Move checksums to kubespray_defaults/vars (#12234)

The checksums are not a defaults and are not meant to be changed from
the inventories.

Furthermore, role defaults have a lower priority that hosts facts, which
technically means a rogue hosts could hijack the hashes for its
variables.

roles/kubespray_defaults/vars/main/main.yml

@@ -0,0 +1,29 @@
+---
+# Kubespray constants
+
+kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}"
+
+# The lowest version allowed to upgrade from (same as calico_version in the previous branch)
+calico_min_version_required: "3.27.0"
+
+containerd_min_version_required: "1.3.7"
+
+# mixed kube_service_addresses/kube_service_addresses_ipv6 for a variety of network stacks(dualstack, ipv6only, ipv4only)
+kube_service_subnets: >-
+  {%- if ipv4_stack and ipv6_stack -%}
+  {{ kube_service_addresses }},{{ kube_service_addresses_ipv6 }}
+  {%- elif ipv4_stack -%}
+  {{ kube_service_addresses }}
+  {%- else -%}
+  {{ kube_service_addresses_ipv6 }}
+  {%- endif -%}
+
+# mixed kube_pods_subnet/kube_pods_subnet_ipv6 for a variety of network stacks(dualstack, ipv6only, ipv4only)
+kube_pods_subnets: >-
+  {%- if ipv4_stack and ipv6_stack -%}
+  {{ kube_pods_subnet }},{{ kube_pods_subnet_ipv6 }}
+  {%- elif ipv4_stack -%}
+  {{ kube_pods_subnet }}
+  {%- else -%}
+  {{ kube_pods_subnet_ipv6 }}
+  {%- endif -%}