Docs on using the bastion

dns-controller: don't make spurious updates in buffer

Create a role for networking addons; use as selector

These will be caught later anyway, but we can save a false invalidation
and a spurious log message.

role.kubernetes.io/networking

This ensures that when we switch networking providers, we replace all
the components of the prior tool.

Fix DNS name precreation

Set default sysctls

Raise an error on an invalid s3 path

Fixing hosted zone errors with bastion, and cleaning up dns model logic

De-emphasize cni for private topologies

We were creating the wrong names for etcd.  Also add a test.

Fix #1393

When outputing to terraform, don't say the cluster is starting

Add diagnostic message when updating DNS

Fix #1373

Fix #902

Tag ELBs when building with terraform

In debugging, it would have been useful to see the old & new values
sometimes

Discover existing ElasticIP & NatGateway without tagging

This should allow for round-tripping with terraform (which can't
practically do remote-resource tagging)

Otherwise we can't delete

Add conversion tests, and fix some problems

* We were naming our etcd zones inconsistently
* When we wrote to v1alpha2, we would change the etc member names

Fix #1202

Suggest the user goes into the output directory and runs terraform plan
& apply instead.

Fix #1141

Fix double initialization of DNSZone

And, while we are it, clean up DNSZone so that it has separate notions
of TaskName, DNSName and HostedZoneID.  We conflated the three
previously, which we don't want to do at the task layer.  We don't want
to conflate the TaskName and the DNSName so that we can create a private
& public hosted zone with the same DNSName.  We don't want to "smuggle"
the hosted zone ID in the DNSName because it doesn't belong in the task
layer.

Fix #1374

Bug fixes and bastion reworking

make installation a heading

Fix AWS storage manifest location

Fix channels build

Looks like I forgot to update it for the k8s API update

Fix storage tests