Patch versions updates

.gitlab-ci/kubevirt.yml

@@ -57,7 +57,6 @@ pr:
           - ubuntu24-kube-router-svc-proxy
           - ubuntu24-ha-separate-etcd
           - fedora40-flannel-crio-collection-scale
-          - openeuler24-calico
 
 # This is for flakey test so they don't disrupt the PR worklflow too much.
 # Jobs here MUST have a open issue so we don't lose sight of them
@@ -68,6 +67,7 @@ pr-flakey:
     matrix:
       - TESTCASE:
           - flatcar4081-calico # https://github.com/kubernetes-sigs/kubespray/issues/12309
+          - openeuler24-calico # https://github.com/kubernetes-sigs/kubespray/issues/12877
 
 # The ubuntu24-calico-all-in-one jobs are meant as early stages to prevent running the full CI if something is horribly broken
 ubuntu24-calico-all-in-one:

Dockerfile

@@ -35,8 +35,8 @@ RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 RUN OS_ARCHITECTURE=$(dpkg --print-architecture) \
-    && curl -L "https://dl.k8s.io/release/v1.35.3/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
+    && curl -L "https://dl.k8s.io/release/v1.35.2/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
-    && echo "$(curl -L "https://dl.k8s.io/release/v1.35.3/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
+    && echo "$(curl -L "https://dl.k8s.io/release/v1.35.2/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
     && chmod a+x /usr/local/bin/kubectl
 
 COPY *.yml ./

README.md

@@ -111,15 +111,15 @@ Note:
 <!-- BEGIN ANSIBLE MANAGED BLOCK -->
 
 - Core
-  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.35.3
+  - [kubernetes](https://github.com/kubernetes/kubernetes) 1.35.2
-  - [etcd](https://github.com/etcd-io/etcd) 3.6.9
+  - [etcd](https://github.com/etcd-io/etcd) 3.6.8
   - [docker](https://www.docker.com/) 28.3
   - [containerd](https://containerd.io/) 2.2.2
   - [cri-o](http://cri-o.io/) 1.35.1 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
   - [cni-plugins](https://github.com/containernetworking/plugins) 1.8.0
-  - [calico](https://github.com/projectcalico/calico) 3.30.7
+  - [calico](https://github.com/projectcalico/calico) 3.30.6
-  - [cilium](https://github.com/cilium/cilium) 1.19.1
+  - [cilium](https://github.com/cilium/cilium) 1.18.6
   - [flannel](https://github.com/flannel-io/flannel) 0.27.3
   - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
   - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1

docs/CNI/cilium.md

@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version
 
 ```yml
-cilium_version: "1.19.1"
+cilium_version: "1.18.6"
 ```
 
 ## Add variable to config

docs/operations/etcd.md

@@ -32,12 +32,12 @@ etcd_metrics_service_labels:
   k8s-app: etcd
   app.kubernetes.io/managed-by: Kubespray
   app: kube-prometheus-stack-kube-etcd
-  release: kube-prometheus-stack
+  release: prometheus-stack
 ```
 
 The last two labels in the above example allows to scrape the metrics from the
 [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack)
-chart when it is installed with the release name `kube-prometheus-stack` and the following Helm `values.yaml`:
+chart with the following Helm `values.yaml` :
 
 ```yaml
 kubeEtcd:
@@ -45,22 +45,8 @@ kubeEtcd:
     enabled: false
 ```
 
-If your Helm release name is different, adjust the `release` label accordingly.
+To fully override metrics exposition urls, define it in the inventory with:
-
-To fully override metrics exposition URLs, define it in the inventory with:
 
 ```yaml
 etcd_listen_metrics_urls: "http://0.0.0.0:2381"
 ```
-
-If you choose to expose metrics on specific node IPs (for example `10.141.4.22`, `10.141.4.23`, `10.141.4.24`) in `etcd_listen_metrics_urls`,
-you can configure kube-prometheus-stack to scrape those endpoints directly with:
-
-```yaml
-kubeEtcd:
-  enabled: true
-  endpoints:
-    - 10.141.4.22
-    - 10.141.4.23
-    - 10.141.4.24
-```

pipeline.Dockerfile

@@ -46,8 +46,8 @@ ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
 RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
     && pip install --break-system-packages --ignore-installed --no-compile --no-cache-dir pip -U \
     && pip install --break-system-packages --no-compile --no-cache-dir -r tests/requirements.txt \
-    && curl -L https://dl.k8s.io/release/v1.35.3/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
+    && curl -L https://dl.k8s.io/release/v1.35.2/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
-    && echo $(curl -L https://dl.k8s.io/release/v1.35.3/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
+    && echo $(curl -L https://dl.k8s.io/release/v1.35.2/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
     && chmod a+x /usr/local/bin/kubectl \
     # Install Vagrant
     && curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \

playbooks/internal_facts.yml

@@ -16,8 +16,6 @@
     - name: Gather and compute network facts
       import_role:
         name: network_facts
-      tags:
-        - always
     - name: Gather minimal facts
       setup:
         gather_subset: '!all'

roles/bootstrap_os/defaults/main.yml

@@ -12,10 +12,6 @@ coreos_locksmithd_disable: false
 # Install epel repo on Centos/RHEL
 epel_enabled: false
 
-## openEuler specific variables
-# Enable metalink for openEuler repos (auto-selects fastest mirror by location)
-openeuler_metalink_enabled: false
-
 ## Oracle Linux specific variables
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true

roles/bootstrap_os/tasks/openEuler.yml

@@ -1,43 +1,3 @@
 ---
-- name: Import CentOS bootstrap for openEuler
+- name: Import Centos boostrap for openEuler
-  ansible.builtin.import_tasks: centos.yml
+  import_tasks: centos.yml
-
-- name: Get existing openEuler repo sections
-  ansible.builtin.shell:
-    cmd: "set -o pipefail && grep '^\\[' /etc/yum.repos.d/openEuler.repo | tr -d '[]'"
-    executable: /bin/bash
-  register: _openeuler_repo_sections
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  become: true
-  when: openeuler_metalink_enabled
-
-- name: Enable metalink for openEuler repos
-  community.general.ini_file:
-    path: /etc/yum.repos.d/openEuler.repo
-    section: "{{ item.key }}"
-    option: metalink
-    value: "{{ item.value }}"
-    no_extra_spaces: true
-    mode: "0644"
-  loop: "{{ _openeuler_metalink_repos | dict2items | selectattr('key', 'in', _openeuler_repo_sections.stdout_lines | default([])) }}"
-  become: true
-  when: openeuler_metalink_enabled
-  register: _openeuler_metalink_result
-  vars:
-    _openeuler_metalink_repos:
-      OS: "https://mirrors.openeuler.org/metalink?repo=$releasever/OS&arch=$basearch"
-      everything: "https://mirrors.openeuler.org/metalink?repo=$releasever/everything&arch=$basearch"
-      EPOL: "https://mirrors.openeuler.org/metalink?repo=$releasever/EPOL/main&arch=$basearch"
-      debuginfo: "https://mirrors.openeuler.org/metalink?repo=$releasever/debuginfo&arch=$basearch"
-      source: "https://mirrors.openeuler.org/metalink?repo=$releasever&arch=source"
-      update: "https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=$basearch"
-      update-source: "https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=source"
-
-- name: Clean dnf cache to apply metalink mirror selection
-  ansible.builtin.command: dnf clean all
-  become: true
-  when:
-    - openeuler_metalink_enabled
-    - _openeuler_metalink_result.changed

roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2

@@ -45,7 +45,7 @@ data:
             force_tcp
         }
         prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_prometheus_port }}
-        health {{ nodelocaldns_ip | ansible.utils.ipwrap }}:{{ nodelocaldns_health_port }}
+        health {{ nodelocaldns_ip }}:{{ nodelocaldns_health_port }}
 {% if dns_etchosts | default(None) %}
         hosts /etc/coredns/hosts {
           fallthrough
@@ -132,7 +132,7 @@ data:
             force_tcp
         }
         prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_secondary_prometheus_port }}
-        health {{ nodelocaldns_ip | ansible.utils.ipwrap }}:{{ nodelocaldns_second_health_port }}
+        health {{ nodelocaldns_ip }}:{{ nodelocaldns_second_health_port }}
 {% if dns_etchosts | default(None) %}
         hosts /etc/coredns/hosts {
           fallthrough

roles/kubespray_defaults/defaults/main/download.yml

@@ -116,7 +116,7 @@ flannel_version: 0.27.3
 flannel_cni_version: 1.7.1-flannel1
 cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"
 
-cilium_version: "1.19.1"
+cilium_version: "1.18.6"
 cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
 cilium_enable_hubble: false
 

roles/kubespray_defaults/defaults/main/main.yml

@@ -218,21 +218,6 @@ kube_network_plugin_multus: false
 # This enables to deploy cilium alongside another CNI to replace kube-proxy.
 cilium_deploy_additionally: false
 
-# Identity allocation mode selects how identities are shared between cilium
-# nodes by setting how they are stored. The options are "crd" or "kvstore".
-# - "crd" stores identities in kubernetes as CRDs (custom resource definition).
-#   These can be queried with:
-#     `kubectl get ciliumid`
-# - "kvstore" stores identities in an etcd kvstore.
-# - In order to support External Workloads, "crd" is required
-#   - Ref: https://docs.cilium.io/en/stable/gettingstarted/external-workloads/#setting-up-support-for-external-workloads-beta
-# - KVStore operations are only required when cilium-operator is running with any of the below options:
-#   - --synchronize-k8s-services
-#   - --synchronize-k8s-nodes
-#   - --identity-allocation-mode=kvstore
-#   - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
-cilium_identity_allocation_mode: crd
-
 # Determines if calico_rr group exists
 peer_with_calico_rr: "{{ 'calico_rr' in groups and groups['calico_rr'] | length > 0 }}"
 

roles/kubespray_defaults/vars/main/checksums.yml

@@ -78,18 +78,15 @@ crio_archive_checksums:
     1.33.0: sha256:b4fa46b25538d8145197f8bf2e935486392c0ca2a9fa609aedd02b9f106d37a6
 kubelet_checksums:
   arm64:
-    1.35.3: sha256:58496a5d16d4316b18397735190d2d41e0c368169ecb458d91b09f4cd1e03c80
     1.35.2: sha256:eaf11f9c20c385624775671662e127b083c9b5d0b451fd613f9468e09ca5656c
     1.35.1: sha256:73475c6db8fd8a9780b1b378fa2f917875e6146166c24603c1abc6eafd4493a8
     1.35.0: sha256:aa658d077348b43d238f50966a583f4244b2a7d45590c77b3b165b7d44983ab8
-    1.34.6: sha256:6b30975e2a582367b5048ffdf9ae26e05442cc18faaf29b5dbd9c6a6b556fa26
     1.34.5: sha256:a4cd54fa5af5ed6b4ed14cf172d30f53fd1f197d7d3f43af733b54b19cc87ac5
     1.34.4: sha256:c78845473c434ee85a2444eeab87f8b20f524e3ab6854a078f79468f44aad8f5
     1.34.3: sha256:765b740e3ad9c590852652a2623424ec60e2dddce2c6280d7f042f56c8c98619
     1.34.2: sha256:3e31b1bee9ab32264a67af8a19679777cd372b1c3a04b5d7621289cf137b357c
     1.34.1: sha256:6a66bc08d6c637fcea50c19063cf49e708fde1630a7f1d4ceca069a45a87e6f1
     1.34.0: sha256:e45a7795391cd62ee226666039153832d3096c0f892266cd968936e18b2b40b0
-    1.33.10: sha256:1e808ecedd61198887190bf472f1352004f97016b273fba827dd95f7efead806
     1.33.9: sha256:c5719223cf378ac6bdd6a7ed79a75ba428bdc4468da70e641b2d4f73f70de6e0
     1.33.8: sha256:e835f15be6d8b7b27b963a46c4a054f7663c26741f17e003bfcb8271350cf882
     1.33.7: sha256:3035c44e0d429946d6b4b66c593d371cf5bbbfc85df39d7e2a03c422e4fe404a
@@ -101,18 +98,15 @@ kubelet_checksums:
     1.33.1: sha256:10540261c311ae005b9af514d83c02694e12614406a8524fd2d0bad75296f70d
     1.33.0: sha256:ae5a4fc6d733fc28ff198e2d80334e21fcb5c34e76b411c50fff9cb25accf05a
   amd64:
-    1.35.3: sha256:28d570423eaad5f1f5658a646bd8c015c786c95d62ffaf14bf35fa0c4326fa05
     1.35.2: sha256:20887f461c0de96b0cb14c7af6b897f92d424ac078f8642f98e83ef52a0bf03e
     1.35.1: sha256:e7343310e03ff0d424df4397bdfa4468947d6d1f0f93dac586c1e8d6e4086d5d
     1.35.0: sha256:2f4ed7778681649b81244426c29c5d98df60ccabf83d561d69e61c1cbb943ddf
-    1.34.6: sha256:603e15187e0a909a2f104b17b3ea1d927514eae9fe1e96cd8a05b015cf1ee82c
     1.34.5: sha256:660c7da5cca02dcd83ba21bb3df95a8983bb1c0169af396a8cc234a6d6e7297f
     1.34.4: sha256:03b8fea715a7ef82eeaf518dee34c72670c57cc7bc40dc1320c04fbf4f15172f
     1.34.3: sha256:0e759f40bbc717c05227ae3994b77786f58f59ffa0137a34958c6b26fa5bcbbd
     1.34.2: sha256:9c5e717b774ee9b9285ce47e7d2150c29e84837eb19a7eaa24b60b1543c9d58f
     1.34.1: sha256:5a72c596c253ea0b0e5bcc6f29903fd41d1d542a7cadf3700c165a2a041a8d82
     1.34.0: sha256:5c0d28cea2a3a5c91861dda088a29d56c1b027e184dae1d792686f0710750076
-    1.33.10: sha256:ae9cc2e8603f53aedf922c989f3be262d443a6fb19f87e590b5edadbabbc9b07
     1.33.9: sha256:d0cec9b15e1ba1b4e3595754aa2d5200d1c8c704892ac07afe5b04b44bdf288c
     1.33.8: sha256:1caa69c5328cfa774218f75f0621a6f10a1b97e095af85015f468aeb8fdf956a
     1.33.7: sha256:2cea40c8c6929330e799f8fc73233a4b61e63f208739669865e2a23a39c3a007
@@ -124,18 +118,15 @@ kubelet_checksums:
     1.33.1: sha256:f7224648451dd4f9f2c4f79416f9874223c286ce41727788965fd0341ddb59c4
     1.33.0: sha256:dd416d94850c342226d3dcdce838518b040ccea16548bfeaf2595934af88ef60
   ppc64le:
-    1.35.3: sha256:f4665d0ad4f43784d90037d67dcce17cc2b079e4d7b165b85a8a90fb1ddc1b51
     1.35.2: sha256:6516f318a3711e83c0b3b8b069514a87c7dfeda931082c1b561043a7c54e312e
     1.35.1: sha256:ec8b7f870043f711b5d73e528342af1705d6ad7f8308d7f31d74d967986b54f6
     1.35.0: sha256:f24eb1244878a3876fe180e6052822cc9998033850478b2f4776e5c3b09baecd
-    1.34.6: sha256:4047c3c7b3c099554b91a57ca7f1f314445d04acd201609b7f9b4151ba8b2fdb
     1.34.5: sha256:625858ed19559873af61728a50cc250419432ecaa2c8062f78e86e41df358f3c
     1.34.4: sha256:fab75e3eb1e0edf15aef7e8ba219256b44f047544ac421737d1778784fa46676
     1.34.3: sha256:67dcceb6d91710e4da7af720eda7b20fd4e8c24237fc345602bb54439ad8ccca
     1.34.2: sha256:a195f278b9bac26803f1e26b0f608e0dce66aad033e8c043e8555775612530c9
     1.34.1: sha256:c4782dbf1987680e9b2baa3ecf5db9e66395772e82b251eb73a150fbfbe0b906
     1.34.0: sha256:ed663fa4ff3e305276dd889885303e07989dfab073e95ef2da931b975f6686e8
-    1.33.10: sha256:3275d6bf23bcb1a604238bde6c9d790052c6f9fa027bcac57d8c701d09c49e6b
     1.33.9: sha256:2afd4985fa8ef88bbc8e40691b83ad44ccf8ae2e57a17297921f922b4aa6f438
     1.33.8: sha256:392ed39b6c037bc5c510412c9b5cfd29238d31dd67d1a3cbae7ef4a274304c63
     1.33.7: sha256:f96dd4272ca8eccf1f93fb5162323840b9286c5a42a5305fcc1b4d47889534d3
@@ -148,18 +139,15 @@ kubelet_checksums:
     1.33.0: sha256:6fa5abbc14d65b943b00fcfc8a6ac7eb39fd7e924271738c6f17e0b7e74c665b
 kubectl_checksums:
   arm:
-    1.35.3: sha256:9cec279039e5c95c79f939f7245d57cf3f65c799de8d76e68281479ace742f68
     1.35.2: sha256:02b6affb0da9837b88354e44a7a188cbe2ad522060c880c70eacd33f19944c35
     1.35.1: sha256:dbe14e5b12184d72978b17b167aedc3f42f4a1faf249180025d6359eebcd983e
     1.35.0: sha256:dca28f6af03b31ca6043baa1da7332472c7a3df743606a758534b9ac3ed7ecce
-    1.34.6: sha256:7dcec0e5d6cd49608e42988eb6485908ed0be7cdc4a9a874f916806f22cfcf01
     1.34.5: sha256:a042713dd3911a46c2118d2df3967cfcee0e3cdf4e78865e1d427a67cf58e7ba
     1.34.4: sha256:3a6e631bdbb79e633d23055dadc97b45f45d325105ddf40e696de2a324a254c0
     1.34.3: sha256:e0cf1eddede6abfd539e30ccbb4e50f65b2d6ff44b3bb9d9107ea8775a90a7e4
     1.34.2: sha256:18e03c1c6ab1dbff6d2a648bf944213f627369d1daeea5b43a7890181ab33abf
     1.34.1: sha256:ca6218ae8bf366bd8ccdcb440b756c67422a4e04936163845f74d8c056e786ee
     1.34.0: sha256:69d2ce88274caf9d9117b359cc27656fb6f9dd6517c266cfd93c6513043968b8
-    1.33.10: sha256:df63b4cb5ba17eaa8d72dc165e0f1bff0a56ccf348629f5ea18337215ae93f50
     1.33.9: sha256:d6b8a351fb5f1409e2c50c52452884eca09e56cabdaae03cfaa40467661d3ecc
     1.33.8: sha256:734dea07663751c8b45926c843e2c250f13473d65f396555a1ecfe0c9c502fa8
     1.33.7: sha256:f6b9ac99f4efb406c5184d0a51d9ed896690c80155387007291309cbb8cdd847
@@ -171,18 +159,15 @@ kubectl_checksums:
     1.33.1: sha256:6b1cd6e2bf05c6adaa76b952f9c4ea775f5255913974ccdb12145175d4809e93
     1.33.0: sha256:bbb4b4906d483f62b0fc3a0aea3ddac942820984679ad11635b81ee881d69ab3
   arm64:
-    1.35.3: sha256:6f0cd088a82dde5d5807122056069e2fac4ed447cc518efc055547ae46525f14
     1.35.2: sha256:cd859449f54ad2cb05b491c490c13bb836cdd0886ae013c0aed3dd67ff747467
     1.35.1: sha256:706256e21a4e9192ee62d1a007ac0bfcff2b0b26e92cc7baad487a6a5d08ff82
     1.35.0: sha256:58f82f9fe796c375c5c4b8439850b0f3f4d401a52434052f2df46035a8789e25
-    1.34.6: sha256:a49a439f83f504e6bc051f516a8baf8d2220d74110f7f9bcaf25feac69e368d1
     1.34.5: sha256:2d433b53b99ea532f877df6fa5044286e3950d4933967ac3d99262760bc649fd
     1.34.4: sha256:5b982c0644ab1e27780246b9085a5886651b4a7ed86243acbb2bacc1bea01dda
     1.34.3: sha256:46913a7aa0327f6cc2e1cc2775d53c4a2af5e52f7fd8dacbfbfd098e757f19e9
     1.34.2: sha256:95df604e914941f3172a93fa8feeb1a1a50f4011dfbe0c01e01b660afc8f9b85
     1.34.1: sha256:420e6110e3ba7ee5a3927b5af868d18df17aae36b720529ffa4e9e945aa95450
     1.34.0: sha256:00b182d103a8a73da7a4d11e7526d0543dcf352f06cc63a1fde25ce9243f49a0
-    1.33.10: sha256:e9494229893ccddc81065275c0e5f21167518ab939f0e95aecb649fb4b41c112
     1.33.9: sha256:af4dc943a6f447ecb070340efe63c7f8ee2808e6c0bc42126efe7cde0cc1e69b
     1.33.8: sha256:76e284669f1f6343bd9fe2a011757809c8c01cf51da9f85ee6ef4eb93c8393a8
     1.33.7: sha256:fa7ee98fdb6fba92ae05b5e0cde0abd5972b2d9a4a084f7052a1fd0dce6bc1de
@@ -194,18 +179,15 @@ kubectl_checksums:
     1.33.1: sha256:d595d1a26b7444e0beb122e25750ee4524e74414bbde070b672b423139295ce6
     1.33.0: sha256:48541d119455ac5bcc5043275ccda792371e0b112483aa0b29378439cf6322b9
   amd64:
-    1.35.3: sha256:fd31c7d7129260e608f6faf92d5984c3267ad0b5ead3bced2fe125686e286ad6
     1.35.2: sha256:924eb50779153f20cb668117d141440b95df2f325a64452d78dff9469145e277
     1.35.1: sha256:36e2f4ac66259232341dd7866952d64a958846470f6a9a6a813b9117bd965207
     1.35.0: sha256:a2e984a18a0c063279d692533031c1eff93a262afcc0afdc517375432d060989
-    1.34.6: sha256:3166155b17198c0af34ff5a360bd4d9d58db98bafadc6f3c2a57ae560563cd6b
     1.34.5: sha256:6a17dd8387783b3144a65535e38d02c351027e9718ea34a6c360476cb26d28bb
     1.34.4: sha256:d50c359d95e0841eaad08ddc27c7be37cba8fdccfba5c8e2ded65e121ff112db
     1.34.3: sha256:ab60ca5f0fd60c1eb81b52909e67060e3ba0bd27e55a8ac147cbc2172ff14212
     1.34.2: sha256:9591f3d75e1581f3f7392e6ad119aab2f28ae7d6c6e083dc5d22469667f27253
     1.34.1: sha256:7721f265e18709862655affba5343e85e1980639395d5754473dafaadcaa69e3
     1.34.0: sha256:cfda68cba5848bc3b6c6135ae2f20ba2c78de20059f68789c090166d6abc3e2c
-    1.33.10: sha256:f156acb753ee4366789ab7a663916eb580e7ee1b9e449bc9b052181db524e3f5
     1.33.9: sha256:9e33e3234c0842cd44a12c13e334b4ce930145ea84b855ce7cc0a7b6bc670c22
     1.33.8: sha256:7f9c3faab7c9f9cc3f318d49eb88efc60eb3b3a7ce9eee5feb39b1280e108a29
     1.33.7: sha256:471d94e208a89be62eb776700fc8206cbef11116a8de2dc06fc0086b0015375b
@@ -217,18 +199,15 @@ kubectl_checksums:
     1.33.1: sha256:5de4e9f2266738fd112b721265a0c1cd7f4e5208b670f811861f699474a100a3
     1.33.0: sha256:9efe8d3facb23e1618cba36fb1c4e15ac9dc3ed5a2c2e18109e4a66b2bac12dc
   ppc64le:
-    1.35.3: sha256:71bbea965f06679407e3b394103c83104d730510cdb5e1d1826359d789eeef7c
     1.35.2: sha256:2101400af7fb53d326cee8d3411c9348e0735ac85d7059cd61514632181b8810
     1.35.1: sha256:bced44e491ce52cce11e2b4bd4bd9181f4f963ffe868438778d028d56485c5d9
     1.35.0: sha256:8989809d0ac771244dabe50ed742249ac60eeb6d385cd234ee151eb40b7c32c4
-    1.34.6: sha256:21c68869ad4adce9ea9ad6f3a3adb031104331e1a5f442ab01a4b6851d6a6c0e
     1.34.5: sha256:22e5813388d20881c2225c86420cd2ff69ed7fc5e953842bb041d4842c38d7f7
     1.34.4: sha256:b083c39879483816f34d1f7e2e31e70ec48984fcc1753c79f4b846cfedbf41ac
     1.34.3: sha256:ae239b7f6f071e47014e1b5b20aa60626e06b32922a6b5054562ae2c5fa82c18
     1.34.2: sha256:49a985986a9add6c229c628bf2a83addebbdeeef40469fce2a54e51b6f1bb05b
     1.34.1: sha256:45499f0728b4a3428400db289edb444609d41787061f09b66f18028c0a73652f
     1.34.0: sha256:1773805a0c128f4d267b2e11f4c74cac287e9a07fffaecc3f7af6df9c8aaf82c
-    1.33.10: sha256:9ecb0ebd9bb289258ef07a7646e39be6b7e0afb2fde85f6fb075798b4685a8d6
     1.33.9: sha256:0641f8f8a6153c13dc3ab90a86e242d095a218d30e13cf42c41000e9a7ccc9c3
     1.33.8: sha256:aa079f403c80ba6017449c230733fed4e5d7b0a8700bd6590ee202161b8b12af
     1.33.7: sha256:0807c38a1342ab8dea6435f33d5897a01527d348a968a5c4ca2929769f3d54f2
@@ -241,18 +220,15 @@ kubectl_checksums:
     1.33.0: sha256:580d076c891711ec37afaf5994f72a8aad9d45c25413e6e94648e988a5a9933a
 kubeadm_checksums:
   arm64:
-    1.35.3: sha256:647a9821c37a27bcaf6d679a191732b686c01cecd0219d5e579129f0cfd62cef
     1.35.2: sha256:b540b734e9eaeb134e2cb7c7803dc62160589ac3b2615d717ce41acb22bbec98
     1.35.1: sha256:80097a3c4ef824f4edfe131d2bd429772c4be3a460c42a44f2320164a917de32
     1.35.0: sha256:1dac7dc2c6a56548bbc6bf8a7ecf4734f2e733fb336d7293d84541ebe52d0e50
-    1.34.6: sha256:7878391ea18b276ad69c570dcdaa46f74449a978f8e222f92d99855332a01f62
     1.34.5: sha256:cc8a59c0f04a1d7389790dc872b1c714e4cf4d3ba0c38ca2f4ca1388fb38b774
     1.34.4: sha256:d8028b7e8c8d6c9b3fc3da6bc88d4d0cfb33df1b4b026a7d6e8c35d1471c9f6e
     1.34.3: sha256:697cf3aa54f1a5740b883a3b18a5d051b4032fd68ba89af626781a43ec9bccc3
     1.34.2: sha256:065f7de266c59831676cc48b50f404fd18d1f6464502d53980957158e4cab3a7
     1.34.1: sha256:b0dc5cf091373caf87d069dc3678e661464837e4f10156f1436bd35a9a7db06b
     1.34.0: sha256:6b7108016bb2b74132f7494e200501d6522682c01759db91892051a052079c77
-    1.33.10: sha256:c7d822a9517ccc6921f22447ad75d3f6edb88ca3a44e366057ad3cddc4e77922
     1.33.9: sha256:d57594c581998d011b7c3ec77fde8b5a2d9e37885f21b749b423087715dc4511
     1.33.8: sha256:b5248b51e66e4716261f2c926fe2f08a293795e6863099e7792b4d57dbb9109e
     1.33.7: sha256:b24eeeff288f9565e11a2527e5aed42c21386596110537adb805a5a2a7b3e9ce
@@ -264,18 +240,15 @@ kubeadm_checksums:
     1.33.1: sha256:5b3e3a1e18d43522fdee0e15be13a42cee316e07ddcf47ef718104836edebb3e
     1.33.0: sha256:746c0ee45f4d32ec5046fb10d4354f145ba1ff0c997f9712d46036650ad26340
   amd64:
-    1.35.3: sha256:a3fb4b3a214a807e2ef4c3fda3196c7f97dcf8152558de5a3c473c869bda0b07
     1.35.2: sha256:a51cb85c70c98ec6868fd3413ac786af5fab4ce51438963752ec5f58e68e5452
     1.35.1: sha256:8a7ff344eef1bfba88f9a74b3fdc9ea4448c94f1b3cefb8c0aeeaf1f96e05053
     1.35.0: sha256:729e7fb34e4f1bfcf2bdaf2a14891ed64bd18c47aaab42f8cc5030875276cfed
-    1.34.6: sha256:75a48673b8b9149c1555e0de3a2ce603468037d5396d746a75158828c9b56d7c
     1.34.5: sha256:e381f7f5c41f2a6916432177d95c1ee95d5539f790bbeacafe9ef61dc68e8e35
     1.34.4: sha256:b967f1fa0e36621c402d38bb560eb4a943954d5cf5a00e5150842f6f5da73455
     1.34.3: sha256:f9ce265434d306e59d800b26f3049b8430ba71f815947f4bacdcdc33359417fb
     1.34.2: sha256:6a2346006132f6e1ed0b5248e518098cf5abbce25bf11b8926fb1073091b83f4
     1.34.1: sha256:20654fd7c5155057af5c30b86c52c9ba169db6229eee6ac7abab4309df4172e7
     1.34.0: sha256:aecc23726768d1753fd417f6e7395cb1a350373295e8e9d9f80e95ed3618e38e
-    1.33.10: sha256:e06fa8adac158ef8bb0bc05c0b64dcfab7abcd7950a27bb5c1b70d70ff98a874
     1.33.9: sha256:9732cc2383e73f64275326e02a5595c792a94ee0ebf84cea37a32fcbf926e6e5
     1.33.8: sha256:8259af514dc3655e8abec1a69b637f31cce2ecb940a80ae4a268e5287890f009
     1.33.7: sha256:c10813d54f58ef33bbe6675f3d39c8bd401867743ebc729afdd043265040c31d
@@ -287,18 +260,15 @@ kubeadm_checksums:
     1.33.1: sha256:9a481b0a5f1cee1e071bc9a0867ca0aad5524408c2580596c00767ba1a7df0bd
     1.33.0: sha256:5a65cfec0648cabec124c41be8c61040baf2ba27a99f047db9ca08cac9344987
   ppc64le:
-    1.35.3: sha256:907fb03a83683e82b0d183675a0c6f0cd36b2cc3970bfe8fdb47098f67ce7828
     1.35.2: sha256:8a3800d88070679a09d2c5cd5dd479d70539dce84415623e876cbaf366d94043
     1.35.1: sha256:eec12948cfabc18115636c44aca894bf9abef3b2ea73cba180314ee3c218dcca
     1.35.0: sha256:77a466e1b6a8e28362a729541269de0a7c4a6b9e7770cccefcd745502e656b90
-    1.34.6: sha256:afd06f4f900e6cd65a93248829c9d521c5e78c22ecf9f212628cc7456f14a23b
     1.34.5: sha256:5e5d7dba56b5bb663e70a5d7962b0f6d4328d9b9a8ee77ddbb2e9760265ff61d
     1.34.4: sha256:69f1065e718ef2aa5f0287444ef97bd4a5fb8841fc0662f54ca8992a39865391
     1.34.3: sha256:2b8b48b3b0eb657e04122a158cb7fcad964fba5bd2d8e07f8eeec6f856a63ecf
     1.34.2: sha256:bea4ed6d971523da794a802de15910b08c09e23bc4c850ee3b953c4bdb0b7976
     1.34.1: sha256:ddb6bd80bee0719924ae901672b99205226badab74fb13a9e1bb6d3de49fbb21
     1.34.0: sha256:7201ba36f44187f408a036c4a545e2a3cd12943b1297092687bb66c9a1a9fed6
-    1.33.10: sha256:5f23294874bdd4097601f9068344ebfa5be4a8d4ce14380fe4f9b764a20f5bb9
     1.33.9: sha256:b644b9947f3b79d0ff4c19389cf23f436bb5d6f23166ed3b4e0aee09775b3065
     1.33.8: sha256:d618fa97b5782b57512e0a8ab9ed17af190236907af7bd3c9c0776d81c78273f
     1.33.7: sha256:db2e20d0c20928ae7d68d7603020f8ffd89dcdac4fdc160ef83f1da663868bed
@@ -311,7 +281,6 @@ kubeadm_checksums:
     1.33.0: sha256:26cb7ac57d522a59c84c4784b176097d23c7b4e61874fab84ae719d0e43ac0bc
 etcd_binary_checksums:
   arm64:
-    3.6.9: sha256:b51e433724325b66770019c4819d091b8965d2e81c07571a46e0619da1c8ece6
     3.6.8: sha256:438f56a700d17ce761510a3e63e6fa5c1d587b2dd4d7a22c179c09a649366760
     3.6.7: sha256:ef5fc443cf7cc5b82738f3c28363704896551900af90a6d622cae740b5644270
     3.6.6: sha256:8a15f5427c111ff4692753682374970fb68878401d946c2c28bdad6857db652f
@@ -321,7 +290,6 @@ etcd_binary_checksums:
     3.6.2: sha256:79d0a2488967aa07ecfde79158b1dab458158522f834810c2827eecac4695a31
     3.6.1: sha256:5f8ed6e314df44128c218decbf0d146cf882583d05c6f6d9023ce905d232aaec
     3.6.0: sha256:81477b120ef66ff338fe7de63d894e5feec17e6e1f1d98507676832e089d9b58
-    3.5.28: sha256:779a741604d2ff45240b277812f6c300bca71754adfd8de1436a3f2df3a18e67
     3.5.27: sha256:1277309f540c5a0329c428f95455c9f76d24f768c8d28fd2753e891c379053fa
     3.5.26: sha256:93ac1667df0e178ea6d152476ce4088df4075604fe4bc7f85f4719e863cd030b
     3.5.25: sha256:419dce0b679df31cc45201ef2449b7a6a48e9d241af01741957c9ac86a35badc
@@ -345,7 +313,6 @@ etcd_binary_checksums:
     3.5.7: sha256:1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51
     3.5.6: sha256:888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87
   amd64:
-    3.6.9: sha256:633136f13fcadac52e5c0ddcb97912643af6fcb9cb362e75774d0f96f7666396
     3.6.8: sha256:cf9cfe91a4856cb90eed9c99e6aee4b708db2c7888b88a6f116281f04b0ea693
     3.6.7: sha256:cf8af880c5a01ee5363cefa14a3e0cb7e5308dcf4ed17a6973099c9a7aee5a9a
     3.6.6: sha256:887afaa4a99f22d802ccdfbe65730a5e79aa5c9ce2c8799c67e9d804c50ecedb
@@ -355,7 +322,6 @@ etcd_binary_checksums:
     3.6.2: sha256:4b5d55d61e2218fab7c1cc1c00b341c469159ecde8cedd575fa858683f67e9f4
     3.6.1: sha256:1324664bfe56d178d1362a57462ca5a7b26a6d2cbe9e1c94b6820e32cb82d673
     3.6.0: sha256:42305b0dcbba7b6fdff0382d0c7b99c42026c88c44847a619ab58cde216725d9
-    3.5.28: sha256:e11b6fab2ffbf0a1d6ee8f6227594045a19e0974ec779c42b8b5bb1942b2abe0
     3.5.27: sha256:0aad9a9e4e0817a021e933f9806a2b2960a62f949ad5a3d6436d8886945cb1bc
     3.5.26: sha256:0a682a91201dc8351d507210bc30b021a11e254eab806f03224b51e8fad29abb
     3.5.25: sha256:168af82b59772e1811a9af7b358d42f5c6df44e0d9767afb006ecf12c4bbd607
@@ -379,7 +345,6 @@ etcd_binary_checksums:
     3.5.7: sha256:a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396
     3.5.6: sha256:4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb
   ppc64le:
-    3.6.9: sha256:bd21e07aa8f19308c96986bf9457f779ba8103a3204066bb89c8c3fb7a1e47dc
     3.6.8: sha256:3b9bb486b0eb8d79b30410749ec26e174db075956c9ecb533b313b9263e7ba78
     3.6.7: sha256:de3b1ed50fc8868cdd56b12b0cd81d6740bf53edbca570400a78e530e4829b7b
     3.6.6: sha256:e4f528b63a731e9b96f5d10f55ce096223fb4e1bc1778aa2535a3d47e9a129e5
@@ -389,7 +354,6 @@ etcd_binary_checksums:
     3.6.2: sha256:bf79b9d4c7e9f86e611e73de9fe54a195bc0ad54aeb17200b1c8bda3c4119705
     3.6.1: sha256:bb87fcd0ea4b9fabf502703512c416ca1d9f4082679cb7f6dbc34bed3dfc13f6
     3.6.0: sha256:1180d06e3a3787ab65078d9a488f778a4712c59cc82d614abde80c5d06efe38f
-    3.5.28: sha256:f928b7f0e615d8125640c0840121ad0001d0736531fd0b95ad24514a8ce0ba3b
     3.5.27: sha256:b41d488dcd579e780f49f5bd747e9386e17e1376ffb77bfff061f7944818a678
     3.5.26: sha256:9678ddaced9fcd4878b76b0b76c9c2a3638a70bdc362c9f4cb25ecc48de2c6d3
     3.5.25: sha256:0dee64e99a43a06dd9541a40a18b52c7309eb1682a2a32740d4bdf358296c007
@@ -435,7 +399,6 @@ cni_binary_checksums:
     1.6.0: sha256:d8d4bd74247407c8c73de057bc00adac28bb1ed2d2ee60a9dda278e3b398bcc2
 calicoctl_binary_checksums:
   arm64:
-    3.30.7: sha256:e62d6f909d72bfd8876a363c3f49cda722d7bfdb282a4bbdeca38dd7e26e7578
     3.30.6: sha256:47ecc00bdd797f82e4bac0ff3904c3a5143ba2d61e8ae1cbbce286ca76d3790a
     3.30.5: sha256:7611343e7a56e770b95e2bb882dda787efbbd4331b1dd6316ff8ea189238dfaa
     3.30.4: sha256:b21fbbc55b6f5d50c1c0faae714242cae3e013185cb8e26ce56981bd10da260d
@@ -458,7 +421,6 @@ calicoctl_binary_checksums:
     3.28.1: sha256:c062d13534498a427c793a4a9190be4df3cf796a3feb29e4a501e1d6f48daa7c
     3.28.0: sha256:c4ca8563d2a920729116a3a30171c481580c8c447938ce974ce14d7ce25a31bf
   amd64:
-    3.30.7: sha256:087e1547878913587ebaa756686f38184a730e9af9b71f3d91b92f6c99b60c11
     3.30.6: sha256:2017e19727dca689d8bb73a9d8dff3c6a8ba7d8c75049f99ee207272161b5749
     3.30.5: sha256:6cdfb17b0276f648f4fdb051a5d75617a50b3c328d4cccfc40d087b96c361d80
     3.30.4: sha256:7e2e5e75b25c55683b68eabeb9b00390b1d359e72bf57f7ec2b76bb006fd175f
@@ -481,7 +443,6 @@ calicoctl_binary_checksums:
     3.28.1: sha256:22ec5727c38dbe19001792b4ca64ac760a6e2985d5c1a231d919dbebe5bca171
     3.28.0: sha256:4ea270699e67ca29e5533ddb0a68d370cb0005475796c7e841f83047da6297b6
   ppc64le:
-    3.30.7: sha256:a7a5bbd35abeaa39625d101ddb075ed04f08c1ffb209ef60b3f0204336073379
     3.30.6: sha256:9a9c368499b1e3d08418dfbb566379483e15c50d08dd1bcaf6148c115d82ed36
     3.30.5: sha256:5b6de49da1af2633549bff5e8f4d8a573a175b65c47c29d327ef6a0760d39a93
     3.30.4: sha256:8fc8ef492d463e184e714bc6d31b05f9066c8af3445928efef233850f036bb92
@@ -580,7 +541,6 @@ ciliumcli_binary_checksums:
     0.16.0: sha256:da98675f961833d4ffd68b1046d907b228a7d394ded2abd70a50b20eaca171c4
 calico_crds_checksums:
   no_arch:
-    3.30.7: sha256:b0eb83f6d70afac27e8830f22642cd12b0692e4d1a1b5060caa9231a951e736a
     3.30.6: sha256:b0eb83f6d70afac27e8830f22642cd12b0692e4d1a1b5060caa9231a951e736a
     3.30.5: sha256:68bbe7f44693374f1379aa3fa55f254e9a689d070c26d0de26b2c9fb8d1166ab
     3.30.4: sha256:be1d346a966a0be79cad7c9856ee5fc0eef8d88b70eba8d4d0bc4be057138bd3
@@ -702,7 +662,6 @@ cri_dockerd_archive_checksums:
     0.3.5: sha256:30d47bd89998526d51a8518f9e8ef10baed408ab273879ee0e30350702092938
 runc_checksums:
   arm64:
-    1.3.5: sha256:bd843d75a788e612c9df286b1fa519a44fcbb7a7b8d01e2268431433cc7c718c
     1.3.4: sha256:d6dcab36d1b6af1b72c7f0662e5fcf446a291271ba6006532b95c4144e19d428
     1.3.3: sha256:3c9a8e9e6dafd00db61f4611692447ebab4a56388bae4f82192aed67b66df712
     1.3.2: sha256:06fbccb4528ecd490f3f333d6dcf22c876bd72a024813a0c0a46312121f4c5fd
@@ -727,7 +686,6 @@ runc_checksums:
     1.1.9: sha256:b43e9f561e85906f469eef5a7b7992fc586f750f44a0e011da4467e7008c33a0
     1.1.8: sha256:7c22cb618116d1d5216d79e076349f93a672253d564b19928a099c20e4acd658
   amd64:
-    1.3.5: sha256:66fa8390be8fb3b23dfbb60c767368bb5b51f1acfa88692bbff1a82953d4d9e9
     1.3.4: sha256:5966ca40b6187b30e33bfc299c5f1fe72e8c1aa01cf3fefdadf391668f47f103
     1.3.3: sha256:8781ab9f71c12f314d21c8e85f13ca1a82d90cf475aa5131a7b543fcc5487543
     1.3.2: sha256:e7a8e30bd6d248f494aae9163521ff4eb112a30602ac56ada0871e3531269c2d
@@ -752,7 +710,6 @@ runc_checksums:
     1.1.9: sha256:b9bfdd4cb27cddbb6172a442df165a80bfc0538a676fbca1a6a6c8f4c6933b43
     1.1.8: sha256:1d05ed79854efc707841dfc7afbf3b86546fc1d0b3a204435ca921c14af8385b
   ppc64le:
-    1.3.5: sha256:62e8f062291c2b2b29bd8ab8c983cef56409063287e256c50ab54fb54f5d98a7
     1.3.4: sha256:268d9be1188f3efa82cad0d8e6b938d8da0d741427660d874ca9386c68d72937
     1.3.3: sha256:c42394e7cf7cd508a91b090b72d57ff4df262effde742d5e29ea607e65f38b43
     1.3.2: sha256:9373062bc547b5afe44fb0122a12aaa980763969d4b69dd17134a6a292838ce5
@@ -823,7 +780,6 @@ kata_containers_binary_checksums:
     3.5.0: sha256:fa4cf67d010244c4f8d0e6d450d04e28d1bbce5ad1a3cbc0154adff628d56c0c
 gvisor_runsc_binary_checksums:
   arm64:
-    '20260316.0': sha512:d73d7dc4b318b513c0df2e4d568a81d894695ab60a892da670d8fd3502dbe0983aaf450b2bdc5df0940d3c5ca7ff5bee9245893f35f2c54d6a3ecb83c55cdcb5
     '20260309.0': sha512:85d37e7a0b249706f1b3b0ec5d84cc38f4dd53a4e490395f489eb406194529233631405be8bcd1648126db3fc0221a8a1b599743eca2b183b2a35ef3aca638fa
     '20260302.0': sha512:1f5a81cd6080252d4bee22e0828ed796b438bc768b0845015457944ca659b37fa5a2c22acdf655963b1a27855d5bb2263887463238eaf930efb55b0e4ca801ed
     '20260223.0': sha512:b3077dc8da3142b117829955ea8ecca7f75fda22f8bd59323a62ba34c6b836f62edea0b10ce0b745d3cd001814cd215175a3bd51d90abc07556bafe600683056
@@ -860,7 +816,6 @@ gvisor_runsc_binary_checksums:
     '20250414.0': sha512:d1ba68b20057622e58e886f472e021a473222590c936a86951005d7b97366b446ef0342b91457ffc0d7e543d54c9c06a363f2883bdd6c594799c4ca1091dabd5
     '20250407.0': sha512:cb590f72b0fbda45e89a2300e9247f12ff295a8c52653c8cf815c662d3fbbc774f9b915cdd4fad59e30694d8cc8737fe2a1a8186ab5136f7701bd6e6877a1662
   amd64:
-    '20260316.0': sha512:224cd1518f43c2b58052f1d15b0ff0736eac07562d0cb584415798b172cc15a18b0a5644cc37916c6759a0860d1c67eb54cede843cfdb94f0b11657d86aa41f4
     '20260309.0': sha512:2f2d5092d53cae40c53006dead1c5b75552f7c901b9f15bd63b967d2444b59953647c029548ee3950adac0de82be6411a7bf199b3aa7a1dfaab59a51509e4768
     '20260302.0': sha512:67c0125cc0e3b2633c2557ab0d76f1f15f9fe7b47db77b5a0c4d1e025b184c3f10803b88109948378995cf72068a5d486b05bac8f7a69ca77bf38460ae43ccdc
     '20260223.0': sha512:9ec46dca073545187cc6640350b728d5eb358740919236915f7f1619fdeb1ed14815dd4b117156ea2c6b00a9cf97024902dd6ee9b2b6be0693f1e930c59f40c2
@@ -898,7 +853,6 @@ gvisor_runsc_binary_checksums:
     '20250407.0': sha512:097259d6d93548bf669e21cfec5ba6a47081e43f61d22c5d8a8a4c0c209c81ac9c4454162b826f98cec49e047bbdc29c270113ab6db5519ef3e6a90f302fa47b
 gvisor_containerd_shim_binary_checksums:
   arm64:
-    '20260316.0': sha512:6959774b99cfad26d588cde8dea4f21a3c9e6cdb1f49ca20bca6a356ef0c17898662ec1eb218c802bb2a034a7a06d3ba458d39ca49327cb838eb3a14ef9e8ddb
     '20260309.0': sha512:43ffb3accd1b4e3d12319824917b3defd268190b1efcdce76bdaea862e7784c598dbd1dd4a3565d12db01452a02609fd1d0b68d9e29c4d26cac5dfde1329a8cb
     '20260302.0': sha512:9bdc7ed0fe570223e6a60368d75e19dd2b211d1b4f84cfbc3d466b0be8b028ba75f49bd9b97e2836ab30140ef2910aec81bebdc444ae9e83805236e5e165b0a9
     '20260223.0': sha512:9bdc7ed0fe570223e6a60368d75e19dd2b211d1b4f84cfbc3d466b0be8b028ba75f49bd9b97e2836ab30140ef2910aec81bebdc444ae9e83805236e5e165b0a9
@@ -935,7 +889,6 @@ gvisor_containerd_shim_binary_checksums:
     '20250414.0': sha512:33b9c67bc7b73ca49154aff48da52029414a707b6a3a25eb4f71e861a94dec8fce220e63a162841670ddd4876f45b0e39abdf9f8c3235019c89f209684d3007d
     '20250407.0': sha512:1c3838e10c905af0cb52697712bf6bd76b94c9e9d3d07a7643cd43dc2f8dab03b4ed4693c117e555e07a158e04ee583b6b1f1cf2fb9705244ffa5fdc4af67248
   amd64:
-    '20260316.0': sha512:427f141f011b79cc68b4b805e2d15f040d96e1b2324d139e16948e4f94e6bb63c40c14111ad9e0c6c319e44da9e5b99c39924a1feef88919fcca2dea55256c90
     '20260309.0': sha512:f5708fd1fdad4da12f440780c2c09ca6f2ca7cb47089e24e536851388bae54228927a462d61c584c3adf3426f03addea9f08e390be39c744cac008a84e7559e9
     '20260302.0': sha512:7b0cbc9130b4f2fdffe45d0f811070a868bbcdafc9cc30264108ee35fa17ee3a54f1a1c7775619c6afa4b7fc623bd4acf0e80f4fb40fbc7f1f58a1cceb8a9f83
     '20260223.0': sha512:7b0cbc9130b4f2fdffe45d0f811070a868bbcdafc9cc30264108ee35fa17ee3a54f1a1c7775619c6afa4b7fc623bd4acf0e80f4fb40fbc7f1f58a1cceb8a9f83

roles/network_facts/defaults/main.yml

@@ -1,5 +0,0 @@
----
-# Additional string host to inject into NO_PROXY
-additional_no_proxy: ""
-additional_no_proxy_list: "{{ additional_no_proxy | split(',') }}"
-no_proxy_exclude_workers: false

roles/network_facts/tasks/main.yaml

@@ -1,12 +1,16 @@
 ---
-- name: Gather node IPs
+- name: Set facts variables
+  tags:
+    - always
+  block:
+    - name: Gather node IPs
       setup:
         gather_subset: '!all,!min,network'
         filter: "ansible_default_ip*"
       when: ansible_default_ipv4 is not defined or ansible_default_ipv6 is not defined
       ignore_unreachable: true
 
-- name: Set computed IPs variables
+    - name: Set computed IPs varables
       vars:
         fallback_ip: "{{ ansible_default_ipv4.address | d('127.0.0.1') }}"
         fallback_ip6: "{{ ansible_default_ipv6.address | d('::1') }}"
@@ -30,34 +34,8 @@
         main_access_ips: "{{ _access_ips | select }}"
         main_ips: "{{ _ips | select }}"
 
-- name: Set no_proxy to all assigned cluster IPs and hostnames
+    - name: Set no_proxy
+      import_tasks: no_proxy.yml
       when:
         - http_proxy is defined or https_proxy is defined
         - no_proxy is not defined
-  vars:
-    groups_with_no_proxy:
-      - kube_control_plane
-      - "{{ '' if no_proxy_exclude_workers else 'kube_node' }}" # TODO: exclude by a boolean in inventory rather than global variable
-      - etcd
-      - calico_rr
-    hosts_with_no_proxy: "{{ groups_with_no_proxy | select | map('extract', groups) | select('defined') | flatten }}"
-    _hostnames: "{{ (hosts_with_no_proxy +
-                      (hosts_with_no_proxy | map('extract', hostvars, morekeys=['ansible_hostname'])
-                      | select('defined')))
-                    | unique }}"
-    no_proxy_prepare:
-      - "{{ apiserver_loadbalancer_domain_name | d('') }}"
-      - "{{ loadbalancer_apiserver.address if loadbalancer_apiserver is defined else '' }}"
-      - "{{ hosts_with_no_proxy | map('extract', hostvars, morekeys=['main_access_ip']) }}"
-      - "{{ _hostnames }}"
-      - "{{ _hostnames | map('regex_replace', '$', '.' + dns_domain ) }}"
-      - "{{ additional_no_proxy_list }}"
-      - 127.0.0.1
-      - localhost
-      - "{{ kube_service_subnets }}"
-      - "{{ kube_pods_subnets }}"
-      - svc
-      - "svc.{{ dns_domain }}"
-  set_fact:
-    no_proxy: "{{ no_proxy_prepare | select | flatten | unique | join(',') }}"
-  run_once: true

roles/network_facts/tasks/no_proxy.yml

@@ -0,0 +1,40 @@
+---
+- name: Set no_proxy to all assigned cluster IPs and hostnames
+  set_fact:
+    # noqa: jinja[spacing]
+    no_proxy_prepare: >-
+      {%- if loadbalancer_apiserver is defined -%}
+      {{ apiserver_loadbalancer_domain_name }},
+      {{ loadbalancer_apiserver.address | default('') }},
+      {%- endif -%}
+      {%- if no_proxy_exclude_workers | default(false) -%}
+      {% set cluster_or_control_plane = 'kube_control_plane' %}
+      {%- else -%}
+      {% set cluster_or_control_plane = 'k8s_cluster' %}
+      {%- endif -%}
+      {%- for item in (groups[cluster_or_control_plane] + groups['etcd'] | default([]) + groups['calico_rr'] | default([])) | unique -%}
+      {{ hostvars[item]['main_access_ip'] }},
+      {%- if item != hostvars[item].get('ansible_hostname', '') -%}
+      {{ hostvars[item]['ansible_hostname'] }},
+      {{ hostvars[item]['ansible_hostname'] }}.{{ dns_domain }},
+      {%- endif -%}
+      {{ item }},{{ item }}.{{ dns_domain }},
+      {%- endfor -%}
+      {%- if additional_no_proxy is defined -%}
+      {{ additional_no_proxy }},
+      {%- endif -%}
+      127.0.0.1,localhost,{{ kube_service_subnets }},{{ kube_pods_subnets }},svc,svc.{{ dns_domain }}
+  delegate_to: localhost
+  connection: local
+  delegate_facts: true
+  become: false
+  run_once: true
+
+- name: Populates no_proxy to all hosts
+  set_fact:
+    no_proxy: "{{ hostvars.localhost.no_proxy_prepare | select }}"
+    # noqa: jinja[spacing]
+    proxy_env: "{{ proxy_env | combine({
+        'no_proxy': hostvars.localhost.no_proxy_prepare,
+        'NO_PROXY': hostvars.localhost.no_proxy_prepare
+      }) }}"

roles/network_plugin/calico/templates/calico-apiserver.yml.j2

@@ -177,9 +177,6 @@ rules:
   - blockaffinities
   - caliconodestatuses
   - tiers
-  - stagednetworkpolicies
-  - stagedglobalnetworkpolicies
-  - stagedkubernetesnetworkpolicies
   verbs:
   - get
   - list

roles/network_plugin/calico/templates/calico-cr.yml.j2

@@ -215,17 +215,3 @@ rules:
       - calico-cni-plugin
     verbs:
       - create
-{% if calico_version is version('3.29.0', '>=') %}
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: calico-tier-getter
-rules:
-  - apiGroups:
-      - "projectcalico.org"
-    resources:
-      - "tiers"
-    verbs:
-      - "get"
-{% endif %}

roles/network_plugin/calico/templates/calico-crb.yml.j2

@@ -26,18 +26,3 @@ subjects:
 - kind: ServiceAccount
   name: calico-cni-plugin
   namespace: kube-system
-{% if calico_version is version('3.29.0', '>=') %}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: calico-tier-getter
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: calico-tier-getter
-subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: system:kube-controller-manager
-{% endif %}

roles/network_plugin/cilium/defaults/main.yml

@@ -14,6 +14,21 @@ cilium_l2announcements: false
 # Cilium agent health port
 cilium_agent_health_port: "9879"
 
+# Identity allocation mode selects how identities are shared between cilium
+# nodes by setting how they are stored. The options are "crd" or "kvstore".
+# - "crd" stores identities in kubernetes as CRDs (custom resource definition).
+#   These can be queried with:
+#     `kubectl get ciliumid`
+# - "kvstore" stores identities in an etcd kvstore.
+# - In order to support External Workloads, "crd" is required
+#   - Ref: https://docs.cilium.io/en/stable/gettingstarted/external-workloads/#setting-up-support-for-external-workloads-beta
+# - KVStore operations are only required when cilium-operator is running with any of the below options:
+#   - --synchronize-k8s-services
+#   - --synchronize-k8s-nodes
+#   - --identity-allocation-mode=kvstore
+#   - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
+cilium_identity_allocation_mode: crd
+
 # Etcd SSL dirs
 cilium_cert_dir: /etc/cilium/certs
 kube_etcd_cacert_file: ca.pem

roles/network_plugin/cilium/templates/cilium/cilium-bgp-advertisement.yml.j2

@@ -1,6 +1,6 @@
 {% for cilium_bgp_advertisement in cilium_bgp_advertisements %}
 ---
-apiVersion: "cilium.io/v2"
+apiVersion: "cilium.io/v2alpha1"
 kind: CiliumBGPAdvertisement
 metadata:
   name: "{{ cilium_bgp_advertisement.name }}"

roles/network_plugin/cilium/templates/cilium/cilium-bgp-cluster-config.yml.j2

@@ -1,6 +1,6 @@
 {% for cilium_bgp_cluster_config in cilium_bgp_cluster_configs %}
 ---
-apiVersion: "cilium.io/v2"
+apiVersion: "cilium.io/v2alpha1"
 kind: CiliumBGPClusterConfig
 metadata:
   name: "{{ cilium_bgp_cluster_config.name }}"

roles/network_plugin/cilium/templates/cilium/cilium-bgp-node-config-override.yml.j2

@@ -1,6 +1,6 @@
 {% for cilium_bgp_node_config_override in cilium_bgp_node_config_overrides %}
 ---
-apiVersion: "cilium.io/v2"
+apiVersion: "cilium.io/v2alpha1"
 kind: CiliumBGPNodeConfigOverride
 metadata:
   name: "{{ cilium_bgp_node_config_override.name }}"

roles/network_plugin/cilium/templates/cilium/cilium-bgp-peer-config.yml.j2

@@ -1,6 +1,6 @@
 {% for cilium_bgp_peer_config in cilium_bgp_peer_configs %}
 ---
-apiVersion: "cilium.io/v2"
+apiVersion: "cilium.io/v2alpha1"
 kind: CiliumBGPPeerConfig
 metadata:
   name: "{{ cilium_bgp_peer_config.name }}"

roles/network_plugin/cilium/templates/cilium/cilium-loadbalancer-ip-pool.yml.j2

@@ -1,6 +1,6 @@
 {% for cilium_loadbalancer_ip_pool in cilium_loadbalancer_ip_pools %}
 ---
-apiVersion: "cilium.io/v2"
+apiVersion: "cilium.io/v2alpha1"
 kind: CiliumLoadBalancerIPPool
 metadata:
   name: "{{ cilium_loadbalancer_ip_pool.name }}"

roles/network_plugin/cilium/templates/values.yaml.j2

@@ -62,8 +62,8 @@ cni:
 
 autoDirectNodeRoutes: {{ cilium_auto_direct_node_routes | to_json }}
 
-ipv4NativeRoutingCIDR: "{{ cilium_native_routing_cidr }}"
+ipv4NativeRoutingCIDR: {{ cilium_native_routing_cidr }}
-ipv6NativeRoutingCIDR: "{{ cilium_native_routing_cidr_ipv6 }}"
+ipv6NativeRoutingCIDR: {{ cilium_native_routing_cidr_ipv6 }}
 
 encryption:
   enabled: {{ cilium_encryption_enabled | to_json }}
@@ -143,14 +143,6 @@ cgroup:
     enabled: {{ cilium_cgroup_auto_mount | to_json }}
   hostRoot: {{ cilium_cgroup_host_root }}
 
-resources:
-  limits:
-    memory: "{{ cilium_memory_limit }}"
-    cpu: "{{ cilium_cpu_limit }}"
-  requests:
-    memory: "{{ cilium_memory_requests }}"
-    cpu: "{{ cilium_cpu_requests }}"
-
 operator:
   image:
     repository: {{ cilium_operator_image_repo }}

roles/remove_node/pre_remove/tasks/main.yml

@@ -17,8 +17,6 @@
       --grace-period {{ drain_grace_period }}
       --timeout {{ drain_timeout }}
       --delete-emptydir-data {{ kube_override_hostname }}
-  async: "{{ (drain_timeout | regex_replace('s$', '') | int) + 120 }}"
-  poll: 15
   when:
     - groups['kube_control_plane'] | length > 0
     # ignore servers that are not nodes

roles/upgrade/pre-upgrade/tasks/main.yml

@@ -59,8 +59,6 @@
         --timeout {{ drain_timeout }}
         --delete-emptydir-data {{ kube_override_hostname | default(inventory_hostname) }}
         {% if drain_pod_selector %}--pod-selector '{{ drain_pod_selector }}'{% endif %}
-      async: "{{ (drain_timeout | regex_replace('s$', '') | int) + 120 }}"
-      poll: 15
       when: drain_nodes
       register: result
       failed_when:
@@ -84,8 +82,6 @@
         --delete-emptydir-data {{ kube_override_hostname | default(inventory_hostname) }}
         {% if drain_pod_selector %}--pod-selector '{{ drain_pod_selector }}'{% endif %}
         --disable-eviction
-      async: "{{ (drain_fallback_timeout | regex_replace('s$', '') | int) + 120 }}"
-      poll: 15
       register: drain_fallback_result
       until: drain_fallback_result.rc == 0
       retries: "{{ drain_fallback_retries }}"

roles/validate_inventory/tasks/main.yml

@@ -213,13 +213,3 @@
   when:
     - kube_external_ca_mode
     - not ignore_assert_errors
-
-- name: Download_file | Check if requested Kubernetes are supported
-  assert:
-    that:
-      - kube_version in kubeadm_checksums[image_arch]
-      - kube_version in kubelet_checksums[image_arch]
-      - kube_version in kubectl_checksums[image_arch]
-    msg: >-
-      Kubernetes v{{ kube_version }} is not supported for {{ image_arch }}.
-      Please check roles/kubespray_defaults/vars/main/checksums.yml for supported versions.

test-infra/image-builder/README.md

@@ -1,57 +0,0 @@
-# KubeVirt Image Builder
-
-Build and push KubeVirt VM disk images to quay.io for Kubespray CI testing.
-
-## How It Works
-
-The Ansible playbook downloads upstream cloud images, converts them to qcow2, resizes (+8G), wraps each in a Docker image based on `kubevirt/registry-disk-v1alpha`, and pushes to `quay.io/kubespray/vm-<os-name>:<tag>`.
-
-## Prerequisites
-
-- Docker, `qemu-img`, Ansible
-- Push access to [quay.io/kubespray](https://quay.io/organization/kubespray) (robot account `kubespray+buildvmimages`)
-
-## Image Definitions
-
-All OS images are defined in [`roles/kubevirt-images/defaults/main.yml`](roles/kubevirt-images/defaults/main.yml).
-
-Each entry specifies:
-
-| Field | Description |
-|-------|-------------|
-| `filename` | Downloaded file name |
-| `url` | Upstream cloud image URL |
-| `checksum` | Checksum for download verification |
-| `converted` | `true` if the source is already qcow2, `false` if conversion is needed |
-| `tag` | Docker image tag (usually `latest`) |
-
-## Usage
-
-### Build and push all images
-
-```bash
-cd test-infra/image-builder/
-make docker_password=<quay-robot-token>
-```
-
-### Add a new OS image
-
-1. Add a new entry to `roles/kubevirt-images/defaults/main.yml`:
-
-   ```yaml
-   new-os-name:
-     filename: cloud-image-file.qcow2
-     url: https://example.com/cloud-image-file.qcow2
-     checksum: sha256:<hash>
-     converted: true
-     tag: "latest"
-   ```
-
-2. Build and push the image:
-
-   ```bash
-   make docker_password=<quay-robot-token>
-   ```
-
-3. Submit a PR with the `defaults/main.yml` change so CI can use the new image.
-   See [#12379](https://github.com/kubernetes-sigs/kubespray/pull/12379) for an example.

tests/cloud_playbooks/roles/packet-ci/vars/main.yml

@@ -50,8 +50,6 @@ cloudinit_config: |
       partition: 'none'
   mounts:
     - ['/dev/disk/by-id/virtio-2825A83CBDC8A32D5E', '/tmp/releases']
-  runcmd:
-    - chmod 777 /tmp/releases
 
 ignition_config:
   ignition:
@@ -70,9 +68,3 @@ ignition_config:
         format: ext4
         path: /tmp/releases
         wipeFilesystem: true
-    directories:
-      - path: /tmp/releases
-        # ignition require a integer, so using the octal notation is easier
-        # than noting it in decimal form
-        # yamllint disable-line rule:octal-values
-        mode: 0777

tests/files/openeuler24-calico.yml

@@ -3,11 +3,8 @@
 cloud_image: openeuler-2403
 vm_memory: 3072
 
-# Use metalink for faster package downloads (auto-selects closest mirror)
+# Openeuler package mgmt is slow for some reason
-openeuler_metalink_enabled: true
+pkg_install_timeout: "{{ 10 * 60 }}"
-
-# CI package installation takes ~7min; default 5min is too tight, use 15min for margin
-pkg_install_timeout: "{{ 15 * 60 }}"
 
 # Work around so the Kubernetes 1.35 tests can pass. We will discuss the openeuler support later.
 kubeadm_ignore_preflight_errors:

tests/files/rockylinux10-cilium.yml

@@ -13,21 +13,3 @@ kube_owner: root
 # Node Feature Discovery
 node_feature_discovery_enabled: true
 kube_asymmetric_encryption_algorithm: "ECDSA-P256"
-
-# Testing no_proxy setup
-# The proxy is not intended to be accessed at all, we're only testing
-# the no_proxy construction
-https_proxy: "http://some-proxy.invalid"
-http_proxy: "http://some-proxy.invalid"
-additional_no_proxy_list:
-  - github.com
-  - githubusercontent.com
-  - k8s.io
-  - rockylinux.org
-  - docker.io
-  - googleapis.com
-  - quay.io
-  - pkg.dev
-  - amazonaws.com
-  - cilium.io
-skip_http_proxy_on_os_packages: true