Revert "Drop linux capabilities and rework users/groups"

roles/kubernetes/secrets/files/make-ssl.sh

@@ -101,8 +101,5 @@ if [ -n "$HOSTS" ]; then
     done
 fi
 
-# Grant the group read access
-chmod g+r *.pem
-
 # Install certs
 mv *.pem ${SSLDIR}/

roles/kubernetes/secrets/tasks/gen_certs.yml

@@ -140,11 +140,11 @@
   file:
     path={{ kube_cert_dir }}
     group={{ kube_cert_group }}
-    owner={{ kubelet_user }}
+    owner=kube
     recurse=yes
 
-- name: Gen_certs | set shared group permissions on keys
-  shell: chmod 0640 {{ kube_cert_dir}}/*.pem
+- name: Gen_certs | set permissions on keys
+  shell: chmod 0600 {{ kube_cert_dir}}/*key.pem
   when: inventory_hostname in groups['kube-master']
   changed_when: false
 

roles/kubernetes/secrets/tasks/main.yml

@@ -9,7 +9,6 @@
     path={{ kube_cert_dir }}
     state=directory
     mode=o-rwx
-    owner={{ kubelet_user }}
     group={{ kube_cert_group }}
 
 - name: Make sure the tokens directory exits
@@ -17,16 +16,14 @@
     path={{ kube_token_dir }}
     state=directory
     mode=o-rwx
-    owner={{ kubelet_user }}
-    group={{ kubelet_group }}
+    group={{ kube_cert_group }}
 
 - name: Make sure the users directory exits
   file:
     path={{ kube_users_dir }}
     state=directory
     mode=o-rwx
-    owner={{ kubelet_user }}
-    group={{ kubelet_group }}
+    group={{ kube_cert_group }}
 
 - name: Populate users for basic auth in API
   lineinfile: