Give kube-apiserver CAP_NET_BIND_SERVICE

It is needed to bind on port 443

contrib/ansible/roles/master/tasks/main.yml

@@ -20,6 +20,10 @@
   notify:
     - restart scheduler
 
+- name: add cap_net_bind_service to kube-apiserver
+  capabilities: path=/usr/bin/kube-apiserver capability=cap_net_bind_service=ep state=present
+  when: not is_atomic
+
 - name: Enable apiserver
   service: name=kube-apiserver enabled=yes state=started