Admin certs only go to etcd nodes
Only generate cert-data for nodes that need sync

Includes hooks for triggering calico, kubelet, and kube-apiserver restarts
if etcd certs changed.

Add tags to allow more granular tasks filtering.
Add generator script for MD formatted tags found.
Add docs for tags how-to.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>