kubernetes-sigs/kubespray v2.27.1 on GitHub

Changes by Kind

The external_cloud_provider support manual option lets users install the cloud controller manager themselves. (#11884, @k8s-infra-cherrypick-robot)
Upgrade ingress-nginx to version v1.12.1 to resolve critical vulnerabilities (CVE-2025-1974 and others) and webhook certgen to v1.5.2. (#12080, @tico88612)

Fix sample inventory for the reserved resource (#11922, @k8s-infra-cherrypick-robot)

Fix CI by exclude the .ansible in .ansible-lint
Remove ctr image pull workaround for nerdctl (#11956, @k8s-infra-cherrypick-robot)

Add support for control plane reconfiguration on upgrades
Add support for kubeadm-config v1beta4 UpgradeConfiguration.apply and UpgradeConfiguration.node
Use kubeadm upgrade node during secondary control plane node upgrades (#12015, @chadswen)
Fix coredns deployment with coredns_pod_disruption_budget: true or enable_nodelocaldns_secondary (#11957, @k8s-infra-cherrypick-robot)
Fix: When running ./manage-offline-container-images.sh register with using Podman, getting the image_id fails and the script is interrupted. (#12314, @k8s-infra-cherrypick-robot)
Install symlinks parroting as other control plane nodes etcd certificates (and key) on all control plane nodes, to make kubeadm works (#12192, @k8s-infra-cherrypick-robot)
Make fallback_ip cacheable in facts (#12182, @guoard)
[calico] Fix kubecontrollersconfigurations list permission (#12039, @k8s-infra-cherrypick-robot)