cert creation

be run by limit on each node without regard for order.

The changes make sure that all of the directories needed to do
certificate management are on the master[0] or etcd[0] node regardless
of when the playbook gets run on each node.  This allows for separate
ansible playbook runs in parallel that don't have to be synchronized.

Use only one certificate for all apiservers

https://github.com/kubernetes/kubernetes/issues/25063

preinstall fails on AWS CentOS7 image

Don't try to delete kargo specific config from dhclient when file does not exist

Also remove the check for != "RedHat" when removing the dhclient hook,
as this had also to be done on other distros. Instead, check if the
dhclienthookfile is defined.

the tasks fail because selinux prevents ip-forwarding setting.

Moving the tasks around addresses two issues.  Makes sure that
the correct python tools are in place before adjusting of selinux
and makes sure that ipforwarding is toggled after selinux adjustments.

Generate individual certificates for k8s hosts

Add tasks to undo changes to hosts /etc/resolv.conf and dhclient configs

Clarify major/minor/maintainance releases

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Docs updates

Fix mismatching inventory examples.
Add command examples.
Clarify groups use cases.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Clarify release policy

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Adding /opt/cni /etc/cni to rkt run kubelet

Fix inventory generator link

Bind nginx localhost proxy to localhost

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Fix wrong path of dhclient on CentOS+Azure

Misc updates for canal

Fix docs formatting

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Update docs

Fix etcd cert generation for calico-rr role

Link docs to README, update README with recent info.
Update comparsions, add kubeadm vs kargo.
Better describe variables precedence UX impact.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Fix docker dns host scenario with no search domains

This proxy should only be listening for local connections, not 0.0.0.0.

Fixes #868

Fixes scenario where docker-dns.conf tries to create an empty
search entry

Set latest stable versions for Calico images

"etcd_node_cert_data" variable is undefinded for "calico-rr" role.
This patch adds "calico-rr" nodes to task where "etcd_node_cert_data"
variable is registered.

Change version for calico images to v1.0.0. Also bump versions for
CNI and policy controller.

Also removing images repo and tag duplication from netchecker role

Implement "dockerd --dns-xxx" based dns mode

remove assertion for family not being CoreOS

Also update reset.yml to do more dns/network related cleanup.