Flanneld + calico, a.k.a. canal setup can use Kubernetes as storage instead of Etcd. This removes need to keep Etcd certificate on all nodes, making whole setup more secure, as access to etcd grants unlimited powers to malicious user.