Continue refactoring certs into nodeup

[johngmyers]

Finally got the api-server server cert. It took a lot of refactoring to get here.

[rifelpet]

/lgtm
/approve

When someone upgrades to a version of Kops that includes these refactors, they'll be left with orphaned certificates in their state store correct? Perhaps we'll want to include a release note on cleaning them up after upgrading.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johngmyers, rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[johngmyers]

They will, but then they'll also have the CA private keys in the state store. This would be more of a concern for keys that can be accessed from worker nodes.

[rifelpet]

ah thats true. anything that currently has read access to the orphaned certs and private keys also has read access to the CA private keys 👍

[johngmyers]

/retest