* Refactor downloads

Add prefixes to tasks (file vs container)
Remove some delegates
Clean up some conditions

* Update ansible.cfg

* Clean up debug in check apiserver test

* Change password generation for kube_user

Special characters are not allowed in known_users.csv file

* Revert "Add option for fact cache expiry (#1602)"

This reverts commit fb30f659.

Store vault users passwords to credentials dir. Create vault and etcd roles after start vault cluster (#1632)

* Add option for fact cache expiry 

By adding the `fact_caching_timeout` we avoid having really stale/invalid data ending up in there. 
Leaving commented out by default, for backwards compatibility, but nice to have there.

* Enabled cache-expiry by default

Set to 2 hours and modified comment to reflect change

* Add comment line and documentation for bastion host usage

* Take out unneeded sudo parm

* Remove blank lines

* revert changes

* take out disabling of strict host checking

Removed unnecessary root user

This sets br_netfilter and net.bridge.bridge-nf-call-iptables sysctl from a single play before kube-proxy is first ran instead of from the flannel and weave network_plugin roles after kube-proxy is started

the uploads.yml playbook was broken with checksum mismatch errors in
various kubespray commits, for example, 3bfad5ca
which updated the version from 3.0.6 to 3.0.17 without updating the
corresponding checksums.

Due to various occasional docker bugs, removing a container will sometimes fail. This can often be mitigated by trying again.

* Fix an error with Canal when RBAC are disabled

* Update using same rbac strategy used elsewhere

This allows the node authorization plugin to function correctly

Disable checks for existing resources to speed up execution.

Vault role updates

* Point apiserver address to 0.0.0.0
Added loadbalancer api server address
* Update documentation

This trigger ensures the inventory file is kept up-to-date. Otherwise, if the file exists and you've made changes to your terraform-managed infra without having deleted the file, it would never get updated. 

For example, consider the case where you've destroyed and re-applied the terraform resources, none of the IPs would get updated, so ansible would be trying to connect to the old ones.

  * using separated vault roles for generate certs with different `O` (Organization) subject field;
  * configure vault roles for issuing certificates with different `CN` (Common name) subject field;
  * set `CN` and `O` to `kubernetes` and `etcd` certificates;
  * vault/defaults vars definition was simplified;
  * vault dirs variables defined in kubernetes-defaults foles for using
  shared tasks in etcd and kubernetes/secrets roles;
  * upgrade vault to 0.8.1;
  * generate random vault user password for each role by default;
  * fix `serial` file name for vault certs;
  * move vault auth request to issue_cert tasks;
  * enable `RBAC` in vault CI;

lost executable path

* Use kubectl apply instead of create/replace

Disable checks for existing resources to speed up execution.

* Fix non-rbac deployment of resources as a list

* Fix autoscaler tolerations field

* set all kube resources to state=latest

* Update netchecker and weave

Canal will be covered by a separate PR

* Drop legacy calico logic

* add calico as a daemonset

Refactored how rbac_enabled is set
Added RBAC to ubuntu-canal-ha CI job
Added rbac for calico policy controller

* Add RBAC policies to dnsmasq

* fix merge conflict

* yamllint

* use .j2 extension for dnsmasq autoscaler

Fixing CA certificate locations for k8s components

Configurable docker yum repos, systemd fix

* Include /opt/bin in PATH for host deployed kubelet on CoreOS

* Removing conditional check for CoreOS