Drop linux capabilities and rework users/groups

* Drop linux capabilities for unprivileged containerized
  worlkoads Kargo configures for deployments.
* Configure required securityContext/user/group/groups for kube
  components' static manifests, etcd, calico-rr and k8s apps,
  like dnsmasq daemonset.
* Rework cloud-init (etcd) users creation for CoreOS.
* Fix nologin paths, adjust defaults for addusers role and ensure
  supplementary groups membership added for users.
* Add netplug user for network plugins (yet unused by privileged
  networking containers though).
* Grant the kube and netplug users read access for etcd certs via
  the etcd certs group.
* Grant group read access to kube certs via the kube cert group.
* Remove priveleged mode for calico-rr and run it under its uid/gid
  and supplementary etcd_cert group.
* Adjust docs.
* Align cpu/memory limits and dropped caps with added rkt support
  for control plane.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

roles/kubernetes/node/defaults/main.yml

@@ -29,3 +29,18 @@ nginx_image_repo: nginx
 nginx_image_tag: 1.11.4-alpine
 
 etcd_config_dir: /etc/ssl/etcd
+
+# Linux capabilities to be dropped for container engines
+apps_drop_cap:
+  - chown
+  - dac_override
+  - fowner
+  - fsetid
+  - kill
+  - setgid
+  - setuid
+  - setpcap
+  - sys_chroot
+  - mknod
+  - audit_write
+  - setfcap

roles/kubernetes/node/tasks/install.yml

@@ -26,6 +26,6 @@
   notify: restart kubelet
 
 - name: install | Install kubelet launch script
-  template: src=kubelet-container.j2 dest="{{ bin_dir }}/kubelet" owner=kube mode=0755 backup=yes
+  template: src=kubelet-container.j2 dest="{{ bin_dir }}/kubelet" owner={{ kubelet_user }} mode=0755 backup=yes
   notify: restart kubelet
   when: kubelet_deployment_type == "docker"

roles/kubernetes/node/tasks/main.yml

@@ -4,6 +4,9 @@
       {%- if inventory_hostname in groups['kube-master'] and inventory_hostname not in groups['kube-node'] -%}true{%- else -%}false{%- endif -%}
   tags: facts
 
+- include: pre-upgrade.yml
+  tags: k8s-pre-upgrade
+
 - include: install.yml
   tags: kubelet
 

roles/kubernetes/node/tasks/pre-upgrade.yml

@@ -0,0 +1,4 @@
+---
+- name: "Pre-upgrade | share access to kube certs for its users"
+  shell: chmod g+r {{ kube_cert_dir }}/*.pem
+  failed_when: false

roles/kubernetes/node/templates/kubelet.rkt.service.j2

@@ -29,7 +29,7 @@ ExecStart=/usr/bin/rkt run \
         --volume run,kind=host,source=/run,readOnly=false \
         --volume usr-share-certs,kind=host,source=/usr/share/ca-certificates,readOnly=true \
         --volume var-lib-docker,kind=host,source={{ docker_daemon_graph }},readOnly=false \
-	--volume var-lib-kubelet,kind=host,source=/var/lib/kubelet,readOnly=false \
+        --volume var-lib-kubelet,kind=host,source=/var/lib/kubelet,readOnly=false \
         --volume var-log,kind=host,source=/var/log \
         --mount volume=dns,target=/etc/resolv.conf \
         --mount volume=etc-cni,target=/etc/cni \
@@ -44,6 +44,7 @@ ExecStart=/usr/bin/rkt run \
         --mount volume=var-log,target=/var/log \
         --stage1-from-dir=stage1-fly.aci \
         {{ hyperkube_image_repo }}:{{ hyperkube_image_tag }} \
+        --memory={{ kubelet_memory_limit }} --cpu={{ kubelet_cpu_limit }} \
         --uuid-file-save=/var/run/kubelet.uuid \
         --debug --exec=/kubelet -- \
                 $KUBE_LOGTOSTDERR \