* Drop linux capabilities for unprivileged containerized
  worlkoads Kargo configures for deployments.
* Configure required securityContext/user/group/groups for kube
  components' static manifests, etcd, calico-rr and k8s apps,
  like dnsmasq daemonset.
* Rework cloud-init (etcd) users creation for CoreOS.
* Fix nologin paths, adjust defaults for addusers role and ensure
  supplementary groups membership added for users.
* Add netplug user for network plugins (yet unused by privileged
  networking containers though).
* Grant the kube and netplug users read access for etcd certs via
  the etcd certs group.
* Grant group read access to kube certs via the kube cert group.
* Remove priveleged mode for calico-rr and run it under its uid/gid
  and supplementary etcd_cert group.
* Adjust docs.
* Align cpu/memory limits and dropped caps with added rkt support
  for control plane.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Add tasks to ensure that the first nodes have their directories for cert gen

Add nginx local balancer port configuration variable

Ansible apps should only check for api-server running on the master.

Fix setting resolvconf when using rkt deploy mode

Update Ansible to 2.2.1

Add docker 1.13, update 1.12 to 1.12.6

Allow to specify number of concurrent DNS queries

Fixes #903

ndots creates overhead as every pod creates 5 concurrent connections
that are forwarded to sky dns. Under some circumstances dnsmasq may
prevent forwarding traffic with "Maximum number of concurrent DNS
queries reached" in the logs.

This patch allows to configure the number of concurrent forwarded DNS
queries "dns-forward-max" as well as "cache-size" leaving the default
values as they were before.

Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>

cert creation

rkt deploy mode doesn't create {{ bin_dir }}/kubelet, so
let's rely on kubelet.env file instad.

Flush handlers before etcd restart

Fix ansible 2.2.1 handling of registered vars

If this runs on other nodes, it will fail the playbook.

systemctl daemon-reload should be run before when task modifies/creates
union for etcd. Otherwise etcd won't be able to start

Closes #892

Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>

Add idempotency checks for CI

Always trigger docker restart when docker package changes

Cert fail if inventory names too long

Docker upgrade doesn't auto-restart docker, causing failures
when trying to start another container

the which port the local nginx proxy should listen on for HA
local balancer configurations.

be run by limit on each node without regard for order.

The changes make sure that all of the directories needed to do
certificate management are on the master[0] or etcd[0] node regardless
of when the playbook gets run on each node.  This allows for separate
ansible playbook runs in parallel that don't have to be synchronized.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

the openssl tools will fail to create signing requests because
the CN is too long.  This is mainly a problem when FQDNs are used
in the inventory file.

THis will truncate the hostname for the CN field only at the
first dot.  This should handle the issue for most cases.

Use only one certificate for all apiservers

https://github.com/kubernetes/kubernetes/issues/25063

preinstall fails on AWS CentOS7 image

Don't try to delete kargo specific config from dhclient when file does not exist

Also remove the check for != "RedHat" when removing the dhclient hook,
as this had also to be done on other distros. Instead, check if the
dhclienthookfile is defined.

the tasks fail because selinux prevents ip-forwarding setting.

Moving the tasks around addresses two issues.  Makes sure that
the correct python tools are in place before adjusting of selinux
and makes sure that ipforwarding is toggled after selinux adjustments.

Generate individual certificates for k8s hosts

Add tasks to undo changes to hosts /etc/resolv.conf and dhclient configs

Clarify major/minor/maintainance releases

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Docs updates