For security and resources utilization reasons, do not auto-start CI
for opened/updated PRs.

A member of the kubernetes-incubator github org has first to approve
that the PR is reasonable to test by putting the "ci check this" into
the PR's comments.

If approved that way, the CI pipeline starts as always. Only the 1st step
of the pipeline is premoderatied, the rest will follow each over on
success.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Fix cert paths for flannel/calico policy apps

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Upgrade docker version and do some cleanups for unsupported distros/docker versions

Comment cloud providers private networks use cases

README: changed minimal ansible version

Fix etc hosts for cluster nodes

Drop non systemd OS types support

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Add section describing Kargo vs Kops

Fix etcd cert generation to support large deployments

Due to bash max args limits, we should pass all node filenames and
base64-encoded tar data through stdin/stdout instead.

Fixes #832

Add yaml/json loader for inventory

Systemd units, limits, and bin path fixes

Rework wildcards matching all nodes

* Add restart for weave service unit
* Reuse docker_bin_dir everythere
* Limit systemd managed docker containers by CPU/RAM. Do not configure native
  systemd limits due to the lack of consensus in the kernel community
  requires out-of-tree kernel patches.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

Fix creation and sync of etcd certs

Admin certs only go to etcd nodes
Only generate cert-data for nodes that need sync

Fix calico-rr to use etcd certs instead of kube certs

* Re-enable ansible_ssh_pipelining as expected for the cluster.yml
* Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd,
  calico-rr groups instead. Other nodes in inventory are out of Kargo
  scope and it's up to users how to manage them.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Rework CI triggers/pipeline

* Run CI triggers in one step
* Run all test matrix for triggers
* Switch back to g1-small

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Rework ignore_errors to report no reds

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Do not forward private domains for upstream resolvers

Also fix kube log level 4 to log dnsmasq queries.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

Add inventory builder python script

Includes tox support for running unit tests.
Small note added to getting-started guide for using
inventory_builder.py

Also adds manual-only unit test.

Adjust etcd server certificates