Secure etcd deployment with TLS assets generated by kubeadm

[alexbrand]

Fixes #40

The following PR deploys a secure etcd cluster (listening on HTTPS for clients and peers).

The etcd role now:

1. Downloads the kubeadm binary directly from the kubernetes release "bucket". The kubeadm version is configurable via a variable.
2. Uses kubeadm to generate the keys and certificates required for secure etcd on the first etcd node.
3. Slurps and distributes generated certs to the rest of the etcd nodes

The kubernetes-masters role now:

1. Slurps the etcd certificates from the first etcd node and copies them to the master nodes
2. The etcd client endpoints variable now uses HTTPS instead of HTTP

Notes for reviewer:

1. Not sure if there's a way to avoid defining the kubernetes version in multiple roles. With this PR, we are adding one more place where the kubernetes (really kubeadm) version must be specified.

[scottslowe]

@alexbrand Can you have a look at this PR and see if you can resolve any merge conflicts?

[detiber]

@chuckha ptal

[alexbrand]

@scottslowe all set 👍

[chuckha]

one tiny nit since I don't know much about Ansible's syntax.

from a kubeadm perspective this looks 💯! Super excited to have this change in wardroom. I think this unblocks standing up a multi-node control plane cluster with the Quickstart.

[chuckha]

I see the [0] in a few places here and |first later on, should these be consistent?

[alexbrand]

Good call. I've updated to |first

[chuckha]

lgtm!

[alexbrand]

Closing as this is superseded by #181