Revert "Drop linux capabilities and rework users/groups"

roles/kubernetes/node/defaults/main.yml

@@ -29,18 +29,3 @@ nginx_image_repo: nginx
 nginx_image_tag: 1.11.4-alpine
 
 etcd_config_dir: /etc/ssl/etcd
-
-# Linux capabilities to be dropped for container engines
-apps_drop_cap:
-  - chown
-  - dac_override
-  - fowner
-  - fsetid
-  - kill
-  - setgid
-  - setuid
-  - setpcap
-  - sys_chroot
-  - mknod
-  - audit_write
-  - setfcap

roles/kubernetes/node/tasks/install.yml

@@ -26,6 +26,6 @@
   notify: restart kubelet
 
 - name: install | Install kubelet launch script
-  template: src=kubelet-container.j2 dest="{{ bin_dir }}/kubelet" owner={{ kubelet_user }} mode=0755 backup=yes
+  template: src=kubelet-container.j2 dest="{{ bin_dir }}/kubelet" owner=kube mode=0755 backup=yes
   notify: restart kubelet
   when: kubelet_deployment_type == "docker"

roles/kubernetes/node/tasks/main.yml

@@ -4,9 +4,6 @@
       {%- if inventory_hostname in groups['kube-master'] and inventory_hostname not in groups['kube-node'] -%}true{%- else -%}false{%- endif -%}
   tags: facts
 
-- include: pre-upgrade.yml
-  tags: k8s-pre-upgrade
-
 - include: install.yml
   tags: kubelet
 

roles/kubernetes/node/tasks/pre-upgrade.yml

@@ -1,4 +0,0 @@
----
-- name: "Pre-upgrade | share access to kube certs for its users"
-  shell: chmod g+r {{ kube_cert_dir }}/*.pem
-  failed_when: false

roles/kubernetes/node/templates/kubelet.rkt.service.j2

@@ -29,7 +29,7 @@ ExecStart=/usr/bin/rkt run \
         --volume run,kind=host,source=/run,readOnly=false \
         --volume usr-share-certs,kind=host,source=/usr/share/ca-certificates,readOnly=true \
         --volume var-lib-docker,kind=host,source={{ docker_daemon_graph }},readOnly=false \
-        --volume var-lib-kubelet,kind=host,source=/var/lib/kubelet,readOnly=false \
+	--volume var-lib-kubelet,kind=host,source=/var/lib/kubelet,readOnly=false \
         --volume var-log,kind=host,source=/var/log \
         --mount volume=dns,target=/etc/resolv.conf \
         --mount volume=etc-cni,target=/etc/cni \
@@ -44,7 +44,6 @@ ExecStart=/usr/bin/rkt run \
         --mount volume=var-log,target=/var/log \
         --stage1-from-dir=stage1-fly.aci \
         {{ hyperkube_image_repo }}:{{ hyperkube_image_tag }} \
-        --memory={{ kubelet_memory_limit }} --cpu={{ kubelet_cpu_limit }} \
         --uuid-file-save=/var/run/kubelet.uuid \
         --debug --exec=/kubelet -- \
                 $KUBE_LOGTOSTDERR \