[WIP] Add cluster-cidr to kube-proxy config

This option enables masquerading for traffic directed at pods
that comes frmom outside the cluster.

Add possibility to enable network policy via Calico network controller

Upgrade to kubernetes version 1.4.0

test to change the machine type

Revert "test to change the machine type"

This reverts commit 7a91f1b5405a39bee6cb91940b09a0b0f9d3aee1.

use google dns server when no upstream dns are defined

comment upstream_dns_servers

update documentation

remove deprecated kubelet flags

Revert "remove deprecated kubelet flags"

This reverts commit 21e3b893c896d0291c36a07d0414f4cb88b8d8ac.

The requirements for network policy feature are described here [1]. In
order to enable it, appropriate configuration must be provided to the CNI
plug in and Calico policy controller must be set up. Beside that
corresponding extensions needed to be enabled in k8s API.

Now to turn on the feature user can define `enable_network_policy`
customization variable for Ansible.

[1] http://kubernetes.io/docs/user-guide/networkpolicies/

Issues/535

and correct checksums

required for usage of Calico CNI plugin version 1.4.2

Use nginx proxy on non-master nodes to proxy apiserver traffic  

Also adds all masters by hostname and localhost/127.0.0.1 to
apiserver SSL certificate.

Includes documentation update on how localhost loadbalancer works.

Allow calico to configure pool if tree exists, but no pools defined

Move kube_version var to defaults

Disable reverse lookups again

Enable quorum read for apiserver

This reduces the likelihood of apiserver status updates
timing out due to etcd write conflicts.

Add support for --masquerade-all in kube-proxy

New boolean var `kube_proxy_masquerade_all` which enables/disables
`--masquerade-all` argument for kube-proxy.

Closes #524

changed to the correct link

Skip download_run_once for binaries as unimplemented yet

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

Allow to use custom "canalized" calico cni

Fix delegate_to expression in download tasks

Initially this was removed, but it turns out that services that
perform reverse lookups (such as MariaDB) will encounter severe
performance degredation with this disabled.

- Allow to overwrite calico cni binaries copied from hyperkube
  by the custom ones.
- Fix calico-ipam deployment (it had wrong source in rsync)
- Make copy from hyperkube idempotent (use rsync instead of cp)
- Remove some orphaned comments

Move the variable kube_version to defaults to have the possibility to overwrite it via group_vars inventory if needed.

Change method to set use_hyperkube_cni var bool

Allow subdomains of dns_domain and fix kubelet restarts

Restored gather facts on all hosts

The precedent method returb a string "True\n" or "False\n", it seems to be an Ansible bug.
New method return a boolean

Fix containers download condition

use variable dns_domain instead of cluster_name for kubedns

* Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf.
* Poke kube dns container image to v1.7
* In order to apply changes to kubelet, notify it to
be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet
may yet to be present up to the moment of the notification being processed.
* Remove unnecessary kubelet restart for master role as the node role ensures
it is up and running. Notify master static pods waiters for apiserver,
scheduler, controller-manager instead.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

Save/push/load containers if only download.enabled and download.container

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

"else omit" is causing problems in this expression. Replacing
it with more strict "inventory_hostname" fixes the issue and
handles `download_run_once` as expected.

Closes issue #514