kube-apiserver should use a different certificate for the requestheader-client-ca-file

[tvs]

The API server should have a specific CA certificate for the Aggregator rather than reusing the kubo_ca. By reusing kubo_ca we're blurring trust boundaries and possibly opening up new attack vectors that wouldn't otherwise exist.

Configure the aggregation layer: Enable apiserver flags
Serving Certificates, Authentication, and Authorization: RequestHeader Authentication

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/158193278

The labels on this github issue will be updated when the story is started.

[alex-slynko]

1. Does Service-catalog use API-extensions?
2. Who uses Aggregator API?
3. How do they provide the certificate for it?
4. What is an upgrade path for such people?