Full rewrite of etcd certificates generation

[VannTen]

What type of PR is this?
/kind cleanup

What this PR does / why we need it:

This is a (WIP) full rewrite of the certificates generation for etcd

The main guiding principles are:

• private key are generated on their use sites and never fetched anywhere else
• Certificate signing request and certificates are passed around using ansible registered variables
• avoid relying on scripts / templated openssl.conf and prefer command line arguments where possible

This should have the following benefits:

• no need for node specific filename, which will work better with kubeadm assumptions (see Unable to upgrade from 1.29.x to 1.30.x with external etcd setup #11500 discussion for instance)
• moving private keys around is antithetic to the design of PKI and assymetric crypto
• This will allow working with private keys which cannot be moved, for instance, where the private key is held by a TPM/HSM.

Out of scope for this PR (but possible follow-ups):

• set up of etcd authorization / restrict client
• external CA integration (I think this design would make Configure external CA #10941 easier, @nicolas-goudry)
• full customization of crypto parameters

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:
This is a work in progress. Roughly :

• Creating CA, CSR, certificates
• Adding correct CN / SANs
• Propagate the names into the rest of kubespray (kubeadm and network plugins directly using etcd as a datastore)

@ant31 @tico88612

Once this is ready this should not merge before 2.28. It's a big change so I'd rather have some time in master before that.

Does this PR introduce a user-facing change?:

action required
All etcd certificates (client, member) no longer include the inventory hostname of the node.
Key and certificates are no longer produced on the first etcd, only on the relevant node

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: VannTen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [VannTen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[aviral-agarwal]

Hey @VannTen
Just a few notes concerning Cilium as CNI and etcd that may be relevant and helpful for the PR

• Cilium running on worker nodes does not always need access to etcd.
  That was the case before, but with the updated version, the default is no access to etcd required
• One configuration (which I am aware of) that will configure Cilium (including Cilium agents on worker nodes) to require etcd access is when identityAllocationMode(Cilium helm)/cilium_identity_allocation_mode(kubespray) is kvstore.
• The current default value, in both Cilium helm charts and kubespray, is crd

This is by no means an exhaustive list, but should be helpful anyway

Feel free to comment/give feedback/or if I can be of any assistance

Thanks and keeping an eye out for this PR