kubeadm/etcd: use config to download certificate (kubernetes-sigs#9609)

This commit uses a kubeadm join config to pull down cert for etcd in
workers nodes (which is needed in some circumstances, for instance with
calico or cilium).

The previous way didn't allow us to pass certain parameters which was
typically given in the config in other kubeadm invokations in Kubespray.
This made kubeadm produced some errors for some edge cases.

For example, in our deployment we don't have a default route and even
though it's only to download the certificates, kubeadm produce an error
`unable to select an IP from default routes` (these command are kubeadm
controlplane command, so kubeadm does some additional checks). This is
fixed by specifying `advertiseAddress` within the kubeadm config.

Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>

Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>

Fix typos in calico (kubernetes-sigs#9327)

disable kubelet_authorization_mode_webhook by default (kubernetes-sig…

…s#9239)

disable kubelet_authorization_mode_webhook by default

[ingress-nginx] upgrade to 1.2.1 (kubernetes-sigs#8904)

[sysctl] set fs.may_detach_mounts=1 even when CRIs don't set it thems…

…elves (kubernetes-sigs#8635) (kubernetes-sigs#8642)

Simplify usage of pre-remove role (kubernetes-sigs#8334)

- Use builtin task scheduling of ansible (same task on each host)
  instead of manual looping on master

Benefits:
- One less play in remove-node.yml playbook
- Parralel node drain
- Drain parameters (timeout, grace period, retries,
  allow_ungraceful_removal) can be adjusted separately for each node
  with ansible variables

[2.17] Update kubernetes version to 1.21.6 (kubernetes-sigs#8142)

Fix default version (kubernetes-sigs#7977)

Fix Oracle yum disabled repository file after EPEL install (kubernete…

…s-sigs#7639)