Generate a kubelet CA and kube-apiserver cert-pair for kubelet auth.

Plumb through to kubelet/kube-apiserver on gci & cvm.

pkg/kubelet/client/kubelet_client.go

@@ -32,8 +32,9 @@ import (
 
 type KubeletClientConfig struct {
 	// Default port - used if no information about Kubelet port can be found in Node.NodeStatus.DaemonEndpoints.
-	Port        uint
-	EnableHttps bool
+	Port         uint
+	ReadOnlyPort uint
+	EnableHttps  bool
 
 	// PreferredAddressTypes - used to select an address from Node.NodeStatus.Addresses
 	PreferredAddressTypes []string