Add option to generate CSRs to kubeadm alpha phase certs

[randomvariable]

FEATURE REQUEST

Certificate generation is currently handled completely internally of kubeadm, although there is support for externally generated certificates (if kubeadm finds certificates but not the private CA key).

Some users of external CAs could consume CSRs generated by kubeadm, which is fed with node information, and pass on those CSRs to external CAs, store the results in the appropriate place and allow kubeadm to use these as any other external CA.

The workflow would be something like:

• Generate config file
• kubeadm alpha phase certs all --csr-only --config <path to config> --csr-dir <somewhere>
  • kubeadm generates CSRs in appropriate directory, also outputs where they should go on disk
• Externally send CSRs to external CAs
• Externally place signed certs in the correct location
• Continue with kubeadm init workflow

Versions

kubeadm version (use kubeadm version):
git commit: 13f3c7c7ca5d79edeb82a6075b3743c788a3ca4a (pre 1.11 master at time of writing this issue)

Environment:
N/A

cc @liztio as per Slack conversation.

[randomvariable]

/kind feature
/sig cluster-lifecycle

[timothysc]

/assign @liztio

[timothysc]

We're going to have to punt this to 1.13 due to code freeze.

[neolit123]

solved in:
kubernetes/kubernetes#70809