Move calico-policy-controller into separate role

By default Calico CNI does not create any network access policies
or profiles if 'policy' is enabled in CNI config. And without any
policies/profiles network access to/from PODs is blocked.

K8s related policies are created by calico-policy-controller in
such case. So we need to start it as soon as possible, before any
real workloads.

This patch also fixes kube-api port in calico-policy-controller
yaml template.

Closes #1132

roles/kubernetes-apps/policy_controller/calico/tasks/main.yml

@@ -0,0 +1,21 @@
+- set_fact:
+    calico_cert_dir: "{{ canal_cert_dir }}"
+  when: kube_network_plugin == 'canal'
+  tags: [facts, canal]
+
+- name: Write calico-policy-controller yaml
+  template:
+    src: calico-policy-controller.yml.j2
+    dest: "{{kube_config_dir}}/calico-policy-controller.yml"
+  when: inventory_hostname == groups['kube-master'][0]
+  tags: canal
+
+- name: Start of Calico policy controller
+  kube:
+    name: "calico-policy-controller"
+    kubectl: "{{bin_dir}}/kubectl"
+    filename: "{{kube_config_dir}}/calico-policy-controller.yml"
+    namespace: "{{system_namespace}}"
+    resource: "rs"
+  when: inventory_hostname == groups['kube-master'][0]
+  tags: canal