Fix cert and netchecker upgrade issues (#1543)

* Bump tag for upgrade CI, fix netchecker upgrade

netchecker-server was changed from pod to deployment, so
we need an upgrade hook for it.

CI now uses v2.1.1 as a basis for upgrade.

* Fix upgrades for certs from non-rbac to rbac

roles/kubernetes-apps/ansible/tasks/netchecker.yml

@@ -15,6 +15,15 @@
     - inventory_hostname == groups['kube-master'][0]
     - rbac_enabled or item.type not in rbac_resources
 
+- name: Kubernetes Apps | Purge old Netchecker server
+  kube:
+    name: "netchecker-server"
+    namespace: "{{ netcheck_namespace }}"
+    kubectl: "{{bin_dir}}/kubectl"
+    resource: "po"
+    state: absent
+  when: inventory_hostname == groups['kube-master'][0]
+
 #FIXME: remove if kubernetes/features#124 is implemented
 - name: Kubernetes Apps | Purge old Netchecker daemonsets
   kube: