Add `state: directory` to `file` task so that `recurse: yes` will actually take effect and ensure
certs/keys have the right file mode and owner

Change the name of `system:node` CRB to `kubespray:system:node` to avoid
conflicts with the auto-reconciled CRB also named `system:node`

Fixes #2121

Drain node except daemonsets resource
Use reset cluser for delete deploy data
Then delete node

Change "command" to "shell" in order for the pipe to work correctly

* Use docker-ce 17.03.2
* Docker-engine may be discarded

Enable OOM killing like docker run etcd

This is trying to match what the roles/bastion-ssh-config is trying to do. When the setup is going through bastion, we want to ssh private key to be used on the bastion instance.

Fixes #2397

Add etcd-events cluster for kube-apiserver

For etcdctl commands, use admin cert instead of node because this file
doesn't exist on etcd only hosts.

* Fix run kubectl error

Fix run kubectl error when first master doesn't work

* if access_ip is define use first_kube_master
else different master use a different ip

* Delete set first_kube_master and use kube_apiserver_access_address

Upgrade to Kubernetes v1.9.3

* Fixed generate front proxy client certs with vault

* fix vault cert management

* Distrebute etcd node certs to vault hosts

Adding health checking to kube proxy. Fixes #2308

* Set filemode to 0640

weave-net.yml file is readable by all users on the host. It however contains the weave_password to encrypt all pod communication. It should only be readable by root.

* Set mode 0640 on users_file with basic auth

Now calico can be deployed if there are other existing pools
and not confuse IPAM and end up with pods in the wrong pools.