Some binaries now run as non-root (kube-scheduler). When umask is 0027, for example, the container image we build has the binary 0750, which is not executable by the non-root UID.