Update calico to v1.0.2

Disable kube_proxy_masquerade_all

Multiples doc fixes

Install pip on Ubuntu

Replace always_run with check_mode

Set ssl_ca_dirs for rkt based on fact

- Refactor 'Check if bootstrap is needed' as ansible loop. This allows
  to add new elements easily without refactoring. Add pip to the list.
- Refactor 'Install python 2.x' task to run once if any of rc
  codes != 0. Actually, need_bootstrap is array of hashes, so map will
  allow to get single array of rc statuses. So if status is not zero it
  will be sorted and the last element will be get, converted to bool.

Closes: #961
Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>

Install pip on Ubuntu

Clean up dnsmasq purge task

Closes: #961
Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>

Document gitlab-runner.sh

always_run was deprecated in Ansible 2.2 and will be removed in 2.4
ansible logs contain "[DEPRECATION WARNING]: always_run is deprecated.
Use check_mode = no instead". This patch fix deprecation.

Also calico-cni to v1.5.6, calico-policy to v0.5.2

Fixes: #1011

Since systemd kubelet.service has {{ ssl_ca_dirs }}, fact should be
gathered before writing kubelet.service.

Closes: #1007
Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>

Add CI cases for testing upgrade from v2.0.1 release

Add kernel upgrade for CentOS

Enable reset of dnsmasq if manifest or config changes

Fixes #1012

Fix misleading HA docs

use ansible sysctl module for config ip forwarding

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Kubernetes Reliability Improvements

Allow kubelet to load kernel modules

These are manual trigger jobs, but should be run if any PR
impacts upgrades.

Enable weave upgrade from previous versions

removed explicit role for efk in cluster.yml

- Exclude kubelet CPU/RAM (kube-reserved) from cgroup. It decreases a
  chance of overcommitment
- Add a possibility to modify Kubelet node-status-update-frequency
- Add a posibility to configure node-monitor-grace-period,
  node-monitor-period, pod-eviction-timeout for Kubernetes controller
  manager
- Add Kubernetes Relaibility Documentation with recomendations for
  various scenarios.

Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>

Raise readiness probe initial time to 60 (was 30)

fix kube_apiserver_ip/kube_apiserver_port description

Fix upgrade for all daemonset type resources

Update code and docs for that assumption.

kubelet lost the ability to load kernel modules.  This
puts that back by adding the lib/modules mount to kubelet.

The new variable kubelet_load_modules can be set to true
to enable this item.  It is OFF by default.