Move calico-policy-controller into separate role

By default Calico CNI does not create any network access policies
or profiles if 'policy' is enabled in CNI config. And without any
policies/profiles network access to/from PODs is blocked.

K8s related policies are created by calico-policy-controller in
such case. So we need to start it as soon as possible, before any
real workloads.

This patch also fixes kube-api port in calico-policy-controller
yaml template.

Closes #1132

roles/kubernetes-apps/ansible/defaults/main.yml

@@ -19,12 +19,6 @@ kubednsmasq_image_tag: "{{ kubednsmasq_version }}"
 exechealthz_image_repo: "gcr.io/google_containers/exechealthz-amd64"
 exechealthz_image_tag: "{{ exechealthz_version }}"
 
-# Limits for calico apps
-calico_policy_controller_cpu_limit: 100m
-calico_policy_controller_memory_limit: 256M
-calico_policy_controller_cpu_requests: 30m
-calico_policy_controller_memory_requests: 64M
-
 # Netchecker
 deploy_netchecker: false
 netchecker_port: 31081
@@ -45,5 +39,4 @@ netchecker_server_memory_requests: 64M
 
 # SSL
 etcd_cert_dir: "/etc/ssl/etcd/ssl"
-calico_cert_dir: "/etc/calico/certs"
 canal_cert_dir: "/etc/canal/certs"

roles/kubernetes-apps/ansible/tasks/calico-policy-controller.yml

@@ -1,20 +0,0 @@
----
-- set_fact:
-    calico_cert_dir: "{{ canal_cert_dir }}"
-  when: kube_network_plugin == 'canal'
-  tags: facts
-
-- name: Write calico-policy-controller yaml
-  template:
-    src: calico-policy-controller.yml.j2
-    dest: "{{kube_config_dir}}/calico-policy-controller.yml"
-  when: inventory_hostname == groups['kube-master'][0]
-
-- name: Start of Calico policy controller
-  kube:
-    name: "calico-policy-controller"
-    kubectl: "{{bin_dir}}/kubectl"
-    filename: "{{kube_config_dir}}/calico-policy-controller.yml"
-    namespace: "{{system_namespace}}"
-    resource: "rs"
-  when: inventory_hostname == groups['kube-master'][0]

roles/kubernetes-apps/ansible/tasks/main.yml

@@ -32,11 +32,6 @@
   when: dns_mode != 'none' and inventory_hostname == groups['kube-master'][0]
   tags: dnsmasq
 
-- include: tasks/calico-policy-controller.yml
-  when: ( enable_network_policy is defined and enable_network_policy == True ) or
-    ( kube_network_plugin == 'canal' )
-  tags: [network, canal]
-
 - name: Kubernetes Apps | Netchecker
   include: tasks/netchecker.yml
   when: deploy_netchecker

roles/kubernetes-apps/ansible/templates/calico-policy-controller.yml.j2

@@ -1,62 +0,0 @@
-apiVersion: extensions/v1beta1
-kind: ReplicaSet
-metadata:
-  name: calico-policy-controller
-  namespace: {{ system_namespace }}
-  labels:
-    k8s-app: calico-policy
-    kubernetes.io/cluster-service: "true"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      kubernetes.io/cluster-service: "true"
-      k8s-app: calico-policy
-  template:
-    metadata:
-      name: calico-policy-controller
-      namespace: {{system_namespace}}
-      labels:
-        kubernetes.io/cluster-service: "true"
-        k8s-app: calico-policy
-    spec:
-      hostNetwork: true
-      containers:
-        - name: calico-policy-controller
-          image: {{ calico_policy_image_repo }}:{{ calico_policy_image_tag }}
-          imagePullPolicy: {{ k8s_image_pull_policy }}
-          resources:
-            limits:
-              cpu: {{ calico_policy_controller_cpu_limit }}
-              memory: {{ calico_policy_controller_memory_limit }}
-            requests:
-              cpu: {{ calico_policy_controller_cpu_requests }}
-              memory: {{ calico_policy_controller_memory_requests }}
-          env:
-            - name: ETCD_ENDPOINTS
-              value: "{{ etcd_access_endpoint }}"
-            - name: ETCD_CA_CERT_FILE
-              value: "{{ calico_cert_dir }}/ca_cert.crt"
-            - name: ETCD_CERT_FILE
-              value: "{{ calico_cert_dir }}/cert.crt"
-            - name: ETCD_KEY_FILE
-              value: "{{ calico_cert_dir }}/key.pem"
-            # Location of the Kubernetes API - this shouldn't need to be
-            # changed so long as it is used in conjunction with
-            # CONFIGURE_ETC_HOSTS="true".
-            - name: K8S_API
-              value: "https://kubernetes.default:{{ kube_apiserver_port }}"
-            # Configure /etc/hosts within the container to resolve
-            # the kubernetes.default Service to the correct clusterIP
-            # using the environment provided by the kubelet.
-            # This removes the need for KubeDNS to resolve the Service.
-            - name: CONFIGURE_ETC_HOSTS
-              value: "true"
-          volumeMounts:
-          - mountPath: {{ calico_cert_dir }}
-            name: etcd-certs
-            readOnly: true
-      volumes:
-      - hostPath:
-          path: {{ calico_cert_dir }}
-        name: etcd-certs