Update Calico to v2.4.1

[tmjd]

Calico was last updated with v2.2.1 in Kops and it should be updated to the latest available to pick up new features and fixes.

One thing that needs to be mentioned is that this update includes a change in the default deny behavior, Calico has switched this behavior for the move of Kubernetes NetworkPolicy to v1. You can see the release notes for Calico at https://github.com/projectcalico/calico/releases/tag/v2.4.0 (see the changes under k8s-policy).
I am looking for guidance on how the kops project would like to handle this behavior change or at least know that it is expected that users should understand the changes of the components they are using.

Just to point out how this new behavior works:

• DefaultDeny is enabled for a pod if there is any policy that selects the pod
  • That means the new way to enable DefaultDeny is create a policy that selects all pods (in a namespace)
  • This also means that if DefaultDeny is not desired then all policy needs to be removed that targets a pod.
• The old default deny annotation has no effect with the new Calico version

[chrislovecnm]

Can we close this now?

[tmjd]

Should any release notes be added for this update? If so, I can add them if you point me to where/how. If not then yeah I'm good with closing this.

[chrislovecnm]

@tmjd yes please start on the 1.7.1 release notes! https://github.com/kubernetes/kops/tree/master/docs/releases is where we store them and create a new file for 1.7.1.

Closing :)