GKE: Symlinked kubelet client certs need to be resolved about kip

[ldx]

These certs should be the ones generated for serving the kubelet API, not the kubelet client certs.

See also #70 for how to fix this for the long term. Kip should generate its own certificates, not share and reuse existing kubelet certs. It should be pretty easy to fix, but it needs to go in node-cli, since the http server is set up via node-cli.

[myechuri]

These certs should be the ones generated for serving the kubelet API, not the kubelet client certs.

Thanks for clarifying, @ldx . By using /etc/kubelet-pki/kubelet-client-2020-05-05-06-52-14.pem , i am essentially sharing one cert between kubelet where vk runs, and the virtual worker exposed by vk, right? Two followups:

1. Is this the best workaround until #70 is fixed?
2. If answer to above is yes, we would need to figure out a way to supply the right cert name (like /etc/kubelet-pki/kubelet-client-2020-05-05-06-52-14.pem) here and here in overlay files for GKE, right?

[ldx]

kubelet-client-2020-05-05-06-52-14.pem is probably the client cert, for serving its API the kubelet uses the other cert (unless GKE has different naming conventions for the kubelet certs). I think the easiest way would be fixing it as suggested in #70

[ldx]

This has been fixed via d99177f