5684
    1.35.4: sha256:2ad1490dd74092d3be53953b13bef36f6fd45d6ad5c05caeffb6afef67ac8ef7
    1.35.3: sha256:f4665d0ad4f43784d90037d67dcce17cc2b079e4d7b165b85a8a90fb1ddc1b51
    1.35.2: sha256:6516f318a3711e83c0b3b8b069514a87c7dfeda931082c1b561043a7c54e312e
    1.35.1: sha256:ec8b7f870043f711b5d73e528342af1705d6ad7f8308d7f31d74d967986b54f6
    1.35.0: sha256:f24eb1244878a3876fe180e6052822cc9998033850478b2f4776e5c3b09baecd
+    1.34.8: sha256:4b4406352433e26c1dd245f879962d7a571c4173f84cc7f5013d89ad315648f7
    1.34.7: sha256:a63cc1b7ef2ae22ca800a6be55a316db72127d97dd19fc49457a76f28126c708
    1.34.6: sha256:4047c3c7b3c099554b91a57ca7f1f314445d04acd201609b7f9b4151ba8b2fdb
    1.34.5: sha256:625858ed19559873af61728a50cc250419432ecaa2c8062f78e86e41df358f3c
@@ -134,25 +116,17 @@ kubelet_checksums:
    1.34.2: sha256:a195f278b9bac26803f1e26b0f608e0dce66aad033e8c043e8555775612530c9
    1.34.1: sha256:c4782dbf1987680e9b2baa3ecf5db9e66395772e82b251eb73a150fbfbe0b906
    1.34.0: sha256:ed663fa4ff3e305276dd889885303e07989dfab073e95ef2da931b975f6686e8
-    1.33.11: sha256:aec60ca95db4d98b7a7da7c24421628bf5e54b8347bf4d4ceb61d6b6f4352260
-    1.33.10: sha256:3275d6bf23bcb1a604238bde6c9d790052c6f9fa027bcac57d8c701d09c49e6b
-    1.33.9: sha256:2afd4985fa8ef88bbc8e40691b83ad44ccf8ae2e57a17297921f922b4aa6f438
-    1.33.8: sha256:392ed39b6c037bc5c510412c9b5cfd29238d31dd67d1a3cbae7ef4a274304c63
-    1.33.7: sha256:f96dd4272ca8eccf1f93fb5162323840b9286c5a42a5305fcc1b4d47889534d3
-    1.33.6: sha256:00ae91297503518efd237d40900af4de0067597ae4f2ab8250ddb629ffb6df05
-    1.33.5: sha256:1d785ead3f6709f66a105c629a020b9dfe6dff775fae42f7d147edec2d178351
-    1.33.4: sha256:5133077024e5a59ece48d2e6d0fdaeed5c4f90c5e781f25c89c984ee4da396a6
-    1.33.3: sha256:bb4123e09734348d4b553c031bfe7710adcffffe79ed9973a526e36d87aa19fe
-    1.33.2: sha256:be8412cb9bf30125e3a88ecb9bfca4df1ff5d4e650947c46222683071f1a17d7
-    1.33.1: sha256:c1bc01115a513eaec76d56dc52a52aeb05f866a6d07c55335c1fff56c868543d
-    1.33.0: sha256:6fa5abbc14d65b943b00fcfc8a6ac7eb39fd7e924271738c6f17e0b7e74c665b
 kubectl_checksums:
  arm:
+    1.36.1: sha256:0f5f7530e6ac3b887e01c963b5eea477cc6f590ec5e3a4e23a5485e6d9227761
+    1.36.0: sha256:bd1ab1f3d3cb7dec7c46799355e82717a6519fa83708752c2be88fe5c378681f
+    1.35.5: sha256:7c3ad2c154975287027cbfaaeaeed83c2f5ec1d602e9b10646da204850d295df
    1.35.4: sha256:44093efefd9f776b352f634cea6c4e8fcf4e78378ffda7f31db23072cef97864
    1.35.3: sha256:9cec279039e5c95c79f939f7245d57cf3f65c799de8d76e68281479ace742f68
    1.35.2: sha256:02b6affb0da9837b88354e44a7a188cbe2ad522060c880c70eacd33f19944c35
    1.35.1: sha256:dbe14e5b12184d72978b17b167aedc3f42f4a1faf249180025d6359eebcd983e
    1.35.0: sha256:dca28f6af03b31ca6043baa1da7332472c7a3df743606a758534b9ac3ed7ecce
+    1.34.8: sha256:3b55edd8e01af9b9d1cf566058fb421ea5fbbea001ec66d6e0f826e11d05ccea
    1.34.7: sha256:e016e26a114941a68777b521cc92f0c9fcd2a3bcba01045822450c04d9719bf4
    1.34.6: sha256:7dcec0e5d6cd49608e42988eb6485908ed0be7cdc4a9a874f916806f22cfcf01
    1.34.5: sha256:a042713dd3911a46c2118d2df3967cfcee0e3cdf4e78865e1d427a67cf58e7ba
@@ -161,24 +135,16 @@ kubectl_checksums:
    1.34.2: sha256:18e03c1c6ab1dbff6d2a648bf944213f627369d1daeea5b43a7890181ab33abf
    1.34.1: sha256:ca6218ae8bf366bd8ccdcb440b756c67422a4e04936163845f74d8c056e786ee
    1.34.0: sha256:69d2ce88274caf9d9117b359cc27656fb6f9dd6517c266cfd93c6513043968b8
-    1.33.11: sha256:59106c12ba63854c20d510357beeb4c915850c67118747f12cde64eebbc9d152
-    1.33.10: sha256:df63b4cb5ba17eaa8d72dc165e0f1bff0a56ccf348629f5ea18337215ae93f50
-    1.33.9: sha256:d6b8a351fb5f1409e2c50c52452884eca09e56cabdaae03cfaa40467661d3ecc
-    1.33.8: sha256:734dea07663751c8b45926c843e2c250f13473d65f396555a1ecfe0c9c502fa8
-    1.33.7: sha256:f6b9ac99f4efb406c5184d0a51d9ed896690c80155387007291309cbb8cdd847
-    1.33.6: sha256:89bcef827ac8662781740d092cff410744c0653d828b68cc14051294fcd717e6
-    1.33.5: sha256:5a3a416a85cfc9f7a348c0c0e6334b7449e00a57288ab5a57286ccf68a4d06af
-    1.33.4: sha256:eefd3864ce5440e0ba648b12d53ccffaad97f1c049781b1aa21af6a5278f035f
-    1.33.3: sha256:0124dba9e9091b872591cabcbaea7df07069cb132d38d95f3c7bc8d5b8b621a9
-    1.33.2: sha256:f3992382aa0ea21f71a976b6fd6a213781c9b58be60c42013950110cf2184f2a
-    1.33.1: sha256:6b1cd6e2bf05c6adaa76b952f9c4ea775f5255913974ccdb12145175d4809e93
-    1.33.0: sha256:bbb4b4906d483f62b0fc3a0aea3ddac942820984679ad11635b81ee881d69ab3
  arm64:
+    1.36.1: sha256:59f7ee8e477fae658447607dc3c8790ac17a1b016c01c622c12070e969e2d4e7
+    1.36.0: sha256:9f9d9c44a7b5264515ac9da5991584e2395bd50662e651132337e7b4d0c56f8f
+    1.35.5: sha256:ac69e06fd6860d69786692f5af1c3a1208ed54f8366a4d97ab15c172e99765ee
    1.35.4: sha256:6a5a4cc4e396d7626a7a693a3044b51c75520f81db30fe6816c2554e53be336f
    1.35.3: sha256:6f0cd088a82dde5d5807122056069e2fac4ed447cc518efc055547ae46525f14
    1.35.2: sha256:cd859449f54ad2cb05b491c490c13bb836cdd0886ae013c0aed3dd67ff747467
    1.35.1: sha256:706256e21a4e9192ee62d1a007ac0bfcff2b0b26e92cc7baad487a6a5d08ff82
    1.35.0: sha256:58f82f9fe796c375c5c4b8439850b0f3f4d401a52434052f2df46035a8789e25
+    1.34.8: sha256:4c9fe1f717738950c638c38056130a8db5075e6413ae36d8687221a240cdf88b
    1.34.7: sha256:93d2113f1f38b5709f2955b7981fcd37d675c9aafda81702c202a63361b6093b
    1.34.6: sha256:a49a439f83f504e6bc051f516a8baf8d2220d74110f7f9bcaf25feac69e368d1
    1.34.5: sha256:2d433b53b99ea532f877df6fa5044286e3950d4933967ac3d99262760bc649fd
@@ -187,24 +153,16 @@ kubectl_checksums:
    1.34.2: sha256:95df604e914941f3172a93fa8feeb1a1a50f4011dfbe0c01e01b660afc8f9b85
    1.34.1: sha256:420e6110e3ba7ee5a3927b5af868d18df17aae36b720529ffa4e9e945aa95450
    1.34.0: sha256:00b182d103a8a73da7a4d11e7526d0543dcf352f06cc63a1fde25ce9243f49a0
-    1.33.11: sha256:75ba96c8cc1f74c67ef3890e43186c0f308ee71d71c8d517879fd703c922d903
-    1.33.10: sha256:e9494229893ccddc81065275c0e5f21167518ab939f0e95aecb649fb4b41c112
-    1.33.9: sha256:af4dc943a6f447ecb070340efe63c7f8ee2808e6c0bc42126efe7cde0cc1e69b
-    1.33.8: sha256:76e284669f1f6343bd9fe2a011757809c8c01cf51da9f85ee6ef4eb93c8393a8
-    1.33.7: sha256:fa7ee98fdb6fba92ae05b5e0cde0abd5972b2d9a4a084f7052a1fd0dce6bc1de
-    1.33.6: sha256:3ab32d945a67a6000ba332bf16382fc3646271da6b7d751608b320819e5b8f38
-    1.33.5: sha256:6db7c5d846c3b3ddfd39f3137a93fe96af3938860eefdbf2429805ee1656e381
-    1.33.4: sha256:76cd7a2aa59571519b68c3943521404cbce55dafb7d8866f8d0ea2995b396eef
-    1.33.3: sha256:3d514dbae5dc8c09f773df0ef0f5d449dfad05b3aca5c96b13565f886df345fd
-    1.33.2: sha256:54dc02c8365596eaa2b576fae4e3ac521db9130e26912385e1e431d156f8344d
-    1.33.1: sha256:d595d1a26b7444e0beb122e25750ee4524e74414bbde070b672b423139295ce6
-    1.33.0: sha256:48541d119455ac5bcc5043275ccda792371e0b112483aa0b29378439cf6322b9
  amd64:
+    1.36.1: sha256:629d3f410e09bf49b64ae7079f7f0bda1191efed311f7d37fdbab0ad5b0ec2b7
+    1.36.0: sha256:123d8c8844f46b1244c547fffb3c17180c0c26dac9890589fe7e67763298748e
+    1.35.5: sha256:90f75ea6ecc9ea5633262e1c0b83a40560003b30fc94a04cb099404fcef0c224
    1.35.4: sha256:b529430df69a688fd61b64ad2299edb5fd71cb58be2a4779dba624c7d3510efd
    1.35.3: sha256:fd31c7d7129260e608f6faf92d5984c3267ad0b5ead3bced2fe125686e286ad6
    1.35.2: sha256:924eb50779153f20cb668117d141440b95df2f325a64452d78dff9469145e277
    1.35.1: sha256:36e2f4ac66259232341dd7866952d64a958846470f6a9a6a813b9117bd965207
    1.35.0: sha256:a2e984a18a0c063279d692533031c1eff93a262afcc0afdc517375432d060989
+    1.34.8: sha256:f6249132865c13abe3c9dd5038f5da65849cb86eee1608c001831504e481aa8c
    1.34.7: sha256:b46ecf2b80f76d5a7d58c296c2e11e42c85eaa1eb866ddbc1e91625f71c21000
    1.34.6: sha256:3166155b17198c0af34ff5a360bd4d9d58db98bafadc6f3c2a57ae560563cd6b
    1.34.5: sha256:6a17dd8387783b3144a65535e38d02c351027e9718ea34a6c360476cb26d28bb
@@ -213,24 +171,16 @@ kubectl_checksums:
    1.34.2: sha256:9591f3d75e1581f3f7392e6ad119aab2f28ae7d6c6e083dc5d22469667f27253
    1.34.1: sha256:7721f265e18709862655affba5343e85e1980639395d5754473dafaadcaa69e3
    1.34.0: sha256:cfda68cba5848bc3b6c6135ae2f20ba2c78de20059f68789c090166d6abc3e2c
-    1.33.11: sha256:5d0ff87b99e4bbc38b9876b3172c414f8691008d291e36f89547318925ce7716
-    1.33.10: sha256:f156acb753ee4366789ab7a663916eb580e7ee1b9e449bc9b052181db524e3f5
-    1.33.9: sha256:9e33e3234c0842cd44a12c13e334b4ce930145ea84b855ce7cc0a7b6bc670c22
-    1.33.8: sha256:7f9c3faab7c9f9cc3f318d49eb88efc60eb3b3a7ce9eee5feb39b1280e108a29
-    1.33.7: sha256:471d94e208a89be62eb776700fc8206cbef11116a8de2dc06fc0086b0015375b
-    1.33.6: sha256:d25d9b63335c038333bed785e9c6c4b0e41d791a09cac5f3e8df9862c684afbe
-    1.33.5: sha256:6a12d6c39e4a611a3687ee24d8c733961bb4bae1ae975f5204400c0a6930c6fc
-    1.33.4: sha256:c2ba72c115d524b72aaee9aab8df8b876e1596889d2f3f27d68405262ce86ca1
-    1.33.3: sha256:2fcf65c64f352742dc253a25a7c95617c2aba79843d1b74e585c69fe4884afb0
-    1.33.2: sha256:33d0cdec6967817468f0a4a90f537dfef394dcf815d91966ca651cc118393eea
-    1.33.1: sha256:5de4e9f2266738fd112b721265a0c1cd7f4e5208b670f811861f699474a100a3
-    1.33.0: sha256:9efe8d3facb23e1618cba36fb1c4e15ac9dc3ed5a2c2e18109e4a66b2bac12dc
  ppc64le:
+    1.36.1: sha256:b6acc7be1bfd5f9a10cd6b03b8e6c25a96c0f9a127efa31932752d3ffe97d909
+    1.36.0: sha256:c0a8afcb7899202969000debabcf98013c902c42765537e96c52da0e31be3032
+    1.35.5: sha256:152feec62929570afd0baf83aa4c75e0f1d7ef72aa643a2317a23c2763d6fcc0
    1.35.4: sha256:f342a732cd59cb390e1bbcae1262d07b5e700ff0e8447ced0ee2331ae6e39c70
    1.35.3: sha256:71bbea965f06679407e3b394103c83104d730510cdb5e1d1826359d789eeef7c
    1.35.2: sha256:2101400af7fb53d326cee8d3411c9348e0735ac85d7059cd61514632181b8810
    1.35.1: sha256:bced44e491ce52cce11e2b4bd4bd9181f4f963ffe868438778d028d56485c5d9
    1.35.0: sha256:8989809d0ac771244dabe50ed742249ac60eeb6d385cd234ee151eb40b7c32c4
+    1.34.8: sha256:a571c1cd7106696ee8ce9a88e1fccc291fef7e7e2973a5b4acefaeb14fad4645
    1.34.7: sha256:0769c29f0f0f5d8e342e514c23ca5763d2843f93d7d9d6f1b1e4b3c267eefc6a
    1.34.6: sha256:21c68869ad4adce9ea9ad6f3a3adb031104331e1a5f442ab01a4b6851d6a6c0e
    1.34.5: sha256:22e5813388d20881c2225c86420cd2ff69ed7fc5e953842bb041d4842c38d7f7
@@ -239,25 +189,17 @@ kubectl_checksums:
    1.34.2: sha256:49a985986a9add6c229c628bf2a83addebbdeeef40469fce2a54e51b6f1bb05b
    1.34.1: sha256:45499f0728b4a3428400db289edb444609d41787061f09b66f18028c0a73652f
    1.34.0: sha256:1773805a0c128f4d267b2e11f4c74cac287e9a07fffaecc3f7af6df9c8aaf82c
-    1.33.11: sha256:78ab0289917b1eac69b01a2da86385b3ccf2b99b56c93973daba4226a32a90f1
-    1.33.10: sha256:9ecb0ebd9bb289258ef07a7646e39be6b7e0afb2fde85f6fb075798b4685a8d6
-    1.33.9: sha256:0641f8f8a6153c13dc3ab90a86e242d095a218d30e13cf42c41000e9a7ccc9c3
-    1.33.8: sha256:aa079f403c80ba6017449c230733fed4e5d7b0a8700bd6590ee202161b8b12af
-    1.33.7: sha256:0807c38a1342ab8dea6435f33d5897a01527d348a968a5c4ca2929769f3d54f2
-    1.33.6: sha256:4b056b1749c619fab6a855247c3bd04123f2b61cf136ca6bddf69ff97a727e32
-    1.33.5: sha256:37e2204d371bbbb90fd693049a7a45b81991ca8bcc9b8baf041a7c9f23e9035c
-    1.33.4: sha256:fa61404b9c3d76f342f2ad05616753475739ab488e0beffd22942e0cb266cfa9
-    1.33.3: sha256:e0261727822c685f63902f7d78ddfcd112bfde4619692b6c1aae68d162245f67
-    1.33.2: sha256:d1cdf13cb786c1ee6d5bf6d85034f496aa2fee97b287028043eb14c5dc74993f
-    1.33.1: sha256:f922dd8f558dc616ebaa34908ceb7964ebb8caadd7c48699d0b791ffff2be1aa
-    1.33.0: sha256:580d076c891711ec37afaf5994f72a8aad9d45c25413e6e94648e988a5a9933a
 kubeadm_checksums:
  arm64:
+    1.36.1: sha256:82fa5119d6687f721cd80cb278bac08f54cc5d3fd0320c66cef9394d42e153a9
+    1.36.0: sha256:43d4ca3a9f8f49c2c2f6db2c056de1a00fa110a3dd5aa68a74fbc52e42d96c01
+    1.35.5: sha256:24658203703a8bfa2813571881c1ba08f8cc4aff714a5b43bbf417af7d3cf229
    1.35.4: sha256:e8f6b5bee3e2c8b5965f4ae65c2ae04e3f9f426d2458a1e2f159e824d419d92c
    1.35.3: sha256:647a9821c37a27bcaf6d679a191732b686c01cecd0219d5e579129f0cfd62cef
    1.35.2: sha256:b540b734e9eaeb134e2cb7c7803dc62160589ac3b2615d717ce41acb22bbec98
    1.35.1: sha256:80097a3c4ef824f4edfe131d2bd429772c4be3a460c42a44f2320164a917de32
    1.35.0: sha256:1dac7dc2c6a56548bbc6bf8a7ecf4734f2e733fb336d7293d84541ebe52d0e50
+    1.34.8: sha256:7b06f4442a7a819fcb4e0697721a2e4a8acda068d66ecfb4e781f213ee804884
    1.34.7: sha256:f0ca19db42757a3612e2a20268209a3843b6eb8c1284f11c5fa7c31d40ed8c8f
    1.34.6: sha256:7878391ea18b276ad69c570dcdaa46f74449a978f8e222f92d99855332a01f62
    1.34.5: sha256:cc8a59c0f04a1d7389790dc872b1c714e4cf4d3ba0c38ca2f4ca1388fb38b774
@@ -266,24 +208,16 @@ kubeadm_checksums:
    1.34.2: sha256:065f7de266c59831676cc48b50f404fd18d1f6464502d53980957158e4cab3a7
    1.34.1: sha256:b0dc5cf091373caf87d069dc3678e661464837e4f10156f1436bd35a9a7db06b
    1.34.0: sha256:6b7108016bb2b74132f7494e200501d6522682c01759db91892051a052079c77
-    1.33.11: sha256:6b85e3ad2e3cf876eaff4bf8833170d991af4a6967f95572c89d43a3994891fc
-    1.33.10: sha256:c7d822a9517ccc6921f22447ad75d3f6edb88ca3a44e366057ad3cddc4e77922
-    1.33.9: sha256:d57594c581998d011b7c3ec77fde8b5a2d9e37885f21b749b423087715dc4511
-    1.33.8: sha256:b5248b51e66e4716261f2c926fe2f08a293795e6863099e7792b4d57dbb9109e
-    1.33.7: sha256:b24eeeff288f9565e11a2527e5aed42c21386596110537adb805a5a2a7b3e9ce
-    1.33.6: sha256:ef80c198ca15a0850660323655ebf5c32cc4ab00da7a5a59efe95e4bcf8503ab
-    1.33.5: sha256:b1c00657649e35771569d095e531d826bd19baf57bcb53cccf3f91d7d60b7808
-    1.33.4: sha256:ef471b454d68ee211e279ddeaebde6ee7a8e14b66ae58e0d0184e967c3595892
-    1.33.3: sha256:bf8ed3bc3952e04f29863c6910ae84b359fe7ac1e642ed4d742ceb396e62c6f2
-    1.33.2: sha256:21efc1ba54a1cf25ac68208b7dde2e67f6d0331259f432947d83e70b975ad4cc
-    1.33.1: sha256:5b3e3a1e18d43522fdee0e15be13a42cee316e07ddcf47ef718104836edebb3e
-    1.33.0: sha256:746c0ee45f4d32ec5046fb10d4354f145ba1ff0c997f9712d46036650ad26340
  amd64:
+    1.36.1: sha256:f35980333a4dae753807345ae359eca03f48f9945855e6a6a6708fe8b3b24038
+    1.36.0: sha256:f962dcee1f49a51368c3b383742144d99eacff77b2132cd0a540ed8c6b30fe81
+    1.35.5: sha256:cbf71fbee3a3f60edf3fae4e50994f88a35b35cddf65d373d7955b58e8785397
    1.35.4: sha256:0c0497da793f8897c14e45340da919534b615294a1aab69dc1998896c0f11145
    1.35.3: sha256:a3fb4b3a214a807e2ef4c3fda3196c7f97dcf8152558de5a3c473c869bda0b07
    1.35.2: sha256:a51cb85c70c98ec6868fd3413ac786af5fab4ce51438963752ec5f58e68e5452
    1.35.1: sha256:8a7ff344eef1bfba88f9a74b3fdc9ea4448c94f1b3cefb8c0aeeaf1f96e05053
    1.35.0: sha256:729e7fb34e4f1bfcf2bdaf2a14891ed64bd18c47aaab42f8cc5030875276cfed
+    1.34.8: sha256:27ec4962fc855f4e7fdc3875aa275168a66e721c27533c4953294968da96e7e5
    1.34.7: sha256:679f304e592c6f8e20bf24c424a2c5f35d8d181d171e15774cecd0cb1dffb7ba
    1.34.6: sha256:75a48673b8b9149c1555e0de3a2ce603468037d5396d746a75158828c9b56d7c
    1.34.5: sha256:e381f7f5c41f2a6916432177d95c1ee95d5539f790bbeacafe9ef61dc68e8e35
@@ -292,24 +226,16 @@ kubeadm_checksums:
    1.34.2: sha256:6a2346006132f6e1ed0b5248e518098cf5abbce25bf11b8926fb1073091b83f4
    1.34.1: sha256:20654fd7c5155057af5c30b86c52c9ba169db6229eee6ac7abab4309df4172e7
    1.34.0: sha256:aecc23726768d1753fd417f6e7395cb1a350373295e8e9d9f80e95ed3618e38e
-    1.33.11: sha256:50b66a385ae5bf1ef69c596d07f387b553f0b62f0c48932e0aa14fdd44b1f006
-    1.33.10: sha256:e06fa8adac158ef8bb0bc05c0b64dcfab7abcd7950a27bb5c1b70d70ff98a874
-    1.33.9: sha256:9732cc2383e73f64275326e02a5595c792a94ee0ebf84cea37a32fcbf926e6e5
-    1.33.8: sha256:8259af514dc3655e8abec1a69b637f31cce2ecb940a80ae4a268e5287890f009
-    1.33.7: sha256:c10813d54f58ef33bbe6675f3d39c8bd401867743ebc729afdd043265040c31d
-    1.33.6: sha256:c1b84cb3482dd79e26629012f432541ccb505c17f5073aa1fdbca26b1e4909fd
-    1.33.5: sha256:6761219749c6c67a56a5668dfe65d669e0c1f34d4b280b72de6d74d47c601f1e
-    1.33.4: sha256:a109ebcb68e52d3dd605d92f92460c884dcc8b68aebe442404af19b6d9d778ec
-    1.33.3: sha256:baaa1f7621c9c239cd4ac3be5b7e427df329d7e1e15430db5f6ea5bb7a15a02b
-    1.33.2: sha256:5c623ec9a9b8584beba510da5c2b775c41cf51c0accdfb43af093bc084563845
-    1.33.1: sha256:9a481b0a5f1cee1e071bc9a0867ca0aad5524408c2580596c00767ba1a7df0bd
-    1.33.0: sha256:5a65cfec0648cabec124c41be8c61040baf2ba27a99f047db9ca08cac9344987
  ppc64le:
+    1.36.1: sha256:4278b80f58501b29040ec574ee5afd433e140d6f93c1697a465a9fdb215cb2bd
+    1.36.0: sha256:e621bf6a3115bea05c26e8d6ef9f7946a27437934e0244bbf59dc296bdf6459e
+    1.35.5: sha256:26169d372ea165a01b33ad15259bf9d298ab1f66e326ab83ae0a942c6f3a43df
    1.35.4: sha256:3da9884894da6a6c1083f00c6a837b52084dca9275114694bdc387ba66bff474
    1.35.3: sha256:907fb03a83683e82b0d183675a0c6f0cd36b2cc3970bfe8fdb47098f67ce7828
    1.35.2: sha256:8a3800d88070679a09d2c5cd5dd479d70539dce84415623e876cbaf366d94043
    1.35.1: sha256:eec12948cfabc18115636c44aca894bf9abef3b2ea73cba180314ee3c218dcca
    1.35.0: sha256:77a466e1b6a8e28362a729541269de0a7c4a6b9e7770cccefcd745502e656b90
+    1.34.8: sha256:6e52f5fadeaee1fd5218021a47e33864b6a6cb40c7f98b7bef606c5f734d08e5
    1.34.7: sha256:c433c4f7f4193125265b57ea2e99c5dae51a6213db9902558507a2c675ff1131
    1.34.6: sha256:afd06f4f900e6cd65a93248829c9d521c5e78c22ecf9f212628cc7456f14a23b
    1.34.5: sha256:5e5d7dba56b5bb663e70a5d7962b0f6d4328d9b9a8ee77ddbb2e9760265ff61d
@@ -318,20 +244,9 @@ kubeadm_checksums:
    1.34.2: sha256:bea4ed6d971523da794a802de15910b08c09e23bc4c850ee3b953c4bdb0b7976
    1.34.1: sha256:ddb6bd80bee0719924ae901672b99205226badab74fb13a9e1bb6d3de49fbb21
    1.34.0: sha256:7201ba36f44187f408a036c4a545e2a3cd12943b1297092687bb66c9a1a9fed6
-    1.33.11: sha256:51c6db310ef120e80c02cb7a345085d50925944ae158de0087e8b22a9a3fe2bf
-    1.33.10: sha256:5f23294874bdd4097601f9068344ebfa5be4a8d4ce14380fe4f9b764a20f5bb9
-    1.33.9: sha256:b644b9947f3b79d0ff4c19389cf23f436bb5d6f23166ed3b4e0aee09775b3065
-    1.33.8: sha256:d618fa97b5782b57512e0a8ab9ed17af190236907af7bd3c9c0776d81c78273f
-    1.33.7: sha256:db2e20d0c20928ae7d68d7603020f8ffd89dcdac4fdc160ef83f1da663868bed
-    1.33.6: sha256:58aaec7b5066b6e3705e0493a2f51c7f101b17165ce714c4d52a2b53861c078b
-    1.33.5: sha256:b1e261109a4e22e0a417d10724bed7f71ba12c2acc167a55d89211e49c2e5eee
-    1.33.4: sha256:eb4f3b7a875ffe06aadd5b5ff7b3dccec125933b7ba6fcb5baed39c9c01220c4
-    1.33.3: sha256:d9f30f0eb538be98cd07603b945611b056be5e5871369b16e23090545ef8cdfa
-    1.33.2: sha256:1b818900ac7af72a14f50300d6c6ad600eecdc578c37b75fa488cc654ca08c25
-    1.33.1: sha256:a772834ba22478c9119f03ecca2a27a70234623d74ff1d7671ee85675a4e830b
-    1.33.0: sha256:26cb7ac57d522a59c84c4784b176097d23c7b4e61874fab84ae719d0e43ac0bc
 etcd_binary_checksums:
  arm64:
+    3.6.11: sha256:5302f1a6157c34eb0568c75fba9d06da98353576df04399f08645bef634acd2d
    3.6.10: sha256:e40dc34b7a512b99c651f7700c1014e9b76e02415e2e24365b248966b173524c
    3.6.9: sha256:b51e433724325b66770019c4819d091b8965d2e81c07571a46e0619da1c8ece6
    3.6.8: sha256:438f56a700d17ce761510a3e63e6fa5c1d587b2dd4d7a22c179c09a649366760
@@ -343,6 +258,7 @@ etcd_binary_checksums:
    3.6.2: sha256:79d0a2488967aa07ecfde79158b1dab458158522f834810c2827eecac4695a31
    3.6.1: sha256:5f8ed6e314df44128c218decbf0d146cf882583d05c6f6d9023ce905d232aaec
    3.6.0: sha256:81477b120ef66ff338fe7de63d894e5feec17e6e1f1d98507676832e089d9b58
+    3.5.30: sha256:4d19473d2567a58e1dbf556e0813b91d506666e58d23bfd5370660c67639eb5e
    3.5.29: sha256:10817d916de91fdab373947977682e083f0a1ac7f37650c1b690c2a746e4c269
    3.5.28: sha256:779a741604d2ff45240b277812f6c300bca71754adfd8de1436a3f2df3a18e67
    3.5.27: sha256:1277309f540c5a0329c428f95455c9f76d24f768c8d28fd2753e891c379053fa
@@ -368,6 +284,7 @@ etcd_binary_checksums:
    3.5.7: sha256:1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51
    3.5.6: sha256:888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87
  amd64:
+    3.6.11: sha256:8756f7a4eaf921668a83de0bf13c0f65cae9186a165696e3ae8396afe6f557ed
    3.6.10: sha256:ed579fafab5701e3aaa95509969e7bc74776a4ae5269d32e3928408b406456ec
    3.6.9: sha256:633136f13fcadac52e5c0ddcb97912643af6fcb9cb362e75774d0f96f7666396
    3.6.8: sha256:cf9cfe91a4856cb90eed9c99e6aee4b708db2c7888b88a6f116281f04b0ea693
@@ -379,6 +296,7 @@ etcd_binary_checksums:
    3.6.2: sha256:4b5d55d61e2218fab7c1cc1c00b341c469159ecde8cedd575fa858683f67e9f4
    3.6.1: sha256:1324664bfe56d178d1362a57462ca5a7b26a6d2cbe9e1c94b6820e32cb82d673
    3.6.0: sha256:42305b0dcbba7b6fdff0382d0c7b99c42026c88c44847a619ab58cde216725d9
+    3.5.30: sha256:a495115162845640be08c6cda069ff961260dbced53207c5a83b1b006ff2ea8e
    3.5.29: sha256:7692f812db0bfeee3a731c45046864cf729e552bad82ce7cb5b507053d033267
    3.5.28: sha256:e11b6fab2ffbf0a1d6ee8f6227594045a19e0974ec779c42b8b5bb1942b2abe0
    3.5.27: sha256:0aad9a9e4e0817a021e933f9806a2b2960a62f949ad5a3d6436d8886945cb1bc
@@ -404,6 +322,7 @@ etcd_binary_checksums:
    3.5.7: sha256:a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396
    3.5.6: sha256:4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb
  ppc64le:
+    3.6.11: sha256:4031a332e71c263ed054a9149761d77dfd57f1bcc301b2aa0e2b1b6079af7095
    3.6.10: sha256:2892716d2826deed1ea392c91651ebabe1da35c5e71964d842fdcd424adb71c1
    3.6.9: sha256:bd21e07aa8f19308c96986bf9457f779ba8103a3204066bb89c8c3fb7a1e47dc
    3.6.8: sha256:3b9bb486b0eb8d79b30410749ec26e174db075956c9ecb533b313b9263e7ba78
@@ -415,6 +334,7 @@ etcd_binary_checksums:
    3.6.2: sha256:bf79b9d4c7e9f86e611e73de9fe54a195bc0ad54aeb17200b1c8bda3c4119705
    3.6.1: sha256:bb87fcd0ea4b9fabf502703512c416ca1d9f4082679cb7f6dbc34bed3dfc13f6
    3.6.0: sha256:1180d06e3a3787ab65078d9a488f778a4712c59cc82d614abde80c5d06efe38f
+    3.5.30: sha256:5f5412fb68aa87df05c5c6e75ffca458ee43e00f23ae43122e81201eaf0187fc
    3.5.29: sha256:3c198d0a0a5e76c0828568c34c1b8811c29830ca62c64043e18474b2625ecadb
    3.5.28: sha256:f928b7f0e615d8125640c0840121ad0001d0736531fd0b95ad24514a8ce0ba3b
    3.5.27: sha256:b41d488dcd579e780f49f5bd747e9386e17e1376ffb77bfff061f7944818a678
@@ -692,6 +612,7 @@ helm_archive_checksums:
    3.16.0: sha256:d13a4b87b31a5b50c8d93dd9988dfb312a61e56504102f466a4004e5a3ab8e9e
 cri_dockerd_archive_checksums:
  arm64:
+    0.3.25: sha256:7eda6e815ed80ddf28095587038a8c48cb9af2060f7b45f9d8e68603c42caa67
    0.3.24: sha256:c783a03735887c4a8fc894bd4cf7a1c0defef3ecf50a4d79ff31eed45c26b17e
    0.3.23: sha256:a78037d2d2e9c52c48372a5cbba7b94b1c57be5759449beef29cfe03cbe6f14b
    0.3.22: sha256:3260b214c9b12dbf0cbf4d60410c45aacfc31ba52aa7b74164135968e8950cb6
@@ -712,6 +633,7 @@ cri_dockerd_archive_checksums:
    0.3.6: sha256:793b8f57cecf734c47bface10387a8e90994c570b516cb755900f21ebd0a663b
    0.3.5: sha256:c20014dc5a71e6991a3bd7e1667c744e3807b5675b1724b26bb7c70093582cfe
  amd64:
+    0.3.25: sha256:adb9b9785dc10fe49107f5d9e6a62c4271d268a214b9813f5dce251afc9d78ff
    0.3.24: sha256:dd4b7f514c248a3aaca398f467430a4c58aae9a77ea8b96a2f5b5d6fba0948d1
    0.3.23: sha256:c7fe5db7f9396186193b58ded0e62a31eca7b3c58ad8691d57017986f96482ee
    0.3.22: sha256:6621a96a885c82844d12318de00f510eae3459871cf1ad47317f38dd242f9a03
@@ -863,6 +785,15 @@ kata_containers_binary_checksums:
    3.5.0: sha256:fa4cf67d010244c4f8d0e6d450d04e28d1bbce5ad1a3cbc0154adff628d56c0c
 gvisor_runsc_binary_checksums:
  arm64:
+    '20260525.0': sha512:5756598b8d158eab2ca3f521ded9ad099e812df91f0e73ef93ff20ce7856f2e9da20081bbc82461ee0787424b881213cfd9b87a5c79bbe484aea3c9e440cc003
+    '20260520.0': sha512:3b3b2a05c8afd55f3d2a714c098f376245c1282890d617b71108cf4cba94964d761ecbf83b69a768b337f43101a055dd0914319042665b72942a46ff669e4050
+    '20260511.0': sha512:1a1da6060bbfb98fcd98304a7e73afb2c23a897ae4a8bf741e1c6a16cf07e0cd14bcd9d0f0e51aff201feb0cf8d19952f944aeb5eb5d92b091509374b9702a26
+    '20260504.0': sha512:e2a6c39afa478e4040e8b2a803324011fb81ee268fdac5cd005f64e165218b3a45e45ba9cef15fcf7f514e80da13b752ce2733d035d6dcded48c89a468d4fd17
+    '20260427.0': sha512:985d4412e50229bb107bc38f53be34ac09c3ae7e654c371557c261d44a6b40b6582688ec4ab39d4df55a14213b4eb6ac328fe5bf1e01ee037a349e2acfada836
+    '20260420.0': sha512:3d12263b01edd46d75cd96586f6860596d8ef1300c591b1e2cba6f5396a3f0f065ede03da454a5009a18c3dfa9c702dc2018ed655d7d8034ad31de2f9738369f
+    '20260413.0': sha512:3c69577f48319452aa15552631eec21560a6ae5d80b5bf6d327e5c6c31989b6c02e02f57023a322717bb387c16417355aafdddcc10c760cf6ed5c4cb3eed6bfa
+    '20260406.0': sha512:b2a0bf0096bcff15bcfe097bd16c8c00491578d1dd69309effa3aa3584eab5143b721f79522c217cd76b6c5337eaac7385eb0c6da3413826df228b54a4f02303
+    '20260330.0': sha512:5d289b8528483a4082a74420446e4267558c2e5c0cbe270d29a1a814a0039f9e9797229fec1416119c286621b899cc8a8919514fa60db199e8b05257505c23b1
    '20260323.0': sha512:2aacb4de88e9c4fadceb9c81c47b9aebf3ecb16df4f68d7def428d844bf3bc3ca1cc7d61a30bf73996e2485cea6a8c12ef86823fa473d0eb6489a95898be7d98
    '20260316.0': sha512:d73d7dc4b318b513c0df2e4d568a81d894695ab60a892da670d8fd3502dbe0983aaf450b2bdc5df0940d3c5ca7ff5bee9245893f35f2c54d6a3ecb83c55cdcb5
    '20260309.0': sha512:85d37e7a0b249706f1b3b0ec5d84cc38f4dd53a4e490395f489eb406194529233631405be8bcd1648126db3fc0221a8a1b599743eca2b183b2a35ef3aca638fa
@@ -901,6 +832,15 @@ gvisor_runsc_binary_checksums:
    '20250414.0': sha512:d1ba68b20057622e58e886f472e021a473222590c936a86951005d7b97366b446ef0342b91457ffc0d7e543d54c9c06a363f2883bdd6c594799c4ca1091dabd5
    '20250407.0': sha512:cb590f72b0fbda45e89a2300e9247f12ff295a8c52653c8cf815c662d3fbbc774f9b915cdd4fad59e30694d8cc8737fe2a1a8186ab5136f7701bd6e6877a1662
  amd64:
+    '20260525.0': sha512:7fd4103d6df5202545011c39449cc484371384059db17b917d811c03e8355c829109e9848603b77f8ec1b050d7a1179ed239546059e210edc67601bfa0504bbb
+    '20260520.0': sha512:d0994b1835fdfbaef9b7732789e3b17e0b799498c6ae7a7d645b52379f3730b76494db7d46b8460cd632b977fd206fa6063766c883da149d5ca742cf559e7e7c
+    '20260511.0': sha512:e227a71c95e794119f6648a44083df945392c6cd457f36abbc49c2b6e0b87c7f01b94e6bf4632f4cb22ee34fbec7a2c34ca03d30efa9c689db76a6215a6e44e1
+    '20260504.0': sha512:27ade75278e3ee7d8ff1b1cdd979383f8beca2327a2a572d054280b43a5a6db615db6387fa82b230839fed30c9a0c65ac249195a81b51298e639ef1262182640
+    '20260427.0': sha512:9844ad2493999c579d0b4bcbde99ad3ed98e9f0ee175d87003b2e4da2e61f22efe452c378503cb911edac1b627820cb7985326e52b44dafe5d17e593d4b9095a
+    '20260420.0': sha512:9efeefada7b9a7bcc21dc3a1ad3531d11dfac267808cced45d047aab742f15ecb91b2bb635dea78a4ae36817f76e5ed223b7ad80f3165f15dd24de9b0c95726f
+    '20260413.0': sha512:12f98f1305ea883a5cf68d158877b26e011348100211fa65cc01f91af25d6777ddf84893a4945dceb133346a5e045719d98da353fdc30d67e9f697f2483cf8d0
+    '20260406.0': sha512:daabda0cf22b1f7f7e0c587b625d684cceb6777e08f99d8010d4bc9bbe99a8396cd0590ecd67084f6cbaa05869c2a44249ec40ce6f8262a7010dec5d1df90b39
+    '20260330.0': sha512:12ec9545b7b0d2ab3234f9942dd32965112a459cea597f65bb5e9678608046a7c05b2468b28641c35fce1d40d8b6f68acbe9c067be292817ef17c4a590698a52
    '20260323.0': sha512:8cfc4e0580e49a0463fafd51661305ac4e69d27eea68de4fc569760a55a7f2c4a2cc75d43d7edeae982288ebfdf4644d6840533b95167bb5f0758cb237e49217
    '20260316.0': sha512:224cd1518f43c2b58052f1d15b0ff0736eac07562d0cb584415798b172cc15a18b0a5644cc37916c6759a0860d1c67eb54cede843cfdb94f0b11657d86aa41f4
    '20260309.0': sha512:2f2d5092d53cae40c53006dead1c5b75552f7c901b9f15bd63b967d2444b59953647c029548ee3950adac0de82be6411a7bf199b3aa7a1dfaab59a51509e4768
@@ -940,6 +880,15 @@ gvisor_runsc_binary_checksums:
    '20250407.0': sha512:097259d6d93548bf669e21cfec5ba6a47081e43f61d22c5d8a8a4c0c209c81ac9c4454162b826f98cec49e047bbdc29c270113ab6db5519ef3e6a90f302fa47b
 gvisor_containerd_shim_binary_checksums:
  arm64:
+    '20260525.0': sha512:f7a0e7de7933f4bbbc4c26ae9d2d4690d31ef87657db1efb99ebe12f59ab7fb303a040d45d3643f78d258836fc75e8d90d79f44b99f72f90c30d013523b8de35
+    '20260520.0': sha512:2bdb5ae2edfc8d5c9802e5fbb710309eabf689243f3664bad85a2ddba1b9626342c168ce2244d9c67aced8e100b90d0fe2a9bd8e929608a061b1019e0f4ef996
+    '20260511.0': sha512:76dc2b9ce47d4231b0f7cb4e4de670a28105d44af13b89a147e4f13a34c6bea969b01dd58aa3ac032e38a922fe9824f1b287384d5fe24ca21a9150224d087937
+    '20260504.0': sha512:1ffd9edb4d200661d1b6b85dd07dab02ec71e211909a20fe61a96ce554fcb03494378f10ca226c5c345afaf039902675959fb06eeafbde693acc63967d0d7cc9
+    '20260427.0': sha512:39ef1a110d14b385bc2ac115b46fdd25e80de37b5659ec5c7151858baa83c584980e5fd97f1f0e4819e9e1eb3b6ad33bd20cb6011fa24908e1fcc0274453d052
+    '20260420.0': sha512:8cfdd518126f2be36b25d4498d0bc9873cc0f36b786e8398fa97c05b2393fad5dd82d14060c16361f43e5e100ecfcd177bb5fe5a39516608fdfd5557267101d5
+    '20260413.0': sha512:bbcb0e39a0ed14625c57cd4b7d73dfeb8847f27302e27a2bb34fed01a87446f10b3f3b5d6e877d6fcde417ebe628c7f9dca2e3f9b60b4d6784ab3559331511d8
+    '20260406.0': sha512:abd41610cf09e2dbcc2095cc54c2c27047c4b99271d75936475014bb5dd04d24bc5daa912498c91ad86d5e745b4c80b8c7c9feba770a8611d823d7387ba29483
+    '20260330.0': sha512:a79a419e501399ee16398294f68d96e323a2f2d49434ef091766d5be8c90cf12fe935cad9292a816dcdb5a565fd24c44039d997b7421205a93b87e89ab27ac09
    '20260323.0': sha512:b285a1ca814d62e2252b30c5ab00888ca6e5a7f51102b83f10babd903faed5eb922e3a5801e3c970e5e89ff957dcce0f112088aa28f834cc7b155c6bfd37eb35
    '20260316.0': sha512:6959774b99cfad26d588cde8dea4f21a3c9e6cdb1f49ca20bca6a356ef0c17898662ec1eb218c802bb2a034a7a06d3ba458d39ca49327cb838eb3a14ef9e8ddb
    '20260309.0': sha512:43ffb3accd1b4e3d12319824917b3defd268190b1efcdce76bdaea862e7784c598dbd1dd4a3565d12db01452a02609fd1d0b68d9e29c4d26cac5dfde1329a8cb
@@ -978,6 +927,15 @@ gvisor_containerd_shim_binary_checksums:
    '20250414.0': sha512:33b9c67bc7b73ca49154aff48da52029414a707b6a3a25eb4f71e861a94dec8fce220e63a162841670ddd4876f45b0e39abdf9f8c3235019c89f209684d3007d
    '20250407.0': sha512:1c3838e10c905af0cb52697712bf6bd76b94c9e9d3d07a7643cd43dc2f8dab03b4ed4693c117e555e07a158e04ee583b6b1f1cf2fb9705244ffa5fdc4af67248
  amd64:
+    '20260525.0': sha512:dd3c0f30f6bdbc87c1658101662159c4dcbc9ce3eabfb310496b2a3049ae8e4665ab5e8c12c2349c4f450d3a12ca355d07701de7a288aaa37a948a05c260f054
+    '20260520.0': sha512:62c8c93d9ee134c5cf136b944bf17ab984b5bb719a3ef4a7f7bd66e93e9c6be0a6466ee5b956a47b0f2c6c65a512a45642f9f345cb2a4575184fc6fd0718d31f
+    '20260511.0': sha512:69d7c9e04dacc3c983016624050a53381326bd1d221f6f5879e1109bae76f1ded91101c7235aa289304852f64c5789c726ad94f0099beb22573078f681c6b529
+    '20260504.0': sha512:5b502b951bfd80666ad628d6f68ebe5a888d986163db9efc6647b07b26eac95e108367648d642b5d4dc8c44b631de55b7ea35e737d620d3b88e636fe11cd20e3
+    '20260427.0': sha512:86a7107d797c36124e1d4800ce4ec596974cb63d17bca1d4b77130047ee3663f37f36851e01ac89638f5bd7a4745d477f954830b370975dab5a6f090c13be80f
+    '20260420.0': sha512:9cdfa92704695beacfe6c57eada3f2fbf18f1c7c274e498468aad91480ea29e3204201fe97799f3cfb5b2c249898ebb7076373e2429a70011710c6aa0e1cef80
+    '20260413.0': sha512:48f388ee9ac5d71181ae65e3b8a9076d95e6dfc0a74d0037c5a11ec2225622cfd154231868d7d09e999f10a2f09e96e6eb4228f10e0bab1d1da235703238a7c0
+    '20260406.0': sha512:2a7c5b2465ab533837710529e9ba5c84a70df5b06d1e782ecf33408b678cf442cae4d600a93e0a9b4d0bf9be3cc64c781b760c3bb29cbee703d6769ef6df7181
+    '20260330.0': sha512:9987505521a22166cbb4e6e736020eb88315642d2b4bab4083e64206151ee69b569eabd2266e424b08f17063ef812dc176e2dfbd7186759767baba7881a4172a
    '20260323.0': sha512:d7cc0c78c8f33c3eafc0424eed6e63e447917350cf04d1db09073ebcc8b3880d3bc853a5abad4bcb2bd5d156aa15c5ff82ae95d243d7bbce62e546bdf63bb15e
    '20260316.0': sha512:427f141f011b79cc68b4b805e2d15f040d96e1b2324d139e16948e4f94e6bb63c40c14111ad9e0c6c319e44da9e5b99c39924a1feef88919fcca2dea55256c90
    '20260309.0': sha512:f5708fd1fdad4da12f440780c2c09ca6f2ca7cb47089e24e536851388bae54228927a462d61c584c3adf3426f03addea9f08e390be39c744cac008a84e7559e9
@@ -1041,6 +999,7 @@ nerdctl_archive_checksums:
    1.7.1: sha256:799d35de7a182da35d850308c7f1787cd7321404348ff2d5ba64ad43b06b395a
    1.7.0: sha256:8b9e7cccbcc0a472685d1bc285f591f41005f8699e7265ea5438a3e06aefdcfd
  arm64:
+    2.3.0: sha256:7c53628e76cdb6bd7642f8aef7f838d413dd53957c6bbf5a78dc2208d58b81f1
    2.2.2: sha256:4e222d6be16d94052079a4773e04f21c82e07f9b5847163fed78396e6ad8eeb5
    2.2.1: sha256:abc83c9ac3d843c3442eedfb61c6456b8b59b1e4cd69f69598ca1582acc7c094
    2.2.0: sha256:37b353122e0785578d1680fb1d7be546f4c64d0a4aed7875d3a216b2c44be76d
@@ -1065,6 +1024,7 @@ nerdctl_archive_checksums:
    1.7.1: sha256:46affa0564bb74f595a817e7d5060140099d9cfd9e00e1272b4dbe8b0b85c655
    1.7.0: sha256:1255eea5bc2dbac9339d0a9acfb0651dda117504d52cd52b38cf3c2251db4f39
  amd64:
+    2.3.0: sha256:e81f6f999cce35ed998cf24b922855d37306bf2ff0e4c0df80492d82b0b58fd6
    2.2.2: sha256:6f637760fb2875e3454e97c3de7438fd17281b5996908cbd8ee1c872b0653cc8
    2.2.1: sha256:34144de7f12756aa4b9dc42a907fd95b0c5eb82a63566a650ca10c8abe7a26a0
    2.2.0: sha256:1b3390a832eaeaa1459cf42357da983205da2dd72300a015ad018b3499fc455e
@@ -1089,6 +1049,7 @@ nerdctl_archive_checksums:
    1.7.1: sha256:5fc0a6e8c3a71cbba95fbdb6833fb8a7cd8e78f53de10988362d4029c14b905a
    1.7.0: sha256:844c47b175a3d6bc8eaad0c51f23624a5ef10c09e55607803ec2bc846fb04df9
  ppc64le:
+    2.3.0: sha256:3f6f9d64095e13deb7d1c7a873b2e7bc60c09f77f274897e7191a0e01b8d319f
    2.2.2: sha256:afc4635fa900815857be72dc17fcbfe81a35251c7de9aac62187974c3e49328c
    2.2.1: sha256:05c3573e0468fbe6ccecce497b8129beec0fa1d8afadeba244e3d5ac63047fce
    2.2.0: sha256:cc9f55ffec892498bb27db1f6b0eef16b591ee4ce873b61f2fd9a9a30930c620
@@ -1114,6 +1075,9 @@ nerdctl_archive_checksums:
    1.7.0: sha256:e421ae655ff68461bad04b4a1a0ffe40c6f0fcfb0847d5730d66cd95a7fd10cd
 containerd_archive_checksums:
  arm64:
+    2.3.1: sha256:46a83603a850f3916ca7c942310daaf82ed17773a85b1d431e92d4a541e46d0d
+    2.3.0: sha256:06623dc8719b30d06303420f7eae91b0a9ade4e71243a4102f6375e585fb0a42
+    2.2.4: sha256:d0897c8e27c96a7b7d4c73e9b278ea9f559dda619d497d88b323a528bd1412c3
    2.2.3: sha256:2942d72435b18610f7b69c1ddb74f99cef5c549425ff80d3e74f04e5e80db6a4
    2.2.2: sha256:cb102473d6e353beb604178879d51cc456da0cdf368d9437d8d404ed01baf674
    2.2.1: sha256:dac15a0d412a24be8bfe6a40cec8f51829062725169f1e72ac7d120a891ef5b6
@@ -1126,6 +1090,7 @@ containerd_archive_checksums:
    2.1.2: sha256:57fa4005ed3bb648f4a2ff3ef2f9ce12b27ee1397225626e3165b9ef4af45530
    2.1.1: sha256:4e3c8c0c2e61438bb393a9ea6bb94f8f56b559ec3243d7b1a2943117bca4dcb4
    2.1.0: sha256:f6c3972347848177805eed8a9c282fca6aaec0e6fd28701579e63cb20bdbce07
+    2.0.9: sha256:fa582638e396f6182348142d642ce65d2efd68f01751d16310446fc8f15fddb2
    2.0.8: sha256:ce4708163e0b6a8787a6480c588569d3440865bbd37f455d50a6736d6dfff78f
    2.0.7: sha256:e590e39956a451ff692454ea991961b08627c514dcc253e8845d2a57f9a78e2f
    2.0.6: sha256:0f308f386b1ee24712875f02bded92ce7099a707ed43f57b3fb9c934dcb6bed1
@@ -1135,6 +1100,7 @@ containerd_archive_checksums:
    2.0.2: sha256:14a2a9f7f75f73e5bcfb8b183d0b84830c54b98ef8c5f6ed70e51f1a230c673e
    2.0.1: sha256:b07120ae227b52edfdb54131d44b13b987b39e8c1f740b0c969b7701e0fad4fa
    2.0.0: sha256:2a00b1553f38aa9e716d61316b661961c2fbfbb7aad7bd73b377be5725ecc0f1
+    1.7.32: sha256:631e7079dba58806e5a03158773030e4ac63c69343afe02e5419fb848485569c
    1.7.31: sha256:d375de285eaaa5a3a58c0b03d92aff6bfa7987657781bce8cd5d30335f9aa2a6
    1.7.30: sha256:a09c3b01b3b6935e839c8a9588b5528c57ebfca4747d816654a7d1e7575c0a63
    1.7.29: sha256:176d523a6d6dc5520e0c35b8eb0de6e54bd4d00486d5fbbeb4163f30e2962f17
@@ -1168,6 +1134,9 @@ containerd_archive_checksums:
    1.7.1: sha256:1f828dc063e3c24b0840b284c5635b5a11b1197d564c97f9e873b220bab2b41b
    1.7.0: sha256:e7e5be2d9c92e076f1e2e15c9f0a6e0609ddb75f7616999b843cba92d01e4da2
  amd64:
+    2.3.1: sha256:628448bd973610c656c1cbea8e88b32fafd85b23cc1aa4a3372eb7198478c054
+    2.3.0: sha256:4cb83e7100a5e73fcb626207d0b5bcfd1294e26aeddfe075dcfb38f375c5f887
+    2.2.4: sha256:62e77f6294e432dca5b56ad7e7d6085b5bbb526ebba0a51d832714f9b04cfdfd
    2.2.3: sha256:ca26ef5138f17b847bbeeec36d4bf5e002b54d25858197a870c125d57f44d32f
    2.2.2: sha256:2c08c99cbde73b3388c6d5da68e0bcaebc70c9174f2b14d785695e4401b3ede0
    2.2.1: sha256:f5d8e90ecb6c1c7e33ecddf8cc268a93b9e5b54e0e850320d765511d76624f41
@@ -1180,6 +1149,7 @@ containerd_archive_checksums:
    2.1.2: sha256:87c18b2686f38ee6f738492d04fc849f80567b7849d0710ee9d19fac3454adc4
    2.1.1: sha256:918e88fd393c28c89424e6535df0546ca36c1dfa7d8a5d685dee70b449380a9b
    2.1.0: sha256:0e5359e957b66b679be807563a543c7416e305e3aafcf56bad90ef87a917014d
+    2.0.9: sha256:3d2dc5e1f47888b4f8fa30fabf7f1b8ea20e1572c85e20557a3bb8bab81a54a3
    2.0.8: sha256:3507e6205867331660e881cdf9bd5fea83eed67b4ba50074be1d82296fdc4de2
    2.0.7: sha256:6dc663cd245d19c3e68260ca86247469563a31decac925087b62a2a819dfcbee
    2.0.6: sha256:a545471a67b8508a3c58ad01a4e6bb2921ace1e59e00a0a2d2e784c1f4fa8caa
@@ -1189,6 +1159,7 @@ containerd_archive_checksums:
    2.0.2: sha256:9bd5b6a1bdf505d520d9a329c520258ed0a17faa9fe3db12712ee858ad59aae3
    2.0.1: sha256:85061a5ce1b306292d5a64f85d5cd3aff93d0982737a1069d370dd6cb7bbfd09
    2.0.0: sha256:6f8da716941f7e89315cefaa6e5a8f1ff10b323ff46611313c455df7ab1ebee1
+    1.7.32: sha256:4db81bc7c67ec5e5e38ec43f287e1eab6962035cd1f4a904694700ca40698b03
    1.7.31: sha256:85795979166ae04c6c0681664ab54d0810d472e390cf54dde0de399ff6d54bef
    1.7.30: sha256:ca0f27e34411504acd1cd24fcbaa71b9c47d31ce9408c47c54a2dc1810ceb1df
    1.7.29: sha256:71d9f6e4ea4a9e108e2172b0e7f6fa137e086808db3e6874dbdb91c01102d3d4
@@ -1222,6 +1193,9 @@ containerd_archive_checksums:
    1.7.1: sha256:9504771bcb816d3b27fab37a6cf76928ee5e95a31eb41510a7d10ae726e01e85
    1.7.0: sha256:b068b05d58025dc9f2fc336674cac0e377a478930f29b48e068f97c783a423f0
  ppc64le:
+    2.3.1: sha256:cb5bcdb38c79fb78dc7b4e7c02d0c0e41b486446f646a49ed7e6c35c077d8d33
+    2.3.0: sha256:2cdb0f1e4fce22733fee6b6887b55ea2a963dfe7436259722db98aeb4f41e051
+    2.2.4: sha256:66328e683a6fe7f7267a0ee611cb9a76b2b0a9b9d9535d9564cd84dae8f38dd7
    2.2.3: sha256:95889d141444ce5845255042c8757a5ca816e895cc884f8d345e9a6d5e99e130
    2.2.2: sha256:8f7a8190f2a635cd0e5580a131408a275ba277f7a04edffba4a4005960093987
    2.2.1: sha256:3de0f215ea649952a9e99040cb3888d8059bd3d35b04edbe6afb916c763f9ea7
@@ -1234,6 +1208,7 @@ containerd_archive_checksums:
    2.1.2: sha256:9d8a02413050ae234eeef4152fb703b3d093b5809411f0e905f098554fc066d6
    2.1.1: sha256:36c90c9993e9f2142aa014cbd352bd7d3db6b8daa2990b4a9f59e706db78deaf
    2.1.0: sha256:3e380629da9d21366c916ec3873022a2a5700584d409297a1bc183b11fcb0809
+    2.0.9: sha256:59cae37f25ec6067d2fdf1ad76850ff45bcbf530ca176a726018d123eae447c0
    2.0.8: sha256:2980b4e80a5607d7723e9d3914d8d94533ed198c4bce4251f153906245a8ea74
    2.0.7: sha256:15186b11d555f61e495e94d5a99b2eb2c7f21a5e569eca02170c4bc12fa8c7f6
    2.0.6: sha256:20df16cac3a912d6df34040dc81c7e5e2c95a06b2b21fc2ffb4372b6d41274e4
@@ -1243,6 +1218,7 @@ containerd_archive_checksums:
    2.0.2: sha256:1b19d31bb8a7f9d26d9b50675e78f397d0b01fa635c33cca456f91c412fa6df1
    2.0.1: sha256:09a25357343c7336fe519e5fd1a9dd0f22da869e9deda50c2bc61b6e8c9384be
    2.0.0: sha256:2e7f4b15ac85c22c1ced102bbb424124078248f0af3183425ff335a998079809
+    1.7.32: sha256:3837f3b88ecbf16bcb1b78c2af46dd2b214663c5ee6a1b5e1f751938581c7fda
    1.7.31: sha256:c0956f5975a113fa15d627ff45d7f072aa596d75e8ae6d97b8aa8ae2f3c44058
    1.7.30: sha256:2edba94f31ed0c32cde0cca2e79e4426224eece4ef4fa1f194b2df4c811417fe
    1.7.29: sha256:8c08edb22b53a44cf7b5a5e31ca8fb86d1d6df378724048ae0d9890a3b66f081
@@ -1277,6 +1253,9 @@ containerd_archive_checksums:
    1.7.0: sha256:051e897d3ee5b8c8097f65be447fea2d29226b583ca5d9ed78e9aebcf4e69889
 containerd_static_archive_checksums:
  arm64:
+    2.3.1: sha256:2511a7f204fe04912acf95d6c59a65180be4491343fec79ce23b9166ac18aff3
+    2.3.0: sha256:07fe31f0e54d0b4a759ca207341bb22e2a78298f127757ad7b9a6529ef397f8b
+    2.2.4: sha256:5f01ac0ad46caf685afee7614e36e406c48e73c1d84a71378dd4afe5d63a11d2
    2.2.3: sha256:b222c671503e7bdac671bb634463cffdea70d694d2420fcdc77b2b04df8c7864
    2.2.2: sha256:f22e03e12edd08dc49e139fec1fb0e0571950df0b6275577bbca718733acea9d
    2.2.1: sha256:6b3b011ee388638eace05ac3be0eb32dfb4a43086695c29d06e997febd336f2e
@@ -1289,6 +1268,7 @@ containerd_static_archive_checksums:
    2.1.2: sha256:3f1dcd2bc02cbf9e8fde308c144551153f19e15105a26cebf213c8e232a27f5e
    2.1.1: sha256:f4525d8adc4445f8d623c6fd91e7dd750189b96539c29ede2636583ac5e4cf7b
    2.1.0: sha256:1239f60717f4ec2e06e51d2ed86c43d8a0ee10880c73131e58e1e0689e9ad049
+    2.0.9: sha256:8f409c39562f11a116227e833797ab421a6ebde96f92aecd88ae0409a6bf1873
    2.0.8: sha256:0e68ca38e33760ce581194933572211a2d2961dcad9a0a751258cca9a4cbf8a2
    2.0.7: sha256:cb46d915f8dea6e94fccd204f29bdb3cbe502d7deb9220a6e662cb33f29784fb
    2.0.6: sha256:4b6e773839b153a189935d76aace6e965811fbacce5cc938d74910582f2c0de3
@@ -1298,6 +1278,7 @@ containerd_static_archive_checksums:
    2.0.2: sha256:da5631d38702257674da542969c285adfdbdccffc12c5ea39de4db6113de51bc
    2.0.1: sha256:6022bd160b6d83f13fccd87b1c3854b0294a940335fdf014c10c80d71b279115
    2.0.0: sha256:428cd0b08eab57003db8a98742d8404b4b69dcd335c5f0f66ceec5fe3b9b31b6
+    1.7.32: sha256:1a1b9fa96e44ae4b66d0846c96d7ed9bdd2b2880e51890c74929962a5116e40c
    1.7.31: sha256:f4a329b5a97ff6241b3eed011f32a0c78969f2d7106524a628b7ee4b547896ff
    1.7.30: sha256:1458b3c4a20eb1305bb1d4680c660d0726fa7709acdd95ec7c0fd6bdd632c36a
    1.7.29: sha256:d428ad3fb7036c07c141f6666de575d8c7fd862e658a28da5ae20b737fdf7d75
@@ -1331,6 +1312,9 @@ containerd_static_archive_checksums:
    1.7.1: sha256:f0435e7cda3c3abc40d3f27d403a8e24bd0b927a8a893a7e4dfaec5996fa9731
    1.7.0: sha256:6e648cd832f026e23eb6998191e618da7c1ec0c0373263d503ff464e0ae3977a
  amd64:
+    2.3.1: sha256:3e7da6f4eaab072e11fc2e88f5a2eaf6da6ffff2c6c2a8f262d3856df8e2be35
+    2.3.0: sha256:d372ee3b2d272514651d65a3cecc75433dbba4bd90ae73d90d193d24d9760325
+    2.2.4: sha256:151f0cb3de61c77f89230e276761cb0f232f0e89d9c2efca3c172282d14193ef
    2.2.3: sha256:80326f17cc35de84f652a8a633a2f14086c1d828a48b62e96720b3c42059e49c
    2.2.2: sha256:5db46232ce716f85bf1e71497a9038c87e63030574bf03f9d09557802188ad27
    2.2.1: sha256:af3e82bac6abed58d45956c653244aa2be583359a9753614278ef652012f2883
@@ -1343,6 +1327,7 @@ containerd_static_archive_checksums:
    2.1.2: sha256:5b2b8e82c5d3e6019428db55296b5169e748b94601c0c944c1d780904aa35543
    2.1.1: sha256:9ab7df748ae3e9c2a513586668b46175c27290eda6028609223d9065eb777964
    2.1.0: sha256:e8e5da8ca6586bf2023940ec5bc5d4e949924ac8dca2a9f0dc469bb9a297146f
+    2.0.9: sha256:6cd7dc915982271ab634193ad7746cf2c7ef07fb4f37cf6f662b2bdcb6678013
    2.0.8: sha256:d7857b2d4f203ac4df95b5eca805e2ae29484e2a864c95806e51b1b34918bf35
    2.0.7: sha256:23371338ea3d930f020f6ad476a608aa8196ecdd016f9f5cd511c87cf37f86b7
    2.0.6: sha256:e6d69c5931af2a36c98cd066c96d60ee8b05a961d1f54d3d13d80c9afcd74a16
@@ -1352,6 +1337,7 @@ containerd_static_archive_checksums:
    2.0.2: sha256:7cd4de9c8ad37f3248a45b9d6347b7628e4d77d1c8e35c1f80343450fa47dc00
    2.0.1: sha256:22b2a7df86fe3e53e219af22a2b5e81d1b67e67d55ec3a18f89990b161fb2157
    2.0.0: sha256:e72cc69db9984a8d46a34495c302d2b50188ee2dd5c7000a7b471d0350e14ad1
+    1.7.32: sha256:4be406ec1ae5e1138ad9c6cd724228900d68bfbcb1f151bdd2283115cf361e6b
    1.7.31: sha256:fcefac10cab1d6d254917ca62596022fb4c3fb91984e052a3618674f75071930
    1.7.30: sha256:290eea517a7aa919aa319563f8270d284ab5197736362285da09b198b76a34b5
    1.7.29: sha256:ba4a2e919d2882dba707d8c9c436ed3496e3bb99f5cfb13a31b29b497cf7ec2e
@@ -1385,6 +1371,9 @@ containerd_static_archive_checksums:
    1.7.1: sha256:8b4e8ed8a650ea435aa71e115fa1a70701ab98bc1836b3ed33341af35bf85a3a
    1.7.0: sha256:64ad6428cc4aca486db3a6148682052955d1e3134b69f079edf686c21d123fcd
  ppc64le:
+    2.3.1: sha256:7d853a1216b0e836cfee0964b00ba116c06f71f1b1f5fae0d73dd1c21481b9c3
+    2.3.0: sha256:747101428337fd8afc996a98d23e45e7d64a1bf2dcb0dad74997356254732e85
+    2.2.4: sha256:5352f7b6523d92e1d7d4a1b5288be5fe490620e104cb48623d6affab309005d6
    2.2.3: sha256:63e884ac7a25591ced974235396ed4ee98569506258672636ed55f60d4bcd66a
    2.2.2: sha256:7e3d541c578fe06bcdb36ee58140e6e36dc97e784a9228e31c3ce99937cbad10
    2.2.1: sha256:fc9235be9a3dd3005e7fe6a9d7bb80e42dbfbff4b119cdce6ea3ee66bc7ae9ca
@@ -1397,6 +1386,7 @@ containerd_static_archive_checksums:
    2.1.2: sha256:4e61d5f9b5789e27c28b94fe0901552fb0070aa0c36aeaabc6e2786f3d5828ff
    2.1.1: sha256:32c307e4b5cf014b594a9e7c22c610238143da8797f2bf4058dfb94225606ad4
    2.1.0: sha256:df73c5ce713196be46f4b20d3ff081d67dabb5c730f61da7a3a65a9029b4f762
+    2.0.9: sha256:07bf0dc2483ee86022e85003f07ef4b37bfb839a1a61452ddde530f1cf97e836
    2.0.8: sha256:b014afa514a68eabf009021ff7ad1707f628d3050eafce41f7d54d8e4f344f82
    2.0.7: sha256:3f5993c7717216ae82083ce8c96af4d471da6e55affb03bfe4b86c59c6f54781
    2.0.6: sha256:15a9af201730810fa2b2943c94a2651063a7d09b684f706520965c02000bbd0a
@@ -1406,6 +1396,7 @@ containerd_static_archive_checksums:
    2.0.2: sha256:4085c490ad5afb40b34782d427130396513a7eb35a49da8a6b7ade946dd309ce
    2.0.1: sha256:6e8608e1993099f4ad44d77765be76fd67147108a6247f6886af33be08287a84
    2.0.0: sha256:c389b68c9ca7774efdbc9e479d9a3be14b71d60a2a8c23f1d8764ec9598f3d55
+    1.7.32: sha256:27090a9a77b5d1656ea95542166be6a8ac7877a76e4ebbc9a4b0b7c9bdbbae69
    1.7.31: sha256:460c276e75cb9bb205d0b4f685875c533fd6a904d91af539604d8085482e6453
    1.7.30: sha256:95f12a656977f516b257f6447c197a30bd75b8b9d494a741a7f1f486a069de8c
    1.7.29: sha256:5f4a351d4ecf0aedda743b2ea4b7304a72cf534f4f83c976de3a0d5adf006445
@@ -7,14 +7,15 @@ kube_next: "{{ ((kube_version | split('.'))[1] | int) + 1 }}"
 kube_major_next_version: "1.{{ kube_next }}"

 pod_infra_supported_versions:
+  '1.36': '3.10.2'
  '1.35': '3.10.1'
  '1.34': '3.10.1'
-  '1.33': '3.10'

 etcd_supported_versions:
+  '1.36': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"
  '1.35': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.7', '<'))[0] }}"
  '1.34': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
-  '1.33': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
+
 # Kubespray constants

 kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}"
@@ -171,10 +171,6 @@ cilium_hubble_peer_service_cluster_domain: "{{ dns_domain }}"

 cilium_gateway_api_enabled: false

-# The default IP address management mode is "Cluster Scope".
-# https://docs.cilium.io/en/stable/concepts/networking/ipam/
-cilium_ipam_mode: cluster-pool
-
 # Cluster Pod CIDRs use the kube_pods_subnet value by default.
 # If your node network is in the same range you will lose connectivity to other nodes.
 # Defaults to kube_pods_subnet if not set.
@@ -67,3 +67,19 @@
    that: "cilium_hubble_event_buffer_capacity in [1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191, 16383, 32767, 65535]"
    msg: "Error: cilium_hubble_event_buffer_capacity:{{ cilium_hubble_event_buffer_capacity }} is not a power of 2 minus 1 and it should be between 1 and 65535."
  when: cilium_hubble_event_buffer_capacity is defined
+
+# Cilium < 1.20 only supports Gateway API v1.4.1; v1.5+ standard channel drops
+# TLSRoute v1alpha2 (served=false) which makes cilium-operator CrashLoopBackOff.
+# Fix is in Cilium 1.20+ (cilium/cilium#45251) and will not be backported.
+- name: Stop if cilium_gateway_api_enabled is incompatible with the Gateway API CRD bundle
+  assert:
+    that:
+      - gateway_api_version is version('1.5.0', '<') or gateway_api_channel != 'standard'
+    msg: |
+      Cilium < 1.20 only supports Gateway API v1.4.1, see
+      https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/.
+      Pin gateway_api_version: '1.4.1', or set gateway_api_channel: 'experimental'.
+  when:
+    - cilium_gateway_api_enabled
+    - gateway_api_enabled
+    - cilium_version is version('1.20.0', '<')
@@ -4,9 +4,7 @@ dependencies:
    when:
      - inventory_hostname == groups['kube_control_plane'][0]
      - custom_cni_chart_release_name | length > 0
-    environment:
-      http_proxy: "{{ http_proxy | default('') }}"
-      https_proxy: "{{ https_proxy | default('') }}"
+    environment: "{{ proxy_env }}"
    release_common_opts: {}
    releases:
      - name: "{{ custom_cni_chart_release_name }}"
@@ -65,6 +65,7 @@ pkgs:
    - "{{ ping_access_ip }}"
  ipvsadm:
    - "{{ kube_proxy_mode == 'ipvs' }}"
+    - "{{ not kube_proxy_remove }}"
    - "{{ 'k8s_cluster' in group_names }}"
  libseccomp:
    - "{{ ansible_os_family == 'RedHat' }}"
@@ -80,6 +81,7 @@ pkgs:
    - "{{ ansible_distribution_major_version == '12' }}"
  nftables:
    - "{{ kube_proxy_mode == 'nftables' }}"
+    - "{{ not kube_proxy_remove }}"
    - "{{ 'k8s_cluster' in group_names }}"
  nss:
    - "{{ ansible_os_family == 'RedHat' }}"
@@ -55,5 +55,5 @@ RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
    && rm vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
    && vagrant plugin install vagrant-libvirt \
    # Install Kubernetes collections
-    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes \
-    && ansible-galaxy collection install kubernetes.core
+    && pip install --break-system-packages --no-compile --no-cache-dir kubernetes==35.0.0 \
+    && ansible-galaxy collection install kubernetes.core:==6.4.0
@@ -3,7 +3,7 @@
  - [etcd](https://github.com/etcd-io/etcd) {{ etcd_version }}
  - [docker](https://www.docker.com/) {{ docker_version }}
  - [containerd](https://containerd.io/) {{ containerd_version }}
-  - [cri-o](http://cri-o.io/) {{ crio_version }} (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [cri-o](https://cri-o.io/) {{ crio_version }} (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
  - [cni-plugins](https://github.com/containernetworking/plugins) {{ cni_version }}
  - [calico](https://github.com/projectcalico/calico) {{ calico_version }}
@@ -2,7 +2,27 @@ deploy:
 	ansible-playbook -i hosts.ini -e docker_password=$(docker_password) cluster.yml

 validate:
-	ansible-playbook -i hosts.ini -e '{"kubevirt_images_push": false}' cluster.yml
+	ansible-playbook -i localhost, -c local \
+		-e images_dir=$(CURDIR)/.image-builder \
+		-e kubevirt_buildkit_output_dir=$(CURDIR)/.image-builder/buildkit-output \
+		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "buildkit", "kubevirt_images_target_host": "localhost"}' \
+		cluster.yml

 validate-single:
-	ansible-playbook -i hosts.ini -e '{"kubevirt_images_push": false, "kubevirt_images_selected": ["$(image_name)"]}' cluster.yml
+	ansible-playbook -i localhost, -c local \
+		-e images_dir=$(CURDIR)/.image-builder \
+		-e kubevirt_buildkit_output_dir=$(CURDIR)/.image-builder/buildkit-output \
+		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "buildkit", "kubevirt_images_target_host": "localhost", "kubevirt_images_selected": ["$(image_name)"]}' \
+		cluster.yml
+
+validate-docker:
+	ansible-playbook -i localhost, -c local \
+		-e images_dir=$(CURDIR)/.image-builder \
+		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "docker", "kubevirt_images_target_host": "localhost"}' \
+		cluster.yml
+
+validate-single-docker:
+	ansible-playbook -i localhost, -c local \
+		-e images_dir=$(CURDIR)/.image-builder \
+		-e '{"kubevirt_images_push": false, "kubevirt_container_builder": "docker", "kubevirt_images_target_host": "localhost", "kubevirt_images_selected": ["$(image_name)"]}' \
+		cluster.yml
@@ -65,6 +65,8 @@ cd test-infra/image-builder/
 make validate
 ```

+This validation path runs locally and uses BuildKit, so it does not depend on SSH access to the remote builder host or a Docker daemon.
+
 ### Build only for one image

 ```bash
@@ -76,3 +78,4 @@ make validate-single image_name=ubuntu-2404

 - `kubevirt_images_push` (default: `true`): when `false`, skip docker login/push/logout.
 - `kubevirt_images_selected` (default: `[]`): list of image keys to build. Empty list builds all images.
+- `kubevirt_container_builder` (default: `docker`): use `buildkit` for local CI validation without Docker daemon access.
@@ -1,6 +1,6 @@
 ---
 - name: Build kubevirt images
-  hosts: image-builder
+  hosts: "{{ kubevirt_images_target_host | default('image-builder') }}"
  gather_facts: false
  roles:
    - kubevirt-images
@@ -6,6 +6,8 @@ docker_host: quay.io
 registry: quay.io/kubespray
 kubevirt_images_push: true
 kubevirt_images_selected: []
+kubevirt_container_builder: docker
+kubevirt_buildkit_output_dir: "{{ images_dir }}/buildkit-output"

 images:
  ubuntu-2004:
@@ -24,8 +26,8 @@ images:

  ubuntu-2404:
    filename: noble-server-cloudimg-amd64.img
-    url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
-    checksum: sha256:0cf56a2b23b430c350311dbcb9221b64823a5f7a401b5cf6ab4821f2ffdabe76
+    url: https://cloud-images.ubuntu.com/noble/20260323/noble-server-cloudimg-amd64.img
+    checksum: sha256:6e7016f2c9f4d3c00f48789eb6b9043ba2172ccc1b6b1eaf3ed1e29dd3e52bb3
    converted: false
    tag: "latest"

@@ -71,6 +73,13 @@ images:
    converted: true
    tag: "latest"

+  fedora-43:
+    filename: Fedora-Cloud-Base-Generic-43-1.6.x86_64.qcow2
+    url: https://download.fedoraproject.org/pub/fedora/linux/releases/43/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-43-1.6.x86_64.qcow2
+    checksum: sha256:846574c8a97cd2d8dc1f231062d73107cc85cbbbda56335e264a46e3a6c8ab2f
+    converted: true
+    tag: "latest"
+
  fedora-coreos:
    filename: fedora-coreos-32.20200601.3.0-openstack.x86_64.qcow2.xz
    url: https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/32.20200601.3.0/x86_64/fedora-coreos-32.20200601.3.0-openstack.x86_64.qcow2.xz
@@ -10,12 +10,63 @@
          - kubevirt_images_selected | length == 0 or kubevirt_images_to_build | length > 0
        fail_msg: "No matching images found in `images` for `kubevirt_images_selected={{ kubevirt_images_selected }}`"

+    - name: Validate requested container builder
+      assert:
+        that:
+          - kubevirt_container_builder in ['docker', 'buildkit']
+        fail_msg: "Unsupported kubevirt_container_builder={{ kubevirt_container_builder }}"
+
+    - name: Validate BuildKit push mode
+      assert:
+        that:
+          - not (kubevirt_container_builder == 'buildkit' and kubevirt_images_push)
+        fail_msg: "BuildKit validation currently requires kubevirt_images_push=false"
+
+    - name: Check qemu-img availability
+      command: qemu-img --version
+      changed_when: false
+
+    - name: Check Docker availability
+      command: docker --version
+      changed_when: false
+      when: kubevirt_container_builder == 'docker'
+
+    - name: Detect BuildKit daemonless wrapper availability
+      shell: command -v buildctl-daemonless.sh
+      args:
+        executable: /bin/bash
+      register: kubevirt_buildctl_daemonless_available
+      changed_when: false
+      failed_when: false
+      when: kubevirt_container_builder == 'buildkit'
+
+    - name: Check BuildKit availability
+      shell: |
+        set -euo pipefail
+        if [ "{{ kubevirt_buildctl_daemonless_available.rc | default(1) }}" -eq 0 ]; then
+          buildctl-daemonless.sh --version
+        else
+          buildctl --version
+          buildkitd --version
+        fi
+      args:
+        executable: /bin/bash
+      changed_when: false
+      when: kubevirt_container_builder == 'buildkit'
+
    - name: Create image directory
      file:
        state: directory
        path: "{{ images_dir }}"
        mode: "0755"

+    - name: Create buildkit output directory
+      file:
+        state: directory
+        path: "{{ kubevirt_buildkit_output_dir }}"
+        mode: "0755"
+      when: kubevirt_container_builder == 'buildkit'
+
    - name: Download images files
      get_url:
        url: "{{ item.value.url }}"
@@ -56,16 +107,95 @@
    - name: Create docker images for each OS
      command: docker build -t {{ registry }}/vm-{{ item.key }}:{{ item.value.tag }} --build-arg cloud_image="{{ item.key }}.qcow2" {{ images_dir }}
      loop: "{{ kubevirt_images_to_build }}"
+      when: kubevirt_container_builder == 'docker'
+
+    - name: Create container images for each OS with BuildKit
+      shell: |
+        set -euo pipefail
+        IMAGE_REF="{{ registry }}/vm-{{ item.key }}:{{ item.value.tag }}"
+        OUTPUT_TAR="{{ kubevirt_buildkit_output_dir }}/vm-{{ item.key }}-{{ item.value.tag }}.tar"
+
+        # Rootless BuildKit is the CI path; root mode must not use rootless-only flags.
+        if [ "$(id -u)" -eq 0 ]; then
+          BUILDKITD_FLAGS="${BUILDKITD_FLAGS:-}"
+        else
+          BUILDKITD_FLAGS="${BUILDKITD_FLAGS:---rootless --oci-worker-no-process-sandbox --oci-worker-snapshotter=native}"
+        fi
+
+        run_buildkit() {
+        if [ "{{ kubevirt_buildctl_daemonless_available.rc | default(1) }}" -eq 0 ]; then
+          export BUILDKITD_FLAGS
+          buildctl-daemonless.sh build \
+            --frontend dockerfile.v0 \
+            --local context={{ images_dir }} \
+            --local dockerfile={{ images_dir }} \
+            --opt filename=Dockerfile \
+            --opt build-arg:cloud_image={{ item.key }}.qcow2 \
+            --output "{{ 'type=image,name=' ~ registry ~ '/vm-' ~ item.key ~ ':' ~ item.value.tag ~ ',push=true' if kubevirt_images_push else 'type=oci,dest=' ~ kubevirt_buildkit_output_dir ~ '/vm-' ~ item.key ~ '-' ~ item.value.tag ~ '.tar' }}"
+        else
+          BUILDKIT_ADDR="unix:///tmp/buildkitd-{{ item.key }}.sock"
+          buildkitd ${BUILDKITD_FLAGS} --addr "${BUILDKIT_ADDR}" >/tmp/buildkitd-{{ item.key }}.log 2>&1 &
+          buildkitd_pid=$!
+
+          cleanup() {
+            kill "${buildkitd_pid}" >/dev/null 2>&1 || true
+            wait "${buildkitd_pid}" >/dev/null 2>&1 || true
+          }
+          trap cleanup EXIT
+
+          for _ in $(seq 1 50); do
+            if buildctl --addr "${BUILDKIT_ADDR}" debug workers >/dev/null 2>&1; then
+              break
+            fi
+            sleep 0.2
+          done
+
+          buildctl --addr "${BUILDKIT_ADDR}" build \
+            --frontend dockerfile.v0 \
+            --local context={{ images_dir }} \
+            --local dockerfile={{ images_dir }} \
+            --opt filename=Dockerfile \
+            --opt build-arg:cloud_image={{ item.key }}.qcow2 \
+            --output "{{ 'type=image,name=' ~ registry ~ '/vm-' ~ item.key ~ ':' ~ item.value.tag ~ ',push=true' if kubevirt_images_push else 'type=oci,dest=' ~ kubevirt_buildkit_output_dir ~ '/vm-' ~ item.key ~ '-' ~ item.value.tag ~ '.tar' }}"
+        fi
+        }
+
+        if run_buildkit; then
+          exit 0
+        fi
+
+        echo "BuildKit failed in this environment; attempting Docker fallback for {{ item.key }}" >&2
+        if ! command -v docker >/dev/null 2>&1; then
+          echo "Docker fallback unavailable: docker command not found" >&2
+          exit 1
+        fi
+
+        docker build -t "${IMAGE_REF}" --build-arg cloud_image="{{ item.key }}.qcow2" {{ images_dir }}
+        {% if kubevirt_images_push %}
+        docker push "${IMAGE_REF}"
+        {% else %}
+        docker save -o "${OUTPUT_TAR}" "${IMAGE_REF}"
+        {% endif %}
+      args:
+        executable: /bin/bash
+      loop: "{{ kubevirt_images_to_build }}"
+      when: kubevirt_container_builder == 'buildkit'

    - name: Docker login
      command: docker login -u="{{ docker_user }}" -p="{{ docker_password }}" "{{ docker_host }}"
-      when: kubevirt_images_push
+      when:
+        - kubevirt_container_builder == 'docker'
+        - kubevirt_images_push

    - name: Docker push image
      command: docker push {{ registry }}/vm-{{ item.key }}:{{ item.value.tag }}
      loop: "{{ kubevirt_images_to_build }}"
-      when: kubevirt_images_push
+      when:
+        - kubevirt_container_builder == 'docker'
+        - kubevirt_images_push

    - name: Docker logout
-      command: docker logout -u="{{ docker_user }}" "{{ docker_host }}"
-      when: kubevirt_images_push
+      command: docker logout "{{ docker_host }}"
+      when:
+        - kubevirt_container_builder == 'docker'
+        - kubevirt_images_push
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-39
+cloud_image: fedora-42

 # Kubespray settings
 auto_renew_certificates: true
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-41
+cloud_image: fedora-42

 # Kubespray settings
 auto_renew_certificates: true
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-41
+cloud_image: fedora-42

 # Kubespray settings
 container_manager: crio
@@ -1,5 +1,5 @@
 ---
-cloud_image: fedora-41
+cloud_image: fedora-42
 cluster_layout:
  - node_groups: ['kube_control_plane', 'etcd', 'kube_node']
  - node_groups: ['kube_node']
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-41
+cloud_image: fedora-43

 # Kubespray settings
 auto_renew_certificates: true
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-39
+cloud_image: fedora-43

 # Kubespray settings
 auto_renew_certificates: true
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-39
+cloud_image: fedora-43

 # Kubespray settings
 container_manager: crio
@@ -1,6 +1,6 @@
 ---
 # Instance settings
-cloud_image: fedora-40
+cloud_image: fedora-43

 # Kubespray settings
 auto_renew_certificates: true
@@ -1,5 +1,5 @@
 ---
-cloud_image: fedora-40
+cloud_image: fedora-43
 network_plugin: flannel
 container_manager: crio

@@ -1,5 +1,5 @@
 ---
-cloud_image: fedora-39
+cloud_image: fedora-43
 cluster_layout:
  - node_groups: ['kube_control_plane', 'etcd', 'kube_node']
  - node_groups: ['kube_node']
Author	SHA1	Message	Date
ujstor	7c8f928405	fix-absent-cni-kubeadm-join-control-planes (#13280 )	2026-06-02 07:34:59 +05:30
Nikhil Kumar	2ffff07887	Replace injected Ansible fact variables in node and control-plane roles (#13240 )	2026-06-02 07:34:51 +05:30
ChengHao Yang	8b234bf138	Patch versions updates (#13283 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-06-01 20:52:54 +05:30
Sumit Solanki	e914bd78c2	Bump containerd from 2.2.3 to 2.3.0 (#13265 )	2026-05-28 14:56:55 +05:30
Zakhar Dvurechensky	9049703ce0	roles: rely on configured defaults (#13249 ) Signed-off-by: Zakhar Dvurechensky <72825626+Zakharden@users.noreply.github.com>	2026-05-27 15:09:50 +05:30
Kubernetes Prow Robot	03ae25e410	Merge pull request #13269 from tico88612/fix/pre-commit Fixed pre-commit and pin Python Client version in pipeline	2026-05-26 13:41:26 +05:30
ChengHao Yang	d2ca095505	Chore: Pipeline kubernetes-python client version pin 35.0.0 Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2026-05-25 20:51:18 +08:00
ChengHao Yang	1b111e06b1	Fix kata-containers job name duplicated Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2026-05-25 20:50:38 +08:00
ChengHao Yang	4e6e63d49d	Chore: pin the pre-commit ansible-core version Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2026-05-25 20:49:52 +08:00
Ali Afsharzadeh	6107c6ab7c	Align nginx worker_rlimit_nofile with containerd defaults (#13255 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-05-21 17:10:48 +05:30
Ali Afsharzadeh	7a62933b17	Update load balancer versions to Nginx 1.30.1 and Haproxy 3.2.19 (#13258 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-05-21 14:16:46 +05:30
Jiří Suchomel	7214e9899b	docs: fix incorrect Ansible paths and standardize inventory references (#13246 ) This commit updates documentation across several files to correct broken file paths and ensure consistency in Ansible command examples - Standardized inventory naming to `inventory.ini` for sample inventories. - Fixed `group_vars` paths to reflect the actual directory structure (e.g., `group_vars/all/all.yml` instead of `group_vars/all.yml`). - Corrected the `k8s-cluster.yml` filename in guides. - Clarified the location for `kubectl_localhost` and `kubeconfig_localhost` settings. - Replaced non-existent placeholders (like `inventory/single.cfg`) with valid repository paths. - Fixed typos in directory names (e.g., `myclsuter` -> `mycluster`).	2026-05-21 13:30:47 +05:30
Sumit Solanki	7fd29b5529	kube-vip: optional Prometheus metrics (default port 2112) (#13229 ) Add kube_vip_metrics_enabled and kube_vip_metrics_port; wire prometheus_server and container port in the static pod manifest. Default metrics port to 2112 to match kube-vip upstream. Document and sample inventory updated.	2026-05-19 11:15:02 +05:30
Ali Afsharzadeh	17f270325d	Remove deprecated apiserver-count kubeadm config option (#13262 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-05-18 16:17:51 +05:30
Justin Lamp	8c3f6270f8	Add toggle to disable node subnet allocation (#13239 ) Signed-off-by: Justin Lamp <justin.lamp@netways.de>	2026-05-16 11:34:34 +05:30
Ali Afsharzadeh	2ac815147b	Upgrade cilium from 1.19.3 to 1.19.4 (#13256 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-05-14 18:04:28 +05:30
Nikhil Kumar	2ed677ce86	Replace injected Ansible fact variables with ansible_facts in preinstall role (#13232 )	2026-05-14 16:08:30 +05:30
ChengHao Yang	22ce2f799f	Patch versions updates (#13254 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-05-14 13:26:27 +05:30
dependabot[bot]	469a8296a1	build(deps): bump cryptography from 47.0.0 to 48.0.0 (#13248 ) Bumps [cryptography](https://github.com/pyca/cryptography) from 47.0.0 to 48.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/47.0.0...48.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-11 19:16:00 +05:30
Takuya Murakami	c1768dd21b	cri-o: Bump cri-o to 1.36.0 for kubernetes 1.36 (#13244 )	2026-05-11 19:15:51 +05:30
Kay Yan	a93615ebde	ci: bump EOL Fedora versions to 42/43 (#13206 ) Fedora 39 (EOL 2024-11-26), Fedora 40 (EOL 2025-05-13), and Fedora 41 (EOL 2025-12-15) are all out of support and no longer receive security updates. This bumps the kubevirt CI test matrix to currently supported releases, distributing tests across Fedora 42 (supported until 2026-05-13) and Fedora 43 (supported until 2026-12-09) to keep multi-version coverage. - Add fedora-43 image entry to the kubevirt image-builder - Rename fedora39-* tests to fedora43-* (4 tests) - Rename fedora40-* tests to fedora43-* (2 tests) - Rename fedora41-* tests to fedora42-* (4 tests) - Update .gitlab-ci/kubevirt.yml testcase names - Regenerate docs/developers/ci.md All 10 existing Fedora test configurations (kube-router, calico-selinux, calico-swap-selinux, crio with/without SELinux enforcing, docker-calico, flannel-crio-collection-scale) are preserved. Signed-off-by: Kay Yan <kay.yan@daocloud.io>	2026-05-11 13:59:56 +05:30
Srishti Jaiswal	da6b8e8b81	image-builder: run validation with Dind (#13212 ) * image-builder: run validation locally with BuildKit * upadte checksum * set BuildKit no-process-sandbox flag for CI * run BuildKit with rootless-safe daemon flags in CI * update * updating root logic * fix ci failure for can't enable NoProcessSandbox * switch to stable url * add --oci-worker-no-process-sandbox ci flag in root path * add more support * add validate-docker and validate-single docker	2026-05-11 13:27:50 +05:30
Justin Lamp	6bb1e2f290	Set http proxy environments for helm app installations (#13234 ) * Set http proxy environments for helm app installations Signed-off-by: Justin Lamp <justin.lamp@netways.de> * Change http_proxy env variables from legacy static entries to new proxy_env variable Signed-off-by: Justin Lamp <justin.lamp@netways.de> --------- Signed-off-by: Justin Lamp <justin.lamp@netways.de>	2026-05-10 08:49:45 +05:30
ChengHao Yang	4cefd77639	Move failing youki to allow_failed and patch update (#13241 ) * Patch versions updates * fix: failing blocker youki https://github.com/youki-dev/youki/issues/3479 --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-05-08 18:43:20 +05:30
Sumit Solanki	e97333dbf8	fix: skip kube-proxy-only tasks when kube_proxy_remove is true (#13228 ) * fix: skip kube-proxy-only tasks when kube_proxy_remove is true Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com> * refactor: use where defaults already define the var Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com> --------- Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>	2026-05-07 18:31:20 +05:30
Ali Afsharzadeh	09e9c43570	Disable controller-manager allocate-node-cidrs for cilium cluster-pool ipam (#13148 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-05-06 15:26:22 +05:30
Seokjun Yang	17f92d2cce	Update Docker image version in README (#13226 )	2026-05-05 08:18:22 +05:30
ChengHao Yang	e6bd0cb37d	Chore: change the GitHub Actions uses commit hash (#13227 ) Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2026-05-04 10:53:38 +05:30
Takuya Murakami	28bdeb8583	[Kubernetes] Support Kubernetes v1.36.0 (#13219 ) - Support Kubernetes 1.36.0 - Bump coredns to 1.14.2	2026-05-01 07:49:25 +05:30
Kay Yan	a254f5ea68	network_plugin/cilium: fail fast when Gateway API CRDs are incompatible (#13223 ) Cilium < 1.20 unconditionally registers a field indexer for TLSRoute v1alpha2 when the Gateway API controller is enabled, but Gateway API >= 1.5.0 ships TLSRoute v1alpha2 with served=false in the standard channel. The result is cilium-operator CrashLoopBackOff with: no matches for kind "TLSRoute" in version "gateway.networking.k8s.io/v1alpha2" The fix landed in Cilium 1.20 only and will not be backported. Add a preflight assert that triggers only when all of the following hold: cilium_gateway_api_enabled, gateway_api_enabled, cilium_version < 1.20.0, gateway_api_version >= 1.5.0, and gateway_api_channel == "standard". Users hit by this combo get a clear error and two workarounds (pin gateway_api_version to 1.4.1, or switch gateway_api_channel to "experimental") instead of debugging a crash loop after the fact. Signed-off-by: Kay Yan <kay.yan@daocloud.io>	2026-04-30 11:43:26 +05:30
Yang-Ming Lin	c3d4864e63	Refactor(defaults): centralize etcd defaults (#13161 )	2026-04-28 07:54:48 +05:30
dependabot[bot]	655c516129	build(deps): bump stefanbuck/github-issue-parser from 3.2.3 to 3.2.5 (#13218 ) Bumps [stefanbuck/github-issue-parser](https://github.com/stefanbuck/github-issue-parser) from 3.2.3 to 3.2.5. - [Release notes](https://github.com/stefanbuck/github-issue-parser/releases) - [Commits](https://github.com/stefanbuck/github-issue-parser/compare/10dcc54158ba4c137713d9d69d70a2da63b6bda3...cb6e97157cbf851e3a393ff8d57c93a484cc323f) --- updated-dependencies: - dependency-name: stefanbuck/github-issue-parser dependency-version: 3.2.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-28 07:26:49 +05:30
dependabot[bot]	846bcb2ccc	build(deps): bump cryptography from 46.0.7 to 47.0.0 (#13217 ) Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 47.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/46.0.7...47.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 47.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-28 07:22:47 +05:30
Kay Yan	76a9d3db08	Releng: bump galaxy version 2.32.0 (#13214 ) Signed-off-by: Kay Yan <kay.yan@daocloud.io>	2026-04-25 15:20:46 +05:30
Kay Yan	1c9add4897	docs: fix release-notes command in release guide (#13211 ) The documented example still uses the removed --required-author flag and misses --repo-path, which breaks with current release-notes binaries. Update it to use the generate subcommand and point at the local checkout. Signed-off-by: Kay Yan <kay.yan@daocloud.io>	2026-04-24 09:46:46 +05:30
Ali Afsharzadeh	00a29dffc8	Add myself (guoard) as reviewer (#13197 ) Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>	2026-04-23 17:48:47 +05:30