More idempotency fixes

Idempotency fixes for etcd certs and resolvconf tasks

Restores working order of contrib/terraform/openstack

Fixed sync_tokens fact
Fixed sync_certs for k8s tokens fact
Disabled register docker images changability
Fixed CNI dir permission
Fix idempotency for etcd pre upgrade checks

Turn on iptables for flannel

Added Jinja 2.8 to Docs

Added Jinja 2.8 Requirements to docs and pip requirements file which
is needed to run the current Ansible Playbooks.

Fix for CoreOS Docu

CoreOS docu was referencing outdated bootstrap playbook that
is now part of kargo itself.

Granular authentication Control

Migrate k8s data to etcd3 api store

Closes: #1135
Closes: #1026
Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>

It is now possible to deactivate selected authentication methods
(basic auth, token auth) inside the cluster by adding
removing the required arguments to the Kube API Server and generating
the secrets accordingly.

The x509 authentification is currently not optional because disabling it
would affect the kubectl clients deployed on the master nodes.

Explicitly set cni-bin-dir

Default backend is now etcd3 (was etcd2).
The migration process consists of the following steps:
* check if migration is necessary
* stop etcd on first etcd server
* run migration script
* start etcd on first etcd server
* stop kube-apiserver until configuration is updated
* update kube-apiserver
* purge old etcdv2 data

Added Support for OpenID Connect Authentication

Add node labels in kubelet

Reference external documentation sources

Removing cloud_provider tag to fix scenario where cloud_provider is n…

Related-issue: https://github.com/kubernetes/community/issues/300
Upgraded nodes do not obtain labels automatically.
See https://github.com/kubernetes/kubernetes/pull/29459 for more details.

To use OpenID Connect Authentication beside deploying an OpenID Connect
Identity Provider it is necesarry to pass additional arguments to the Kube API Server.
These required arguments were added to the kube apiserver manifest.

Adding vsphere cloud provider support

Disable vault role properly on ansible 2.2.0

Remove standalone etcd specific play, cleanup host mode

when condition does not seem to work correctly at playbook
level for ansible 2.2.0.

Now etcd role can optionally disable etcd cluster setup for faster
deployment when it is combined with etcd role.

Use find module for checking for certificates

Added Missing AWS IAM Profiles and Policies

The AWS IAM profiles and policies required to run Kargo on AWS
are no longer hosted in the kubernetes main repo since kube-up got
deprecated. Hence we have to move the files into the kargo repository.

Also generate certs only when absent on master (rather than
when absent on target node)

Add support for atomic host

Possibility to add Loadbalancers without static IP (e.g. AWS ELB) #1074

Restores working order of contrib/terraform/openstack, includes vault group and avoids group_vars/k8s-cluster.yml

fix inline verbatim blocks formatting in markdown