Control plane based updates

[leoluk]

Updating works, but currently uses an interactive script, which is inconvenient in larger clusters (unreachable nodes, etc).

Set an update policy (possibly with auto-updates) and automate its roll out.

Draft design doc: https://docs.google.com/document/d/1wfRry-WkNCqOXdvHz33T2NkYCw9VuTnkPm7yQlTFBv4/edit#heading=h.y1witgmu0r8m

Related:

• controlplane: minimum version negotiation/consensus #272

/cc @lorenz

[lorenz]

Inconvenience is not the primary problem here but people accidentally breaking/degrading their cluster by not doing the upgrade properly (jumping to incompatible versions, too many control plane nodes at the same time, not respecting update order, ...). By doing it ourselves we can guarantee that it is done properly and don't need to explain all constraints to the user.