app-admin/*-wrapper: pull container as docker image by default

quay.io is removing ACI conversion support.  Unless overridden, pull
as a docker image instead.

sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files/etcd-wrapper

@@ -27,11 +27,13 @@ function require_ev_one() {
 require_ev_one ETCD_IMAGE ETCD_IMAGE_TAG
 require_ev_all ETCD_USER ETCD_DATA_DIR
 
-ETCD_IMAGE_URL="${ETCD_IMAGE_URL:-quay.io/coreos/etcd}"
+ETCD_IMAGE_URL="${ETCD_IMAGE_URL:-docker://quay.io/coreos/etcd}"
 ETCD_IMAGE="${ETCD_IMAGE:-${ETCD_IMAGE_URL}:${ETCD_IMAGE_TAG}}"
 
 if [[ "${ETCD_IMAGE%%/*}" == "quay.io" ]]; then
 	RKT_RUN_ARGS="${RKT_RUN_ARGS} --trust-keys-from-https"
+elif [[ "${ETCD_IMAGE%%/*}" == "docker:" ]]; then
+	RKT_RUN_ARGS="${RKT_RUN_ARGS} --insecure-options=image"
 fi
 
 if [[ ! -e "${ETCD_DATA_DIR}" ]]; then

sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper

@@ -36,11 +36,13 @@ FLANNEL_IMAGE_TAG="${FLANNEL_IMAGE_TAG:-${FLANNEL_VER}}"
 
 require_ev_one FLANNEL_IMAGE FLANNEL_IMAGE_TAG
 
-FLANNEL_IMAGE_URL="${FLANNEL_IMAGE_URL:-${FLANNEL_IMG:-quay.io/coreos/flannel}}"
+FLANNEL_IMAGE_URL="${FLANNEL_IMAGE_URL:-${FLANNEL_IMG:-docker://quay.io/coreos/flannel}}"
 FLANNEL_IMAGE="${FLANNEL_IMAGE:-${FLANNEL_IMAGE_URL}:${FLANNEL_IMAGE_TAG}}"
 
 if [[ "${FLANNEL_IMAGE%%/*}" == "quay.io" ]]; then
 	RKT_RUN_ARGS="${RKT_RUN_ARGS} --trust-keys-from-https"
+elif [[ "${FLANNEL_IMAGE%%/*}" == "docker:" ]]; then
+	RKT_RUN_ARGS="${RKT_RUN_ARGS} --insecure-options=image"
 fi
 
 ETCD_SSL_DIR="${ETCD_SSL_DIR:-/etc/ssl/etcd}"

sdk_container/src/third_party/coreos-overlay/app-admin/kubelet-wrapper/files/kubelet-wrapper

@@ -42,13 +42,15 @@ KUBELET_IMAGE_TAG="${KUBELET_IMAGE_TAG:-${KUBELET_VERSION}}"
 
 require_ev_one KUBELET_IMAGE KUBELET_IMAGE_TAG
 
-KUBELET_IMAGE_URL="${KUBELET_IMAGE_URL:-${KUBELET_ACI:-quay.io/coreos/hyperkube}}"
+KUBELET_IMAGE_URL="${KUBELET_IMAGE_URL:-${KUBELET_ACI:-docker://quay.io/coreos/hyperkube}}"
 KUBELET_IMAGE="${KUBELET_IMAGE:-${KUBELET_IMAGE_URL}:${KUBELET_IMAGE_TAG}}"
 
 RKT_RUN_ARGS="${RKT_RUN_ARGS} ${RKT_OPTS}"
 
 if [[ "${KUBELET_IMAGE%%/*}" == "quay.io" ]]; then
 	RKT_RUN_ARGS="${RKT_RUN_ARGS} --trust-keys-from-https"
+elif [[ "${KUBELET_IMAGE%%/*}" == "docker:" ]]; then
+	RKT_RUN_ARGS="${RKT_RUN_ARGS} --insecure-options=image"
 fi
 
 mkdir --parents /etc/kubernetes