Fix instability while starting kubelet on worker/controller nodes

[mumoshu]

i.e. coreos/coreos-kubernetes#697

[mumoshu]

I'm going to eventually fix 3 units: docker.service, flanneld.service, kubelet.service.
The reasoning behind this is that I believe

• If flanneld.service depends on just local etcd.service, normally it shouldn't fail transiently(aws: workaround for systemd #1312 coreos/coreos-kubernetes#697 (comment)). But in today's kube-aws, it depends on discrete etcd nodes in controller/worker nodes. It may fail when etcd.service's in controller/worker nodes started before the remote etcd's become ready.
• docker.service depends on local flanneld.service which depends on the remote etcd in controller/worker nodes. It may fail on startup then.
• kubelet.service depends on flanneld.service. It may also fail then.

fyi @dghubble

[mumoshu]

well, some more information regarding this. I'm reconsidering where to fix.

• flanneld.service doesn't seem to depend on suspicious services (other than the decrypt-tls-assets oneshot service which had been considered problematic and also addressed in my PR to coreos-kubernetes), and it has Restart=always. It won't fail because of dependency failure then.
• log messages referred in controller node fails to start periodically because flannel doesn't start. coreos/coreos-kubernetes#710 does show failed decrypt-tls-assets.service, which is required by kubelet.service and flanneld.service in kube-aws

[mumoshu]

I've noticed that, in cloud-config-etcd, we should make decrypt-tls-assets based rkt instead of docker, as we had done so for workers/controllers.
I'll address that in a separate issue if it matters.

[mumoshu]

Let me outline how I'm going to fix the issue based on my initial plan in coreos/coreos-kubernetes#697 (comment)

• Modification to kubelet.service would be useful according to coreos-baremetal#253

Make it not require flannel and/or docker, but want just flannel to up using the Wants and ExecStartPre pattern. This will prevent kubelet.service from stopped forever in case of startup failures in flanneld.service (and decrypt-tls-assets)

• Modification to flanneld.service would be useful according to Fix node drain error when trying to evict pods from jobs #710

Make it want/require nothing. Just run decrypt-tls-assets in ExecStartPre to prevent a single failure of decrypt-tls-assets from breaking flanneld.service forever.

• Modification to docker.service would be useful according to Allow userdata to be split across multiple parts #682

The Wants and ExecStartPre on flanneld to prevent a single failure in starting flanneld.service from breaking docker.service forever.

Also note that, it should work as long as docker.service, flanneld.service and kublet.service aren't Required from other services.