details:https://github.com/moby/moby/pull/31490/files

Support docker-ce and docker-engine include redhat/centos ubuntu debian

Add `state: directory` to `file` task so that `recurse: yes` will actually take effect and ensure
certs/keys have the right file mode and owner

Change the name of `system:node` CRB to `kubespray:system:node` to avoid
conflicts with the auto-reconciled CRB also named `system:node`

Fixes #2121

Drain node except daemonsets resource
Use reset cluser for delete deploy data
Then delete node

Change "command" to "shell" in order for the pipe to work correctly

* Use docker-ce 17.03.2
* Docker-engine may be discarded

Enable OOM killing like docker run etcd

This is trying to match what the roles/bastion-ssh-config is trying to do. When the setup is going through bastion, we want to ssh private key to be used on the bastion instance.

to the API server configuration.

This solves the problem where if you have non-resolvable node names,
and try to scale the server by adding new nodes, kubectl commands
start to fail for newly added nodes, giving a TCP timeout error when
trying to resolve the node hostname against a public DNS.

Fixes #2397

Add etcd-events cluster for kube-apiserver

For etcdctl commands, use admin cert instead of node because this file
doesn't exist on etcd only hosts.

* Fix run kubectl error

Fix run kubectl error when first master doesn't work

* if access_ip is define use first_kube_master
else different master use a different ip

* Delete set first_kube_master and use kube_apiserver_access_address

Upgrade to Kubernetes v1.9.3

* Fixed generate front proxy client certs with vault

* fix vault cert management

* Distrebute etcd node certs to vault hosts

Adding health checking to kube proxy. Fixes #2308

* Set filemode to 0640

weave-net.yml file is readable by all users on the host. It however contains the weave_password to encrypt all pod communication. It should only be readable by root.

* Set mode 0640 on users_file with basic auth

Now calico can be deployed if there are other existing pools
and not confuse IPAM and end up with pods in the wrong pools.