add a "minion" default user

create a default user in the templates rather than relying on whatever
is used in the underlying images, which may be "centos" or "fedora"
or "ec2-user" or something else.
permit kube api access via services