kubeadm: validate local etcd certficates during expiration checks

[neolit123]

What type of PR is this?

/kind bug

What this PR does / why we need it:

kubeadm: validate local etcd certficates during expiration checks 

In case stacked etcd is used, the code that does expiration checks
does not validate if the etcd CA is "external" (missing key)
and if the etcd CA signed certificates are valid.

Add a new function UsingExternalEtcdCA() similar to existing functions
for the cluster CA and front-proxy CA, that performs the checks for
missing etcd CA key and certificate validity.

This function only runs for stacked etcd, since if etcd is external
kubeadm does not track any certs signed by that etcd CA.

This fixes a bug where the etcd CA will be reported as local even
if the etcd/ca.key is missing during "certs check-expiration".

this second commit is a cleanup on the side...

kubeadm: print the CA of kubeconfig files in "check expiration" 

Apply a small fix to ensure the kubeconfig files
that kubeadm manages have a CA when printed in the table
of the "check expiration" command. "CAName" is the field used for that.

In practice kubeconfig files can contain multiple credentials
from different CAs, but this is not supported by kubeadm and there
is a single cluster CA that signs the single client cert/key
in kubeadm managed kubeconfigs.

Which issue(s) this PR fixes:

xref kubernetes/kubeadm#2618 (comment)
xref kubernetes/kubeadm#2618

Special notes for your reviewer:

Does this PR introduce a user-facing change?

kubeadm: during execution of the "check expiration" command, treat the etcd CA as external if there is a missing etcd CA key file (etcd/ca.key) and perform the proper validation on certificates signed by the etcd CA. Additionally, make sure that the CA for all entries in the output table is included - for both certificates on disk and in kubeconfig files.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[neolit123]

/triage accepted
/priority backlog
/cc @pacoxu

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: neolit123

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS [neolit123]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[SataQiu]

It works fine.

[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Nov 06, 2022 10:59 UTC   332d            ca                      no
apiserver                  Nov 06, 2022 10:59 UTC   332d            ca                      no
apiserver-etcd-client      Nov 06, 2022 10:59 UTC   332d            etcd-ca                 yes
apiserver-kubelet-client   Nov 06, 2022 10:59 UTC   332d            ca                      no
controller-manager.conf    Nov 06, 2022 10:59 UTC   332d            ca                      no
etcd-healthcheck-client    Nov 06, 2022 10:59 UTC   332d            etcd-ca                 yes
etcd-peer                  Nov 06, 2022 10:59 UTC   332d            etcd-ca                 yes
etcd-server                Nov 06, 2022 10:59 UTC   332d            etcd-ca                 yes
front-proxy-client         Nov 06, 2022 10:59 UTC   332d            front-proxy-ca          no
scheduler.conf             Nov 06, 2022 10:59 UTC   332d            ca                      no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Nov 04, 2031 10:59 UTC   9y              no
etcd-ca                 Nov 04, 2031 10:59 UTC   9y              yes
front-proxy-ca          Nov 04, 2031 10:59 UTC   9y              no

[SataQiu]

/lgtm

[SataQiu]

We can also cherry-pick this to the previous versions after it is merged.

[k8s-triage-robot]

The Kubernetes project has merge-blocking tests that are currently too flaky to consistently pass.

This bot retests PRs for certain kubernetes repos according to the following rules:

• The PR does have any do-not-merge/* labels
• The PR does not have the needs-ok-to-test label
• The PR is mergeable (does not have a needs-rebase label)
• The PR is approved (has cncf-cla: yes, lgtm, approved labels)
• The PR is failing tests required for merge

You can:

• Review the full test history for this PR
• Prevent this bot from retesting with /lgtm cancel or /hold
• Help make our tests less flaky by following our Flaky Tests Guide

/retest