fix bad conditional

* kubedns & kubedns-autoscaler: Stick to master nodes.

 - Tolerate only master nodes and not any NoSchedule taint
 - Pods are on different nodes
 - Pods are required to be on a master node.

* kubedns: use soft nodeAffinity.

Prefer to be on a master node, don't require.

* coredns: Stick to (different) master nodes.

     - Pods are on different nodes
     - Pods are preferred to be on a master node.

cilium v1.1.2

weave: Upgrade to 2.4.0

Update all configs to current upstream state.
Add more resources (unable to pass tests now)...

Fix skip_downloads condition.

Merge pull request #2904 from mirwan/var_lib_kubelet_should_not_be_unmounted_when_having_its_own_partition

Only subdirectories in /var/lib/kubelet should be unmounted at reset time

Fixed checking skip_downloads condition.

Add support for admission controllers in 1.10 and above

Remove istio support

contrib/terraform/terraform.py: fix for Ansible 2.6.2+, issue #3067

Use helm install or support in future

Add tags for coredns and kubedns

Enable swap

ingress-nginx: Upgrade to 0.17.1

Upstream Changes:

-   weave 2.4.0 (https://github.com/weaveworks/weave/releases/tag/v2.4.0)
-   Support `externalTrafficPolicy: Local` (https://github.com/weaveworks/weave/issues/2924)
-   Make the ipset list size bigger (https://github.com/weaveworks/weave/pull/3305)
-   Break out of kube rm-peers loop if nothing changes (https://github.com/weaveworks/weave/pull/3317)

Our Changes:

-   Revamp weave-net.yml.j2 with upstream changes
-   Add more variables for customization
-   Replace WEAVE_PASSWORD with k8s secret
-   Remove hard-corded seed mode support, in favor of variables customization

Upstream Changes:

-   ingress-nginx 0.17.1 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.17.1)
-   Remove duplicated `securityContext` (https://github.com/kubernetes/ingress-nginx/pull/2705)
-   Remove --publish-service flag, in favor of DaemonSet + hostPort

Close #2998
Close #2999

cert-manager: Upgrade to 0.4.0

allow for setting the cacert on openstack cloud provider

Adding cluster_name to api cert alt name for vault

Configure openstack subnet cidr

dashboard_token_ttl option override possibility with default

Variablize kube_proxy_healthz_bind_address

update .gitignore

Add support for docker 17.09

Fix a broken symbolic link for group_vars

availability zones support for OpenStack

Service file binary place mismatch

Upstream Changes:

-   cert-manager 0.4.0 (https://github.com/jetstack/cert-manager/releases/tag/v0.4.0)

According to cluster/binary.yml vault binary will be placed to `{{ bin_dir }}` and according to `inventory/sample/group_vars/all.yml` that is 
`inventory/sample/group_vars/all.yml`