Drop linux capabilities and rework users/groups

* Drop linux capabilities for unprivileged containerized
  worlkoads Kargo configures for deployments.
* Configure required securityContext/user/group/groups for kube
  components' static manifests, etcd, calico-rr and k8s apps,
  like dnsmasq daemonset.
* Rework cloud-init (etcd) users creation for CoreOS.
* Fix nologin paths, adjust defaults for addusers role and ensure
  supplementary groups membership added for users.
* Add netplug user for network plugins (yet unused by privileged
  networking containers though).
* Grant the kube and netplug users read access for etcd certs via
  the etcd certs group.
* Grant group read access to kube certs via the kube cert group.
* Remove priveleged mode for calico-rr and run it under its uid/gid
  and supplementary etcd_cert group.
* Adjust docs.
* Align cpu/memory limits and dropped caps with added rkt support
  for control plane.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

roles/kubernetes/secrets/files/make-ssl.sh

@@ -101,5 +101,8 @@ if [ -n "$HOSTS" ]; then
     done
 fi
 
+# Grant the group read access
+chmod g+r *.pem
+
 # Install certs
 mv *.pem ${SSLDIR}/

roles/kubernetes/secrets/tasks/gen_certs.yml

@@ -110,11 +110,11 @@
   file:
     path={{ kube_cert_dir }}
     group={{ kube_cert_group }}
-    owner=kube
+    owner={{ kubelet_user }}
     recurse=yes
 
-- name: Gen_certs | set permissions on keys
-  shell: chmod 0600 {{ kube_cert_dir}}/*key.pem
+- name: Gen_certs | set shared group permissions on keys
+  shell: chmod 0640 {{ kube_cert_dir}}/*.pem
   when: inventory_hostname in groups['kube-master']
   changed_when: false
 

roles/kubernetes/secrets/tasks/main.yml

@@ -9,6 +9,7 @@
     path={{ kube_cert_dir }}
     state=directory
     mode=o-rwx
+    owner={{ kubelet_user }}
     group={{ kube_cert_group }}
 
 - name: Make sure the tokens directory exits
@@ -16,14 +17,16 @@
     path={{ kube_token_dir }}
     state=directory
     mode=o-rwx
-    group={{ kube_cert_group }}
+    owner={{ kubelet_user }}
+    group={{ kubelet_group }}
 
 - name: Make sure the users directory exits
   file:
     path={{ kube_users_dir }}
     state=directory
     mode=o-rwx
-    group={{ kube_cert_group }}
+    owner={{ kubelet_user }}
+    group={{ kubelet_group }}
 
 - name: Populate users for basic auth in API
   lineinfile: