upgrade etcd version to 2.3.7

Add KUBE_API_INSECURE_BIND to systemd unit file

This was missing from commit c4c312c2

Add configurable option for kube_apiserver_insecure_bind_address

Update calico systemd.service template for EL7

upgrade pypy version

Add IAM profiles for Kubernetes nodes

Force install of specified docker version, fixes #295

This allows Ubuntu/Debian to downgrade Docker version if
a newer version is installed, instead of failing.

WIP: terraform openstack

Add docker_options to calico networking

Add kpm role

install kpm in order to deploy addons

upgrade calico to v0.20 and calico-cni to v1.3.1

base functionality to create aws resources

allow for bootstrapping of separate CoreOS etcd nodes

clean conditions into docker templates

Add scale-up for etcd cluster

Fix order in restart kubelet to fix systemd reload

Systemd reload before reload kubelet was failing because its definition was before "restart kubelet". Its definition should be after the notify hook.

* Set ETCD_INITIAL_CLUSTER_STATE from `new` to `existing`,
because parameter `new` makes sense only on cluster assembly
stage.
* If cluster exists and current node is not a part
of the cluster, add it with command `etcdctl add member name url`.

Closes kubespray/kargo/#270

example env allow insecure-registry

Many use cases of k8s involve running a local
registry, chances are the person running this
will learn the hard way that they need to allow
insecure registry on the `kube_service_addresses`
network.

We should just default to settings this in
`inventory/group_vars/all.yml` to help reduce
potential friction for first time users.