https://github.com/kubernetes/kubernetes/issues/25063

Also remove the check for != "RedHat" when removing the dhclient hook,
as this had also to be done on other distros. Instead, check if the
dhclienthookfile is defined.

the tasks fail because selinux prevents ip-forwarding setting.

Moving the tasks around addresses two issues.  Makes sure that
the correct python tools are in place before adjusting of selinux
and makes sure that ipforwarding is toggled after selinux adjustments.

This proxy should only be listening for local connections, not 0.0.0.0.

Fixes #868

Fixes scenario where docker-dns.conf tries to create an empty
search entry

"etcd_node_cert_data" variable is undefinded for "calico-rr" role.
This patch adds "calico-rr" nodes to task where "etcd_node_cert_data"
variable is registered.

Change version for calico images to v1.0.0. Also bump versions for
CNI and policy controller.

Also removing images repo and tag duplication from netchecker role

Also update reset.yml to do more dns/network related cleanup.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Due to bash max args limits, we should pass all node filenames and
base64-encoded tar data through stdin/stdout instead.

Fixes #832

* Add restart for weave service unit
* Reuse docker_bin_dir everythere
* Limit systemd managed docker containers by CPU/RAM. Do not configure native
  systemd limits due to the lack of consensus in the kernel community
  requires out-of-tree kernel patches.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

Admin certs only go to etcd nodes
Only generate cert-data for nodes that need sync

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Also fix kube log level 4 to log dnsmasq queries.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

ETCD doesn't need cert/key options set. It only requires peer
cert options.

workaround case for etcdctl not yet being installed, only allow for return code of 0 (no error)

    Resolves: #748

Includes hooks for triggering calico, kubelet, and kube-apiserver restarts
if etcd certs changed.

This was alredy fixed in #755 but had to be reverted. This PR should be
more intelligent about deciding which path to use.

Fixes #777

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>