Individual etcd ssl certs

Includes hooks for triggering calico, kubelet, and kube-apiserver restarts
if etcd certs changed.

roles/etcd/tasks/main.yml

@@ -22,10 +22,11 @@
     enabled: yes
   when: is_etcd_master
 
-- name: Restart etcd if binary changed
+- name: Restart etcd if binary or certs changed
   command: /bin/true
   notify: restart etcd
   when: etcd_deployment_type == "host" and etcd_copy.stdout_lines and is_etcd_master
+    or etcd_secret_changed|default(false)
 
 # Reload systemd before starting service
 - meta: flush_handlers