Give the API server access to TLS certs.

Moved the cert generation to a separate salt state and put it in a more appropriate sharable location (`/srv/kubernetes/`).

cluster/saltbase/salt/nginx/init.sls

@@ -8,45 +8,7 @@ nginx:
       - file: /etc/nginx/nginx.conf
       - file: /etc/nginx/sites-enabled/default
       - file: /usr/share/nginx/htpasswd
-      - cmd: /usr/share/nginx/server.cert
-
-{% if grains.cloud is defined %}
-  {% if grains.cloud == 'gce' %}
-    {% set cert_ip='_use_gce_external_ip_' %}
-  {% endif %}
-  {% if grains.cloud == 'aws' %}
-    {% set cert_ip='_use_aws_external_ip_' %}
-  {% endif %}
-  {% if grains.cloud == 'vagrant' %}
-    {% set cert_ip=grains.fqdn_ip4 %}
-  {% endif %}
-  {% if grains.cloud == 'vsphere' %}
-    {% set cert_ip=grains.ip_interfaces.eth0[0] %}
-  {% endif %}
-{% endif %}
-# If there is a pillar defined, override any defaults.
-{% if pillar['cert_ip'] is defined %}
-  {% set cert_ip=pillar['cert_ip'] %}
-{% endif %}
-
-{% set certgen="make-cert.sh" %}
-{% if cert_ip is defined %}
-  {% set certgen="make-ca-cert.sh" %}
-{% endif %}
-
-/usr/share/nginx/server.cert:
-  cmd.script:
-    - unless: test -f /usr/share/nginx/server.cert
-    - source: salt://nginx/{{certgen}} 
-{% if cert_ip is defined %}
-    - args: {{cert_ip}}
-    - require:
-      - pkg: curl
-{% endif %}
-    - cwd: /
-    - user: root
-    - group: root
-    - shell: /bin/bash
+      - cmd: kubernetes-cert
 
 /etc/nginx/nginx.conf:
   file: