Fix cert and netchecker upgrade issues (#1543)

* Bump tag for upgrade CI, fix netchecker upgrade

netchecker-server was changed from pod to deployment, so
we need an upgrade hook for it.

CI now uses v2.1.1 as a basis for upgrade.

* Fix upgrades for certs from non-rbac to rbac

roles/kubernetes/secrets/tasks/gen_certs_script.yml

@@ -40,7 +40,7 @@
   command: "{{ kube_script_dir }}/make-ssl.sh -f {{ kube_config_dir }}/openssl.conf -d {{ kube_cert_dir }}"
   environment:
     - MASTERS: "{% for m in groups['kube-master'] %}
-                  {% if gen_node_certs[m]|default(false) %}
+                  {% if gen_master_certs|default(false) %}
                     {{ m }}
                   {% endif %}
                 {% endfor %}"