Merge pull request #911 from bogdando/DROP_CAPS

Drop linux capabilities and rework users/groups

roles/kubernetes/secrets/files/make-ssl.sh

@@ -101,5 +101,8 @@ if [ -n "$HOSTS" ]; then
     done
 fi
 
+# Grant the group read access
+chmod g+r *.pem
+
 # Install certs
 mv *.pem ${SSLDIR}/

roles/kubernetes/secrets/tasks/gen_certs.yml

@@ -140,11 +140,11 @@
   file:
     path={{ kube_cert_dir }}
     group={{ kube_cert_group }}
-    owner=kube
+    owner={{ kubelet_user }}
     recurse=yes
 
-- name: Gen_certs | set permissions on keys
-  shell: chmod 0600 {{ kube_cert_dir}}/*key.pem
+- name: Gen_certs | set shared group permissions on keys
+  shell: chmod 0640 {{ kube_cert_dir}}/*.pem
   when: inventory_hostname in groups['kube-master']
   changed_when: false
 

roles/kubernetes/secrets/tasks/main.yml

@@ -9,6 +9,7 @@
     path={{ kube_cert_dir }}
     state=directory
     mode=o-rwx
+    owner={{ kubelet_user }}
     group={{ kube_cert_group }}
 
 - name: Make sure the tokens directory exits
@@ -16,14 +17,16 @@
     path={{ kube_token_dir }}
     state=directory
     mode=o-rwx
-    group={{ kube_cert_group }}
+    owner={{ kubelet_user }}
+    group={{ kubelet_group }}
 
 - name: Make sure the users directory exits
   file:
     path={{ kube_users_dir }}
     state=directory
     mode=o-rwx
-    group={{ kube_cert_group }}
+    owner={{ kubelet_user }}
+    group={{ kubelet_group }}
 
 - name: Populate users for basic auth in API
   lineinfile: