When running the 1.19 variant of k3os to rotate my certs do I need to restart all masters or one?