kubelet: allow disabling staticPodPath on workers

[isumitsolanki]

What type of PR is this?
/kind feature

What this PR does / why we need it:
Reintroduces kubelet_static_pod_path (reverted in v2.31.0 via #12970) so worker kubelets can satisfy the Kubernetes STIG requirement to disable staticPodPath without setting kube_manifest_dir to "", which breaks preinstall directory creation and other manifest-related tasks.

Adds kubelet_static_pod_path (defaults to kube_manifest_dir); when set to "", staticPodPath is omitted from KubeletConfiguration.
Keeps kube_manifest_dir for control plane static pods, load balancer manifests, and directory layout.
Skips manifest directory creation in preinstall when kube_manifest_dir is empty (defensive).
Fails inventory validation with a clear message if kube_manifest_dir is empty, directing users to kubelet_static_pod_path instead.
Documents usage in docs/operations/hardening.md and docs/ansible/vars.md.

Which issue(s) this PR fixes:

Fixes #13281

Special notes for your reviewer:

Prior implementation in #12433 was reverted because users were advised to clear kube_manifest_dir, which is unsafe. This PR keeps those variables separate.
Nodes in both kube_control_plane and kube_node must keep the default kubelet_static_pod_path; use host_vars on pure workers if group overlap is a concern.
Workers with loadbalancer_apiserver_localhost (nginx/haproxy static pods) still need staticPodPath unless API access is provided another way.

Does this PR introduce a user-facing change?:

None

[k8s-ci-robot]

Hi @isumitsolanki. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: isumitsolanki
Once this PR has been reviewed and has the lgtm label, please assign tico88612 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tico88612]

@isumitsolanki Did you read the issue comment?

[yankay]

/ok-to-test

[VannTen]

What's unsafe about setting kube_manifest_dir to "" exactly ? If it breaks some tasks, that means we ought to fix the tasks, not introduce another variable.

[Copilot]

Pull request overview

Reintroduces kubelet_static_pod_path to allow omitting staticPodPath from generated KubeletConfiguration (e.g., to satisfy Kubernetes STIG guidance on worker nodes) without requiring kube_manifest_dir to be set to an unsafe empty value.

Changes:

• Adds kubelet_static_pod_path (defaulting to kube_manifest_dir) and conditionally renders staticPodPath in the kubelet config template.
• Updates preinstall directory creation to avoid attempting to create an empty kube_manifest_dir.
• Adds inventory validation and documentation updates guiding users away from setting kube_manifest_dir: "".

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
roles/validate_inventory/tasks/main.yml	Adds an assertion to prevent kube_manifest_dir from being empty and updates removed-vars handling.
roles/kubernetes/preinstall/tasks/0050-create_directories.yml	Creates the manifests directory in a dedicated task and skips it when kube_manifest_dir is empty.
roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2	Conditionally includes staticPodPath based on kubelet_static_pod_path.
roles/kubernetes/node/defaults/main.yml	Introduces kubelet_static_pod_path defaulting to kube_manifest_dir.
docs/operations/hardening.md	Documents how to omit staticPodPath for STIG scenarios.
docs/ansible/vars.md	Documents kubelet_static_pod_path behavior and intended usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[isumitsolanki]

Hi @tico88612 , @VannTen can you have a look once again I have made the changes as per the suggestion.