Update apiserver certificate SANs with k8s master IPs

[atsikham]

Bug #1520
Changes were made according to design spec. Important note that kubectl will act as before with private IPs if they were not used in ansible inventory, as initially k8s apiserver certificates have only SANs related to current node, for example

DNS:atsikham-update-kubernetes-master-vm-1, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, DNS:localhost, IP Address:10.96.0.1, IP Address:10.1.1.6

Cases that were tested:

• HA cluster deployment from scratch
• HA cluster update with old certificate SANs
• HA cluster update with new certificate SANs
• promotion to HA of single-master cluster that contains old certificate SANs

Tests were performed with 3-master k8s clusters.
To check that changes work as expected:

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout | grep DNS:
openssl s_client -connect   <master_ip>:3446 | openssl x509 -noout -text | grep DNS: 

[sk4zuzu]

I have manually tested the following scenarios:

• multi master deployment (3 instances) ✔️
• single non-ha master deployment ✔️
• promotion from single non-ha master ✔️
• scaling up from single master to multi master (3 instances) ✔️

Code quality seems good, LGTM 👍.