Drop linux capabilities and rework users/groups

* Drop linux capabilities for unprivileged containerized
  worlkoads Kargo configures for deployments.
* Configure required securityContext/user/group/groups for kube
  components' static manifests, etcd, calico-rr and k8s apps,
  like dnsmasq daemonset.
* Rework cloud-init (etcd) users creation for CoreOS.
* Fix nologin paths, adjust defaults for addusers role and ensure
  supplementary groups membership added for users.
* Add netplug user for network plugins (yet unused by privileged
  networking containers though).
* Grant the kube and netplug users read access for etcd certs via
  the etcd certs group.
* Grant group read access to kube certs via the kube cert group.
* Remove priveleged mode for calico-rr and run it under its uid/gid
  and supplementary etcd_cert group.
* Adjust docs.
* Align cpu/memory limits and dropped caps with added rkt support
  for control plane.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

roles/adduser/tasks/main.yml

@@ -1,13 +1,35 @@
 ---
+- name: User | Create Certificate Access Groups
+  group: name={{ item }} system=yes
+  with_items: "{{ user.groups.split(',') }}"
+
 - name: User | Create User Group
   group: name={{user.group|default(user.name)}} system={{user.system|default(omit)}}
 
+- name: User | Create cloud-init user
+  template:
+    dest: /etc/{{ user.name }}_user_cloud_init_conf
+    src: users.j2
+    owner: root
+    mode: 0640
+  notify: User | update users for cloud-init
+  when: "{{ user.type|default('standard') == 'cloud-init' }}"
+
+- meta: flush_handlers
+
+- name: User | Hack groups for existing cloud-init users CoreOS
+  command: /usr/sbin/usermod -aG {{ item }} {{ user.name }}
+  with_items: "{{ user.groups.split(',') }}"
+  when: "{{ ansible_os_family in ['CoreOS', 'Container Linux by CoreOS'] and user.type|default('standard') == 'cloud-init' }}"
+
 - name: User | Create User
   user:
     comment: "{{user.comment|default(omit)}}"
-    createhome: "{{user.create_home|default(omit)}}"
+    createhome: "{{user.createhome|default(omit)}}"
     group: "{{user.group|default(user.name)}}"
+    groups: "{{user.groups|default(omit)}}"
     home: "{{user.home|default(omit)}}"
     shell: "{{user.shell|default(omit)}}"
     name: "{{user.name}}"
     system: "{{user.system|default(omit)}}"
+  when: "{{ user.type|default('standard') != 'cloud-init' }}"