Kubespray API compatibility

Supported, adapter, conditional, and explicitly rejected Kubespray Playbooks, Roles, and variables.

Core summary

The compatibility contract covers root Playbooks, public Role paths, Inventory groups, default variables, and tags.
It does not promise identical internal Kubespray task bodies or resulting state.
Inputs without a safe RKE2 translation fail before host mutation instead of being silently ignored.
docs/kubespray-api-compatibility.yml is the canonical source for support status.
Upstream baseline changes require mapping and reachability review and are never merged automatically.

Classification	Meaning	Example
Supported	Operates with the same intent above the Kubernetes API	General `kubernetes-apps` Roles
Adapter	Translates a public name into RKE2 behavior	`kubernetes/kubeadm`, `container-engine`
Conditional	Operates only with a topology or feature prerequisite	Embedded-etcd control-plane recovery
Unsupported	Has no current safe equivalent and is explicitly rejected	kubeadm phases, Docker or CRI-O selection
Adapter gap	RKE2 can support it, but the adapter is incomplete	Current external or custom CNI path

Input	Handling
`container_manager: docker` or `crio`	Preflight failure
Non-empty `kubeadm_patches`	Preflight failure
Invalid union of control-plane and worker groups	Inventory validation failure
External or custom CNI	Current preflight failure
Windows control plane	Unsupported
External datastore with control-plane recovery	Use the external datastore's recovery procedure

Move KUBESPRAY_BASELINE to the commit under review.
Inspect parity output for added or removed Playbooks, Roles, variables, groups, and tags.
Classify each API as Supported, Adapter, Conditional, or Unsupported.
Record the mapping and rationale in the compatibility manifest.
Test reachability and failure behavior through canonical root Playbooks.
Review the synchronization PR manually without automatic merging.

make check PYTHON_BIN=/path/to/python

Unsupported inputs must never be silently ignored.
Root Playbooks must resolve from a source checkout without an external Collection.
A production cluster must not become an unapproved change-test target.

Before applying a Kubespray variable, look up its current classification in the machine-readable contract.
When prose and code differ, prefer the current release's compatibility manifest and preflight result.