Changed to use first_kube_control_plane to parse kubeadm_certificate_key (#12758 )

Co-authored-by: Fredrik Liv <fredrik.liv@elastisys.com> Co-authored-by: nvalembois <nvalembois@live.com>
Fix calico etcd mode networkpolicy RBAC (#12753 )
2025-12-13 21:34:40 +03:00 · 2025-12-02 07:28:26 -08:00 · 2025-11-28 08:36:21 -08:00 · 2025-11-19 23:57:59 -08:00 · 2025-11-17 22:27:37 -08:00 · 2025-11-17 21:27:38 -08:00
36 changed files with 639 additions and 136 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -37,5 +37,7 @@ exclude_paths:
  - tests/files/custom_cni/cilium.yaml
  - venv
  - .github
+  - .ansible
+  - .cache
 mock_modules:
  - gluster.gluster.gluster_volume
--- a/.gitlab-ci/lint.yml
+++ b/.gitlab-ci/lint.yml
@@ -3,15 +3,16 @@ pre-commit:
  stage: test
  tags:
  - ffci
-  image: 'ghcr.io/pre-commit-ci/runner-image@sha256:aaf2c7b38b22286f2d381c11673bec571c28f61dd086d11b43a1c9444a813cef'
+  image: 'ghcr.io/pre-commit-ci/runner-image@sha256:fe01a6ec51b298412990b88627c3973b1146c7304f930f469bafa29ba60bcde9'
  variables:
-    PRE_COMMIT_HOME: /pre-commit-cache
+    PRE_COMMIT_HOME: ${CI_PROJECT_DIR}/.cache/pre-commit
  script:
  - pre-commit run --all-files
  cache:
-    key: pre-commit-all
+    key: pre-commit-2
    paths:
-    - /pre-commit-cache
+    - ${PRE_COMMIT_HOME}
+    when: 'always'
  needs: []

 vagrant-validate:
--- a/.gitlab-ci/packet.yml
+++ b/.gitlab-ci/packet.yml
@@ -75,7 +75,7 @@ packet_ubuntu20-calico-all-in-one:
 # ### PR JOBS PART2

 packet_ubuntu20-crio:
-  extends: .packet_pr_manual
+  extends: .packet_pr

 packet_ubuntu22-calico-all-in-one:
  extends: .packet_pr
@@ -89,7 +89,7 @@ packet_ubuntu24-calico-etcd-datastore:
  extends: .packet_pr

 packet_almalinux8-crio:
-  extends: .packet_pr
+  extends: .packet_pr_manual

 packet_almalinux8-kube-ovn:
  extends: .packet_pr
@@ -111,8 +111,13 @@ packet_rockylinux9-cilium:
  variables:
    RESET_CHECK: "true"

+# Need an update of the container image to use schema v2
+# update: quay.io/kubespray/vm-amazon-linux-2:latest
 packet_amazon-linux-2-all-in-one:
-  extends: .packet_pr
+  extends: .packet_pr_manual
+  rules:
+    - when: manual
+      allow_failure: true

 packet_opensuse-docker-cilium:
  extends: .packet_pr
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,7 @@
 ---
 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
    hooks:
      - id: check-added-large-files
      - id: check-case-conflict
@@ -15,7 +15,7 @@ repos:
      - id: trailing-whitespace

  - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.35.1
+    rev: v1.37.1
    hooks:
      - id: yamllint
        args: [--strict]
@@ -27,7 +27,7 @@ repos:
        exclude: "^.github|(^docs/_sidebar\\.md$)"

  - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.10.0.1
+    rev: v0.11.0.1
    hooks:
      - id: shellcheck
        args: ["--severity=error"]
@@ -35,16 +35,17 @@ repos:
        files: "\\.sh$"

  - repo: https://github.com/ansible/ansible-lint
-    rev: v24.12.2
+    rev: v25.11.0
    hooks:
      - id: ansible-lint
        additional_dependencies:
+          - ansible
          - jmespath==1.0.1
          - netaddr==1.3.0
          - distlib

  - repo: https://github.com/golangci/misspell
-    rev: v0.6.0
+    rev: v0.7.0
    hooks:
      - id: misspell
        exclude: "OWNERS_ALIASES$"
--- a/README.md
+++ b/README.md
@@ -94,14 +94,14 @@ Note: Upstart/SysV init based OS types are not supported.
 ## Supported Components

 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) v1.31.4
-  - [etcd](https://github.com/etcd-io/etcd) v3.5.16
+  - [kubernetes](https://github.com/kubernetes/kubernetes) v1.31.9
+  - [etcd](https://github.com/etcd-io/etcd) v3.5.21
  - [docker](https://www.docker.com/) v26.1
-  - [containerd](https://containerd.io/) v1.7.24
-  - [cri-o](http://cri-o.io/) v1.31.0 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
+  - [containerd](https://containerd.io/) v1.7.27
+  - [cri-o](http://cri-o.io/) v1.31.6 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
-  - [cni-plugins](https://github.com/containernetworking/plugins) v1.2.0
-  - [calico](https://github.com/projectcalico/calico) v3.29.1
+  - [cni-plugins](https://github.com/containernetworking/plugins) v1.4.1
+  - [calico](https://github.com/projectcalico/calico) v3.29.4
  - [cilium](https://github.com/cilium/cilium) v1.15.9
  - [flannel](https://github.com/flannel-io/flannel) v0.22.0
  - [kube-ovn](https://github.com/alauda/kube-ovn) v1.12.21
@@ -112,7 +112,7 @@ Note: Upstart/SysV init based OS types are not supported.
 - Application
  - [cert-manager](https://github.com/jetstack/cert-manager) v1.15.3
  - [coredns](https://github.com/coredns/coredns) v1.11.3
-  - [ingress-nginx](https://github.com/kubernetes/ingress-nginx) v1.12.0
+  - [ingress-nginx](https://github.com/kubernetes/ingress-nginx) v1.12.1
  - [krew](https://github.com/kubernetes-sigs/krew) v0.4.4
  - [argocd](https://argoproj.github.io/) v2.11.0
  - [helm](https://helm.sh/) v3.16.4
--- a/contrib/offline/manage-offline-container-images.sh
+++ b/contrib/offline/manage-offline-container-images.sh
@@ -146,7 +146,7 @@ function register_container_images() {
 		if [ "${org_image}" == "ID:" ]; then
 		  org_image=$(echo "${load_image}"  | awk '{print $4}')
 		fi
-		image_id=$(sudo ${runtime} image inspect ${org_image} | grep "\"Id\":" | awk -F: '{print $3}'| sed s/'\",'//)
+		image_id=$(sudo ${runtime} image inspect --format "{{.Id}}" "${org_image}")
 		if [ -z "${file_name}" ]; then
 			echo "Failed to get file_name for line ${line}"
 			exit 1
--- a/contrib/terraform/aws/create-infrastructure.tf
+++ b/contrib/terraform/aws/create-infrastructure.tf
@@ -1,5 +1,11 @@
 terraform {
  required_version = ">= 0.12.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
 }

 provider "aws" {
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -2,7 +2,7 @@
 namespace: kubernetes_sigs
 description: Deploy a production ready Kubernetes cluster
 name: kubespray
-version: 2.27.0
+version: 2.27.2
 readme: README.md
 authors:
  - The Kubespray maintainers (https://kubernetes.slack.com/channels/kubespray)
--- a/inventory/sample/group_vars/all/all.yml
+++ b/inventory/sample/group_vars/all/all.yml
@@ -45,9 +45,11 @@ loadbalancer_apiserver_healthcheck_port: 8081
 ## If set the possible values only 'external' after K8s v1.31.
 # cloud_provider:

-## When cloud_provider is set to 'external', you can set the cloud controller to deploy
-## Supported cloud controllers are: 'openstack', 'vsphere', 'huaweicloud' and 'hcloud'
-## When openstack or vsphere are used make sure to source in the required fields
+# External Cloud Controller Manager (Formerly known as cloud provider)
+# cloud_provider must be "external", otherwise this setting is invalid.
+# Supported external cloud controllers are: 'openstack', 'vsphere', 'oci', 'huaweicloud', 'hcloud' and 'manual'
+# 'manual' does not install the cloud controller manager used by Kubespray.
+# If you fill in a value other than the above, the check will fail.
 # external_cloud_provider:

 ## Set these proxy values in order to update package manager and docker daemon to use proxies and custom CA for https_proxy if needed
--- a/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml
@@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
 kube_api_anonymous_auth: true

 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.31.4
+kube_version: v1.31.9

 # Where the binaries will be downloaded.
 # Note: ensure that you've enough disk space (about 1G)
@@ -268,11 +268,6 @@ default_kubelet_config_dir: "{{ kube_config_dir }}/dynamic_kubelet_dir"
 # kube_cpu_reserved: 100m
 # kube_ephemeral_storage_reserved: 2Gi
 # kube_pid_reserved: "1000"
-# Reservation for control plane hosts
-# kube_master_memory_reserved: 512Mi
-# kube_master_cpu_reserved: 200m
-# kube_master_ephemeral_storage_reserved: 2Gi
-# kube_master_pid_reserved: "1000"

 ## Optionally reserve resources for OS system daemons.
 # system_reserved: true
@@ -283,10 +278,6 @@ default_kubelet_config_dir: "{{ kube_config_dir }}/dynamic_kubelet_dir"
 # system_memory_reserved: 512Mi
 # system_cpu_reserved: 500m
 # system_ephemeral_storage_reserved: 2Gi
-## Reservation for master hosts
-# system_master_memory_reserved: 256Mi
-# system_master_cpu_reserved: 250m
-# system_master_ephemeral_storage_reserved: 2Gi

 ## Eviction Thresholds to avoid system OOMs
 # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
--- a/inventory/sample/group_vars/k8s_cluster/kube_control_plane.yml
+++ b/inventory/sample/group_vars/k8s_cluster/kube_control_plane.yml
@@ -0,0 +1,11 @@
+# Reservation for control plane kubernetes components
+# kube_memory_reserved: 512Mi
+# kube_cpu_reserved: 200m
+# kube_ephemeral_storage_reserved: 2Gi
+# kube_pid_reserved: "1000"
+
+# Reservation for control plane host system
+# system_memory_reserved: 256Mi
+# system_cpu_reserved: 250m
+# system_ephemeral_storage_reserved: 2Gi
+# system_pid_reserved: "1000"
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,6 @@
 ansible==9.13.0
 # Needed for community.crypto module
-cryptography==44.0.0
+cryptography==44.0.2
 # Needed for jinja2 json_query templating
 jmespath==1.0.1
 # Needed for ansible.utils.ipaddr
--- a/roles/bootstrap-os/defaults/main.yml
+++ b/roles/bootstrap-os/defaults/main.yml
@@ -30,8 +30,3 @@ override_system_hostname: true
 is_fedora_coreos: false

 skip_http_proxy_on_os_packages: false
-
-# If this is true, debug information will be displayed but
-# may contain some private data, so it is recommended to set it to false
-# in the production environment.
-unsafe_show_logs: false
--- a/roles/etcd/defaults/main.yml
+++ b/roles/etcd/defaults/main.yml
@@ -114,11 +114,6 @@ etcd_retries: 4
 # https://groups.google.com/a/kubernetes.io/g/dev/c/B7gJs88XtQc/m/rSgNOzV2BwAJ?utm_medium=email&utm_source=footer
 etcd_experimental_initial_corrupt_check: true

-# If this is true, debug information will be displayed but
-# may contain some private data, so it is recommended to set it to false
-# in the production environment.
-unsafe_show_logs: false
-
 # Enable distributed tracing
 # https://etcd.io/docs/v3.5/op-guide/monitoring/#distributed-tracing
 etcd_experimental_enable_distributed_tracing: false
--- a/roles/etcd/tasks/gen_certs_script.yml
+++ b/roles/etcd/tasks/gen_certs_script.yml
@@ -153,3 +153,25 @@
    owner: "{{ etcd_owner }}"
    mode: "{{ etcd_cert_dir_mode }}"
    recurse: true
+
+# This is a hack around the fact kubeadm expect the same certs path on all kube_control_plane
+# TODO: fix certs generation to have the same file everywhere
+# OR work with kubeadm on node-specific config
+- name: Gen_certs | Pretend all control plane have all certs (with symlinks)
+  file:
+    state: link
+    src: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}{{ item[0] }}.pem"
+    dest: "{{ etcd_cert_dir }}/node-{{ item[1] }}{{ item[0] }}.pem"
+    mode: "0640"
+  loop: "{{ suffixes | product(groups['kube_control_plane']) }}"
+  vars:
+    suffixes:
+      - ''
+      - '-key'
+  when:
+    - ('kube_control_plane' in group_names)
+    - item[1] != inventory_hostname
+  register: symlink_created
+  failed_when:
+    - symlink_created is failed
+    - ('refusing to convert from file to symlink' not in symlink_created.msg)
--- a/roles/kubernetes-apps/ansible/vars/main.yml
+++ b/roles/kubernetes-apps/ansible/vars/main.yml
@@ -13,10 +13,10 @@ coredns_manifests:
 - coredns-sa.yml.j2
 - coredns-svc.yml.j2
 - "{{ dns_autoscaler_manifests if enable_dns_autoscaler else [] }}"
- "{{ coredns-poddisruptionbudget.yml.j2 if coredns_pod_disruption_budget else [] }}"
+- "{{ 'coredns-poddisruptionbudget.yml.j2' if coredns_pod_disruption_budget else [] }}"

 nodelocaldns_manifests:
 - nodelocaldns-config.yml.j2
 - nodelocaldns-daemonset.yml.j2
 - nodelocaldns-sa.yml.j2
- "{{ nodelocaldns-second-daemonset.yml.j2 if enable_nodelocaldns_secondary else [] }}"
+- "{{ 'nodelocaldns-second-daemonset.yml.j2' if enable_nodelocaldns_secondary else [] }}"
--- a/roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml
+++ b/roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml
@@ -27,11 +27,6 @@ vsphere_csi_aggressive_node_not_ready_timeout: 300

 vsphere_csi_node_affinity: {}

-# If this is true, debug information will be displayed but
-# may contain some private data, so it is recommended to set it to false
-# in the production environment.
-unsafe_show_logs: false
-
 # https://github.com/kubernetes-sigs/vsphere-csi-driver/blob/master/docs/book/features/volume_snapshot.md#how-to-enable-volume-snapshot--restore-feature-in-vsphere-csi-
 # according to the above link , we can controler the block-volume-snapshot parameter
 vsphere_csi_block_volume_snapshot: false
--- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
+++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
@@ -30,6 +30,8 @@ spec:
          operator: Exists
        - key: node-role.kubernetes.io/control-plane
          effect: NoSchedule
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
 {% if policy_controller_extra_tolerations is defined %}
        {{ policy_controller_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }}
 {% endif %}
@@ -59,6 +61,8 @@ spec:
              - /usr/bin/check-status
              - -r
            periodSeconds: 10
+          securityContext:
+            runAsNonRoot: true
          env:
            - name: LOG_LEVEL
              value: {{ calico_policy_controller_log_level }}
@@ -68,6 +72,8 @@ spec:
            - name: DATASTORE_TYPE
              value: kubernetes
 {% else %}
+            - name: ENABLED_CONTROLLERS
+              value: policy,namespace,serviceaccount,workloadendpoint,node
            - name: ETCD_ENDPOINTS
              value: "{{ etcd_access_addresses }}"
            - name: ETCD_CA_CERT_FILE
--- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
+++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
@@ -6,27 +6,21 @@ metadata:
  namespace: kube-system
 rules:
 {% if calico_datastore == "etcd"  %}
-  - apiGroups:
-    - ""
-    - extensions
+  # Pods are monitored for changing labels.
+  # The node controller monitors Kubernetes nodes.
+  # Namespace and serviceaccount labels are used for policy.
+  - apiGroups: [""]
    resources:
      - pods
-      - namespaces
-      - networkpolicies
      - nodes
+      - namespaces
      - serviceaccounts
    verbs:
      - watch
      - list
      - get
-  - apiGroups:
-    - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-  - apiGroups:
-    - networking.k8s.io
+  # Watch for changes to Kubernetes NetworkPolicies.
+  - apiGroups: ["networking.k8s.io"]
    resources:
      - networkpolicies
    verbs:
@@ -67,6 +61,7 @@ rules:
      - blockaffinities
      - ipamblocks
      - ipamhandles
+      - tiers
    verbs:
      - get
      - list
@@ -101,6 +96,7 @@ rules:
    verbs:
      # read its own config
      - get
+      - list
      # create a default if none exists
      - create
      # update status
--- a/roles/kubernetes/control-plane/defaults/main/main.yml
+++ b/roles/kubernetes/control-plane/defaults/main/main.yml
@@ -248,6 +248,9 @@ kube_apiserver_tracing_sampling_rate_per_million: 100
 # Enable kubeadm file discovery if anonymous access has been removed
 kubeadm_use_file_discovery: "{{ remove_anonymous_access }}"

+# imagePullSerial specifies if image pulling performed by kubeadm must be done serially or in parallel. Default: true
+kubeadm_image_pull_serial: true
+
 # Supported asymmetric encryption algorithm types for the cluster's keys and certificates.
 # can be one of RSA-2048(default), RSA-3072, RSA-4096, ECDSA-P256
 # ref: https://kubernetes.io/docs/reference/config-api/kubeadm-config.v1beta4/#kubeadm-k8s-io-v1beta4-ClusterConfiguration
--- a/roles/kubernetes/control-plane/tasks/check-api.yml
+++ b/roles/kubernetes/control-plane/tasks/check-api.yml
@@ -0,0 +1,10 @@
+---
+- name: Kubeadm | Check api is up
+  uri:
+    url: "https://{{ ip | default(fallback_ip) }}:{{ kube_apiserver_port }}/healthz"
+    validate_certs: false
+  when: ('kube_control_plane' in group_names)
+  register: _result
+  retries: 60
+  delay: 5
+  until: _result.status == 200
--- a/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml
@@ -24,11 +24,11 @@

 - name: Parse certificate key if not set
  set_fact:
-    kubeadm_certificate_key: "{{ hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
+    kubeadm_certificate_key: "{{ hostvars[first_kube_control_plane]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
  run_once: true
  when:
-    - hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is defined
-    - hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is not skipped
+    - hostvars[first_kube_control_plane]['kubeadm_upload_cert'] is defined
+    - hostvars[first_kube_control_plane]['kubeadm_upload_cert'] is not skipped

 - name: Create kubeadm ControlPlane config
  template:
--- a/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
@@ -228,7 +228,7 @@
 - name: Kubeadm | Join other control plane nodes
  include_tasks: kubeadm-secondary.yml

- name: Kubeadm | upgrade kubernetes cluster
+- name: Kubeadm | upgrade kubernetes cluster to {{ kube_version }}
  include_tasks: kubeadm-upgrade.yml
  when:
    - upgrade_cluster_setup
--- a/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
@@ -1,56 +1,81 @@
 ---
- name: Kubeadm | Check api is up
-  uri:
-    url: "https://{{ ip | default(fallback_ip) }}:{{ kube_apiserver_port }}/healthz"
-    validate_certs: false
-  when: ('kube_control_plane' in group_names)
-  register: _result
-  retries: 60
-  delay: 5
-  until: _result.status == 200
+- name: Ensure kube-apiserver is up before upgrade
+  import_tasks: check-api.yml

+  # kubeadm-config.v1beta4 with UpgradeConfiguration requires some values that were previously allowed as args to be specified in the config file
 - name: Kubeadm | Upgrade first control plane node
  command: >-
    timeout -k 600s 600s
-    {{ bin_dir }}/kubeadm
-    upgrade apply -y {{ kube_version }}
+    {{ bin_dir }}/kubeadm upgrade apply -y {{ kube_version }}
+    {%- if kubeadm_config_api_version == 'v1beta3' %}
    --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
    --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
    --allow-experimental-upgrades
    --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | lower }}
    {% if kubeadm_patches | length > 0 %}--patches={{ kubeadm_patches_dir }}{% endif %}
    --force
+    {%- else %}
+    --config={{ kube_config_dir }}/kubeadm-config.yaml
+    {%- endif -%}
  register: kubeadm_upgrade
-  # Retry is because upload config sometimes fails
-  retries: 3
-  until: kubeadm_upgrade.rc == 0
  when: inventory_hostname == first_kube_control_plane
  failed_when: kubeadm_upgrade.rc != 0 and "field is immutable" not in kubeadm_upgrade.stderr
  environment:
    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
-  notify: Control plane | restart kubelet

 - name: Kubeadm | Upgrade other control plane nodes
  command: >-
-    timeout -k 600s 600s
-    {{ bin_dir }}/kubeadm
-    upgrade apply -y {{ kube_version }}
+    {{ bin_dir }}/kubeadm upgrade node
+    {%- if kubeadm_config_api_version == 'v1beta3' %}
    --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
    --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
-    --allow-experimental-upgrades
    --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | lower }}
    {% if kubeadm_patches | length > 0 %}--patches={{ kubeadm_patches_dir }}{% endif %}
-    --force
+    {%- else %}
+    --config={{ kube_config_dir }}/kubeadm-config.yaml
+    {%- endif -%}
  register: kubeadm_upgrade
-  # Retry is because upload config sometimes fails
-  retries: 3
-  until: kubeadm_upgrade.rc == 0
  when: inventory_hostname != first_kube_control_plane
  failed_when: kubeadm_upgrade.rc != 0 and "field is immutable" not in kubeadm_upgrade.stderr
  environment:
    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
+
+# kubeadm upgrade no longer reconciles ClusterConfiguration and KubeProxyConfiguration changes, this must be done separately after upgrade to ensure the latest config is applied
+- name: Update kubeadm and kubelet configmaps after upgrade
+  command: "{{ bin_dir }}/kubeadm init phase upload-config all --config {{ kube_config_dir }}/kubeadm-config.yaml"
+  register: kubeadm_upload_config
+  # Retry is because upload config sometimes fails
+  retries: 3
+  until: kubeadm_upload_config.rc == 0
+  when:
+  - inventory_hostname == first_kube_control_plane
+
+- name: Update kube-proxy configmap after upgrade
+  command: "{{ bin_dir }}/kubeadm init phase addon kube-proxy --config {{ kube_config_dir }}/kubeadm-config.yaml"
+  register: kube_proxy_upload_config
+  # Retry is because upload config sometimes fails
+  retries: 3
+  until: kube_proxy_upload_config.rc == 0
+  when:
+  - inventory_hostname == first_kube_control_plane
+  - ('addon/kube-proxy' not in kubeadm_init_phases_skip)
+
+- name: Rewrite kubeadm managed etcd static pod manifests with updated configmap
+  command: "{{ bin_dir }}/kubeadm init phase etcd local --config {{ kube_config_dir }}/kubeadm-config.yaml"
+  when:
+  - etcd_deployment_type == "kubeadm"
  notify: Control plane | restart kubelet

+- name: Rewrite kubernetes control plane static pod manifests with updated configmap
+  command: "{{ bin_dir }}/kubeadm init phase control-plane all --config {{ kube_config_dir }}/kubeadm-config.yaml"
+  notify: Control plane | restart kubelet
+
+- name: Flush kubelet handlers
+  meta: flush_handlers
+
+- name: Ensure kube-apiserver is up after upgrade and control plane configuration updates
+  import_tasks: check-api.yml
+
 - name: Kubeadm | Remove binding to anonymous user
  command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
  when: remove_anonymous_access
@@ -60,8 +85,8 @@
    path: "{{ item }}"
    state: absent
  with_items:
-    - /root/.kube/cache
-    - /root/.kube/http-cache
+  - /root/.kube/cache
+  - /root/.kube/http-cache

 # FIXME: https://github.com/kubernetes/kubeadm/issues/1318
 - name: Kubeadm | scale down coredns replicas to 0 if not using coredns dns_mode
@@ -75,6 +100,6 @@
  until: scale_down_coredns is succeeded
  run_once: true
  when:
-    - kubeadm_scale_down_coredns_enabled
-    - dns_mode not in ['coredns', 'coredns_dual']
+  - kubeadm_scale_down_coredns_enabled
+  - dns_mode not in ['coredns', 'coredns_dual']
  changed_when: false
--- a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
+++ b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
@@ -29,6 +29,8 @@ nodeRegistration:
  - name: cloud-provider
    value: external
 {% endif %}
+  imagePullPolicy: {{ k8s_image_pull_policy }}
+  imagePullSerial: {{ kubeadm_image_pull_serial | lower }}
 {% if kubeadm_patches | length > 0 %}
 patches:
  directory: {{ kubeadm_patches_dir }}
@@ -468,6 +470,42 @@ scheduler:
 {% endfor %}
 {% endif %}
 ---
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: UpgradeConfiguration
+apply:
+  kubernetesVersion: {{ kube_version }}
+  allowExperimentalUpgrades: true
+  certificateRenewal: {{ kubeadm_upgrade_auto_cert_renewal | lower }}
+  etcdUpgrade: {{ (etcd_deployment_type == "kubeadm") | lower }}
+  forceUpgrade: true
+{% if kubeadm_ignore_preflight_errors | length > 0 %}
+  ignorePreflightErrors:
+{% for ignore_error in kubeadm_ignore_preflight_errors %}
+  - "{{ ignore_error }}"
+{% endfor %}
+{% endif %}
+{% if kubeadm_patches | length > 0 %}
+  patches:
+    directory: {{ kubeadm_patches_dir }}
+{% endif %}
+  imagePullPolicy: {{ k8s_image_pull_policy }}
+  imagePullSerial: {{ kubeadm_image_pull_serial | lower }}
+node:
+  certificateRenewal: {{ kubeadm_upgrade_auto_cert_renewal | lower }}
+  etcdUpgrade: {{ (etcd_deployment_type == "kubeadm") | lower }}
+{% if kubeadm_ignore_preflight_errors | length > 0 %}
+  ignorePreflightErrors:
+{% for ignore_error in kubeadm_ignore_preflight_errors %}
+  - "{{ ignore_error }}"
+{% endfor %}
+{% endif %}
+{% if kubeadm_patches | length > 0 %}
+  patches:
+    directory: {{ kubeadm_patches_dir }}
+{% endif %}
+  imagePullPolicy: {{ k8s_image_pull_policy }}
+  imagePullSerial: {{ kubeadm_image_pull_serial | lower }}
+---
 apiVersion: kubeproxy.config.k8s.io/v1alpha1
 kind: KubeProxyConfiguration
 bindAddress: {{ kube_proxy_bind_address }}
--- a/roles/kubernetes/control-plane/templates/podsecurity.yaml.j2
+++ b/roles/kubernetes/control-plane/templates/podsecurity.yaml.j2
@@ -1,6 +1,6 @@
-{% if kube_pod_security_use_default %}
 apiVersion: pod-security.admission.config.k8s.io/v1
 kind: PodSecurityConfiguration
+{% if kube_pod_security_use_default %}
 defaults:
  enforce: "{{ kube_pod_security_default_enforce }}"
  enforce-version: "{{ kube_pod_security_default_enforce_version }}"
--- a/roles/kubernetes/kubeadm/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/tasks/main.yml
@@ -86,13 +86,13 @@
    - not kubelet_conf.stat.exists
  vars:
    ignored:
-      - DirAvailable--etc-kubernetes-manifests
+      - "{{ 'DirAvailable--etc-kubernetes-manifests' if 'all' not in kubeadm_ignore_preflight_errors }}"
      - "{{ kubeadm_ignore_preflight_errors }}"
  command: >-
    timeout -k {{ kubeadm_join_timeout }} {{ kubeadm_join_timeout }}
    {{ bin_dir }}/kubeadm join
    --config {{ kube_config_dir }}/kubeadm-client.conf
-    --ignore-preflight-errors={{ ignored | flatten | join(',') }}
+    --ignore-preflight-errors={{ ignored | select | flatten | join(',') }}
    --skip-phases={{ kubeadm_join_phases_skip | join(',') }}

 - name: Update server field in kubelet kubeconfig
--- a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
+++ b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
@@ -185,7 +185,7 @@

 - name: Check external_cloud_provider value
  assert:
-    that: external_cloud_provider in ['hcloud', 'huaweicloud', 'oci', 'openstack', 'vsphere']
+    that: external_cloud_provider in ['hcloud', 'huaweicloud', 'oci', 'openstack', 'vsphere', 'manual']
  when:
    - cloud_provider == 'external'
    - not ignore_assert_errors
--- a/roles/kubespray-defaults/defaults/main/checksums.yml
+++ b/roles/kubespray-defaults/defaults/main/checksums.yml
@@ -26,38 +26,153 @@ crictl_checksums:
    v1.29.0: 2803a1865045077f29f798b9c569e1db7d44b5c329a546a0fd183e906925b99f
 crio_archive_checksums:
  arm:
+    v1.31.6: 0
+    v1.31.5: 0
+    v1.31.4: 0
+    v1.31.3: 0
+    v1.31.2: 0
+    v1.31.1: 0
    v1.31.0: 0
+    v1.30.11: 0
+    v1.30.10: 0
+    v1.30.9: 0
+    v1.30.8: 0
+    v1.30.7: 0
+    v1.30.6: 0
+    v1.30.5: 0
+    v1.30.4: 0
    v1.30.3: 0
    v1.30.2: 0
    v1.30.1: 0
    v1.30.0: 0
+    v1.29.13: 0
+    v1.29.12: 0
+    v1.29.11: 0
+    v1.29.10: 0
+    v1.29.9: 0
+    v1.29.8: 0
+    v1.29.7: 0
+    v1.29.6: 0
+    v1.29.5: 0
+    v1.29.4: 0
+    v1.29.3: 0
    v1.29.2: 0
    v1.29.1: 0
    v1.29.0: 0
  arm64:
+    v1.31.9: 00d651e043db5c7e6844bef84a3f51b60b444587da9a546bf37f87c5c79115be
+    v1.31.8: a6fd3bf8f9d40d51ad806be7246d3d38682cb2071af428404300098ca086afcf
+    v1.31.7: 66c4beb5e331881bec173baf5945b7c1da78fd56479e79b35185c63b05fcd03e
+    v1.31.6: 1a7baa55c495ea2d89d5c27d9ee1b4c1f251e4dba2c0e71c75c2a194cd733081
+    v1.31.5: 8b00fe37779cb7bf4716c600c25bffff3fd175c88e0938e4dc56409791040459
+    v1.31.4: 9b8c89a13c56449acc7b97d06179c1d2cc7276023406fb70d477e1237e5644f2
+    v1.31.3: 150e828420848d7dc4d190c13b313c7033f9a255a6e656e32b98f27ac574daa0
+    v1.31.2: ba0e71699aa7a0e995ac2563b8aee2f2a3358ac120edb8b951e151824f16d5a4
+    v1.31.1: 760d00cecaf1b6bf5a3bfae39daa5e46a74408f7a6869cbb41716a5610a7a18f
    v1.31.0: d54afe0140afde0bed09136bd923d8fb415c9016189e7f1b719565ec84edf737
+    v1.30.13: f9eda79e902660e8dd53231d533e6f4f0feaa6a3fc1b15bb30b8f17e8d9bf93c
+    v1.30.12: 6eee45aae63f56f2bab317b672580e1c7645568b28750bc0a89460d7a48c4ab0
+    v1.30.11: 89e5ec8b441303b08dd18edabf3607564823a62451b2312049e24a38d1f7644c
+    v1.30.10: 2e93a1ee31b3cdeebbd05cf342dcfab5f35a3a654a25ea47963daf185cdf792a
+    v1.30.9: 1d565518cada3d767d87b69b8831384e1f51cbb4909c1a58777b133d954bbe05
+    v1.30.8: 8a1ab4b2589991cba6950a13985aec8d8f4adb16f2d2ed29d9d0e3022e964d12
+    v1.30.7: 5227aad37976a554b8195e99f07fa23d5b4b7abea61f85efcf68ebe8bfd63675
+    v1.30.6: 24183ad2e5b496d8f55c0c9d8dcc960a3ce708105b54e88c0b7789dba7024e67
+    v1.30.5: 61354b4d0d5e4564ef36c92fe4dfef3d38cb1839dcf4987ce52fcd78032dcd0f
+    v1.30.4: 073be5d718657719fee993af005f9b897ecb209e61e3828a8e74c74314b7d8c6
    v1.30.3: 2e47b4b307788b15263256e0e423574c60eec80e17576704df736a7ccc13d7bd
    v1.30.2: 6c0ed1a8a38c65fda45d8b725b8742d247e9f658d8cd6c56baa05bd749b9ccbe
    v1.30.1: 371a6da24dfc7c9e01f29191b36a0629474a37cd8300fa8a36483647a7859b72
    v1.30.0: 7e7c934cebff6433594e4cdc440e1ceb5602741a35d74b2342dac6fb585c3549
+    v1.29.13: 0e3e408dc7ef13e3b16a610e55e5ac0c99fdc51e747eeb8580ce6430ec1bf90b
+    v1.29.12: bf12452a7c64689bb002cc6d81a210a70d3427446a671511d139b084299f5025
+    v1.29.11: d35529e741b9fef2b8a300b7092ec7088cd2f66742ccdff070f984954004401a
+    v1.29.10: 09d91f6482db86a8099bfd63e63a9697268eb62ce88fcc73c3aad75f1aec77cc
+    v1.29.9: 565ea044a20343e3c67062509911c8d1fdd566df7bb451da3c226c5d1773ff11
+    v1.29.8: 1882275a8d4dd5912ed41722a7b08eb69a7dc2bcd842b6b7bef0ef2a13ce4c84
+    v1.29.7: 00818dc12336029475739bdbdb6784f75bf61995235cf4d81d2df23d53ee918d
+    v1.29.6: 55f0d70f0b02d24537c16fe60454d885f88b521fe7541aa2ef9b6da3bd8b59bc
+    v1.29.5: a2e93f5234bbc58117f5f110fe61bbcafd75d17c6efcc33d2ca24057573f6673
+    v1.29.4: 67e65afe0c6a38fea65dce5cc21b5105f37024b7c9399093294fc15272e9c089
+    v1.29.3: dee6983861639dba25097801f7437ec673a894772bc9c23883e99962b1052c40
    v1.29.2: e2ddaeb9d46b6a39057e67f77f5840e79d2226839014d77eb6ef243b88761f7a
    v1.29.1: f7d7ca187b44ec490f4511e32f5a6bdf2d5ff14fb3dd1b452e330d7369e69c29
    v1.29.0: 2bf11aeb85362ce4b25a7d9fc17bbe80659013425430e5efb922b4388031a027
  amd64:
+    v1.31.9: 62f6af6b7b2e22be9d5fa8b396d489ac6e6484f84f94bc24a9d9bac999662d3c
+    v1.31.8: 1730457a0d6cbd9bafe4c4ed33dcfcc843af65b53393d04fb658d42c9ed4d4c5
+    v1.31.7: d97a5e7d282e16d98740d96f72d8d5ea5f0ebd410b6db0357ad8ce0812a08951
+    v1.31.6: 0280c799006946b1073e1f66426f103d479268aeb121bff3f845f279828811b3
+    v1.31.5: 783dcf77f3539e11ef5fa5cdaf5ea259835055471578541b1009b2f5b79fa099
+    v1.31.4: a66cd010f79c627abdd328d098564200272afa0c6148867317dad73feb07cb1b
+    v1.31.3: 9241c5676934b1cba216abcd573361b72b5a88fe0696ada0ff338db7cee77b4b
+    v1.31.2: d035a728c0c3e05e734d69d4a488d7509ac281fa12ae0c228dee257e9da41237
+    v1.31.1: ea51b7db06ca97ecf7a76d0341ca168dca102a21fb14f97b1fc139c8e7fb1d47
    v1.31.0: 3cc88ce3c19b2f9bbdfaa1bd42eea64bd7d5ffac6e714a83abbdea40df9ef8c2
+    v1.30.13: 8a40791ee8be099f861574bfca0908fa1c17f9513c47cb8025c833fe59c6c3c7
+    v1.30.12: 75d9df396c256005b628b1f4e94117e11cca0cedb1394f51aea0fdc8e3e0bd36
+    v1.30.11: 5702f05e0ba49ba06e1e8d41f1113701a0a8cb76f418c924b98401b730ab9426
+    v1.30.10: 747a78355df3d8fe28c877d84bbafd71dfcd645cb69fbccb5afebfeb1c0bca65
+    v1.30.9: 8ef818653159f42da18b9e87e0382a16124ac6037cebdefd46b052a80378e39d
+    v1.30.8: c436fa5a91fe9e808eb1563d0ddac6334902f6ad9ef007a132a974bad56c8c9e
+    v1.30.7: 56c8f0a0d93355264c319da651b2833604c0592678070caf9ebd168a478662e2
+    v1.30.6: 832bd6bd8148a90eb10683ebd0a8399fc00bce5c3b46b8c4b0052806752db26d
+    v1.30.5: 735ee8f838f0ef16dc25658bc2a177d64459e2bf6e8214e1278ca6ce60aa3fb3
+    v1.30.4: 2287cc901c18e67b6496522c46f142d5603445bea9395af163b8af5dca9c0924
    v1.30.3: 622809ec7e21350a3ff7897c7d2cabdf4367b1a5904d346514adc485de3c7172
    v1.30.2: 10be07d2626a093b58a29110e84256029d4c46aeb06a6b41e8bddc30bcfcaa4b
    v1.30.1: 7293f51295d89106e59fe0f83af9599e71fe4f446e1b13c40687ef63ecc1b194
    v1.30.0: c2b189febc9f9cb51f84eecad0da955182e31b98a9f456314546bb83ee2a901a
+    v1.29.13: 5170582aa9922bccb61abda5d26c26b5a0800936ede1325d91ebb7d3bcb896bf
+    v1.29.12: 40b179e8da8fc60809098f900bdca50d81d53737961a1ec671c4926f2d372d3d
+    v1.29.11: 1c8579bab362a78c6707ac0f4131e9fd3d8f75b5d42d892e2bf5d90e5990cc8c
+    v1.29.10: 3b11aee2527de082ab5178fff09502e86fd4c2ce7eb4d1bb22eee926764d0024
+    v1.29.9: aa89a16ade96b00d422f138ae9420147087225bbb07524f11064464f9aed0e37
+    v1.29.8: fad2d486ad5827a5018c75e61ad0937289006eaa87c5602f49423effb924c7eb
+    v1.29.7: edf0d2aa9d60c65e49b80c0a5a51baba8d2aa89acf49d4a793cec4f4211581a4
+    v1.29.6: 542d2956b61198a64057669389c06db21740542d2e41fd9137798e2940763ab3
+    v1.29.5: 2e9f4b4e371859d5dc8392db3fe5d21b2fc605acb3ca2e5b43224fda9cc80f70
+    v1.29.4: 9b4bc62976c5965de16121c2e2cfdf72647bd87d1a5ae84c180bb3e449569b4e
+    v1.29.3: b31d0acd759042b32eb7de9ea556c52fca7f47b29eb31ed858b9f99f7162c6fd
    v1.29.2: 55e71ef1bceb1cd9490ec85fdbfc889d3f3a9dd2ef3b8954dcbcf33cb6609167
    v1.29.1: 127ca9f57c2a3ad44dde2e64e0ec94169886245dffb74c12e68eedc80756c260
    v1.29.0: 79c161d8db8ee7f0f4807d6232283d481ef0c20c514b61289238258f66734ac6
  ppc64le:
+    v1.31.9: 722420b92513c87c6ca28a12e9e9c40a7871f53fa6c841b1d972b24b03adee2c
+    v1.31.8: 1b6f60c58766e1c2bab2e60c10060494500747dd0965e70072367a86182dd8b4
+    v1.31.7: 1a2d82271ec5f4c7b4ee9c9eae6e83c62da57928a54de01f47b7f773a2dc20df
+    v1.31.6: 416afcda1d8bf1e616043942c2c2fe4ccd92f10c829199527ac69c76b93ec44a
+    v1.31.5: 88acc92f1c8094ca1772246b56b29ac243c3a56184479620ff3c7103fe9e64df
+    v1.31.4: 4ac60d4585752ce53fa7484e49d458d86fafe76ead8e8b2b8c690135331dba28
+    v1.31.3: 0ce44aab3645256ac68840e54aa9720ac559c4b877e1566829b4c4b193999b75
+    v1.31.2: 57596bb63aef508e86f3b41672816f02a6dee3b1a71ce472756d2c7aed836407
+    v1.31.1: 94b3b1b8cebd3a3b3483cbefd11826fadaa240302c4b61f98c29bd2bf3dd72ee
    v1.31.0: 46d901644f86d25dd62f12c16bd88cf26a0b9c400405f571fc5b68abdfefad95
+    v1.30.13: 6ec25c7429b1adb0b9803d5d454c96b2a932f4c0f505f4d7cdf6a590d0f5ab46
+    v1.30.12: 3a674ba6434d5be13969c2031efc4ce839b2cc2ebeb046f71a78289a7d99dd89
+    v1.30.11: 007e8c9f9a509b028233239464de160948015922beb8063b7775fe5f47c83fe9
+    v1.30.10: 39a0fd5837bf644d7ef6a4cc672eff0138c812c620aca44237863ba22a349823
+    v1.30.9: 4bbdcd6cad45fa7bdf6f5be95916f45fd3ce9bc8d5cc891406507b7d643d2eb6
+    v1.30.8: 08a2103e599be9842d3e0cc3b8e360cdf2e39eb8e0dbfa9541cd89671d43ce35
+    v1.30.7: 252313742fa133671546f7e32275e77a860b885d0749b1dd24dfdb5d1560d709
+    v1.30.6: bf4ba36ffa339050b3e29683c17dbe113c7d5c9b7787c3277e21fd5422079dd8
+    v1.30.5: 3673325249cbf7d55a29fc3198d34449b523bb0ebc7e4b8a842966b633fe8549
+    v1.30.4: 12d269043f8b8ba691c2ca9a1b6aa0ca428922d179a0fe6bf50027d2f1e31535
    v1.30.3: 44ed039a1c0c492b14212bbe59c63fe804e3cc525102f47475a5bc0ffd08f4e8
    v1.30.2: 19169b1ef3324c749a0b0105b47288c0ef4949964b340c85229d00234e6148a1
    v1.30.1: e6fb05de749a06316d046e46f8ff4345a413264e63f63dc9e3f1db2cb8a7c962
    v1.30.0: e6fe5c39fa7b7cf8167bb59b94dc9028f8def0c4fec4c1c9028ec4b84da6c53a
+    v1.29.13: 370d4683784186f4d7af64d94f40b20ec7c0125151459e965494d5c5c0afcc4b
+    v1.29.12: ff4e07ef762adb503e8caae5be592238b40d585cf74db371b51bd5828c020f27
+    v1.29.11: 64d1398809028f25e30ed905eea233e4e61212a8219ed3e9b39e82feb84a35b0
+    v1.29.10: 1231ce9fbb811c131b9d992b55f5af5f3d9b3d816570051d8edd0ec15119d4ae
+    v1.29.9: fafa18bf54b8539601746b03a6ea07956c5309aac0502b42880775ebddfdc942
+    v1.29.8: dd0fb949748299f9d49d7809a52f62e07b61a5c969e2dc0a02df7add35d9e3f2
+    v1.29.7: 812f45ce36b220b5ff09d55da0b070368c748f06cf5d0f3874cb164606ec87b0
+    v1.29.6: e0da2856e2d34997c128e93e1f217fbff4f87f4597455db70aae097b413fb503
+    v1.29.5: c11a1f3a3ed8a4a157b97d26eb9ba17d29c24dca67d3128507d319598989b880
+    v1.29.4: 290d03d1de4e39a77928d0e073131ee093238faf5e79787229a73c068379c4c2
+    v1.29.3: d962577de46d01e7c4e428d197f142f198ed713988579968b923e658db86723a
    v1.29.2: 6577d1476124bcd6bcfd25419bb0d1dc01585dc6e8246a986a7769ad2af407fa
    v1.29.1: e26613e038d48271ad83877e5db5ad6f2116181d202495de849d378ab4a76062
    v1.29.0: 8adddaf6cf0ed2905820dc162ca5ef541baa7b251368ee00c75435a872a886fb
@@ -65,9 +180,19 @@ crio_archive_checksums:
 # Kubernetes versions above Kubespray's current target version are untested and should be used with caution.
 kubelet_checksums:
  arm:
+    v1.31.7: 0
+    v1.31.6: 0
+    v1.31.5: 0
+    v1.31.4: 0
+    v1.31.3: 0
    v1.31.2: 0
    v1.31.1: 0
    v1.31.0: 0
+    v1.30.11: 0
+    v1.30.10: 0
+    v1.30.9: 0
+    v1.30.8: 0
+    v1.30.7: 0
    v1.30.6: 0
    v1.30.5: 0
    v1.30.4: 0
@@ -87,11 +212,21 @@ kubelet_checksums:
    v1.29.1: 0
    v1.29.0: 0
  arm64:
+    v1.31.9: 2debf321e74f430c3832e2426766271f4d51e54927e6ad4be0235d31453dace6
+    v1.31.8: c071aa506071db5f03a03ea3f406b4250359b08b7ae10eeee3cfb3da05411925
+    v1.31.7: c6624e9e0bbf31334893f991f9a85c7018d8073c32147f421f6338bc92ac6f33
+    v1.31.6: 79b2bae5f578bae643e44ae1a40c834221983ac8e695c82aad79f2dc96c50ada
+    v1.31.5: 922a96405fdc3ae41e403565d06c5a6c3b733b0c3d0d1d61086b39c6760103d3
    v1.31.4: fb6f02f3324a72307acc11998eb5b1c3778167ae165c98f9d49bd011498e72f8
    v1.31.3: 0ec590052f2d1cee158a789d705ca931cbc2556ceed364c4ad754fd36c61be28
    v1.31.2: 118e1b0e85357a81557f9264521c083708f295d7c5f954a4113500fd1afca8f8
    v1.31.1: fbd98311e96b9dcdd73d1688760d410cc70aefce26272ff2f20eef51a7c0d1da
    v1.31.0: b310da449a9d2f8b928cab5ca12a6772617ba421023894e061ca2647e6d9f1c3
+    v1.30.13: 673ffbf0c84814a0625fef0d4e44647ec7cf3786ab839729d2d03782559b3cdf
+    v1.30.12: 0d280ebaa41b7d4c34977f131cf9cda663db94c3ae33d5613b1729a02b3bedd7
+    v1.30.11: 2ead74deda3ae5ab2fac1e1476d5b4c81ad73cf6383c279b5781513b98e43f39
+    v1.30.10: 497d403610fda7ff4fefa1c5c467a5fe9efbc3b3368ecd40542ef1e22eff88ca
+    v1.30.9: f12aa046f04ec3d0fb2af90b7ff15a8012ffd6d362286f96d2f462bd4f85cfaa
    v1.30.8: fdda0047c8c6a59956db72c781705eb705018d00ba594afffdb15ef630f81e28
    v1.30.7: cb9d916c3c3332a400b42271be342728d5660a4b78dfaaf7819db8a58cb4caa4
    v1.30.6: a35e5ab0701b84c03c5cffb142e5de78dc3a5a4af9ba503a6eb3bf8944ded26d
@@ -101,6 +236,9 @@ kubelet_checksums:
    v1.30.2: 72ceb082311b42032827a936f80cd2437b8eee03053d05dbe36ba48585febfb8
    v1.30.1: c45049b829af876588ec1a30def3884ce77c2c175cd77485d49c78d2064a38fb
    v1.30.0: fa887647422d34f3c7cc5b30fefcf97084d2c3277eff237c5808685ba8e4b15a
+    v1.29.15: 6bba172d4712fd3d01c6df319db7752a57b47aeea1856b23b3d65a0122a346ce
+    v1.29.14: 330be54c1ac4feccadd2c05bb2644de7f7b558db1af869ea1bec0ead3f04eccc
+    v1.29.13: 34de59f4a38b56170c9d676453389b7782c4ab6c89b908f090598667c165673d
    v1.29.12: 92237be83840bf8dd2318cb281ce309e907e0b665cac6b7629a5fa43a11ae606
    v1.29.11: c0d0a26a4e0c2e0ec00a26afe7cd0b667bd52c6b2629314a9a93164e02f8f69a
    v1.29.10: 1c750d983e3d2fddeb829d1b9bdcf83c7d81e6f9cf7e1b50ccd9daad47807915
@@ -115,11 +253,21 @@ kubelet_checksums:
    v1.29.1: e46417ab1ceae995f0e00d4177959a36ed34b807829422bc9dda70b263fe5c5d
    v1.29.0: 0e0e4544c2a0a3475529154b7534d0d58683466efa04a2bb2e763b476db0bb16
  amd64:
+    v1.31.9: 4e5e2bce4e80575a253654877f0156393d79647a36afb784da27f3ddef446456
+    v1.31.8: 02697f8d14fc36089954380730f300df78b63dada1dc6f52d8e60bd5ce217d48
+    v1.31.7: 279e766a1a7c0dce2efae452c9de1e52b169df31c4b75c9d3b7d51f767ae6d42
+    v1.31.6: ea50176095dd4650f6b270c79cf6d30deaaeb96ffa7d1eaac6924428cc9d2486
+    v1.31.5: 4fdedf2b6e3e8c4976c3cd000edf9ae61c94f0d6024ffe8b06bae6218ff2c94e
    v1.31.4: 9062fbb2b6054ecab07b9e841b0a49ab4acc224860b01c218d01ba95017c5e49
    v1.31.3: a5c9e871541251db15436fc307d945217e160d12920730070417ba8037e090df
    v1.31.2: b0de6290267bbb4f6bcd9c4d50bb331e335f8dc47653644ae278844bb04c1fb6
    v1.31.1: 50619fff95bdd7e690c049cc083f495ae0e7c66d0cdf6a8bcad298af5fe28438
    v1.31.0: 39e7f1c61c8389ea7680690f8bd5dd733672fa16875ae598df0fd8c205df57a9
+    v1.30.13: b8d8c3cc0c13b2e42c1d83ab6c03024825bc01887c923fd6f8568ebe066ec28e
+    v1.30.12: aab260aa88dd27f785bdb64e7e5be0173bcd1a871d0fa84d5dc7736469f7c395
+    v1.30.11: 59177fc92e2b2bb988f7d8d39682ea9e3d9d883273c9c8b51b39502d9b965431
+    v1.30.10: 0c7aa1db3fa339aa13af0f825d25a76b3c74f785d4fcd49d6a0bc5a96f0971f0
+    v1.30.9: 59c61c8018686bb58be96481f8aa3abe42bba9f791c6dd3c9d4a2ed697187e5b
    v1.30.8: 7b5191dfed6a27faadefebdc4a3b602b9a76adfc58fd04c50307f1377eabc590
    v1.30.7: 4b2fb90661e2b7be8b34b5bd405652590f6351a9f55194430fa16d547a7c9d16
    v1.30.6: 9d5585448bc34d37f70171c282febaa10d32687bfee4f8e4467c1bf149674d50
@@ -129,6 +277,9 @@ kubelet_checksums:
    v1.30.2: 6923abe67ef069afca61c71c585023840426e802b198298055af3a82e11a4e52
    v1.30.1: 87bd6e5de9c0769c605da5fedb77a35c8b764e3bda1632447883c935dcf219d3
    v1.30.0: 32a32ec3d7e7f8b2648c9dd503ce9ef63b4af1d1677f5b5aed7846fb02d66f18
+    v1.29.15: cd0228a5820f98bbb6371344e5d6645f6486d767c30f927a1d0ec8d17eca4da5
+    v1.29.14: b165ecf4e9a5f4f396d8a8a3563257d552946285d45dac0ccbe8b73435554dc5
+    v1.29.13: ed89d8cdf60b14aae2aa665f8c1e3fc3e868ccc511c8ef5916f55c8cbd5ec772
    v1.29.12: 45475d908f6c44bfbf994fec91a4d5ceebf41d93c9f3867e687b2fa67b57b5b0
    v1.29.11: 1aaa9025cceac0c9a4df295a58aa79d8932a5b13a43c8910412c9ef970c42d21
    v1.29.10: 4cc094062cd1cff49ca551208635669ab86e3982d38e8d0a77ab833a941ff708
@@ -143,11 +294,21 @@ kubelet_checksums:
    v1.29.1: 1b1975c58d38be1a99a8bcba4564ac489afd223b0abe9f2ab08bbde89d2412a3
    v1.29.0: e1c38137db8d8777eed8813646b59bf4d22d19b9011ab11dc28e2e34f6b80a05
  ppc64le:
+    v1.31.9: 53410497c9abf3355c89997654f0e1f189084888dc56a57199c6ed1c4e3cb61c
+    v1.31.8: 925bc404df4a54fed659db28e5bc55b5e4b6707f60d8aa26660b2a20f65a804c
+    v1.31.7: 159be13904091020c2be08a22155f3d3a2e22a0d31d96ceabfa84cabe1dbb6f7
+    v1.31.6: 910a4cfc99e18d6065a4d8abcd678559d278797a5de2110050cc75931b000d8f
+    v1.31.5: d8b7f6d4dbcab95ffd7914f4888beae24e937848822748f20f458db4148c5c40
    v1.31.4: 184154c5aa25539cf0547bbcde6d8bee7b8e05984f28da8c996a513787eef8ed
    v1.31.3: 46bd2fcd44ce9ec2a77009ae8248a3fd652305e9866c562b01524a99b18cda7a
    v1.31.2: b7eb859eaa5494273c587b0dcbb75a5a27251df5e140087de542cb7e358d79b1
    v1.31.1: 5b9e8de02f797991670c3f16fa7e46edc7e862644bfa376573c2fca2eaf01519
    v1.31.0: b347b96dd79d3ac09e490669b38c5c2a49b5d73cf82cb619a1c54c6e0a165dbb
+    v1.30.13: 94ce01e6628f8339a9ff06f13e37298bbd2aedbcb3e37e7943ed8d90fd55e91d
+    v1.30.12: b49ce79bbaedb9d40805be5f6968c6c9ee9a711dde9fc01831cd257dea7ae8a9
+    v1.30.11: c9f778480278a4bda2c81cdeec7b2bab9c969299054f9e27234359fd5b80d6f3
+    v1.30.10: e2061a23cac69937ab2454fc9f870f6e5cad4debe668e81389fd4a7fde36d3dd
+    v1.30.9: 111084f90946dd1b191e77237d56871564b0ed4e91ae85ad9fce8b1cb81c1aaf
    v1.30.8: ef3bc0239b9adbbe33ba024c93a1496a1359faa745b0dd16f7e1b8e42a015c2e
    v1.30.7: 76c7b73c15baf9b07df36ff39e15ec8e144258900d78bbd9501c6239dacf0d33
    v1.30.6: a4641d919d28f4a46e6049862a1de5449b009cfa8ee84066451b94374442ba29
@@ -157,6 +318,9 @@ kubelet_checksums:
    v1.30.2: 268dfbb7ee3abcb8ff9fd0a88f81204e40dd33d177f7878941c9ff6b7cca0474
    v1.30.1: 1ac58eae0aa02fefad47d2318bfa5846ae0d7d11a5b691850cd86b2b614ceffe
    v1.30.0: 8d4aa6b10bcddae9a7c754492743cfea88c1c6a4628cab98cdd29bb18d505d03
+    v1.29.15: 761077857ccc67d81dff5147ed3deb4f38275adf0fe867c848cabc30a8fe5d76
+    v1.29.14: f3cd59fbd2f289f0e181892049227196556ef95bb18dcbb02eaeb5fbc551ddd3
+    v1.29.13: b938aa771a9ffa2925328d1d52b9e4f7f22c04f373cc330593cd76efc985de21
    v1.29.12: 77cfe8af37201bb6ab1173c90eded7c8bbc264a731c189a43db6336ca89b8930
    v1.29.11: aaf4384f7c2c7c2cb734480394a159ff51bba59b5b0db310f2fc15d2c762a3a1
    v1.29.10: fbe2c747416ae82690cb255d1122266fd251d182a409e6b6c99a03836254efe1
@@ -172,11 +336,21 @@ kubelet_checksums:
    v1.29.0: 67f09f866d3e4aee8211ce9887ec8bc427b188474a882a7af999fc0fee939028
 kubectl_checksums:
  arm:
+    v1.31.9: 54e560eb3ad4b2b0ae95d79d71b2816dfa154b33758e49f2583bec0980f19861
+    v1.31.8: 65fdd04f5171e44620cc4e0b9e0763b1b3d10b2b15c1f7f99b549d36482015d4
+    v1.31.7: 870d919f8ef5f5c608bd69c57893937910de6a8ed2c077fc4f0945375f61734d
+    v1.31.6: b370a552cd6c9bb5fc42e4e9031b74f35da332f27b585760bacb0d3189d8634d
+    v1.31.5: cbb4e470751ef8864ade9d008e848f691ac6cbdee320539797a68a5512b9f7f8
    v1.31.4: 055d1672f63fda86c6dfa5a2354d627f908f68bde6bf8394fdc9a99cadc4de19
    v1.31.3: e0d00fbac98e67b774ff1ed9a0e6fc5be5c1f08cc69b0c8b483904ed15ad8c50
    v1.31.2: f2a638bdaa4764e82259ed1548ce2c86056e33a3d09147f7f0c2d4ee5b5e300c
    v1.31.1: 51b178c9362a4fbe35644399f113d7f904d306261953a51c5c0a57676e209fa6
    v1.31.0: a4d6292c88c199688a03ea211bea08c8ae29f1794f5deeeef46862088d124baa
+    v1.30.13: da7f49225c9c10f69371e5f351ea3049e3561cf02e92c31e72ee46d8575e8c1a
+    v1.30.12: b8a5de1e9abc5c154fb466dd19758edd149cbea05ac4dfd64ba1f82461745f6f
+    v1.30.11: ef419b7376850d2ca47413f15d6c94eeefb393ae648c9fb739e931da179adf06
+    v1.30.10: 71dc80f99598d9571191e7b5dc52b4c426da960426b3d62e644b173b50a4c2f2
+    v1.30.9: 8a629ebd72611351487b2f6ba3ed380772779594db1e7aa35e112a6d277238cd
    v1.30.8: ef0985c6915c2c23407a2a15dbfe5af71c397178a66afdc8e0e60c5b892c4e99
    v1.30.7: 4e3df1c0cd7e1895467525483a213e8f0f37a778c0cbf485e7a62eeb76c73d0e
    v1.30.6: 20ca85ccceb5f6539a3075d6faaec8bfc6f6351984e59cbe14f00c1b96c57bab
@@ -186,6 +360,9 @@ kubectl_checksums:
    v1.30.2: 2dab982920d87bc9a17c539bfa4f94b758afc454bb044029dee06144e8dbee08
    v1.30.1: b05c4c4b1c440e8797445b8b15e9f4a00010f1365533a2420b9e68428da19d89
    v1.30.0: ff54e96c73f4b87d740768f77edada7df8f2003f278d3c79bbbaa047b1fc708d
+    v1.29.15: 6c3328d118e1a0675a7b5b8b30846b6e573c6b76c55f7035cee9c9e8a26e9920
+    v1.29.14: 9a8ff199ba37c50693235b039572d8e6f6562d8ea0fc00a5ede232d941227042
+    v1.29.13: 9f121880d0dd1ab5f37f5d193237016cc63c74fb2945391d2224708d11bc1464
    v1.29.12: 64e736bd7e6fdbad029ba20a3c2f0a97a26ecea90ec2bd7d2d02c9c46f587daa
    v1.29.11: 3ee9c2a1d5de61cd2cb90440533af91b80f079db9288e697a8fc643a9ba241aa
    v1.29.10: 5062cab3e174a98d5a6d44f31a0055caa4f98f48839687b5742f086315bdbb58
@@ -200,11 +377,21 @@ kubectl_checksums:
    v1.29.1: a4b478cc0e9adaab0c5bb3627c20c5228ea0fe2aeff9e805d611eb3edb761972
    v1.29.0: a2388eb458d07ec734e4fa02fd0147456a1922a7d6b8e67a32db9d64a4d7621c
  arm64:
+    v1.31.9: 1e6de599df408824f13602d73333c08c3528cfa5d6c8c98c633868a966882129
+    v1.31.8: bd76445943b22d976bdbd1d0709e4bcb5f0081cc02c10139f4b3e5e209dc3019
+    v1.31.7: d95454093057af230f09e7b73ee9ae0714cf9e5197fbcb7b902881ca47b7e249
+    v1.31.6: fc40a8bbdba41f022aced2dec729a1b9e937ad99872b430b6c2489f1f36a61f5
+    v1.31.5: 697c8b4239f9e53cba46296e114bcc02c726b5c7a45e1c464804aad56e5c7a86
    v1.31.4: b97e93c20e3be4b8c8fa1235a41b4d77d4f2022ed3d899230dbbbbd43d26f872
    v1.31.3: a3953ad2b32eca0b429249a5fbdf4f8ef7d57223c45cc0401fd80fd12c7b9071
    v1.31.2: bb9fd6e5a92c2e2378954a2f1a8b4ccb2e8ba5a3635f870c3f306a53b359f971
    v1.31.1: 3af2451191e27ecd4ac46bb7f945f76b71e934d54604ca3ffc7fe6f5dd123edb
    v1.31.0: f42832db7d77897514639c6df38214a6d8ae1262ee34943364ec1ffaee6c009c
+    v1.30.13: afed1753b98ab30812203cb469e013082b25502c864f2889e8a0474aac497064
+    v1.30.12: 1af7e16a143c283a29821a09f5a006aacf0fe8368bc18adbd40588ba395e0352
+    v1.30.11: 11f86b29416f344b090c2581df4bc8a98ed7cc14a2bb28e46a6d4aa708af19f4
+    v1.30.10: 9d65d54f02b0b305d9f3f89d19a60d3e130e09f5407df99f6d48f8c10f31e2ae
+    v1.30.9: bab82f333f6347507a4c725bc726fefd3d862eb64a36a4fb8b99bfe9e10813d0
    v1.30.8: e51d6a76fade0871a9143b64dc62a5ff44f369aa6cb4b04967d93798bf39d15b
    v1.30.7: 5e856defeac209ff82dd473ce46f91a3118df82b863de0d2ed59bdf3558cffca
    v1.30.6: 0b448581f05f46d80219d1a73bd1966de09066c313f64e67e7b75b35e07191cd
@@ -214,6 +401,9 @@ kubectl_checksums:
    v1.30.2: 56becf07105fbacd2b70f87f3f696cfbed226cb48d6d89ed7f65ba4acae3f2f8
    v1.30.1: d90446719b815e3abfe7b2c46ddf8b3fda17599f03ab370d6e47b1580c0e869e
    v1.30.0: 669af0cf520757298ea60a8b6eb6b719ba443a9c7d35f36d3fb2fd7513e8c7d2
+    v1.29.15: a41984dc0ff34ee05f1283ebd9b3121c003b3469b97214738246faa5b6788f7c
+    v1.29.14: 03c95785fc0325896eb8540b9a1447ccc89b1f1721b7594012e4f32a719d8e0a
+    v1.29.13: 92a08a9e74efd81be46c9138fce597ab8827e18479fe5cc9c4065659d6464cf1
    v1.29.12: 1cf2c00bb4f5ee6df69678e95af8ba9a4d4b1050ddefb0ae9d84b5c6f6c0e817
    v1.29.11: d0fcb8ead20f45ffab2d680b84a93c8e459b2c7c1d6dadf566769cf59f04c506
    v1.29.10: 4cfa950fbd354bdc655cc425494aa77fe81710bc8f7d3f95285338aac223cc82
@@ -228,11 +418,21 @@ kubectl_checksums:
    v1.29.1: 96d6dc7b2bdcd344ce58d17631c452225de5bbf59b83fd3c89c33c6298fb5d8b
    v1.29.0: 8f7a4bd6bae900a4ddab12bd1399aa652c0d59ea508f39b910e111d248893ff7
  amd64:
+    v1.31.9: 720d31a15368ad56993c127a7d4fa2688a8520029c2e6be86b1a877ad6f92624
+    v1.31.8: be0aa44a50a9aada4e9402e361ffb0d5bb1fd4f6950751399fcaf3b8b936a746
+    v1.31.7: 80a3c83f00241cd402bc8688464e5e3eedd52a461ee41d882f19cf04ad6d0379
+    v1.31.6: c46b2f5b0027e919299d1eca073ebf13a4c5c0528dd854fc71a5b93396c9fa9d
+    v1.31.5: fbecbfd375b3686002c2e81d51c390172f5ffba3d6b47920d55342cb03f557af
    v1.31.4: 298e19e9c6c17199011404278f0ff8168a7eca4217edad9097af577023a5620f
    v1.31.3: 981f6b49577068bc174275184d8ee7105d8e54f40733792c519cd85023984c0f
    v1.31.2: 399e9d1995da80b64d2ef3606c1a239018660d8b35209fba3f7b0bc11c631c68
    v1.31.1: 57b514a7facce4ee62c93b8dc21fda8cf62ef3fed22e44ffc9d167eab843b2ae
    v1.31.0: 7c27adc64a84d1c0cc3dcf7bf4b6e916cc00f3f576a2dbac51b318d926032437
+    v1.30.13: b92bd89b27386b671841d5970b926b645c2ae44e5ca0663cff0f1c836a1530ee
+    v1.30.12: 261a3c4eb12e09207b9e08f0b43d547220569317ed8d7a22638572100ace5b80
+    v1.30.11: 228a8b2679f84de9192a1ac5ad527c9ab73b0f76c452ed74f11da812bbcfaa42
+    v1.30.10: bc74dbeefd4b9d53f03016f6778f3ffc9a72ef4ca7b7c80fd5dc1a41d52dcab7
+    v1.30.9: d77041f285d9237c4aa451370c3ec6e5c042007dbb55c894f0a179b1d149bf32
    v1.30.8: 7f39bdcf768ce4b8c1428894c70c49c8b4d2eee52f3606eb02f5f7d10f66d692
    v1.30.7: 3950ec7b81b9aa5a3856dd6155e42e1ad12a2fa8b050502f5a9652050f94a8ee
    v1.30.6: 7a3adf80ca74b1b2afdfc7f4570f0005ca03c2812367ffb6ee2f731d66e45e61
@@ -242,6 +442,9 @@ kubectl_checksums:
    v1.30.2: c6e9c45ce3f82c90663e3c30db3b27c167e8b19d83ed4048b61c1013f6a7c66e
    v1.30.1: 5b86f0b06e1a5ba6f8f00e2b01e8ed39407729c4990aeda961f83a586f975e8a
    v1.30.0: 7c3807c0f5c1b30110a2ff1e55da1d112a6d0096201f1beb81b269f582b5d1c5
+    v1.29.15: 3473e14c7b024a6e5403c6401b273b3faff8e5b1fed022d633815eb3168e4516
+    v1.29.14: a4902c8a454a3678d589b51d95d810ec84791c03ed6b5779969df559c9c0357e
+    v1.29.13: 9f4cba9b3e12a3fd7fa99dee651d7293281333469852a8e755a1210d5b128b8d
    v1.29.12: 35fc028853e6f5299a53f22ab58273ea2d882c0f261ead0a2eed5b844b12dbfb
    v1.29.11: 14d7ea4ada60ff15ef3b7734a83c4d05cff164d4843b6f4c081a50b86547c17d
    v1.29.10: 24f2f09a635d36b2ce36eaebf191326e2b25097eec541a3e47fee6726ef06cef
@@ -256,11 +459,21 @@ kubectl_checksums:
    v1.29.1: 69ab3a931e826bf7ac14d38ba7ca637d66a6fcb1ca0e3333a2cafdf15482af9f
    v1.29.0: 0e03ab096163f61ab610b33f37f55709d3af8e16e4dcc1eb682882ef80f96fd5
  ppc64le:
+    v1.31.9: 4a2786e8f5dcc2acc3820795811289d5a8e80ff34b5e311ac226af389236da94
+    v1.31.8: 4cc6503cecca4a385362392dc9b350837cd00a654ffc7ad424cc30ebf04c3fab
+    v1.31.7: c00f6aca4ef62dac55b2e7e818c7907704ea96b72ff4861303ee1b5ac4a1158f
+    v1.31.6: 678d2299674c20414d83224caad9c4b8290105c2962c911ec90a2e661777e3aa
+    v1.31.5: 5d00492e969cfd8a4389fec4f23832321856c1aab0387d255cfb66a1b1bdbe26
    v1.31.4: 5089625fc8f4dc7082c6e0186a839c8d4e791ad15bcbbc586d4839f25f12a3df
    v1.31.3: a5855c5fb02cc40c68eee603f08a5c5bcf86d85e6c9e757f450d4fd6138e89d4
    v1.31.2: 3a9405b1f8f606f282abb03bf3f926d160be454c21b3867505f15ad2123d4139
    v1.31.1: 635275e4b207902bc6dda29de898e5152229271c46cb9613340e36c3abc2cb67
    v1.31.0: 92393bc295423429522fa8c49724f95f31fa9bf20062d2c123e928d08886c95d
+    v1.30.13: 48a0287fb9d7b35bc2b7095976fcaf57225e9d3ae3d5c9c0165219f8d0ba39e9
+    v1.30.12: d6434d10b4347cfe1aa93092bc8dd89a9ef0dd40e85b5aba7a705facfbff103f
+    v1.30.11: d3de093b8b4c791aa171ad895c44fd738aa5b30135e4c7ee78ee6ac59b2967f2
+    v1.30.10: 1bd3adfcb66189575817e7e0149ecb1b6fc157bf06763232ed8d360df8ff29ab
+    v1.30.9: 4a45bb72eedbadad75a543d99ce388f9125220e36eef6ec42adfdc2dbc959611
    v1.30.8: 76b7ecd7212c939271493204c726e8e7ea56ac748005c901bec3f6598ee479e0
    v1.30.7: 7992f401b75399ea8a1ded372badf75da643835f0fe4645f0668c3720006a3cd
    v1.30.6: 54ae05b59c52edea26e1d4009b5e469be96d582ddbe388f33d3b07a66caf7ac8
@@ -270,6 +483,9 @@ kubectl_checksums:
    v1.30.2: 738bc1bad45df79fc4313d167a68ed5a1cf747f1f94e4434f0733e3126989f2e
    v1.30.1: ef01ae21e91600469db3df01172144fac6c61083e7d3282bef72ce732d76d0d8
    v1.30.0: f8a9eac6e12bc8ab7debe6c197d6536f5b3a9f199e8837afd8e4405291351811
+    v1.29.15: 11d0c6721246dbe32023f10a3ed44d1adeb9133440518b33723400a5cc6a1b9d
+    v1.29.14: 69db159873a86aed5916ebfd68a0768c5dd1ed65666b48fc0dd7ca1eb7b4eb81
+    v1.29.13: 718a14f85f47ebe3505e18309ac7876f29ca4551761b42450bb7a1c273635a79
    v1.29.12: 439ebbe9d1710cccfeb3fe1fede02cffbee68c2f3ff1af17d25ada49620af1ba
    v1.29.11: 6f9a43ae26afac5ab2e5d7fb6db21bd99187ca35f5eca909dd4e05137c6151a5
    v1.29.10: 306973163a10c01a76ebab384b0e900b3293b4f6cc935dfd517f0bb69399be54
@@ -285,9 +501,19 @@ kubectl_checksums:
    v1.29.0: ea926d8cf25e2ce982ff5c375da32b51ccbd122b721b1bc4a32f52a9a0d073ab
 kubeadm_checksums:
  arm:
+    v1.31.7: 0
+    v1.31.6: 0
+    v1.31.5: 0
+    v1.31.4: 0
+    v1.31.3: 0
    v1.31.2: 0
    v1.31.1: 0
    v1.31.0: 0
+    v1.30.11: 0
+    v1.30.10: 0
+    v1.30.9: 0
+    v1.30.8: 0
+    v1.30.7: 0
    v1.30.6: 0
    v1.30.5: 0
    v1.30.4: 0
@@ -307,11 +533,21 @@ kubeadm_checksums:
    v1.29.1: 0
    v1.29.0: 0
  arm64:
+    v1.31.9: d8f5dbb17ce2dead6aedcc700e4293a9395e246079fcdc1772ab9e5cbfeca906
+    v1.31.8: d0d1a6634e397e4f14b1e5f9b4bd55758ea70bfc114728730d25d563952e453e
+    v1.31.7: 3f95765db3b9ebb0cf2ff213ac3b42a831dd995a48d9a6b1d544137d3f2c3018
+    v1.31.6: 03b6df27c630f6137be129d2cef49dc4da12077381af8d234a92e451ba2a16d2
+    v1.31.5: 971904ff1ac2879d968cac1d4865b7c0ce0d9374506bd17bd0b123981803769b
    v1.31.4: 4598c2f0c69e60feb47a070376da358f16efe0e1403c6aca97fa8f7ab1d0e7c0
    v1.31.3: 8113900524bd1c8b3ce0b3ece0d37f96291cbf359946afae58a596319a5575c8
    v1.31.2: 0f9d231569b3195504f8458415e9b3080e23fb6a749fe7752abfc7a2884efadf
    v1.31.1: 66195cd53cda3c73c9ae5e49a1352c710c0ea9ce244bbdeb68b917d809f0ea78
    v1.31.0: dbeb84862d844d58f67ad6be64021681a314cda162a04e6047f376f2a9ad0226
+    v1.30.13: 53a256e2ff51d51079e73c5856acfe4c2b1b71ea614aee3e832cf0a72b45fc71
+    v1.30.12: 7abc2db71e0ab3c7c30546851d254542f2c6778d4022437a47a1d48bd722a5d1
+    v1.30.11: 644f70389d6f5186685a2d94c0221b55a280a9ec14bd3f3609f008d9244c70e8
+    v1.30.10: 1dfba299e19ce4b1e605d39604b898c723274eba51495bd8547732a35b90a8c1
+    v1.30.9: e6363fd0da7ff38d1dd26cf661cb925efe5579bc52dd5db351d7f0b9657ab27e
    v1.30.8: 7bca884b54e2c3988e81250f8eba6a49d718994dd7fe67d14905cb65dcec8b56
    v1.30.7: 3684d219d3398964038d87bf609266149cd898d810a52d21a4a6534f8a187ba8
    v1.30.6: 6206938156e079d1c3031ba9a291e720c9f04031492753759b93bc3b67b3390b
@@ -321,6 +557,9 @@ kubeadm_checksums:
    v1.30.2: 7268762b7afd44bf07619985dd52c376b63e47d73b8f9a3b08cc49624a8fbd55
    v1.30.1: bda423cb4b9d056f99a2ef116bdf227fadbc1c3309fa3d76da571427a7f41478
    v1.30.0: c36afd28921303e6db8e58274de16c60a80a1e75030fc3c4e9c4ed6249b6b696
+    v1.29.15: 5f34cc54cf72426d05f9f10015446fb02dfc8c60c15f4dd8a80eff07d65f054e
+    v1.29.14: 4c4c69515f75bcae793af0df65a637424f8cda3eea2aa60239d16ba9de2d9a28
+    v1.29.13: 5d2d1f3bf874c3095352d6e2dd297161e2591f1449034f09bf5a1ef593802241
    v1.29.12: d953ed504c2ddd08272d45cc94439fc69b7ffd77ff1d0c78917b3275a5c9c044
    v1.29.11: c1482dec2a478e7142b4c4d6fe9434cc04b02e4f760c19bab9287ec05df2d539
    v1.29.10: a10b015db9b5b5a29420a9f8e696c39f11d171bb9d67ad39c1a6b05f7da6d823
@@ -335,11 +574,21 @@ kubeadm_checksums:
    v1.29.1: 3bff8c50c104c45e416cce9991706c6ac46365f0defbcd54f8cf4ace0fa68dcf
    v1.29.0: bbddee2d46d2e1643ae3623698b45b13aa2e858616d61c642f2f49e5bb14c980
  amd64:
+    v1.31.9: 9653845e48754df94842cce1ef76874e7f4c1a32d782dd0c7e6cf12e3a718dde
+    v1.31.8: b979b58548902a152b0ab89265347c34aac9f1c7e9666953806267d033f0d63b
+    v1.31.7: be84c87c7b40977edf67fb8ee231abb273b93bbab5bb770af0f3f37c0d7c4b81
+    v1.31.6: c9d9add6c8cdbeb29d5e1743f23060fc06219b23f561eb9f959b5502fb055611
+    v1.31.5: 879add53ba3ed7e86bdb3b06d1ebb1f5e31b9a01e3bc57353d6385422febbd73
    v1.31.4: 6c8e2fd2fa2cab51debf215fcb9149b94e7046f69ff558290066875200975cf6
    v1.31.3: dcfcc6eb79e94994d5f1b04a7746239214030ce8a2e8b0e21a4772938f911d12
    v1.31.2: e3d3f1051d9f7e431aabaf433f121c76fcf6d8401b7ea51f4c7af65af44f1e54
    v1.31.1: b3f92d19d482359116dd9ee9c0a10cb86e32a2a2aef79b853d5f07d6a093b0df
    v1.31.0: cf3b1a44b11ab226e40610e63d99fae7588a82940bb77da471a6dec624c819c2
+    v1.30.13: dbea796b7b716f7b30ea99e021c3730ef3debace4c8a62c88abfc266b3ab7a96
+    v1.30.12: 88422e8b3749b5eaf50a9889a56ee5615cd8a027711f26c6687788e758b949f8
+    v1.30.11: 06ff7ff15b7fa9af60189fdece5f7c56efa8b637c38b4a498715ca2f04ccfcb2
+    v1.30.10: 177254194194975df68fd69a3647c86260a6c635bee42f516d3cecc047c4bc7c
+    v1.30.9: f763a8f5616cf1da80d88555b3654ab6aacd62dc62e6ba7dd2d540c34eea24c0
    v1.30.8: ffe1a2b6345fae55e059afe7eed90ae9f46f0a755fde5fc17b9113134ab8b79e
    v1.30.7: 3635901a3a6e5b0124547151de700a1dbd4571531327a32edbec43bb155b877b
    v1.30.6: 216b7728c6eca12a6a21a7e4199d898d4b88cf8f489a63c2779e2e525302cca7
@@ -349,6 +598,9 @@ kubeadm_checksums:
    v1.30.2: 672b0cae2accce5eac10a1fe4ea6b166e5b518c79ccf71a2fbe7b53c2ca74062
    v1.30.1: 651faa3bbbfb368ed00460e4d11732614310b690b767c51810a7b638cc0961a2
    v1.30.0: 29f4232c50e6524abba3443ff3b9948d386964d79eb8dfefb409e1f8a8434c14
+    v1.29.15: d0744fbaa1e67fc65c4a3409f083e01a4ede58181c759b2feeb08b1ef10d6201
+    v1.29.14: 4f72a1148b786a766cf695ead7cffa41859661286cd4e6e6a49da0838feae840
+    v1.29.13: 584d4ded69ea6e660d7b205c9c924f37cdfca24ad858cf05aeca626048e25f46
    v1.29.12: bce712631bc425726b45930e58b00790c2ab3deec4282f86af353ea907817c46
    v1.29.11: 6cf3567bd69a14859fb80fb39a09196dc2de1729ae72566e7e4819c5600e49c6
    v1.29.10: 9098c908e0f3a601e8bef9b2cdb4a9777e18204595a6542be58b3928c7b51440
@@ -363,11 +615,21 @@ kubeadm_checksums:
    v1.29.1: d4d81d9020b550c896376fb9e0586a9f15a332175890d061619b52b3e9bc6cbd
    v1.29.0: 629d4630657caace9c819fd3797f4a70c397fbd41a2a7e464a0507dad675d52c
  ppc64le:
+    v1.31.9: 0edee6d9df59cbde094dc7c78bc2cb326ef5ee05072a41196413d1952d078224
+    v1.31.8: ce95a67e563099bf0020c8b577d12e1acd28fa622a317c5dbea4dcba38f1a4db
+    v1.31.7: 98c501edf7ceb4defd84a6925d9c69f6a8053f16342091af946ff2f2bdace10b
+    v1.31.6: 03cd9275b9437fc913cbc7b4a365671bd9cb52e67525dd1ba154c792bbfc44fa
+    v1.31.5: 44c796865dbf1d69c20f534577f5fa9065fff6cb7067df1d5c653b8505d6345f
    v1.31.4: 9d0a6abf9595f79660f29625ed649df4f64369e1552aa68eb7ad49b45455ab04
    v1.31.3: 646130bbb60949bdc9b7a449298537369b0eff0ff39b9f7f4222a4760ab824be
    v1.31.2: 57771542703fbb18916728b3701298fda62f28a1d9f144ae3712846d2bb50f8a
    v1.31.1: 76667e109e2dfcb332820c35f598b6f588b6f18c8b59acfb956fb9b4995dda4e
    v1.31.0: 002307ea116a5aa5f78d3d9fb00e9981593711fb79fdfc9be0a9857c370bdcf3
+    v1.30.13: 6751937c03c3202afe650b015ded5ff2d2ec63db2d1a87fae50f07f3084049d8
+    v1.30.12: dda533c81cbe3cc130f78dffa46c839015a5b75d889c95ee178f8989ff7d21f9
+    v1.30.11: 93f26ae616ad31d59a4160d1948a7b3a621cf8e8b47efe55e7ed84f9667a94fa
+    v1.30.10: fe825263316c29eb9cf78267ad524953865d058744135121b6b0b5aa0dcbee8c
+    v1.30.9: 0210c7e644231a63765e5524edce039124cc5a3051fd7ee32f227645f29b17aa
    v1.30.8: 48b8eefb82a9b5646286bb0479dea8c690da62b1bf9b8d5515cd854316837ad5
    v1.30.7: 62d1cd87f541b5eb179b968577e26d72e23b053f3eee4946bbc1a61dc9b6a03d
    v1.30.6: 8febc55f1a984b23deb3ecca2dfe7073180f462636512dbfdfb69537c0783ec2
@@ -377,6 +639,9 @@ kubeadm_checksums:
    v1.30.2: 8aee71554003411470a5933cdff7896736ae1182055c0de6bb3782d0a7581c71
    v1.30.1: dc529fae8227422a23a8d4f70e28161fa207a4da7cb24d340aae0592dd729ea5
    v1.30.0: a77badcaff292862df8324e17f74ab7ce3c6ea9f390647878f1838a3a832f413
+    v1.29.15: 993b145b746ffdc5e5a819b213b48059844ffd663bbe1ed0e2a6766a169bd576
+    v1.29.14: c1dcff90f263aa5abeb5cd20f040afa91fcb455a44ad0eaf26b2d6af7803c000
+    v1.29.13: 612516c373bb95d83828666ae576dc511a5ac69234e41da65e19aef45cf19847
    v1.29.12: e3763de339534dc0eb6faca17a06c183cefb5cf0486f00527233a9eea0788373
    v1.29.11: 48bf5ef0a67ad4072a5f956c30d1710a19550df2b441c34f214297d7d7455809
    v1.29.10: 5f90095f3bd107fef219984e0aade9a7ab12c960392596e9ec08f31dca73acc1
@@ -392,6 +657,9 @@ kubeadm_checksums:
    v1.29.0: 4c414a463ed4277e9062c797d1c0435aa7aec2fd1688c5d34e3161c898113cb5
 etcd_binary_checksums:
  arm:
+    v3.5.19: 0
+    v3.5.18: 0
+    v3.5.17: 0
    v3.5.16: 0
    v3.5.15: 0
    v3.5.14: 0
@@ -404,6 +672,11 @@ etcd_binary_checksums:
    v3.5.7: 0
    v3.5.6: 0
  arm64:
+    v3.5.21: 95bf6918623a097c0385b96f139d90248614485e781ec9bee4768dbb6c79c53f
+    v3.5.20: f034232e6fb64b0d89c45fd78b8b4c3e9fb8d69605dddddcdebf5d7cd96a1531
+    v3.5.19: a786fd2c92c3c0404586ffedf1b318e4944a17aefed1fa6566f5712ddb8359ad
+    v3.5.18: c2bcaf465537d6d47c8bb82a69e31f786f32257050e3bca445bc4e63479ec714
+    v3.5.17: 7d717a62520bf39fa1115dfbb1df79479ff74b5eda0914f4132bfa60a48b9549
    v3.5.16: 8e68c55e6d72b791a9e98591c755af36f6f55aa9eca63767822cd8a3817fdb23
    v3.5.15: 5aa28b435edb1f22bf6455f754e16a13e3e4eb1ad8fc7c22ad47aa8e722febf2
    v3.5.14: 90510c79c4aae3c3313691f5770fc53b3ac883338fc0254bf8d22460acd3c19d
@@ -416,6 +689,11 @@ etcd_binary_checksums:
    v3.5.7: 1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51
    v3.5.6: 888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87
  amd64:
+    v3.5.21: adddda4b06718e68671ffabff2f8cee48488ba61ad82900e639d108f2148501c
+    v3.5.20: 9ac85616fb8c0e45f485074dde0258ca2b7b42f1dd5320821af5a8b66daf7072
+    v3.5.19: 16ae742def5f330800590e8d505d72830a3b0b7012e559e6bd76f0bc9864bf42
+    v3.5.18: 6ddde039a7a506badf34e7edfb38e1ea90e36f05c8cfceba602045df623d86fa
+    v3.5.17: eff6ac621d41711085d0f38fab17d8fa3705f6326c3ff11301a1f5a71fc94edd
    v3.5.16: b414b27a5ad05f7cb01395c447c85d3227e3fb1c176e51757a283b817f645ccc
    v3.5.15: 3f6b48d8c2844699f2b19c1880508ecf63e1489769ed37ebb97495d5cd848a89
    v3.5.14: b0b34298f53f6830f08e7ddc57fc74dc45563216a66e94d9e6b0b9e0b0281b34
@@ -428,6 +706,11 @@ etcd_binary_checksums:
    v3.5.7: a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396
    v3.5.6: 4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb
  ppc64le:
+    v3.5.21: 6fb6ecb3d1b331eb177dc610a8efad3aceb1f836d6aeb439ba0bfac5d5c2a38c
+    v3.5.20: 563bdac64fc92442cf366c02294dff1cbbd3885a86dbcf7f2e87d9388c3b3223
+    v3.5.19: cc8651929f4d5794892eeeabf612a243ea6233125bc5f8b0f711118736e2710f
+    v3.5.18: ad90260978a9a94572c8aedfa3c4ab225a451e84ab01a1df35e4124863672999
+    v3.5.17: 5c737b586a1ebcc12bf0d68a2b56583764f4aba82ab4934629626da93d4a9ecc
    v3.5.16: 33322806f4a2aa3d4947a4d42ec6a120296535e7f00e2f9d74e515e9386333e0
    v3.5.15: 6512f7308a0d0af7c9bb46bca1c4f4e816304304d838d1045ae21d9772c5490e
    v3.5.14: 01681d4d33bba5130c9cffca42c35b0f68e0d991b0b4ee65dab6fd36568d4fee
@@ -441,6 +724,7 @@ etcd_binary_checksums:
    v3.5.6: e235cb885996b8aac133975e0077eaf0a2f8dc7062ad052fa7395668a365906b
 cni_binary_checksums:
  arm:
+    v1.4.1: 50a794507a32edbae8e2fe450f228b5c9c5072e6d958d8c2dc5cd157d4d4fdb0
    v1.4.0: 6cddc5804fff93b914f3314d62fa03f24d69f59c03940e0bbe85a370371b5bb8
    v1.3.0: 86c4c866a01a8073ad14f6feec74de1fd63669786850c7be47521433f9570902
    v1.2.0: fde5bf2da73995196d248177ee8deeafa8005f33cbe1ab33bd2d75c17ca5a99a
@@ -449,6 +733,7 @@ cni_binary_checksums:
    v1.0.1: d35e3e9fd71687fc7e165f7dc7b1e35654b8012995bbfd937946b0681926d62d
    v1.0.0: 910c2ba8b6f50b1081b219d6db04459b555940973249fcf39a792932a91f6d39
  arm64:
+    v1.4.1: 56fe62d73942cffd8f119d2b8ecb6a062e85f529a3dbfc7aa5cd83c2c01929a7
    v1.4.0: 304d4389d5b732b7a73513d002c4895f731d030682d40653f411e10e39114194
    v1.3.0: de7a666fd6ad83a228086bd55756db62ef335a193d1b143d910b69f079e30598
    v1.2.0: 525e2b62ba92a1b6f3dc9612449a84aa61652e680f7ebf4eff579795fe464b57
@@ -457,6 +742,7 @@ cni_binary_checksums:
    v1.0.1: 2d4528c45bdd0a8875f849a75082bc4eafe95cb61f9bcc10a6db38a031f67226
    v1.0.0: 736335bc5923a37cfb6cc2305489ce6206bcc565004f525b5f7c3604f092aa3a
  amd64:
+    v1.4.1: 2a0ea7072d1806b8526489bcd3b4847a06ab010ee32ba3c3d4e5a3235d3eb138
    v1.4.0: c2485ddb3ffc176578ae30ae58137f0b88e50f7c7f2af7d53a569276b2949a33
    v1.3.0: 754a71ed60a4bd08726c3af705a7d55ee3df03122b12e389fdba4bea35d7dd7e
    v1.2.0: f3a841324845ca6bf0d4091b4fc7f97e18a623172158b72fc3fdcdb9d42d2d37
@@ -465,6 +751,7 @@ cni_binary_checksums:
    v1.0.1: 5238fbb2767cbf6aae736ad97a7aa29167525dcd405196dfbc064672a730d3cf
    v1.0.0: 5894883eebe3e38f4474810d334b00dc5ec59bd01332d1f92ca4eb142a67d2e8
  ppc64le:
+    v1.4.1: 7de34118d5195396ed48d51af98fafe7e480e532ae8bd66cc10bf94346d6fa8c
    v1.4.0: c87a36a75ad1692933e3218cae734ba809ae2190c725a050ac9033fc96d2ed26
    v1.3.0: 8ceff026f4eccf33c261b4153af6911e10784ac169d08c1d86cf6887b9f4e99b
    v1.2.0: 4960283b88d53b8c45ff7a938a6b398724005313e0388e0a36bd6d0b2bb5acdc
@@ -474,8 +761,11 @@ cni_binary_checksums:
    v1.0.0: 1a055924b1b859c54a97dc14894ecaa9b81d6d949530b9544f0af4173f5a8f2a
 calicoctl_binary_checksums:
  arm:
+    v3.29.3: 0
+    v3.29.2: 0
    v3.29.1: 0
    v3.29.0: 0
+    v3.28.3: 0
    v3.28.2: 0
    v3.28.1: 0
    v3.28.0: 0
@@ -486,8 +776,13 @@ calicoctl_binary_checksums:
    v3.27.1: 0
    v3.27.0: 0
  arm64:
+    v3.29.4: 3139c83cdd3e648d9605c2cebb4657871e41310aad0c7b4bf198e3a8393c5cec
+    v3.29.3: d6cba570af9162dff56714ac5e22dfdd170742bc58a51211f587875a3de79fc4
+    v3.29.2: 3a9b80335338b7f4af762d4a7cf68e67b40839e50711fbe6e67f9a62b69bafdd
    v3.29.1: 6f662d316a267854dc5487242ca7ec8ca70c35b52bed258aafb76c2d113643c2
    v3.29.0: ab23afb283fcdffcf0e1156cdced68d05b6c2b70fd4ea2cbc3189d0ecd43bdfd
+    v3.28.4: 48887a6dd715f7340511788c3f311810326e61dcce5a6c1554e365cd372ffab1
+    v3.28.3: b61b5206bc7795793edf792040acf5c52d48ff5de701001d0dbbd850edd0c077
    v3.28.2: 8ebe965424ac94084499182b2853de62e5d18cdc346a3b8974e991d8b7a9592d
    v3.28.1: c062d13534498a427c793a4a9190be4df3cf796a3feb29e4a501e1d6f48daa7c
    v3.28.0: c4ca8563d2a920729116a3a30171c481580c8c447938ce974ce14d7ce25a31bf
@@ -497,9 +792,21 @@ calicoctl_binary_checksums:
    v3.27.2: 0fd1f65a511338cf9940835987d420c94ab95b5386288ba9673b736a4d347463
    v3.27.1: 0
    v3.27.0: b4b8c71f9658165e45336b9b5e4fad865529feeffe4294247eb5b4c4310dcaf9
+    v3.26.5: 424f2e41ac859a5e270959f8703cb44171bd7199f0a4c3df12e8a4f180e9d969
+    v3.26.4: d647d9443ce89df62da6619643375a4f577f5a7fa4e1162416403df521826c2d
+    v3.26.3: c50272a39658a3b358b33c03fe10d1dde894764413279fecc72d40b95535b398
+    v3.26.2: 44de9118f481a1125e2d50cdfbb55073e744dd8e71d2be45eeb2757302910c67
+    v3.26.1: bba2fbdd6d2998bca144ae12c2675d65c4fbf51c0944d69b1b2f20e08cd14c22
+    v3.26.0: b88c4fd34293fa95d4291b7631502f6b9ad38b5f5a3889bb8012f36f001ff170
+    v3.25.2: 1cf28599dc1d52ef7c888731f508662a187129ff7bb3294f58319d79c517085c
  amd64:
+    v3.29.4: f2a6da6e97052da3b8b787aaea61fa83298586e822af8b9ec5f3858859de759c
+    v3.29.3: 8101eef6d31ca80db0c64c7ab8930f657dafc1f8696f145ef5d5f162026eedda
+    v3.29.2: 6076d6745c4d60c0c4322961cbb256a0ffa8476cf7f8dbe5de4ae82c55bca020
    v3.29.1: 2ac849181cb1fb40c61c06d075711025cdb909d80562d078cc548d50a0edcd3d
    v3.29.0: df5048549d72a1f7ea4f61c655699d3b16d8a45873f28c3855c39597b73e8a3d
+    v3.28.4: ff07f5ac4dbf9a849adb12db20e7b35857869fb98b23e802404dbb4a8a98e013
+    v3.28.3: b7dc6d01407ea04c110b8d50312591d7a7c3aa5239c875354ced83ac6b924137
    v3.28.2: d7f30447f0f59262051b95bdc656407442c4f71066dc37ddd3b676108fab569d
    v3.28.1: 22ec5727c38dbe19001792b4ca64ac760a6e2985d5c1a231d919dbebe5bca171
    v3.28.0: 4ea270699e67ca29e5533ddb0a68d370cb0005475796c7e841f83047da6297b6
@@ -509,9 +816,21 @@ calicoctl_binary_checksums:
    v3.27.2: 692f69dc656e41cd35e23e24f56c98c4aeeb723fed129985b46f71e6eb5e1594
    v3.27.1: 0
    v3.27.0: 46e79ae146b3dd90998f56511cf5d6db64deb97cb784235caf1f99e0672d66e4
+    v3.26.5: 3c5b3bf8d6cd4f9e14f585ca9ea5b8614209daa6019e25036b15062110022afc
+    v3.26.4: 9960357ef6d61eda7abf80bd397544c1952f89d61e5eaf9f6540dae379a3ef61
+    v3.26.3: 82bd7d12b0f6973f9593fb62f5410ad6a81ff6b79e92f1afd3e664202e8387cf
+    v3.26.2: eba9bc34f44801a513c48f730a409dc1ece0ebfd9c1acc21fd3adf0eff93ecdc
+    v3.26.1: c8f61c1c8e2504410adaff4a7255c65785fe7805eebfd63340ccd3c472aa42cf
+    v3.26.0: 19ce069f121f9e245f785a7517521e20fe3294ce1add9d1b2bbcbb0a9b9de24e
+    v3.25.2: b6f6017b1c9520d8eaea101442d82020123d1efc622964b20d97d3e08e198eed
  ppc64le:
+    v3.29.4: c7798ef7817bb67f84d54aef661066e64f957977fc80f88b49be2b13a3492d06
+    v3.29.3: edb98d2a0d3f8afbf98eb000f0d535d4678af39dd6e10a09ea5615a4824f692f
+    v3.29.2: 6f3fd72be26fcf52605d9ece716363a73bb194ca59ee34a257156d30fa5c1542
    v3.29.1: ef6064f2ec1a09b5eb8c43ab0c64bd42785c24f5b22b950583fb5074f472c2b7
    v3.29.0: c9c2a29a349c6f681aa79b5f5d6aee738305d95aa7f158b6217f487808758e53
+    v3.28.4: 9646b8b66981ed68017d30291f44e3e4ff1f6ce318c88c1e837097c061e2bb79
+    v3.28.3: 08bfe47df894ae22f2a1256f28b46345cc1718cd9c936ca8248ae5b761c33dab
    v3.28.2: 9889a2f9c26ae82a501b33440b3a0772f552a4ece128cd57a21e395452b4238f
    v3.28.1: 985caad36fed7b883a2cd4cf91e556974bcca95fe4e6b7ff4cb64d8d8fbe9223
    v3.28.0: 0789cb0d1478ec3f0a44db265b19042be9dfc18bc1776343c7ea8d246561d12b
@@ -521,6 +840,13 @@ calicoctl_binary_checksums:
    v3.27.2: f918bb88de1d01de3d143e1e75d0ee1256f247c5cbabec7d665aaf8d1fd3cc6c
    v3.27.1: 0
    v3.27.0: 3de46d8bc30c6f9d9387d484ed62a5655c1f204b1b831b5a90f0a0d1c1ffd752
+    v3.26.5: 115427fa9d135a17b92efd5fdb9d68588dd5186c06772bc9f56be27dbec89e3b
+    v3.26.4: 41cfa77cc27cfe89a046ddb033cf71a46512f4b81251e28c69fca2cee13617ff
+    v3.26.3: 30a32acbe71894a9783e350ed44294e739b3322f157b2c224ad3c058473e5701
+    v3.26.2: c4d42a85afb67020e9cf9dcafe184af6ad60c5609d60001b9505b1a83959b246
+    v3.26.1: 7f8baf18f4d7954b6f16b1ddcdadbc818cae2fe1f72137464ccc7b8e6fef03a0
+    v3.26.0: b82b931e3aa53248d87b24f00969abfe5ea4518c56a85b5894187c7b47dc452e
+    v3.25.2: a5e19931ce50953a36387c67b596e56c4b4fc7903893f1ad25248177027ad0dd
 ciliumcli_binary_checksums:
  arm:
    v0.16.0: 0
@@ -534,6 +860,12 @@ ciliumcli_binary_checksums:
    v0.15.16: 0
    v0.15.15: 0
  arm64:
+    v0.16.24: cf7f1276bbcf4aa5e6347d5619efe990cf1340d5898f8405931e277a1f76c670
+    v0.16.23: 7973302bead01c3f2e1d0f03e2766a0d6e76d3c52c666c750b9871a28b9afb32
+    v0.16.22: b70c15e40b36ac34d59597f2448c5b4e0033964c517f926dbb9654aa07fb1e5b
+    v0.16.21: 7b710ddc0d3250f8c5d49a4cefb459b98c3c6651da9389d65cc727451fe3c4e6
+    v0.16.20: 4e3f50a6021fa8985232cebb0d9d33ba63e51f43f8fe5d657fc3e91179f8b96a
+    v0.16.19: 4a7a401d671054efb98dc9a8028aea82d66bed0bfc86ff008d823d1200d20030
    v0.16.0: fe16bcd447fc6fe764ca75712f5832d7504845e9f782684ff09c9f52548237fe
    v0.15.23: 9aa37d99a15e72bbcb555d7ed5b88c2ae3a7e6fbc478f9ee402a835ba6b41175
    v0.15.22: 23caf44dade82b5a986e9799db333724845750bebe32e571a356ab9116406f6d
@@ -545,6 +877,12 @@ ciliumcli_binary_checksums:
    v0.15.16: 86ed6a2e796c39dd00072e7c141fc35b68d63392d1ac5e183a7ce9d7263e23a0
    v0.15.15: 5c1693ea163b094a92ebc6997b6e678cc8c24a52040c22433b58b419de74b28f
  amd64:
+    v0.16.24: 019c9c765222b3db5786f7b3a0bff2cd62944a8ce32681acfb47808330f405a7
+    v0.16.23: e7cd3b982eca9b6214226536a147490ebb6ea3caad40d5a724daeea0bec5e3be
+    v0.16.22: 8bd9faae272aef2e75c686a55de782018013098b66439a1ee0c8ff1e05c5d32c
+    v0.16.21: f5c4fed6f78b340a6678793c299cc5a8907e55bde9c9e0cc1759c26f6f37db05
+    v0.16.20: 8d0e75bf3a867880cb82bbec57027864879775997e3824737e36cf16467d9d04
+    v0.16.19: 211c994c9cabe1cb194f308510b78d8498681ee88771fd7c503e259e74eeb541
    v0.16.0: da98675f961833d4ffd68b1046d907b228a7d394ded2abd70a50b20eaca171c4
    v0.15.23: cda3f1c40ae2191a250a7cea9e2c3987eaa81cb657dda54cd8ce25f856c384da
    v0.15.22: c9bdf99362c16bb63ea44a214e39319d8ac1d196345792caae9665f36fe274a3
@@ -556,6 +894,12 @@ ciliumcli_binary_checksums:
    v0.15.16: f30095e1a0b926d2114b7a419141bea76e950b643182e97e666950ca05a205d9
    v0.15.15: 492279c1f960c79747290a5d1e1b21084a04a93f9e13ab4ae7df4c76fe808aff
  ppc64le:
+    v0.16.24: 0
+    v0.16.23: 0
+    v0.16.22: 0
+    v0.16.21: 0
+    v0.16.20: 0
+    v0.16.19: 0
    v0.16.0: 0
    v0.15.23: 0
    v0.15.22: 0
@@ -567,8 +911,12 @@ ciliumcli_binary_checksums:
    v0.15.16: 0
    v0.15.15: 0
 calico_crds_archive_checksums:
+  v3.29.4: 6d2396fde36ba59ad55a92b5b66643adcc9ee13bb2b3986b1014e2f8f95fa861
+  v3.29.3: 66d49b3af986944e58fede252a2c164251a63f43894181ed7401a6e11dcd8421
+  v3.29.2: 1866b407213b6191627c0ce7be5a0d7c14a016823b3bbc2a6898c57be6c59917
  v3.29.1: 17894ed9f7487f1418e599fdeff5db9047374dee12d560114e25ff9147a455c3
  v3.29.0: 403a6b8616c4e97b081d7be27e9024f2f66b2d73a0ea037420a29689205b2064
+  v3.28.3: 2b3348fb9e022bb6703c460789bd9327d9062c6854262e263fd409ff368034e7
  v3.28.2: f02a0e99e060850bd9050d4c94d37df899911a5e357e1d26e1b5b79a923bb389
  v3.28.1: c56f1530e7ded9d5b4afb9d83a7a24da6d2959ef7ad38521813f1c2bf138182d
  v3.28.0: ee721337db0cd847e91aae1cdfd420596896ebcb865575fd913c2f12ac2cdb76
@@ -578,6 +926,13 @@ calico_crds_archive_checksums:
  v3.27.2: 8154bb4aad887f2a5500b505fe203a918f72c4e602b04c688c4b94f76a26e925
  v3.27.1: 76abb0db222af279e3514cfae02be9259097b565bbb2ffcb776ca00566480edb
  v3.27.0: 2a4b5132035dfd6ac4abc8d545f33de139350eca523e0c5cfe4ac32e43fcb2f1
+  v3.26.5: ab82fdb9b76b0306cc5c23653824aff27296e4adf338cdca763895eb72c416a5
+  v3.26.4: 481e52de684c049f3f7f7bac78f0f6f4ae424d643451adc9e3d3fa9d03fb6d57
+  v3.26.3: b51817e7ae5189b0737ccc901b7b5950a4f84b6029eebfdcc3e3b851bd410d03
+  v3.26.2: 8c15b29db525c4cab7bea304357c942a0d55483c03d9c2a0ed3303f66b8f9ff8
+  v3.26.1: 6d0afbbd4bdfe4deb18d0ac30adb7165eb08b0114ec5a00d016f37a8caf88849
+  v3.26.0: a263e507e79c0a131fdc2a49422d3bdf0456ea5786eb44ace2659aba879b5c7c
+  v3.25.2: 6a6e95a51a8ebf65d41d671f20854319cca1f26cd87fbcfc30d1382a06ecfee0
 krew_archive_checksums:
  darwin:
    arm:
@@ -685,6 +1040,11 @@ helm_archive_checksums:
    v3.14.0: f1f9d3561724863edd4c06d89acb2e2fd8ae0f1b72058ceb891fa1c346ce5dbc
 cri_dockerd_archive_checksums:
  arm:
+    0.3.16: 0
+    0.3.15: 0
+    0.3.14: 0
+    0.3.13: 0
+    0.3.12: 0
    0.3.11: 0
    0.3.10: 0
    0.3.9: 0
@@ -693,6 +1053,11 @@ cri_dockerd_archive_checksums:
    0.3.6: 0
    0.3.5: 0
  arm64:
+    0.3.16: 0ab930b6f7ab87697cd94c954d01e19fdd5b5d65810662effb957c5db49a55d4
+    0.3.15: 39e430378c9c08a1d5056426e3c772ae50416ffeadbe720fa63a853c475fd5a4
+    0.3.14: 12c5538887ccea5ec363337dbb50ff52f3b020c93d65649ee1a906c4ec994bf7
+    0.3.13: a4a3d18f26902631b8323c6b6d87925f8ceff626b21dbc1d160aca84454f9b69
+    0.3.12: 23520fc42dcdcb9f44b0edb555a5d760eedde52a230750e21227fbb258f514b5
    0.3.11: 877f635a7005b393f7aab24ca4b1cd7bdfb3b967d055e858408240c86e3cab9a
    0.3.10: 24d2d9cdbb4ed4bda4b0838edb52104ac7a4e2212a0ee05b177de0ae5b6a4a9a
    0.3.9: f5051002b4f95b0e8fe7fbd5f8de4493350e010834d2a8b647f2b26c45c6c203
@@ -701,6 +1066,11 @@ cri_dockerd_archive_checksums:
    0.3.6: 793b8f57cecf734c47bface10387a8e90994c570b516cb755900f21ebd0a663b
    0.3.5: c20014dc5a71e6991a3bd7e1667c744e3807b5675b1724b26bb7c70093582cfe
  amd64:
+    0.3.16: cc7f181ce850130dc375515c54cd8a27e1e862252abc5b7eade7b4a03ddabd8e
+    0.3.15: 4779b7c3663f002871e79ecf6aa8eb48d0bb74df035baecf56b816deb21d12c4
+    0.3.14: 89096dff11b60c8d4f061ee88751c895650a3ef6db5c19d63ab22a1aeb42a5b3
+    0.3.13: b902eef9bd02529e73a03078a1234c038cd9a12cd86af19970e4f8596f95df26
+    0.3.12: bf0890018cb339a313b6d52e994fe2628f5b6d5f005cec39adb171f055691c96
    0.3.11: b2475988f3b86d85c7835269121171e35c92454ad5f4cd6252183b0fccd74d63
    0.3.10: 3e19ef525e02d2d1dfd42e8d661ee45b4bc8a49a6dcafd8baa578bdb3a23aeb6
    0.3.9: a6d9b4b796e9eff830311a2349d259507302cb3955dd07b78296b91e40e8b433
@@ -709,6 +1079,11 @@ cri_dockerd_archive_checksums:
    0.3.6: cf271d65abee88c0c0a6d9dacb151913bf37d25d45913a7e04b09efe408eae18
    0.3.5: 30d47bd89998526d51a8518f9e8ef10baed408ab273879ee0e30350702092938
  ppc64le:
+    0.3.16: 0
+    0.3.15: 0
+    0.3.14: 0
+    0.3.13: 0
+    0.3.12: 0
    0.3.11: 0
    0.3.10: 0
    0.3.9: 0
@@ -718,6 +1093,8 @@ cri_dockerd_archive_checksums:
    0.3.5: 0
 runc_checksums:
  arm:
+    v1.2.5: 0
+    v1.2.4: 0
    v1.2.3: 0
    v1.2.2: 0
    v1.2.1: 0
@@ -731,6 +1108,9 @@ runc_checksums:
    v1.1.9: 0
    v1.1.8: 0
  arm64:
+    v1.2.6: 12c612e2ebe6ca198de676ce75ed557e79fe6109032209bb8e25166c967fe170
+    v1.2.5: bfc6575f4c601740539553b639ad6f635c23f76695ed484171bd864df6a23f76
+    v1.2.4: 285f6c4c3de1d78d9f536a0299ae931219527b2ebd9ad89df5a1072896b7e82a
    v1.2.3: 4ef19ab21ce1ae5a01e1d3fa5b005e45cdf59f5d3ab32541c9e262cb2b2d3451
    v1.2.2: bfd3e6c58bd6060eaa725520c31cbc8f6386ac7606e65bfa7fe9084100aa1789
    v1.2.1: 8c0d81c80ffdaab986629a9c787d8468ab41851e7aab8f9617a4c3674e192aaa
@@ -744,6 +1124,9 @@ runc_checksums:
    v1.1.9: b43e9f561e85906f469eef5a7b7992fc586f750f44a0e011da4467e7008c33a0
    v1.1.8: 7c22cb618116d1d5216d79e076349f93a672253d564b19928a099c20e4acd658
  amd64:
+    v1.2.6: 0774f49d1b1eebb5849e644db5e4dc6f2b06cee05f13b3d17d5d6ba62d6f2ebc
+    v1.2.5: fbd851fce6a8e0d67a9d184ea544c2abf67c9fd29b80fcc1adf67dfe9eb036a1
+    v1.2.4: e83565aa78ec8f52a4d2b4eb6c4ca262b74c5f6770c1f43670c3029c20175502
    v1.2.3: e6e8c8049b1910fce58fa68c057aaa5f42cee2a73834df5e59e5da7612d2739d
    v1.2.2: a34f5ab4fc1df1f456293c3d797a76f2d41cf3cd970bb49fc53ba94bbc8a5cf6
    v1.2.1: b106d49c60e688022f5909432a77bd3260f29687199d47213ed87269588af781
@@ -757,6 +1140,9 @@ runc_checksums:
    v1.1.9: b9bfdd4cb27cddbb6172a442df165a80bfc0538a676fbca1a6a6c8f4c6933b43
    v1.1.8: 1d05ed79854efc707841dfc7afbf3b86546fc1d0b3a204435ca921c14af8385b
  ppc64le:
+    v1.2.6: 0d7fffba4f89920edd3246afd4f07b18a975d0d97193ffae418e8418c236c168
+    v1.2.5: 3764385971ac719535425629e1ac4d451934392993779ee9e8e8ed7566715f5f
+    v1.2.4: 141fa41c1f382483ccf374827f99c7843414fceb95e8ceb710aba8bac984d016
    v1.2.3: 6d1b771096000a14faae660465faf9626a76afe994cbe60581ec4eac1718f12d
    v1.2.2: 9af46fe0bdc654c72593a937806ca034ffbbf4f62f25c1de7a40b5b0f4374de7
    v1.2.1: 652920e145b461151b7e87b28b339594e62129cfc87370b03651a37c39bbc0df
@@ -997,6 +1383,9 @@ nerdctl_archive_checksums:
    1.7.0: e421ae655ff68461bad04b4a1a0ffe40c6f0fcfb0847d5730d66cd95a7fd10cd
 containerd_archive_checksums:
  arm:
+    1.7.26: 0
+    1.7.25: 0
+    1.7.24: 0
    1.7.23: 0
    1.7.22: 0
    1.7.21: 0
@@ -1045,6 +1434,9 @@ containerd_archive_checksums:
    1.6.15: 0
    1.6.14: 0
  arm64:
+    1.7.27: 3f03ea60c7dacddf890be3ab18f7ef859d9d104b19627f52038d7984361912bc
+    1.7.26: adea067914e678ac37d5091ead66f1e36e5cced4d395bbd2be60772495e09eff
+    1.7.25: e9201d478e4c931496344b779eb6cb40ce5084ec08c8fff159a02cabb0c6b9bf
    1.7.24: 420406d2b34ebb422ab3755fbeede59bf3bfcfccf5cfa584b558c93769d99064
    1.7.23: 6a66b5e63a5e88ff7eeb478ccaca9083d44e51e1d7261ae183fe5951a6226ccd
    1.7.22: 48d0a8461ae829b12b07c3663b14b70287d0607a0792719c51b4e4dd700b02ce
@@ -1070,6 +1462,8 @@ containerd_archive_checksums:
    1.7.2: d75a4ca53d9addd0b2c50172d168b12957e18b2d8b802db2658f2767f15889a6
    1.7.1: 1f828dc063e3c24b0840b284c5635b5a11b1197d564c97f9e873b220bab2b41b
    1.7.0: e7e5be2d9c92e076f1e2e15c9f0a6e0609ddb75f7616999b843cba92d01e4da2
+    1.6.38: 8a685abe7e5352baab1511933431195964e893e19b4a229af48c7a32ee50ab58
+    1.6.37: c3da773c40a2e509c13a55fbd25a165c5dfaed7c9b67a71bb4033c3d8d2d0b6a
    1.6.36: 48aaf746ad4adc6e5c3b077875ddbd15a8f5b660a5f7dcb533f0205aeeff3785
    1.6.35: 0e0066aeffbd4360bfcf16bd08b6a9e40da7f437aa7b292991ce8d08083bee40
    1.6.34: 9e898686ff003cec2d80c30cf5ad342c1ac88373568dae792f93cd088e66d038
@@ -1094,6 +1488,9 @@ containerd_archive_checksums:
    1.6.15: d63e4d27c51e33cd10f8b5621c559f09ece8a65fec66d80551b36cac9e61a07d
    1.6.14: 3ccb61218e60cbba0e1bbe1e5e2bf809ac1ead8eafbbff36c3195d3edd0e4809
  amd64:
+    1.7.27: 5b038fb22ab5dbb1ce57dd3d8f102460cd8619ff2afc78870837b06e8c4e840a
+    1.7.26: fdf1fb17086b62fc861103da4e3fda3d79bc543b42d2acef5d07e76b13d35d19
+    1.7.25: 02990fa281c0a2c4b073c6d2415d264b682bd693aa7d86c5d8eb4b86d684a18c
    1.7.24: 1a94f15139f37633f39e24f08a4071f4533b285df3cbee6478972d26147bcaef
    1.7.23: 8a0de43d9313aef2ebdccc0ffa49461a4a28139a2c0ef104c3c847f6f37c8119
    1.7.22: f8b2d935d1f86003f4e0c1af3b9f0d2820bacabe6dc9f562785b74af24c5e468
@@ -1119,6 +1516,8 @@ containerd_archive_checksums:
    1.7.2: 2755c70152ab40856510b4549c2dd530e15f5355eb7bf82868e813c9380e22a7
    1.7.1: 9504771bcb816d3b27fab37a6cf76928ee5e95a31eb41510a7d10ae726e01e85
    1.7.0: b068b05d58025dc9f2fc336674cac0e377a478930f29b48e068f97c783a423f0
+    1.6.38: 84f6098c96ff4afc6add67fe4dffc2bb206c86f4b8ceea2157124e4c328697a0
+    1.6.37: fd74db561289cede7efcede1dce7da92a7da025b4ca8b2c36fc5559ab1892089
    1.6.36: e9a53f5f7549afbe9208578609eddecd238b7166663ab273f2954fab77602b3f
    1.6.35: 50f05b2986a8635827e3f015f10d8d1c342e9a9d6886c7392160b5c27ac77c83
    1.6.34: 18969d667cd6b9993d168f6d30f9ad978f0aca72cf984c1f522fc5277780885b
@@ -1143,6 +1542,9 @@ containerd_archive_checksums:
    1.6.15: 191bb4f6e4afc237efc5c85b5866b6fdfed731bde12cceaa6017a9c7f8aeda02
    1.6.14: 7da626d46c4edcae1eefe6d48dc6521db3e594a402715afcddc6ac9e67e1bfcd
  ppc64le:
+    1.7.27: ccdfa16e4bba3a993d74fac794d22ddadc1013d351cd099ea933827050ef05a0
+    1.7.26: 34a86b1bd598b34e8c05956c5976fb0c0b347937d3cd0837edbcebc7f9e7e53f
+    1.7.25: 0934176e32eace1c23dcb9edff0e78f872bf8f7152b5e6f622e9ccf1ddce8722
    1.7.24: 2ca4d527dac68132a2a6b3971d82ddfd18edc7fa838b7cfcfe6eb11efd017871
    1.7.23: 00dd8a1145d7392ffe1e2b74da147b896e4387afb5e73ed6e5cd3744add32826
    1.7.22: 6747b7291ffbfde2c0bf0031978985df92ac74414f09bf190afda0fc9e797146
@@ -1168,6 +1570,8 @@ containerd_archive_checksums:
    1.7.2: cbe7ec913cb603ca218bd8867efdce4bee3b0e0115e467e51c910467daf8184e
    1.7.1: 17d97ef55c6ce7af9778dbafb5e73f577d1b34220043a91cccde49dbcc610342
    1.7.0: 051e897d3ee5b8c8097f65be447fea2d29226b583ca5d9ed78e9aebcf4e69889
+    1.6.38: 8971075ef3ab09a478b57342438f5864984b0d38ecd7f432e295727e2035fe4e
+    1.6.37: de4d165271e04b2fabf4c4c6ad5be81dc121c1b79818e43b37d1807e1932b981
    1.6.36: 8978cd8bcd4d5a2640bad26d8ea522a46847b6e4a62da1b07bfa482c8906e5ce
    1.6.35: 99095ab778f6fd532eb01d11771e7f8de8383ef20a00ec536c0cf9c018895115
    1.6.34: 14a4392ba4e533e313fe6d3ed1a68cfdce038b87ad4693be6e71ff31568e2173
--- a/roles/kubespray-defaults/defaults/main/download.yml
+++ b/roles/kubespray-defaults/defaults/main/download.yml
@@ -5,7 +5,9 @@ download_cache_dir: /tmp/kubespray_cache
 # If this is true, debug information will be displayed but
 # may contain some private data, so it is recommended to set it to false
 # in the production environment.
-unsafe_show_logs: false
+# false by default, unless we're running in CI. (CI_PROJECT_URL should be globally unique even if kubespray happens to run
+# in gitlab-ci in other contexts
+unsafe_show_logs: "{{ lookup('env', 'CI_PROJECT_URL') == 'https://gitlab.com/kargo-ci/kubernetes-sigs-kubespray' }}"

 # do not delete remote cache files after using them
 # NOTE: Setting this parameter to TRUE is only really useful when developing kubespray
@@ -57,8 +59,7 @@ download_retries: 4
 docker_image_pull_command: "{{ docker_bin_dir }}/docker pull"
 docker_image_info_command: "{{ docker_bin_dir }}/docker images -q | xargs -i {{ '{{' }} docker_bin_dir }}/docker inspect -f {% raw %}'{{ '{{' }} if .RepoTags }}{{ '{{' }} join .RepoTags \",\" }}{{ '{{' }} end }}{{ '{{' }} if .RepoDigests }},{{ '{{' }} join .RepoDigests \",\" }}{{ '{{' }} end }}' {% endraw %} {} | tr '\n' ','"
 nerdctl_image_info_command: "{{ bin_dir }}/nerdctl -n k8s.io images --format '{% raw %}{{ .Repository }}:{{ .Tag }}{% endraw %}' 2>/dev/null | grep -v ^:$ | tr '\n' ','"
-# Using the ctr instead of nerdctl to workdaround the https://github.com/kubernetes-sigs/kubespray/issues/10670
-nerdctl_image_pull_command: "{{ bin_dir }}/ctr -n k8s.io images pull{% if containerd_registries_mirrors is defined %} --hosts-dir {{ containerd_cfg_dir }}/certs.d{%- endif -%}"
+nerdctl_image_pull_command: "{{ bin_dir }}/nerdctl -n k8s.io pull --quiet"
 crictl_image_info_command: "{{ bin_dir }}/crictl images --verbose | awk -F ': ' '/RepoTags|RepoDigests/ {print $2}' | tr '\n' ','"
 crictl_image_pull_command: "{{ bin_dir }}/crictl pull"

@@ -75,12 +76,12 @@ image_arch: "{{ host_architecture | default('amd64') }}"

 # Versions
 crun_version: 1.17
-runc_version: v1.2.3
+runc_version: v1.2.6
 kata_containers_version: 3.1.3
 youki_version: 0.4.1
 gvisor_version: 20240305
-containerd_version: 1.7.24
-cri_dockerd_version: 0.3.11
+containerd_version: 1.7.27
+cri_dockerd_version: 0.3.16

 # this is relevant when container_manager == 'docker'
 docker_containerd_version: 1.6.32
@@ -100,7 +101,7 @@ github_image_repo: "ghcr.io"

 # TODO(mattymo): Move calico versions to roles/network_plugins/calico/defaults
 # after migration to container download
-calico_version: "v3.29.1"
+calico_version: "v3.29.4"
 calico_ctl_version: "{{ calico_version }}"
 calico_cni_version: "{{ calico_version }}"
 calico_policy_version: "{{ calico_version }}"
@@ -112,10 +113,10 @@ calico_apiserver_enabled: false
 flannel_version: "v0.22.0"
 flannel_cni_version: "v1.1.2"
 weave_version: 2.8.7
-cni_version: "v1.4.0"
+cni_version: "v1.4.1"

 cilium_version: "v1.15.9"
-cilium_cli_version: "v0.16.0"
+cilium_cli_version: "v0.16.24"
 cilium_enable_hubble: false

 kube_ovn_version: "v1.12.21"
@@ -137,9 +138,9 @@ pod_infra_supported_versions:
 pod_infra_version: "{{ pod_infra_supported_versions[kube_major_version] }}"

 etcd_supported_versions:
-  v1.31: "v3.5.16"
-  v1.30: "v3.5.16"
-  v1.29: "v3.5.16"
+  v1.31: "v3.5.21"
+  v1.30: "v3.5.21"
+  v1.29: "v3.5.21"
 etcd_version: "{{ etcd_supported_versions[kube_major_version] }}"

 crictl_supported_versions:
@@ -149,9 +150,9 @@ crictl_supported_versions:
 crictl_version: "{{ crictl_supported_versions[kube_major_version] }}"

 crio_supported_versions:
-  v1.31: v1.31.0
-  v1.30: v1.30.3
-  v1.29: v1.29.1
+  v1.31: v1.31.6
+  v1.30: v1.30.11
+  v1.29: v1.29.13
 crio_version: "{{ crio_supported_versions[kube_major_version] }}"

 # Scheduler plugins doesn't build for K8s 1.29 yet
@@ -329,13 +330,13 @@ rbd_provisioner_image_tag: "{{ rbd_provisioner_version }}"
 local_path_provisioner_version: "v0.0.24"
 local_path_provisioner_image_repo: "{{ docker_image_repo }}/rancher/local-path-provisioner"
 local_path_provisioner_image_tag: "{{ local_path_provisioner_version }}"
-ingress_nginx_version: "v1.12.0"
+ingress_nginx_version: "v1.12.1"
 ingress_nginx_controller_image_repo: "{{ kube_image_repo }}/ingress-nginx/controller"
 ingress_nginx_opentelemetry_image_repo: "{{ kube_image_repo }}/ingress-nginx/opentelemetry"
 ingress_nginx_controller_image_tag: "{{ ingress_nginx_version }}"
 ingress_nginx_opentelemetry_image_tag: "v20230721-3e2062ee5"
 ingress_nginx_kube_webhook_certgen_image_repo: "{{ kube_image_repo }}/ingress-nginx/kube-webhook-certgen"
-ingress_nginx_kube_webhook_certgen_image_tag: "v1.5.0"
+ingress_nginx_kube_webhook_certgen_image_tag: "v1.5.2"
 alb_ingress_image_repo: "{{ docker_image_repo }}/amazon/aws-alb-ingress-controller"
 alb_ingress_image_tag: "v1.1.9"
 cert_manager_version: "v1.15.3"
--- a/roles/kubespray-defaults/defaults/main/main.yml
+++ b/roles/kubespray-defaults/defaults/main/main.yml
@@ -18,7 +18,7 @@ kubelet_fail_swap_on: true
 kubelet_swap_behavior: LimitedSwap

 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.31.4
+kube_version: v1.31.9

 ## The minimum version working
 kube_version_min_required: v1.29.0
@@ -285,7 +285,8 @@ kubelet_shutdown_grace_period_critical_pods: 20s
 cloud_provider: ""
 # External Cloud Controller Manager (Formerly known as cloud provider)
 # cloud_provider must be "external", otherwise this setting is invalid.
-# Supported external cloud controllers are: 'openstack', 'vsphere', 'oci', 'huaweicloud' and 'hcloud'
+# Supported external cloud controllers are: 'openstack', 'vsphere', 'oci', 'huaweicloud', 'hcloud' and 'manual'
+# 'manual' does not install the cloud controller manager used by Kubespray.
 # If you fill in a value other than the above, the check will fail.
 external_cloud_provider: ""

--- a/roles/kubespray-defaults/tasks/main.yaml
+++ b/roles/kubespray-defaults/tasks/main.yaml
@@ -16,6 +16,7 @@
    - name: Set fallback_ip
      set_fact:
        fallback_ip: "{{ ansible_default_ipv4.address | d('127.0.0.1') }}"
+        cacheable: true
      when: fallback_ip is not defined

    - name: Set no_proxy
--- a/roles/remove-node/remove-etcd-node/tasks/main.yml
+++ b/roles/remove-node/remove-etcd-node/tasks/main.yml
@@ -1,16 +1,4 @@
 ---
- name: Lookup node IP in kubernetes
-  command: >
-    {{ kubectl }} get nodes {{ node }}
-    -o jsonpath-as-json='{.status.addresses[?(@.type=="InternalIP")].address}'
-  register: k8s_node_ips
-  changed_when: false
-  when:
-  - groups['kube_control_plane'] | length > 0
-  - ip is not defined
-  - access_ip is not defined
-  delegate_to: "{{ groups['kube_control_plane'] | first }}"
-
 - name: Remove etcd member from cluster
  environment:
    ETCDCTL_API: "3"
@@ -21,20 +9,18 @@
  delegate_to: "{{ groups['etcd'] | first }}"
  block:
  - name: Lookup members infos
-    command: "{{ bin_dir }}/etcdctl member list"
+    command: "{{ bin_dir }}/etcdctl member list -w json"
    register: etcd_members
    changed_when: false
    check_mode: false
    tags:
    - facts
  - name: Remove member from cluster
-    vars:
-      node_ip: "{{ ip if ip is defined else (access_ip if access_ip is defined else (k8s_node_ips.stdout | from_json)[0]) }}"
    command:
      argv:
      - "{{ bin_dir }}/etcdctl"
      - member
      - remove
-      - "{{ ((etcd_members.stdout_lines | select('contains', '//' + node_ip + ':'))[0] | split(','))[0] }}"
+      - "{{ '%x' | format(((etcd_members.stdout | from_json).members | selectattr('peerURLs.0', '==', etcd_peer_url))[0].ID) }}"
    register: etcd_removal_output
    changed_when: "'Removed member' in etcd_removal_output.stdout"
--- a/tests/files/packet_ubuntu20-flannel-ha.yml
+++ b/tests/files/packet_ubuntu20-flannel-ha.yml
@@ -9,3 +9,7 @@ etcd_deployment_type: kubeadm
 kubeadm_certificate_key: 3998c58db6497dd17d909394e62d515368c06ec617710d02edea31c06d741085
 skip_non_kubeadm_warning: true
 kube_asymmetric_encryption_algorithm: "RSA-4096"
+
+# This test the variable usage, it is not a prerequisite of the test itself
+kubeadm_ignore_preflight_errors:
+  - all
--- a/tests/files/ubuntu24-ha-separate-etcd
+++ b/tests/files/ubuntu24-ha-separate-etcd
@@ -0,0 +1,2 @@
+REMOVE_NODE_CHECK=true
+REMOVE_NODE_NAME=etcd[2]
--- a/tests/scripts/testcases_run.sh
+++ b/tests/scripts/testcases_run.sh
@@ -130,7 +130,7 @@ run_playbook tests/testcases/100_check-k8s-conformance.yml

 # Test node removal procedure
 if [ "${REMOVE_NODE_CHECK}" = "true" ]; then
-  run_playbook remove-node.yml -e skip_confirmation=yes -e node=${REMOVE_NODE_NAME}
+  run_playbook remove-node.yml -e skip_confirmation=yes -e node="${REMOVE_NODE_NAME}"
 fi

 # Clean up at the end, this is to allow stage1 tests to include cleanup test
Author	SHA1	Message	Date
k8s-infra-cherrypick-robot	b01c407387	Changed to use first_kube_control_plane to parse kubeadm_certificate_key (#12758 ) Co-authored-by: Fredrik Liv <fredrik.liv@elastisys.com> Co-authored-by: nvalembois <nvalembois@live.com>	2025-12-02 07:28:26 -08:00
k8s-infra-cherrypick-robot	17d21676e9	Fix calico etcd mode networkpolicy RBAC (#12753 ) Co-authored-by: Chad Swenson <chadswen@gmail.com>	2025-11-28 08:36:21 -08:00
k8s-infra-cherrypick-robot	7a27aef736	[release-2.27] CI: enable unsafe_show_logs == true by default (#12726 ) * CI: enable unsafe_show_logs == true by default * Deduplicate defaults vars (unsafe_show_logs) --------- Co-authored-by: Max Gautier <mg@max.gautier.name>	2025-11-19 23:57:59 -08:00
k8s-infra-cherrypick-robot	406ea25217	Fix breakage when ignoring all kubeadm preflight errors (#12618 ) kubeadm errors out if 'all' is specified with specific checks, so check that case when we add hardcoded checks. Add a test to catch regression. Co-authored-by: Max Gautier <mg@max.gautier.name>	2025-11-17 22:27:37 -08:00
Max Gautier	87597b044d	galaxy.yml: up to next patch version (#12697 )	2025-11-17 21:27:38 -08:00
Max Gautier	16e3670dd4	Remove etcd member by peerURLs (#12691 ) The way to obtain the IP of a particular member is convoluted and depend on multiple variables. The match is also textual and it's not clear against what we're matching It's also broken for etcd member which are not also Kubernetes nodes, because the "Lookup node IP in kubernetes" task will fail and abort the play. Instead, match against 'peerURLs', which does not need new variable, and use json output. - Add testcase for etcd removal on external etcd	2025-11-17 02:53:40 -08:00
Max Gautier	c06b669ae6	[release-2.27] Update pre-commit hooks (#12698 ) * Update pre-commit hooks * CI: Put pre-commit cache under CI_PROJECT_DIR (#11929) * CI: Put pre-commit cache under CI_PROJECT_DIR Apparently gitlab-runner can't cache stuff outside of the project directory. Put the cache under CI_PROJECT_DIR to make it work (which also means we need to ignore it from ansible-lint). Also update the pre-commit image while we're at it. Link: https://gitlab.com/gitlab-org/gitlab/-/issues/14151 * update ansible-lint pre-commit	2025-11-16 01:11:36 -08:00
k8s-infra-cherrypick-robot	f3354ce2c9	calico: update calico-kube-controller manifest (#12481 ) Co-authored-by: Cyclinder Kuo <kuocyclinder@gmail.com>	2025-08-28 00:21:10 -07:00
k8s-infra-cherrypick-robot	7cb6b07c44	Fix: Change "empty" definition for PodSecurity Admission configuration (#12476 ) Fixes a bug where `kube-apiserver` fails to start if the PodSecurity configuration file doesn't have the `apiVersion` and `kind` keys. Signed-off-by: Alejandro Macedo <alex.macedopereira@gmail.com> Co-authored-by: Alejandro Macedo <alex.macedopereira@gmail.com>	2025-08-26 09:22:10 -07:00
ChengHao Yang	9505e74d6e	Fix: pre-commit failing test (#12484 ) Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2025-08-26 09:02:11 -07:00
ChengHao Yang	45140b5582	Fix: galaxy.yml set version to 2.27.1 (#12345 ) Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2025-06-27 07:00:33 -07:00
k8s-infra-cherrypick-robot	16760787ad	Add version pinning for AWS tf provider to fix CI (#12326 ) Co-authored-by: Chad Swenson <chadswen@gmail.com>	2025-06-19 19:48:51 -07:00
k8s-infra-cherrypick-robot	266117d174	fix manage-offline-container-images.sh get image_id (#12314 ) Co-authored-by: DearJay <zhongtianjieyi143@gmail.com>	2025-06-15 07:46:57 -07:00
Ali Afsharzadeh	c59833b2e5	[release-2.27] Patch versions update (#12231 ) * [release-2.27] Patch versions update * Add calico crds archive checksum for v3.29.3 * Update kube_version in roles/kubespray-defaults/defaults/main/main.yml * Revert crio version upgrade * Upgrade calico to v3.29.4	2025-06-05 09:00:38 -07:00
Max Gautier	55194fcf6d	Move 'pretend certificates' after cert distribution (#12221 ) The link target will only exist after we distribute the certs on each node.	2025-05-16 07:43:14 -07:00
k8s-infra-cherrypick-robot	d10000ee90	Workaround missing etcd certds on control plane node (#12192 ) Co-authored-by: Max Gautier <mg@max.gautier.name>	2025-05-06 09:31:16 -07:00
Ali Afsharzadeh	6a67d28fab	[release-2.27] Make fallback_ip cacheable in facts (#12182 ) * Make fallback_ip cacheable in facts * Move cacheable property after fallback_ip variable Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com> --------- Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2025-05-02 22:03:55 -07:00
Chad Swenson	bf68231a5a	Refactor control plane upgrades with reconfiguration support (#12015 ) (#12103 ) * Refactor control plane upgrades with reconfiguration support Adds revised support for: - The previously removed `--config` argument for `kubeadm upgrade apply` - Changes to `ClusterConfiguration` as part of the `upgrade-cluster.yml` playbook lifecycle - kubeadm-config `v1beta4` `UpgradeConfiguration` for the `kubeadm upgrade apply` command: [UpgradeConfiguration v1beta4](https://kubernetes.io/docs/reference/config-api/kubeadm-config.v1beta4/#kubeadm-k8s-io-v1beta4-UpgradeConfiguration). * Add kubeadm upgrade node support Per discussion: - Use `kubeadm upgrade node` on secondary control plane upgrades - Add support for UpgradeConfiguration.node in kubeadm-config.v1beta4 - Remove redundant `allowRCUpgrades` config - Revert from `block` for first and secondary control plane back to unblocked tasks since they no longer share much code and it's more readable this way * Add kubelet and kube-proxy reconfiguration to upgrades * Fix task to use `kubeadm init phase etcd local` * Rebase with changes from "Adapt checksums and versions to new hashes updater" PR * Add `imagePullPolicy` and `imagePullSerial` to kubeadm-config v1beta4 `InitConfiguration.nodeRegistration` (cherry picked from commit `b551fe083d`)	2025-04-02 23:18:38 -07:00
ChengHao Yang	de25806c56	Bump ingress-nginx to 1.12.1 and certgen to 1.5.2 (#12080 ) Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2025-03-27 00:44:34 -07:00
ChengHao Yang	bbabe496c4	[calico] fix v3.29.2 crds archive checksum (#12082 ) Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2025-03-26 02:14:33 -07:00
k8s-infra-cherrypick-robot	6073fee806	build(deps): bump cryptography from 44.0.1 to 44.0.2 (#12062 ) Bumps [cryptography](https://github.com/pyca/cryptography) from 44.0.1 to 44.0.2. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/44.0.1...44.0.2) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-03-21 06:32:32 -07:00
k8s-infra-cherrypick-robot	e354295476	fix: kubecontrollersconfigurations list permission (#12039 ) [WARNING][1] kube-controllers/runconfig.go 193: unable to list KubeControllersConfiguration(default) error=connection is unauthorized: kubecontrollersconfigurations.crd.projectcalico.org "default" is forbidden: User "system:serviceaccount:kube-system:calico-kube-controllers" cannot list resource "kubecontrollersconfigurations" in API group "crd.projectcalico.org" at the cluster scope Co-authored-by: darkobas <marko@datafund.io>	2025-03-15 09:15:47 -07:00
Kubernetes Prow Robot	1af53ce9a6	Merge pull request #12031 from VannTen/2.27-update-versions [release-2.27] Patch versions update	2025-03-14 01:27:48 -07:00
Max Gautier	26779c01a9	CI: switch crio testing to ubuntu20 The switch to crun as a default runtime does not work with RHEL-8 like OS, because of the default to cgroups v2 https://github.com/cri-o/cri-o/issues/8743	2025-03-13 15:43:14 +01:00
Max Gautier	5e083a5370	Update defaults versions to last checksums	2025-03-13 12:09:40 +01:00
Max Gautier	1528bdda39	Checksums updates	2025-03-13 12:05:40 +01:00
k8s-infra-cherrypick-robot	ccf2abb5b1	Remove amazon-linux2 from CI: issue with vm creation (#12017 ) Co-authored-by: ant31 <2t.antoine@gmail.com>	2025-03-04 04:35:43 -08:00
k8s-infra-cherrypick-robot	ecd5b73c5e	build(deps): bump cryptography from 44.0.0 to 44.0.1 (#11973 ) Bumps [cryptography](https://github.com/pyca/cryptography) from 44.0.0 to 44.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/44.0.0...44.0.1) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-02-19 01:08:27 -08:00
k8s-infra-cherrypick-robot	3514ae8d04	[release-2.27] Fix incorrect syntax for secondary nodelocaldns manifest (#11957 ) * Fix incorrect syntax * Fix incorrect syntax --------- Co-authored-by: Raul Butuc <raulbutuc@gmail.com>	2025-02-07 08:57:56 -08:00
k8s-infra-cherrypick-robot	99e2bfe2fa	[release-2.27] Fix CI by exclude the `.ansible` in `.ansible-lint` & remove `ctr image pull` workaround (#11956 ) * exclude .ansible in ansible-lint * remote ctr i pull workdaround Signed-off-by: Kay Yan <kay.yan@daocloud.io> --------- Signed-off-by: Kay Yan <kay.yan@daocloud.io> Co-authored-by: Kay Yan <kay.yan@daocloud.io>	2025-02-07 08:05:58 -08:00
k8s-infra-cherrypick-robot	7d14c4283a	[release-2.27] Updated sample in inventory (#11922 ) * Updated sample in inventory * Review changes --------- Co-authored-by: Anshuman <anshuman@ibm.com>	2025-01-24 00:39:21 -08:00
k8s-infra-cherrypick-robot	eb413e4719	[release-2.27] Add `manual` option to the `external_cloud_provider` variable (#11884 ) * Add `manual` option in the `external_cloud_provider` value Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com> * Update external cloud provider description in roles & sample inventory Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com> --------- Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com> Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>	2025-01-13 08:24:33 -08:00