* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size

Fix path for pip and python when already bootstrapped

coreos: explicitely set pip executable.

Add Openstack tenant name

Use 'items()' for python compatibility

Update CoreDNS to version 1.1.2

Fix apiserver manifest and kubelet for kube version < 1.9

tiny spacing change "can be"

Update aws.md

I had an issue with DNS not working because i didn't add the "kubernetes.io/cluster/$cluster_name" to the route table my subnets where using.

sync certs tasks (fix #2596 #2667)

ingress-nginx: Upgrade to 0.14.0

Fix broken terraform aws readme

* [terraform/openstack] Restores ability to use existing public nodes and masters as bastion.

* [terraform/openstack] Uses network_id as output

* [terraform/openstack] Fixes link to inventory/local/group_vars

* [terraform/openstack] Adds supplementary master groups

* [terraform/openstack] Updates documentation avoiding manual setups for bastion (as they are not needed now).

* [terraform/openstack] Supplementary master groups in docs.

* [terraform/openstack] Fixes repeated usage of master fips instead of bastion fips

* [terraform/openstack] Missing change for network_id to subnet_id

* [terraform/openstack] Changes conditional to element( concat ) form to avoid type issues with empty lists.

ISSUE-2706: Provide consistent usage of supplementary_addresses_in_ssl_keys across vault and script mode (#2707)

Update netchecker to v1.2.2.

Add oidc-user-prefix and oidc-group-prefix args

Replaced 'mem' with 'memory/ in elasticsearch and kibana deployment

* sysctl file should be in defaults so that it can be overriden

* Change sysctl_file_path to be consistent with roles/kubernetes/preinstall/defaults/main.yml

This reverts commit 51f4e658.

Using official image from mirantis at dockerhub.

Document how to allow ipip traffic with calico on OpenStack

run_once pre_upgrade tasks which are executing in localhost

cephfs-provisioner: Upgrade to a71a49d4