The requirements for network policy feature are described here [1]. In
order to enable it, appropriate configuration must be provided to the CNI
plug in and Calico policy controller must be set up. Beside that
corresponding extensions needed to be enabled in k8s API.

Now to turn on the feature user can define `enable_network_policy`
customization variable for Ansible.

[1] http://kubernetes.io/docs/user-guide/networkpolicies/

Issues/535

and correct checksums

required for usage of Calico CNI plugin version 1.4.2

Use nginx proxy on non-master nodes to proxy apiserver traffic  

Also adds all masters by hostname and localhost/127.0.0.1 to
apiserver SSL certificate.

Includes documentation update on how localhost loadbalancer works.

Allow calico to configure pool if tree exists, but no pools defined

Move kube_version var to defaults

Disable reverse lookups again

Enable quorum read for apiserver

This reduces the likelihood of apiserver status updates
timing out due to etcd write conflicts.

Add support for --masquerade-all in kube-proxy

New boolean var `kube_proxy_masquerade_all` which enables/disables
`--masquerade-all` argument for kube-proxy.

Closes #524

changed to the correct link

Skip download_run_once for binaries as unimplemented yet

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

Allow to use custom "canalized" calico cni

Fix delegate_to expression in download tasks

Initially this was removed, but it turns out that services that
perform reverse lookups (such as MariaDB) will encounter severe
performance degredation with this disabled.

- Allow to overwrite calico cni binaries copied from hyperkube
  by the custom ones.
- Fix calico-ipam deployment (it had wrong source in rsync)
- Make copy from hyperkube idempotent (use rsync instead of cp)
- Remove some orphaned comments

Move the variable kube_version to defaults to have the possibility to overwrite it via group_vars inventory if needed.

Change method to set use_hyperkube_cni var bool

Allow subdomains of dns_domain and fix kubelet restarts

Restored gather facts on all hosts

The precedent method returb a string "True\n" or "False\n", it seems to be an Ansible bug.
New method return a boolean

Fix containers download condition

use variable dns_domain instead of cluster_name for kubedns

* Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf.
* Poke kube dns container image to v1.7
* In order to apply changes to kubelet, notify it to
be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet
may yet to be present up to the moment of the notification being processed.
* Remove unnecessary kubelet restart for master role as the node role ensures
it is up and running. Notify master static pods waiters for apiserver,
scheduler, controller-manager instead.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

Save/push/load containers if only download.enabled and download.container

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

"else omit" is causing problems in this expression. Replacing
it with more strict "inventory_hostname" fixes the issue and
handles `download_run_once` as expected.

Closes issue #514

Correct nslookup command

Add more DNS docs

Copy hyperkube CNI plugins when using weave

Add Docker 1.12.1 version

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>