Upstream Changes:

-   cert-manager 0.4.0 (https://github.com/jetstack/cert-manager/releases/tag/v0.4.0)

Fix yaml roles error

fix missing libraries on newer coreos versions

Clarify etcd deployment script failure mechanism

set LC_ALL=C for growpart

add openstack security group for traffic to 30000-32767/tcp on worker nodes

Attempting to clarify the language surrounding the etcd node deployment script failure mechanism. I had this error when doing a new cluster deployment last night and, though it should have been, it wasn't immediately apparent to me what was causing the issue (since my default master node hostnames do not specify whether they are also acting as etcd replicas).

Fix label of registry in README

This will make NodePort services work out of the box

Remove double slash

Even without this PR, the operation works well.
However, it is better to use a single slash rather than
a double slash in the path.

Include etcd and masters in adding node doc

Fixed kubectl path.

apiserver cert should be created only once

add docker upgrade tag doc

ingress-nginx: Upgrade to 0.16.2

Force copy cni files

ingress-nginx 0.16.2 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.16.2)

This patch simplify ingress-nginx deployment by default deploy on
master, with customizable options; on the other hand, remove the
additional Ansible group "kube-ingress" and its k8s node label
injection.

Reference to https://kubernetes.io/docs/concepts/services-networking/ingress/#prerequisites:

    GCE/Google Kubernetes Engine deploys an ingress controller on the master.

By changing `ingress_nginx_nodeselector` plus custom k8s node
label, user could customize the DaemonSet deployment target.

If `ingress_nginx_nodeselector` is empty, will deploy DaemonSet on
every k8s node.

cert-manager: Upgrade to 0.3.2

Upstream Changes:

-   cert-manager 0.3.2 (https://github.com/jetstack/cert-manager/releases/tag/v0.3.2)

Our Changes:

-   Remove legacy addon dir, manifests and namespace before upgrade

cephfs-provisioner: Upgrade to 1.1.0-k8s1.10

Remove step that disables `kube_basic_auth`.

Fix 2976

Fix failure when the container attribute is not set for a download

The referenced issue (https://github.com/kubernetes/kubeadm/issues/441) has already been fixed.

Upstream Changes:

-   Update CEPH_VERSION to mimic (https://github.com/kubernetes-incubator/external-storage/pull/841)

Our Changes:

-   Using image from official repo which contain latest changes (https://quay.io/repository/external_storage/cephfs-provisioner)

change create to apply

* Add tags for cert serial tasks

This will help facilitate tag-based deployment of specific components.

* fixup kubernetes node

Add TF_VAR_ to terraform env