Admin certs only go to etcd nodes Only generate cert-data for nodes that need sync
Includes hooks for triggering calico, kubelet, and kube-apiserver restarts if etcd certs changed.