Now that that the apiserver can auto-generate self-signed
certificates, and drop them in /var/run/kubernetes (which is really
/run/kubernetes), we need to ensure it's created on boot.
(I'm not sure why the default isnt' *persistent* self-signed
certificates, but that's a different patch)