Use dedicated front-proxy-ca for front-proxy-client

roles/kubernetes/master/tasks/kubeadm-migrate-certs.yml

...tes/master/templates/manifests/kube-apiserver.manifest.j2

roles/kubernetes/secrets/defaults/main.yml

roles/kubernetes/secrets/files/make-ssl.sh

roles/kubernetes/secrets/tasks/check-certs.yml

roles/kubernetes/secrets/tasks/gen_certs_script.yml

roles/kubernetes/secrets/tasks/gen_certs_vault.yml

roles/kubernetes/secrets/tasks/sync_kube_master_certs.yml

roles/vault/defaults/main.yml

roles/vault/tasks/cluster/create_mounts.yml

roles/vault/tasks/cluster/main.yml

roles/vault/tasks/shared/issue_cert.yml