fix: Prevent version skews when upgrading cluster

[ludwighansson]

Description

Hello,

We have encountered issues when upgrading clusters where agent nodes are upgraded before the API servers, thus violating the Kubernetes kubelet versioning skew policy which states:

kubelet must not be newer than kube-apiserver.

Combining this violation with the configuration option rke2_wait_for_all_pods_to_be_ready=true, the role execution will get stuck and eventually fail as all non-static pods will go into a CreateContainerConfigError state with an event from kubelet like:

Error: services have not yet been read at least once, cannot construct envvars

This change ensures that rolling restarts are done on server nodes first to ensure all API servers has been upgraded prior to any agents being restarted to prevent this versioning skew violation.

It is basically a duplicate of the existing include_task block for rolling_restart.yml, where each block leverages the rke2_servers_group_name and rke2_agents_group_name for targeting server and agent nodes respectively.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• Small minor change not affecting the Ansible Role code (GitHub Actions Workflow, Documentation etc.)

How Has This Been Tested?

This has been tested by uplifting Kubernetes from 1.30.3+rke2r1 to 1.31.4+rke2r1 in a 12-node cluster (3 servers, 9 agents), as well as a smaller cluster with 1 server and 3 agent nodes. After patching the role, all servers were upgraded first, with agents following after, resulting in a successful upgrade with rke2_wait_for_all_pods_to_be_ready=true.

[MonolithProjects]

Hi @ludwighansson , thanks for this PR. It looks good, but it should take into account also setup with a single node.

[ludwighansson]

Ahh yes, I totally missed single node installations, sorry!

I will look into fixing that within the next few days!

[ludwighansson]

I updated the with_items key to default to an empty list in case the agent group is undefined. It seems to pass my single node tests now!

btw, is it supported to have a host in both server and agent groups at the same time? (eg. for single node setup?)
I added a when condition on the agent block to ensure it isn't in the server group too, to prevent it from being restarted twice. What do you think?

[MonolithProjects]

@ludwighansson in a single node setup the node is supposed to be in the server group. But i guess it's fine that you added the exception for agent block (to be hones i never tried how the role would behave inf the single node would be in the both groups).

[MonolithProjects]

LGTM. Thanks