The number of pods on a given node is determined by the  --max-pods=k
directive. When the address space is exhausted, no more pods can be
scheduled even if from the --max-pods-perspective, the node still has
capacity.

The special case that a pod is scheduled and uses the node IP in the
host network namespace is too "soft" to derive a guarantee.

Comparing kubelet_max_pods with kube_network_node_prefix when given
allows to assert that pod limits match the CIDR address space.

* Upgrade k8s to 1.10.2

Bumped etcd version to 3.2.16 as recommended

* Add ipvs fix for v1.10

* change flannel addons test to ha

make admin.conf -> .kube/config non-executable

Bump kube-dns to 1.14.10

Update README.md

Upgrade kube-dns to 1.14.10
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dns

https://github.com/kubernetes-incubator/kubespray/issues/2764

Almost certainly, the .kube/config file (YAML) should not be executable.

Restart scheduler when policy changes

Fix issue #2702: 'docker_bin_dir' is undefined when running ansible-playbook remove-node.yml

Fix privilege escalation timeout for remove-node playbook

add svc to netchecker-service.default.svc.cluster.local

* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size

Fix path for pip and python when already bootstrapped

coreos: explicitely set pip executable.

Add Openstack tenant name

Use 'items()' for python compatibility

Update CoreDNS to version 1.1.2

Fix apiserver manifest and kubelet for kube version < 1.9

tiny spacing change "can be"

Update aws.md

I had an issue with DNS not working because i didn't add the "kubernetes.io/cluster/$cluster_name" to the route table my subnets where using.

sync certs tasks (fix #2596 #2667)

ingress-nginx: Upgrade to 0.14.0

Fix broken terraform aws readme

* [terraform/openstack] Restores ability to use existing public nodes and masters as bastion.

* [terraform/openstack] Uses network_id as output

* [terraform/openstack] Fixes link to inventory/local/group_vars

* [terraform/openstack] Adds supplementary master groups

* [terraform/openstack] Updates documentation avoiding manual setups for bastion (as they are not needed now).

* [terraform/openstack] Supplementary master groups in docs.

* [terraform/openstack] Fixes repeated usage of master fips instead of bastion fips

* [terraform/openstack] Missing change for network_id to subnet_id

* [terraform/openstack] Changes conditional to element( concat ) form to avoid type issues with empty lists.