Change:
Typically, the dns and dashboard is in crash loop. Ref cc
if you check the file, does it contain lines like ?
Previous comment is ref: from I'll copy that to container-linux as well.

Discussion:
local -r known_tokens_csv="${auth_dir}/known_tokens.csv" if [[ ! -e "${known_tokens_csv}" ]]; then echo "${KUBE_BEARER_TOKEN},admin,admin" > "${known_tokens_csv}" <del> echo "${KUBELET_TOKEN},kubelet,kubelet" >> "${known_tokens_csv}" echo "${KUBE_PROXY_TOKEN},kube_proxy,kube_proxy" >> "${known_tokens_csv}" </del> <ins> echo "${KUBE_CONTROLLER_MANAGER_TOKEN},system:kube-controller-manager,uid:system:kube-controller-manager" >> "${known_tokens_csv}" echo "${KUBELET_TOKEN},system:node:node-name,uid:kubelet,system:nodes" >> "${known_tokens_csv}" echo "${KUBE_PROXY_TOKEN},system:kube-proxy,uid:kube_proxy" >> "${known_tokens_csv}" </ins> fi local use_cloud_config="false" cat <<EOF >/etc/gce.conf

EOF } <ins> function create-kubecontrollermanager-kubeconfig { echo "Creating kube-controller-manager kubeconfig file" mkdir -p /etc/srv/kubernetes/kube-controller-manager cat <<EOF >/etc/srv/kubernetes/kube-controller-manager/kubeconfig apiVersion: v1 kind: Config users: - name: kube-controller-manager user: token: ${KUBE_CONTROLLER_MANAGER_TOKEN} clusters: - name: local cluster: insecure-skip-tls-verify: true server: https://localhost:443 contexts: - context: cluster: local user: kube-controller-manager name: service-account-context current-context: service-account-context EOF } </ins> function create-master-etcd-auth { if [[ -n "${ETCD_CA_CERT:-}" && -n "${ETCD_PEER_KEY:-}" && -n "${ETCD_PEER_CERT:-}" ]]; then local -r auth_dir="/etc/srv/kubernetes"

local params="${API_SERVER_TEST_LOG_LEVEL:-"--v=2"} ${APISERVER_TEST_ARGS:-} ${CLOUD_CONFIG_OPT}" params+=" --address=127.0.0.1" params+=" --allow-privileged=true" <del> params+=" --authorization-policy-file=/etc/srv/kubernetes/abac-authz-policy.jsonl" </del> params+=" --cloud-provider=gce" params+=" --client-ca-file=/etc/srv/kubernetes/ca.crt" params+=" --etcd-servers=http://127.0.0.1:2379"

webhook_authn_config_volume="{"name": "webhookauthnconfigmount","hostPath": {"path": "/etc/gcp_authn.config"}}," fi <del> params+=" --authorization-mode=ABAC" </del> <ins> params+=" --authorization-mode=RBAC" </ins> local webhook_config_mount="" local webhook_config_volume="" if [[ -n "${GCP_AUTHZ_URL:-}" ]]; then

fi local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty" <del> if [[ -n "${KUBE_USER:-}" || ! -e /etc/srv/kubernetes/abac-authz-policy.jsonl ]]; then local -r abac_policy_json="${src_dir}/abac-authz-policy.jsonl" remove-salt-config-comments "${abac_policy_json}" if [[ -n "${KUBE_USER:-}" ]]; then sed -i -e "s/{{kube_user}}/${KUBE_USER}/g" "${abac_policy_json}" else sed -i -e "/{{kube_user}}/d" "${abac_policy_json}" fi cp "${abac_policy_json}" /etc/srv/kubernetes/ fi </del> src_file="${src_dir}/kube-apiserver.manifest" remove-salt-config-comments "${src_file}" # Evaluate variables.

#   DOCKER_REGISTRY function start-kube-controller-manager { echo "Start kubernetes controller-manager" <ins> create-kubecontrollermanager-kubeconfig </ins> prepare-log-file /var/log/kube-controller-manager.log # Calculate variables and assemble the command line. local params="${CONTROLLER_MANAGER_TEST_LOG_LEVEL:-"--v=2"} ${CONTROLLER_MANAGER_TEST_ARGS:-} ${CLOUD_CONFIG_OPT}" <ins> params+=" --use-service-account-credentials" </ins> params+=" --cloud-provider=gce" <del> params+=" --master=127.0.0.1:8080" </del> <ins> params+=" --kubeconfig=/etc/srv/kubernetes/kube-controller-manager/kubeconfig" </ins> params+=" --root-ca-file=/etc/srv/kubernetes/ca.crt" params+=" --service-account-private-key-file=/etc/srv/kubernetes/server.key" if [[ -n "${ENABLE_GARBAGE_COLLECTOR:-}" ]]; then

echo "Prepare kube-addons manifests and start kube addon manager" local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty" local -r dst_dir="/etc/kubernetes/addons" <ins> # prep the additional bindings that are particular to e2e users and groups setup-addon-manifests "addons" "e2e-rbac-bindings" </ins> # Set up manifests of other addons. if [[ "${ENABLE_CLUSTER_MONITORING:-}" == "influxdb" ]] ||  [[ "${ENABLE_CLUSTER_MONITORING:-}" == "google" ]] || 

fi fi <ins> # generate the controller manager token here since its only used on the master. KUBE_CONTROLLER_MANAGER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null) </ins> # KUBERNETES_CONTAINER_RUNTIME is set by the `kube-env` file, but it's a bit of a mouthful if [[ "${CONTAINER_RUNTIME:-}" == "" ]]; then CONTAINER_RUNTIME="${KUBERNETES_CONTAINER_RUNTIME:-docker}"