Adding missing service-account certificate for vault

Enabling MutatingAdmissionWebhook for Istio Automatic sidecar injection

Fix missing install remove-node feature

Add note about ansible_become to coreos section

https://kubernetes.io/docs/admin/admission-controllers/#is-there-a-recommended-set-of-admission-controllers-to-use

Changed from OS_PROJECT_ID to OS_PROJECT_NAME.

All checks test if this is defined meaning there is no way to undefine it.

Also updates the commit ID we use as a basis for upgrade tests.

Fix new envvar for setting openstack_tenant_id

Remove jinja2 dependency of do

Changed from OS_PROJECT_ID to OS_PROJECT_NAME.

fix kubectl download location and kubectl.sh helper owner/group remove

https://istio.io/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection

While `do` looks cleaner, forcing this extra option in ansible.cfg
seems to be more invasive. It would be better to keep the traditional
approach of `set dummy = ` instead.

Fix check docker error for atomic

Fix issues #2611

Fix issues #2522 Support Debian stretch

Missed in #2554

https://download.docker.com/linux/debian/dists/

Fix typos (no logic changes)

Persist ip_vs modules

Rotate local-volume-provisioner token

Use legacy policy config to apply the scheduler policy

Properly check vsphere_cloud_provider.rc

istio: container download related things should defined in the download role

Bump ingress-nginx-controller to version 0.12.0

check if dedicated service account token signing key exists