Perform K8s API operations from Salt master

[NicolasT]

So, here's the deal: currently, we run all these states on the bootstrap minion, which may be fine, but is not OK once we grow the cluster and such. The rationale is simple: this state (and others) should run just once.

This relates to #626 which would allow us to run this state only once, on the Salt master. In order for that to work, the master indeed needs creds, and ideally those are referred to from its configuration file, which we can do.

As to which creds to use: I'd like to create a ClusterRole and a Role that grants whatever access the Salt master requires to do its job (we can create those using the admin creds), then create a cert for the Salt master with bindings to said (Cluster)Role. That way, we can deploy Salt master(s) without handing out any non-required authorizations.

Originally posted by @NicolasT in #689

[NicolasT]

I believe this is done now, right @TeddyAndrieux ?

[TeddyAndrieux]

Yes I think