Give the API server access to TLS certs.

Moved the cert generation to a separate salt state and put it in a more appropriate sharable location (`/srv/kubernetes/`).
Merge pull request #2341 from jbeda/cert-gen

Give the API server access to TLS certs.