Fix mountflags and kubelet config

Add missing --require-kubeconfig to the if..else stanza.
Make sure certs dirs mounted in RO.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>

roles/network_plugin/canal/templates/canal-node.yml.j2

@@ -111,6 +111,7 @@ spec:
               mountPath: "/run/flannel"
             - name: "canal-certs"
               mountPath: "{{ canal_cert_dir }}"
+              readOnly: true
         # Runs calico/node container on each Kubernetes node.  This
         # container programs network policy and local routes on each
         # host.
@@ -156,3 +157,4 @@ spec:
               readOnly: false
             - name: "canal-certs"
               mountPath: "{{ canal_cert_dir }}"
+              readOnly: true

roles/network_plugin/flannel/templates/flannel-pod.yml

@@ -33,6 +33,7 @@
             mountPath: "/run/flannel"
           - name: "etcd-certs"
             mountPath: "{{ etcd_cert_dir }}"
+            readOnly: true
         securityContext:
           privileged: true
     hostNetwork: true