Currently, we are using .NonMasqueradeCIDR in the wrong fashion. We
should be using .KubeControllerManager.ClusterCIDR to prevent IP
collision with Service IPs.
This gives the ability to a user to enable cross-subnet mode in Calico.
Also introduces a new addon that, full disclosure, I wrote.
[ottoyiu/k8s-ec2-srcdst](https://github.com/ottoyiu/k8s-ec2-srcdst)
When system is low on resources, it is possible that calico-node will be
evicted by kubernetes. That's what happened today in our cluster
bringing down all containers.