Raise drain timeout to 5m

Enable etcd secure client to prevent etcdctl access without cert and key

Enable flannel hairpin mode

* iptables: flush nat table as well as filter table upon reset

* Indentation fix

Update dashboard version to v1.8.1

Support for disabling apiserver insecure port (the sequel)

Dnsmasq autoscaler image should be a variable

Fix for Issue #2141

Renamed variable from disable_volume_zone_conflict to volume_cross_zone_attachment and removed cloud provider condition; fix identation

Restart docker when http-proxy.conf changed.

Fix 'no such host' problem reported by commands *kubectl logs* and *kubectl exec*
when cloud_provider is OpenStack

Closes: #2147

* Update rpm spec and pbr setup configs

* Rename package to kubespray
* Do not break Fedora's FHS and install to /usr/share instead
* Remove the vendor tag
* Update source0 for better artifacts' names
* Fix missing files build errors
* Make version/release to auto match from git and fit PEP 440

Co-authored-by: Matthias Runge <mrunge@redhat.com>
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Add package paths to roles search in ansible conf

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Poke jinja2 requirements in rpm spec file

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Merge branch 'hardcoded_dnsmasq-autoscaler_image' of github.com:mirwan/kubespray into hardcoded_dnsmasq-autoscaler_image

Add support for flex volumes plugins.

Updated with correct syntax to access default_tags variable.

Manage deprecated kubelet option

Add kubelet_custom_flags to kubelet.kubeadm.env.j2

updated weave to 2.1.3

Retry kube container removal during upgrade

Remove blank lines

fix fluentd template

* Fix HA docs API access endpoints explained

Follow-up commit 81347298a3ef7932cbeb55e877644ca22d1625f1
and fix the endpoint value provided in HA docs.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Clarify internal LB with external LB use case

* Clarify how to use both internal and external, non-cluster aware and
  not managed with Kubespray, LB solutions.
* Clarify the requirements, like TLS/SSL termination, for such an external LB.
  Unlike to the 'cluster-aware' external LB config, endpoints' security must be
  managed by that non-cluster aware external LB.
* Note that masters always contact their local apiservers via https://bip:sp.
  It's highly unlikely to go down and it reduces latency that might be
  introduced when going host->lb->host. Only computes go that path.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Add a note for supplementary_addresses_in_ssl_keys

Explain how to benefit from supplementary_addresses_in_ssl_keys

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Add support for cert alt names for etcd

* Update gen_certs_vault.yml