Repository: kubermatic/machine-controller
Pull request #710 (2020-03-13 15:15:16)

Fix the ip address updating in the cluster status
**What this PR does / why we need it**:
The `status.addresses` in the machine object was lacking the list of the ip addresses for the instances that are created in Azure cloud provider. The reason for that was sending wrong parameters to the azure api.
**Which issue(s) this PR fixes**
Fixes kubermatic/kubermatic#5137

**Special notes for your reviewer**:
Make sure that the `pull-machine-controller-e2e-azure` job is green :) 
```release-note
None
```


kubermatic-bot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubermatic/machine-controller/pull/710#" title="Author self-approved">moadqassem</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubermatic%2Fmachine-controller).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubermatic/machine-controller/blob/master/OWNERS)~~ [moadqassem]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
moadqassem: /test pull-machine-controller-e2e-azure
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | e998660839ff38a895e901216ac2e466e03593f3 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1238492587015278592) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
moadqassem: /test pull-machine-controller-e2e-azure

kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | e998660839ff38a895e901216ac2e466e03593f3 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1238501896663076864) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | e998660839ff38a895e901216ac2e466e03593f3 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1238547949693177856) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
moadqassem: /test pull-machine-controller-e2e-azure 
xrstf: /lgtm
kubermatic-bot: LGTM label has been added.  <details>Git tree hash: ba306590f872ea1a4a8a769b9d59548ca3b82594</details>
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | e998660839ff38a895e901216ac2e466e03593f3 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239483245112856576) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-triage-bot: /retest
This bot automatically retries jobs that failed/flaked on approved PRs

Review the [full test history](https://prow.loodse.com/pr-history/?org=kubermatic&repo=machine-controller&pr=710)

Silence the bot with an `/lgtm cancel` or `/hold` comment for consistent failures.

Also, here is a cat.
/meow
kubermatic-bot: @kubermatic-triage-bot: ![cat image](https://cdn2.thecatapi.com/images/9v3.jpg)

<details>

In response to [this](https://github.com/kubermatic/machine-controller/pull/710#issuecomment-599476748):

>/retest
>This bot automatically retries jobs that failed/flaked on approved PRs
>
>Review the [full test history](https://prow.loodse.com/pr-history/?org=kubermatic&repo=machine-controller&pr=710)
>
>Silence the bot with an `/lgtm cancel` or `/hold` comment for consistent failures.
>
>Also, here is a cat.
>/meow


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | e998660839ff38a895e901216ac2e466e03593f3 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239508917189349376) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-triage-bot: /retest
This bot automatically retries jobs that failed/flaked on approved PRs

Review the [full test history](https://prow.loodse.com/pr-history/?org=kubermatic&repo=machine-controller&pr=710)

Silence the bot with an `/lgtm cancel` or `/hold` comment for consistent failures.

Also, here is a cat.
/meow
kubermatic-bot: @kubermatic-triage-bot: ![cat image](https://cdn2.thecatapi.com/images/cfa.jpg)

<details>

In response to [this](https://github.com/kubermatic/machine-controller/pull/710#issuecomment-599519929):

>/retest
>This bot automatically retries jobs that failed/flaked on approved PRs
>
>Review the [full test history](https://prow.loodse.com/pr-history/?org=kubermatic&repo=machine-controller&pr=710)
>
>Silence the bot with an `/lgtm cancel` or `/hold` comment for consistent failures.
>
>Also, here is a cat.
>/meow


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | e998660839ff38a895e901216ac2e466e03593f3 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239535338863464448) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-triage-bot: /retest
This bot automatically retries jobs that failed/flaked on approved PRs

Review the [full test history](https://prow.loodse.com/pr-history/?org=kubermatic&repo=machine-controller&pr=710)

Silence the bot with an `/lgtm cancel` or `/hold` comment for consistent failures.

Also, here is a cat.
/meow
kubermatic-bot: @kubermatic-triage-bot: ![cat image](https://cdn2.thecatapi.com/images/7Q76qhEAF.jpg)

<details>

In response to [this](https://github.com/kubermatic/machine-controller/pull/710#issuecomment-599572518):

>/retest
>This bot automatically retries jobs that failed/flaked on approved PRs
>
>Review the [full test history](https://prow.loodse.com/pr-history/?org=kubermatic&repo=machine-controller&pr=710)
>
>Silence the bot with an `/lgtm cancel` or `/hold` comment for consistent failures.
>
>Also, here is a cat.
>/meow


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | e998660839ff38a895e901216ac2e466e03593f3 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239561890980433920) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
moadqassem: /hold
kubermatic-bot: New changes are detected. LGTM label has been removed.
moadqassem: /test pull-machine-controller-e2e-azure
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 20dbf3708876aa5677e2f57b70a080857dd125ad | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239586934091681792) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
moadqassem: /test pull-machine-controller-e2e-azure
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 1ba60cfb706801a5da3626aaa801a204e78bac0b | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239598633200914432) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
moadqassem: /test pull-machine-controller-e2e-azure
kubermatic-bot: @moadqassem: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 1ba60cfb706801a5da3626aaa801a204e78bac0b | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239598633200914432) | `/test pull-machine-controller-e2e-azure`
pull-machine-controller-e2e-vsphere | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-vsphere/1239612992811700225) | `/test pull-machine-controller-e2e-vsphere`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-bot: @moadqassem: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 1ba60cfb706801a5da3626aaa801a204e78bac0b | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239598633200914432) | `/test pull-machine-controller-e2e-azure`
pull-machine-controller-e2e-vsphere | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-vsphere/1239612992811700225) | `/test pull-machine-controller-e2e-vsphere`
pull-machine-controller-e2e-ubuntu-upgrade | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-ubuntu-upgrade/1239612992954306560) | `/test pull-machine-controller-e2e-ubuntu-upgrade`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-bot: @moadqassem: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 1ba60cfb706801a5da3626aaa801a204e78bac0b | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239598633200914432) | `/test pull-machine-controller-e2e-azure`
pull-machine-controller-e2e-vsphere | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-vsphere/1239612992811700225) | `/test pull-machine-controller-e2e-vsphere`
pull-machine-controller-e2e-ubuntu-upgrade | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-ubuntu-upgrade/1239612992954306560) | `/test pull-machine-controller-e2e-ubuntu-upgrade`
pull-machine-controller-e2e-gce | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-gce/1239612992715231232) | `/test pull-machine-controller-e2e-gce`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-bot: @moadqassem: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 1ba60cfb706801a5da3626aaa801a204e78bac0b | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239598633200914432) | `/test pull-machine-controller-e2e-azure`
pull-machine-controller-e2e-vsphere | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-vsphere/1239612992811700225) | `/test pull-machine-controller-e2e-vsphere`
pull-machine-controller-e2e-ubuntu-upgrade | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-ubuntu-upgrade/1239612992954306560) | `/test pull-machine-controller-e2e-ubuntu-upgrade`
pull-machine-controller-e2e-gce | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-gce/1239612992715231232) | `/test pull-machine-controller-e2e-gce`
pull-machine-controller-e2e-kubevirt | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-kubevirt/1239612992811700224) | `/test pull-machine-controller-e2e-kubevirt`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-bot: @moadqassem: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 1ba60cfb706801a5da3626aaa801a204e78bac0b | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239598633200914432) | `/test pull-machine-controller-e2e-azure`
pull-machine-controller-e2e-vsphere | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-vsphere/1239612992811700225) | `/test pull-machine-controller-e2e-vsphere`
pull-machine-controller-e2e-ubuntu-upgrade | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-ubuntu-upgrade/1239612992954306560) | `/test pull-machine-controller-e2e-ubuntu-upgrade`
pull-machine-controller-e2e-gce | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-gce/1239612992715231232) | `/test pull-machine-controller-e2e-gce`
pull-machine-controller-e2e-kubevirt | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-kubevirt/1239612992811700224) | `/test pull-machine-controller-e2e-kubevirt`
pull-machine-controller-e2e-digitalocean | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-digitalocean/1239612992715231233) | `/test pull-machine-controller-e2e-digitalocean`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
moadqassem: /retest
kubermatic-bot: @moadqassem: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-kubevirt | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-kubevirt/1239612992811700224) | `/test pull-machine-controller-e2e-kubevirt`
pull-machine-controller-e2e-azure | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239610966858010629) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
kubermatic-bot: @moadqassem: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239610966858010629) | `/test pull-machine-controller-e2e-azure`
pull-machine-controller-e2e-kubevirt | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-kubevirt/1239615007587569664) | `/test pull-machine-controller-e2e-kubevirt`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
moadqassem: /retest 
kubermatic-bot: @moadqassem: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-machine-controller-e2e-azure | 2ab56d2f038142af4d8fccecf8c3c1c776aff759 | [link](https://public-prow.loodse.com/view/gcs/prow-dev-public-data/pr-logs/pull/kubermatic_machine-controller/710/pull-machine-controller-e2e-azure/1239843500346839040) | `/test pull-machine-controller-e2e-azure`

[Full PR test history](https://public-prow.loodse.com/pr-history?org=kubermatic&repo=machine-controller&pr=710)

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/Makefile b/Makefile
index defa0247..3450cf31 100644
--- a/Makefile
+++ b/Makefile
@@ -12,13 +12,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+SHELL = /bin/bash -eu -o pipefail
+
 GO_VERSION = 1.13.8
 
 export CGO_ENABLED := 0
 
 export E2E_SSH_PUBKEY ?= $(shell test -f ~/.ssh/id_rsa.pub && cat ~/.ssh/id_rsa.pub)
 
-export DOCKER_TAG ?= $(shell git tag --points-at HEAD)
+export GIT_TAG ?= $(shell git tag --points-at HEAD)
 
 export GOFLAGS?=-mod=readonly -trimpath
 
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 80919118..52defe09 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -5,7 +5,6 @@ aliases:
     - irozzo-1A
     - kdomanski
     - kron4eg
-    - nikhita
     - moadqassem
     - moelsayed
     - themue
diff --git a/examples/machine-controller.yaml b/examples/machine-controller.yaml
index dc5bc83f..2b7af746 100644
--- a/examples/machine-controller.yaml
+++ b/examples/machine-controller.yaml
@@ -167,7 +167,7 @@ spec:
             # Machines that fail to join the cluster within this timeout and
             # are owned by a MachineSet will get deleted so the MachineSet
             # controller re-creates them
-            - -join-cluster-timeout=15m
+            - -join-cluster-timeout=25m
           ports:
           - containerPort: 8085
           livenessProbe:
diff --git a/go.mod b/go.mod
index dc95749e..d18cf459 100644
--- a/go.mod
+++ b/go.mod
@@ -92,12 +92,13 @@ require (
 	k8s.io/gengo v0.0.0-20200205140755-e0e292d8aa12 // indirect
 	k8s.io/klog v1.0.0
 	k8s.io/kube-openapi v0.0.0-20200204173128-addea2498afe // indirect
+	k8s.io/kubelet v0.15.10
 	k8s.io/utils v0.0.0-20200124190032-861946025e34
 	kubevirt.io/client-go v0.19.0
 	kubevirt.io/containerized-data-importer v1.9.3
 	launchpad.net/gocheck v0.0.0-20140225173054-000000000087 // indirect
 	sigs.k8s.io/controller-runtime v0.3.0
-	sigs.k8s.io/yaml v1.2.0 // indirect
+	sigs.k8s.io/yaml v1.2.0
 )
 
 replace github.com/Azure/go-autorest => github.com/Azure/go-autorest v12.3.0+incompatible
diff --git a/go.sum b/go.sum
index 159a6a7a..7af0b168 100644
--- a/go.sum
+++ b/go.sum
@@ -716,6 +716,8 @@ k8s.io/kube-openapi v0.0.0-20190228160746-b3a7cee44a30 h1:TRb4wNWoBVrH9plmkp2q86
 k8s.io/kube-openapi v0.0.0-20190228160746-b3a7cee44a30/go.mod h1:BXM9ceUBTj2QnfH2MK1odQs778ajze1RxcmP6S8RVVc=
 k8s.io/kube-openapi v0.0.0-20200204173128-addea2498afe h1:GOfbcWvX5wW2vcfNch83xYp9SDZjRgAJk+t373yaHKk=
 k8s.io/kube-openapi v0.0.0-20200204173128-addea2498afe/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
+k8s.io/kubelet v0.15.10 h1:GLkov2jb4UofR+0vnw59w50w4iSTGaUAWmOGixzzbck=
+k8s.io/kubelet v0.15.10/go.mod h1:iRQzy33Np9G9KIv+6Pdpuny94iUYZlHihVvkMujR7ws=
 k8s.io/utils v0.0.0-20190221042446-c2654d5206da/go.mod h1:8k8uAuAQ0rXslZKaEWd0c3oVhZz7sSzSiPnVZayjIX0=
 k8s.io/utils v0.0.0-20190506122338-8fab8cb257d5 h1:VBM/0P5TWxwk+Nw6Z+lAw3DKgO76g90ETOiA6rfLV1Y=
 k8s.io/utils v0.0.0-20190506122338-8fab8cb257d5/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
diff --git a/pkg/cloudprovider/provider/azure/get_client.go b/pkg/cloudprovider/provider/azure/get_client.go
index 3d1ae547..c5fb7357 100644
--- a/pkg/cloudprovider/provider/azure/get_client.go
+++ b/pkg/cloudprovider/provider/azure/get_client.go
@@ -35,6 +35,17 @@ func getIPClient(c *config) (*network.PublicIPAddressesClient, error) {
 	return &ipClient, nil
 }
 
+func getIPConfigClient(c *config) (*network.InterfaceIPConfigurationsClient, error) {
+	var err error
+	ipConfigClient := network.NewInterfaceIPConfigurationsClient(c.SubscriptionID)
+	ipConfigClient.Authorizer, err = auth.NewClientCredentialsConfig(c.ClientID, c.ClientSecret, c.TenantID).Authorizer()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create authorizer: %s", err.Error())
+	}
+
+	return &ipConfigClient, nil
+}
+
 func getSubnetsClient(c *config) (*network.SubnetsClient, error) {
 	var err error
 	subnetClient := network.NewSubnetsClient(c.SubscriptionID)
diff --git a/pkg/cloudprovider/provider/azure/provider.go b/pkg/cloudprovider/provider/azure/provider.go
index 8f0f9eab..e2f3ad18 100644
--- a/pkg/cloudprovider/provider/azure/provider.go
+++ b/pkg/cloudprovider/provider/azure/provider.go
@@ -322,12 +322,22 @@ func getNICIPAddresses(ctx context.Context, c *config, ifaceName string) ([]stri
 				name = splitConfID[len(splitConfID)-1]
 			}
 
-			addrStrings, err := getIPAddressStrings(ctx, c, name)
+			if c.AssignPublicIP {
+				publicIPName := ifaceName + "-pubip"
+				publicIPs, err := getIPAddressStrings(ctx, c, publicIPName)
+				if err != nil {
+					return nil, fmt.Errorf("failed to retrieve IP string for IP %q: %v", name, err)
+				}
+				ipAddresses = append(ipAddresses, publicIPs...)
+			}
+
+			internalIPs, err := getInternalIPAddresses(ctx, c, ifaceName, name)
 			if err != nil {
-				return nil, fmt.Errorf("failed to retrieve IP string for IP %q: %v", name, err)
+				return nil, fmt.Errorf("failed to retrieve internal IP string for IP %q: %v", name, err)
 			}
 
-			ipAddresses = append(ipAddresses, addrStrings...)
+			ipAddresses = append(ipAddresses, internalIPs...)
+
 		}
 	}
 
@@ -350,11 +360,30 @@ func getIPAddressStrings(ctx context.Context, c *config, addrName string) ([]str
 	}
 
 	var ipAddresses []string
-	if ip.IPConfiguration.PublicIPAddress != nil && ip.IPConfiguration.PublicIPAddress.IPAddress != nil {
-		ipAddresses = append(ipAddresses, *ip.IPConfiguration.PublicIPAddress.IPAddress)
+	if ip.IPAddress != nil {
+		ipAddresses = append(ipAddresses, *ip.IPAddress)
+	}
+
+	return ipAddresses, nil
+}
+
+func getInternalIPAddresses(ctx context.Context, c *config, inetface, ipconfigName string) ([]string, error) {
+	var ipAddresses []string
+	ipConfigClient, err := getIPConfigClient(c)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create IP config client: %v", err)
+	}
+
+	internalIP, err := ipConfigClient.Get(ctx, c.ResourceGroup, inetface, ipconfigName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get IP config %q: %v", inetface, err)
+	}
+
+	if internalIP.ID == nil {
+		return nil, fmt.Errorf("private IP %q has nil IPConfiguration", inetface)
 	}
-	if ip.IPConfiguration.PrivateIPAddress != nil {
-		ipAddresses = append(ipAddresses, *ip.IPConfiguration.PrivateIPAddress)
+	if internalIP.PrivateIPAddress != nil {
+		ipAddresses = append(ipAddresses, *internalIP.PrivateIPAddress)
 	}
 
 	return ipAddresses, nil
diff --git a/pkg/controller/nodecsrapprover/node_csr_approver.go b/pkg/controller/nodecsrapprover/node_csr_approver.go
index 5e253953..84d71355 100644
--- a/pkg/controller/nodecsrapprover/node_csr_approver.go
+++ b/pkg/controller/nodecsrapprover/node_csr_approver.go
@@ -21,6 +21,9 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
+	"strings"
+
+	"github.com/kubermatic/machine-controller/pkg/apis/cluster/v1alpha1"
 
 	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
@@ -35,7 +38,16 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
-const ControllerName = "node_csr_autoapprover"
+const (
+	// ControllerName is name of the NodeCSRApprover controller
+	ControllerName = "node_csr_autoapprover"
+
+	nodeUser       = "system:node"
+	nodeUserPrefix = nodeUser + ":"
+
+	nodeGroup          = "system:nodes"
+	authenticatedGroup = "system:authenticated"
+)
 
 type reconciler struct {
 	client.Client
@@ -91,30 +103,41 @@ func (r *reconciler) reconcile(ctx context.Context, request reconcile.Request) e
 		}
 	}
 
-	// Ensure system:nodes is in groups
-	if !sets.NewString(csr.Spec.Groups...).Has("system:nodes") {
-		klog.V(4).Infof("Skipping reconciling CSR '%s' because 'system:nodes' is not in its groups", csr.ObjectMeta.Name)
+	// Validate the CSR object and get the node name
+	nodeName, err := r.validateCSRObject(csr)
+	if err != nil {
+		klog.V(4).Infof("Skipping reconciling CSR '%s' because CSR object is not valid: %v", csr.ObjectMeta.Name, err)
 		return nil
 	}
 
-	// Check are present usages matching allowed usages
-	if len(csr.Spec.Usages) != 3 {
-		klog.V(4).Infof("Skipping reconciling CSR '%s' because it has not exactly three usages defined", csr.ObjectMeta.Name)
-		return nil
+	// Get machine name for the appropriate node
+	machine, found, err := r.getMachineForNode(nodeName)
+	if err != nil {
+		return fmt.Errorf("failed to get machine for node '%s': %v", nodeName, err)
 	}
-	for _, usage := range csr.Spec.Usages {
-		if !isUsageInUsageList(usage, allowedUsages) {
-			klog.V(4).Infof("Skipping reconciling CSR '%s' because its usage (%v) is not in the list of allowed usages (%v)",
-				csr.ObjectMeta.Name, usage, allowedUsages)
-			return nil
-		}
+	if !found {
+		return fmt.Errorf("no machine found for given node '%s'", nodeName)
 	}
-	// Validate the CSR request
-	if err := validateCSRRequest(csr); err != nil {
-		klog.V(4).Infof("Skipping reconciling CSR '%s' because CSR request is not valid: %v", csr.ObjectMeta.Name, err)
-		return nil
+
+	// Parse the certificate request
+	csrBlock, rest := pem.Decode(csr.Spec.Request)
+	if csrBlock == nil {
+		return fmt.Errorf("no certificate request found for the given CSR")
+	}
+	if len(rest) != 0 {
+		return fmt.Errorf("found more than one PEM encoded block in the result")
+	}
+	certRequest, err := x509.ParseCertificateRequest(csrBlock.Bytes)
+	if err != nil {
+		return err
+	}
+
+	// Validate the certificate request
+	if err := r.validateX509CSR(csr, certRequest, machine); err != nil {
+		return fmt.Errorf("error validating the x509 certificate request: %v", err)
 	}
 
+	// Approve CSR
 	klog.V(4).Infof("Approving CSR %s", csr.ObjectMeta.Name)
 	approvalCondition := certificatesv1beta1.CertificateSigningRequestCondition{
 		Type:   certificatesv1beta1.CertificateApproved,
@@ -130,40 +153,104 @@ func (r *reconciler) reconcile(ctx context.Context, request reconcile.Request) e
 	return nil
 }
 
-func isUsageInUsageList(usage certificatesv1beta1.KeyUsage, usageList []certificatesv1beta1.KeyUsage) bool {
-	for _, usageListItem := range usageList {
-		if usage == usageListItem {
-			return true
-		}
+// validateCSRObject valides the CSR object and returns name of the node that requested the certificate
+func (r *reconciler) validateCSRObject(csr *certificatesv1beta1.CertificateSigningRequest) (string, error) {
+	// Get and validate the node name
+	if !strings.HasPrefix(csr.Spec.Username, nodeUserPrefix) {
+		return "", fmt.Errorf("username must have the '%s' prefix", nodeUserPrefix)
+	}
+	nodeName := strings.TrimPrefix(csr.Spec.Username, nodeUserPrefix)
+	if len(nodeName) == 0 {
+		return "", fmt.Errorf("node name is empty")
 	}
-	return false
-}
 
-// validateCSRRequest parses the CSR request and compares certificate request CommonName with CSR username, and
-// certificateRequest Organization with CSR groups.
-func validateCSRRequest(csr *certificatesv1beta1.CertificateSigningRequest) error {
-	csrBlock, rest := pem.Decode(csr.Spec.Request)
-	if csrBlock == nil {
-		return fmt.Errorf("no certificate request found for the given CSR")
+	// Ensure system:nodes and system:authenticated are in groups
+	if len(csr.Spec.Groups) < 2 {
+		return "", fmt.Errorf("there are less than 2 groups")
 	}
-	if len(rest) != 0 {
-		return fmt.Errorf("found more than one PEM encoded block in the result")
+	if !sets.NewString(csr.Spec.Groups...).HasAll(nodeGroup, authenticatedGroup) {
+		return "", fmt.Errorf("'%s' and/or '%s' are not in its groups", nodeGroup, authenticatedGroup)
 	}
-	csrRequest, err := x509.ParseCertificateRequest(csrBlock.Bytes)
-	if err != nil {
-		return err
+
+	// Check are present usages matching allowed usages
+	if len(csr.Spec.Usages) != 3 {
+		return "", fmt.Errorf("there are no exactly three usages defined")
 	}
+	for _, usage := range csr.Spec.Usages {
+		if !isUsageInUsageList(usage, allowedUsages) {
+			return "", fmt.Errorf("usage %v is not in the list of allowed usages (%v)", usage, allowedUsages)
+		}
+	}
+
+	return nodeName, nil
+}
+
+// validateX509CSR validates the certificate request by comparing CN with username,
+// and organization with groups.
+func (r *reconciler) validateX509CSR(csr *certificatesv1beta1.CertificateSigningRequest, certReq *x509.CertificateRequest, machine v1alpha1.Machine) error {
 	// Validate Subject CommonName
-	if csrRequest.Subject.CommonName != csr.Spec.Username {
-		return fmt.Errorf("commonName '%s' is different then CSR username '%s'", csrRequest.Subject.CommonName, csr.Spec.Username)
+	if certReq.Subject.CommonName != csr.Spec.Username {
+		return fmt.Errorf("commonName '%s' is different then CSR username '%s'", certReq.Subject.CommonName, csr.Spec.Username)
 	}
+
 	// Validate Subject Organization
-	if len(csrRequest.Subject.Organization) != 1 {
-		return fmt.Errorf("error validating subject organizations")
+	if len(certReq.Subject.Organization) != 1 {
+		return fmt.Errorf("expected only one organization but got %d instead", len(certReq.Subject.Organization))
+	}
+	if certReq.Subject.Organization[0] != nodeGroup {
+		return fmt.Errorf("organization '%s' doesn't match node group '%s'", certReq.Subject.Organization[0], nodeGroup)
+	}
+
+	machineAddressSet := sets.NewString(machine.Status.NodeRef.Name)
+	for _, addr := range machine.Status.Addresses {
+		machineAddressSet.Insert(addr.Address)
 	}
-	if csrRequest.Subject.Organization[0] != "system:nodes" {
-		return fmt.Errorf("expected 'system:nodes' in organization, but got '%s'", csrRequest.Subject.Organization[0])
+
+	// Validate SAN DNS names
+	for _, dns := range certReq.DNSNames {
+		if len(dns) == 0 {
+			continue
+		}
+		if !machineAddressSet.Has(dns) {
+			return fmt.Errorf("dns name '%s' cannot be associated with node '%s'", dns, machine.Status.NodeRef.Name)
+		}
+	}
+
+	// Validate SAN IP addresses
+	for _, ip := range certReq.IPAddresses {
+		if len(ip) == 0 {
+			continue
+		}
+		if !machineAddressSet.Has(ip.String()) {
+			return fmt.Errorf("ip address '%v' cannot be associated with node '%s'", ip, machine.Status.NodeRef.Name)
+		}
 	}
 
 	return nil
 }
+
+func (r *reconciler) getMachineForNode(nodeName string) (v1alpha1.Machine, bool, error) {
+	// List all Machines in all namespaces
+	machines := &v1alpha1.MachineList{}
+	listOptions := &client.ListOptions{Namespace: ""}
+	if err := r.Client.List(context.Background(), machines, listOptions); err != nil {
+		return v1alpha1.Machine{}, false, fmt.Errorf("failed to list all machine objects: %v", err)
+	}
+
+	for _, machine := range machines.Items {
+		if machine.Status.NodeRef != nil && machine.Status.NodeRef.Name == nodeName {
+			return machine, true, nil
+		}
+	}
+
+	return v1alpha1.Machine{}, false, fmt.Errorf("failed to get machine for given node name '%s'", nodeName)
+}
+
+func isUsageInUsageList(usage certificatesv1beta1.KeyUsage, usageList []certificatesv1beta1.KeyUsage) bool {
+	for _, usageListItem := range usageList {
+		if usage == usageListItem {
+			return true
+		}
+	}
+	return false
+}
diff --git a/pkg/userdata/centos/provider.go b/pkg/userdata/centos/provider.go
index 18a913df..1f36ac82 100644
--- a/pkg/userdata/centos/provider.go
+++ b/pkg/userdata/centos/provider.go
@@ -184,7 +184,10 @@ write_files:
     hostnamectl set-hostname {{ .MachineSpec.Name }}
     {{ end }}
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -201,8 +204,6 @@ write_files:
     {{- if eq .CloudProviderName "vsphere" }}
     systemctl enable --now vmtoolsd.service
     {{ end -}}
-{{- /* Without this, the conformance tests fail with differing tests causing it, the common denominator: They look for some string in container logs and get an empty log */ -}}
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -233,31 +234,7 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
-    apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    {{- range .DNSIPs }}
-      - "{{ . }}"
-    {{- end }}
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
-    authentication:
-      x509:
-        clientCAFile: /etc/kubernetes/pki/ca.crt
-      webhook:
-        enabled: true
-      anonymous:
-        enabled: false
-    protectKernelDefaults: true
+{{ kubeletConfiguration "cluster.local" .DNSIPs | indent 4 }}
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -284,6 +261,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+{{ dockerConfig .InsecureRegistries .RegistryMirrors | indent 4 }}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/coreos/provider.go b/pkg/userdata/coreos/provider.go
index 55a404f5..73e288da 100644
--- a/pkg/userdata/coreos/provider.go
+++ b/pkg/userdata/coreos/provider.go
@@ -276,31 +276,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
-          apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-          {{- range .DNSIPs }}
-            - "{{ . }}"
-          {{- end }}
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
-          authentication:
-            x509:
-              clientCAFile: /etc/kubernetes/pki/ca.crt
-            webhook:
-              enabled: true
-            anonymous:
-              enabled: false
-          protectKernelDefaults: true
+{{ kubeletConfiguration "cluster.local" .DNSIPs | indent 10 }}
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
diff --git a/pkg/userdata/helper/helper.go b/pkg/userdata/helper/helper.go
index bfcedcbb..e09c0187 100644
--- a/pkg/userdata/helper/helper.go
+++ b/pkg/userdata/helper/helper.go
@@ -102,10 +102,13 @@ SystemMaxUse=5G
 }
 
 type dockerConfig struct {
-	ExecOpts           []string `json:"exec-opts"`
-	StorageDriver      string   `json:"storage-driver"`
-	InsecureRegistries []string `json:"insecure-registries"`
-	RegistryMirrors    []string `json:"registry-mirrors"`
+	ExecOpts           []string          `json:"exec-opts,omitempty"`
+	StorageDriver      string            `json:"storage-driver,omitempty"`
+	StorageOpts        []string          `json:"storage-opts,omitempty"`
+	LogDriver          string            `json:"log-driver,omitempty"`
+	LogOpts            map[string]string `json:"log-opts,omitempty"`
+	InsecureRegistries []string          `json:"insecure-registries,omitempty"`
+	RegistryMirrors    []string          `json:"registry-mirrors,omitempty"`
 }
 
 // DockerConfig returns the docker daemon.json.
@@ -113,6 +116,8 @@ func DockerConfig(insecureRegistries, registryMirrors []string) (string, error)
 	cfg := dockerConfig{
 		ExecOpts:           []string{"native.cgroupdriver=systemd"},
 		StorageDriver:      "overlay2",
+		LogDriver:          "json-file",
+		LogOpts:            map[string]string{"max-size": "100m"},
 		InsecureRegistries: insecureRegistries,
 		RegistryMirrors:    registryMirrors,
 	}
diff --git a/pkg/userdata/helper/kubelet.go b/pkg/userdata/helper/kubelet.go
index 85b06b5a..032b6f82 100644
--- a/pkg/userdata/helper/kubelet.go
+++ b/pkg/userdata/helper/kubelet.go
@@ -24,6 +24,10 @@ import (
 	"text/template"
 
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kubeletv1b1 "k8s.io/kubelet/config/v1beta1"
+	"k8s.io/utils/pointer"
+	kyaml "sigs.k8s.io/yaml"
 )
 
 const (
@@ -131,6 +135,47 @@ func KubeletSystemdUnit(kubeletVersion, cloudProvider, hostname string, dnsIPs [
 	return b.String(), nil
 }
 
+// kubeletConfiguration returns marshaled kubelet.config.k8s.io/v1beta1 KubeletConfiguration
+func kubeletConfiguration(clusterDomain string, clusterDNS []net.IP) (string, error) {
+	clusterDNSstr := make([]string, 0, len(clusterDNS))
+	for _, ip := range clusterDNS {
+		clusterDNSstr = append(clusterDNSstr, ip.String())
+	}
+
+	cfg := kubeletv1b1.KubeletConfiguration{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "KubeletConfiguration",
+			APIVersion: "kubelet.config.k8s.io/v1beta1",
+		},
+		Authentication: kubeletv1b1.KubeletAuthentication{
+			X509: kubeletv1b1.KubeletX509Authentication{
+				ClientCAFile: "/etc/kubernetes/pki/ca.crt",
+			},
+			Webhook: kubeletv1b1.KubeletWebhookAuthentication{
+				Enabled: pointer.BoolPtr(true),
+			},
+			Anonymous: kubeletv1b1.KubeletAnonymousAuthentication{
+				Enabled: pointer.BoolPtr(false),
+			},
+		},
+		Authorization: kubeletv1b1.KubeletAuthorization{
+			Mode: kubeletv1b1.KubeletAuthorizationModeWebhook,
+		},
+		CgroupDriver:          "systemd",
+		ClusterDNS:            clusterDNSstr,
+		ClusterDomain:         clusterDomain,
+		FeatureGates:          map[string]bool{"RotateKubeletServerCertificate": true},
+		ProtectKernelDefaults: true,
+		ReadOnlyPort:          0,
+		RotateCertificates:    true,
+		ServerTLSBootstrap:    true,
+		StaticPodPath:         "/etc/kubernetes/manifests",
+	}
+
+	buf, err := kyaml.Marshal(cfg)
+	return string(buf), err
+}
+
 // KubeletFlags returns the kubelet flags
 func KubeletFlags(version, cloudProvider, hostname string, dnsIPs []net.IP, external bool, pauseImage string, initialTaints []corev1.Taint) (string, error) {
 	tmpl, err := template.New("kubelet-flags").Funcs(TxtFuncMap()).Parse(kubeletFlagsTpl)
diff --git a/pkg/userdata/helper/template_functions.go b/pkg/userdata/helper/template_functions.go
index b832a29a..c9428be2 100644
--- a/pkg/userdata/helper/template_functions.go
+++ b/pkg/userdata/helper/template_functions.go
@@ -29,6 +29,7 @@ func TxtFuncMap() template.FuncMap {
 
 	funcMap["downloadBinariesScript"] = DownloadBinariesScript
 	funcMap["kubeletSystemdUnit"] = KubeletSystemdUnit
+	funcMap["kubeletConfiguration"] = kubeletConfiguration
 	funcMap["kubeletFlags"] = KubeletFlags
 	funcMap["cloudProviderFlags"] = CloudProviderFlags
 	funcMap["kernelModulesScript"] = LoadKernelModulesScript
diff --git a/pkg/userdata/rhel/provider.go b/pkg/userdata/rhel/provider.go
index a7e20270..79fec5d7 100644
--- a/pkg/userdata/rhel/provider.go
+++ b/pkg/userdata/rhel/provider.go
@@ -192,9 +192,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -206,20 +204,6 @@ write_files:
       ipvsadm{{ if eq .CloudProviderName "vsphere" }} \
       open-vm-tools{{ end }}
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
 {{ downloadBinariesScript .KubeletVersion true | indent 4 }}
 
     {{- if eq .CloudProviderName "vsphere" }}
@@ -256,31 +240,7 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
-    apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    {{- range .DNSIPs }}
-      - "{{ . }}"
-    {{- end }}
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
-    authentication:
-      x509:
-        clientCAFile: /etc/kubernetes/pki/ca.crt
-      webhook:
-        enabled: true
-      anonymous:
-        enabled: false
-    protectKernelDefaults: true
+{{ kubeletConfiguration "cluster.local" .DNSIPs | indent 4 }}
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -307,6 +267,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+{{ dockerConfig .InsecureRegistries .RegistryMirrors | indent 4 }}
+  
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/sles/provider.go b/pkg/userdata/sles/provider.go
index c5801e0b..e4a7f3db 100644
--- a/pkg/userdata/sles/provider.go
+++ b/pkg/userdata/sles/provider.go
@@ -230,31 +230,7 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
-    apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    {{- range .DNSIPs }}
-      - "{{ . }}"
-    {{- end }}
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
-    authentication:
-      x509:
-        clientCAFile: /etc/kubernetes/pki/ca.crt
-      webhook:
-        enabled: true
-      anonymous:
-        enabled: false
-    protectKernelDefaults: true
+{{ kubeletConfiguration "cluster.local" .DNSIPs | indent 4 }}
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/provider.go b/pkg/userdata/ubuntu/provider.go
index 2516574b..970a3bc5 100644
--- a/pkg/userdata/ubuntu/provider.go
+++ b/pkg/userdata/ubuntu/provider.go
@@ -152,7 +152,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -241,7 +241,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -348,31 +348,7 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
-    apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    {{- range .DNSIPs }}
-      - "{{ . }}"
-    {{- end }}
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
-    authentication:
-      x509:
-        clientCAFile: /etc/kubernetes/pki/ca.crt
-      webhook:
-        enabled: true
-      anonymous:
-        enabled: false
-    protectKernelDefaults: true
+{{ kubeletConfiguration "cluster.local" .DNSIPs | indent 4 }}
 
 - path: /etc/docker/daemon.json
   permissions: "0644"


Test patch:
diff --git a/hack/ci-e2e-test.sh b/hack/ci-e2e-test.sh
index ee9673f7..2409d8d8 100755
--- a/hack/ci-e2e-test.sh
+++ b/hack/ci-e2e-test.sh
@@ -99,4 +99,4 @@ EXTRA_ARGS=""
 if [[ $# -gt 0 ]]; then
   EXTRA_ARGS="-run $1"
 fi
-go test -race -tags=e2e -parallel 240 -v -timeout 50m  ./test/e2e/... -identifier=$BUILD_ID $EXTRA_ARGS
+go test -race -tags=e2e -parallel 240 -v -timeout 70m  ./test/e2e/... -identifier=$BUILD_ID $EXTRA_ARGS
diff --git a/pkg/controller/nodecsrapprover/node_csr_approver_test.go b/pkg/controller/nodecsrapprover/node_csr_approver_test.go
index a7e87373..df8284cd 100644
--- a/pkg/controller/nodecsrapprover/node_csr_approver_test.go
+++ b/pkg/controller/nodecsrapprover/node_csr_approver_test.go
@@ -17,102 +17,706 @@ limitations under the License.
 package nodecsrapprover
 
 import (
-	"context"
-	"sync"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
 	"testing"
 
+	"github.com/kubermatic/machine-controller/pkg/apis/cluster/v1alpha1"
+
 	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/kubernetes/typed/certificates/v1beta1/fake"
-	fakeclienttest "k8s.io/client-go/testing"
-
-	k8sclientfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
+/*
+	Certificate generation (cfssl required):
+cat <<EOF | cfssl genkey - | cfssljson -bare server
+{
+  "hosts": [
+    "ip-172-31-114-48.eu-west-3.compute.internal",
+    "192.0.2.24"
+  ],
+  "CN": "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [{
+	"O": "system:nodes"
+  }]
+}
+EOF
+*/
+
 const (
-	testCertificateRequest = `-----BEGIN CERTIFICATE REQUEST-----
-MIIBnTCCAUQCAQAwWTEVMBMGA1UEChMMc3lzdGVtOm5vZGVzMUAwPgYDVQQDEzdz
+	testValidCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBYzCCAQoCAQAwWTEVMBMGA1UEChMMc3lzdGVtOm5vZGVzMUAwPgYDVQQDEzdz
+eXN0ZW06bm9kZTppcC0xNzItMzEtMTE0LTQ4LmV1LXdlc3QtMy5jb21wdXRlLmlu
+dGVybmFsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvt0lQhUzm7HRM+nK64Uj
+B8Nm4N59ksjOUiEnH1nDamPTZXjVzhfUShKiaYTpGU11xZz2rZu97AGhZeiSfPI4
+eqBPME0GCSqGSIb3DQEJDjFAMD4wPAYDVR0RBDUwM4IraXAtMTcyLTMxLTExNC00
+OC5ldS13ZXN0LTMuY29tcHV0ZS5pbnRlcm5hbIcEwAACGDAKBggqhkjOPQQDAgNH
+ADBEAiAenX66LOL8U0C6Oo5WAQLxErmImuKpN1lRj/qeYE3sYQIgGu1UpkyNmMqM
+ZNeG8Y4JZvQejnbdkbToeB0yodC1tEE=
+-----END CERTIFICATE REQUEST-----
+`
+
+	testInvalidCommonNameCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBMDCB1wIBADAmMRUwEwYDVQQKEwxzeXN0ZW06bm9kZXMxDTALBgNVBAMTBHRl
+c3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT4FVNaMAPVcv05WF+EQ3FbTmax
+A3dIxE938g04uFvKFV00TggRaUW/obOo8BET0ADHmxA3QWM9XfX2UNI88VRLoE8w
+TQYJKoZIhvcNAQkOMUAwPjA8BgNVHREENTAzgitpcC0xNzItMzEtMTE0LTQ4LmV1
+LXdlc3QtMy5jb21wdXRlLmludGVybmFshwTAAAIYMAoGCCqGSM49BAMCA0gAMEUC
+IQDqnqQLBH2nBVoz4P35lrSPVqAZYmg5HN145jMy3/GUFQIgIHJJ0U6sd8xbksMV
+xW5irA6nWST0ILKeIJz7BBds2K0=
+-----END CERTIFICATE REQUEST-----
+`
+
+	testMultipleOrganizationsCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBcDCCARcCAQAwZjEiMBMGA1UEChMMc3lzdGVtOm5vZGVzMAsGA1UEChMEdGVz
+dDFAMD4GA1UEAxM3c3lzdGVtOm5vZGU6aXAtMTcyLTMxLTExNC00OC5ldS13ZXN0
+LTMuY29tcHV0ZS5pbnRlcm5hbDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNF9
+okm72Aez+e9qeylkTGYQOTfEgSRRgmgyOtkqug/QwxkR0adlyIJcKiX/DZ4Eiqhe
+tFgq4c4vBNKKg6SKxWKgTzBNBgkqhkiG9w0BCQ4xQDA+MDwGA1UdEQQ1MDOCK2lw
+LTE3Mi0zMS0xMTQtNDguZXUtd2VzdC0zLmNvbXB1dGUuaW50ZXJuYWyHBMAAAhgw
+CgYIKoZIzj0EAwIDRwAwRAIgTKGXyZ8WEoPWba8varaH1RTKjLVq8Xa0iDMQGCRx
+wDQCIBkAk4Z5KiOQMWEH8gH+cl5EVprL4bCEyPnnNF8gofpz
+-----END CERTIFICATE REQUEST-----
+`
+
+	testNoOrganizationCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBTTCB8wIBADBCMUAwPgYDVQQDEzdzeXN0ZW06bm9kZTppcC0xNzItMzEtMTE0
+LTQ4LmV1LXdlc3QtMy5jb21wdXRlLmludGVybmFsMFkwEwYHKoZIzj0CAQYIKoZI
+zj0DAQcDQgAEMA3EgzRCWIK1NbZ3WE4w3SRX4AXub49aGs1f7emlmGjs7smhN/NB
+fzbPH/eMGkVB8A10+DyuHw51XCLufUrbJKBPME0GCSqGSIb3DQEJDjFAMD4wPAYD
+VR0RBDUwM4IraXAtMTcyLTMxLTExNC00OC5ldS13ZXN0LTMuY29tcHV0ZS5pbnRl
+cm5hbIcEwAACGDAKBggqhkjOPQQDAgNJADBGAiEAtuVHYeKM8uNtJy0kFCFJmsIy
+g/X2uvkjAnSLjizhF3oCIQCfwZ5jQy5JUufOYORk0oEl7DAln10PkRFICBoDcVtt
+wQ==
+-----END CERTIFICATE REQUEST-----
+`
+
+	testInvalidOrganizationCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBWzCCAQICAQAwUTENMAsGA1UEChMEdGVzdDFAMD4GA1UEAxM3c3lzdGVtOm5v
+ZGU6aXAtMTcyLTMxLTExNC00OC5ldS13ZXN0LTMuY29tcHV0ZS5pbnRlcm5hbDBZ
+MBMGByqGSM49AgEGCCqGSM49AwEHA0IABP9SWPd4Tf8zWuzTTBratQRFwC6dXyyq
+IltYaTny5+pZxwiSzZCuLSYe1mSPQvBLjfMcMJiDIeH82oHXPehxPR+gTzBNBgkq
+hkiG9w0BCQ4xQDA+MDwGA1UdEQQ1MDOCK2lwLTE3Mi0zMS0xMTQtNDguZXUtd2Vz
+dC0zLmNvbXB1dGUuaW50ZXJuYWyHBMAAAhgwCgYIKoZIzj0EAwIDRwAwRAIgNui6
+Ch0hJUx9r3a1VTOMRa5BDJ6z02hizuSC4rMg3N4CIEmKExaOFYT5lwOs5ZYaQ4xc
+6usii8YdNQ7Y0WlreYTQ
+-----END CERTIFICATE REQUEST-----
+`
+
+	testInvalidDNSNameCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBYzCCAQoCAQAwWTEVMBMGA1UEChMMc3lzdGVtOm5vZGVzMUAwPgYDVQQDEzdz
 eXN0ZW06bm9kZTppcC0xNzItMzEtMTE0LTQ4LmV1LXdlc3QtMy5jb21wdXRlLmlu
-dGVybmFsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAvwSO5A7Thh4Dw1KejVf
-JwvVeTXCbe5i/AzQr1DRO2g9Hsd/3iwFc27OX29PJ6tXt9wNVG9dn+D7fLuvRIdY
-4KCBiDCBhQYJKoZIhvcNAQkOMXgwdjB0BgNVHREEbTBrgjBlYzItNTItNDctOTct
-MTExLmV1LXdlc3QtMy5jb21wdXRlLmFtYXpvbmF3cy5jb22CK2lwLTE3Mi0zMS0x
-MTQtNDguZXUtd2VzdC0zLmNvbXB1dGUuaW50ZXJuYWyHBKwfcjCHBDQvYW8wCgYI
-KoZIzj0EAwIDRwAwRAIgLdF0Ud9UHmE3Ezxovw5oafCAKYiCE/EirpNXkUHee80C
-IDjKG4ahwgDJQRtpmGqufjFBqrVVI3DxEFvt2RATJ3HA
------END CERTIFICATE REQUEST-----`
+dGVybmFsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEI0vty8uehZOaXxjluaEi
+DaTBhB0rplD92+Mi8Xt36nCq+BmrtXBIst1Cp8jzx/AESEuC/06T1FoZnXir5H5k
+KKBPME0GCSqGSIb3DQEJDjFAMD4wPAYDVR0RBDUwM4IraXAtMTcyLTMxLTExNC00
+OC5ldS1lYXN0LTMuY29tcHV0ZS5pbnRlcm5hbIcEwAACGDAKBggqhkjOPQQDAgNH
+ADBEAiARKzqSf5A4K9mSpfN5BZkvagN2hpSuCrNh969aMHKWGgIgLMlqn6GED5cS
+rHy6Ox5XuLIEfuyO2lw4Tpse1T0MN5c=
+-----END CERTIFICATE REQUEST-----
+`
+
+	testInvalidIPAddressCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBYzCCAQoCAQAwWTEVMBMGA1UEChMMc3lzdGVtOm5vZGVzMUAwPgYDVQQDEzdz
+eXN0ZW06bm9kZTppcC0xNzItMzEtMTE0LTQ4LmV1LXdlc3QtMy5jb21wdXRlLmlu
+dGVybmFsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5bGjubaUuMpo5IHK/nfm
+fPoG/uPDkDUtx9wugPaNGd8vn5Mu/3QMf3NuD5kXRY4RCWl9w4vddkLdT+hSekP1
+i6BPME0GCSqGSIb3DQEJDjFAMD4wPAYDVR0RBDUwM4IraXAtMTcyLTMxLTExNC00
+OC5ldS13ZXN0LTMuY29tcHV0ZS5pbnRlcm5hbIcEwAACAjAKBggqhkjOPQQDAgNH
+ADBEAiB9myW6lAcQKX2WCsfriwK3aIMzgY4jCkr8tPV1oZeLLQIgbwlqgQcAOQqC
+/6Fr0hK/AIDlykBtDKkNYDgm3n3Oqqc=
+-----END CERTIFICATE REQUEST-----
+`
+
+	testAdditionalDNSNameCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBkTCCATcCAQAwWTEVMBMGA1UEChMMc3lzdGVtOm5vZGVzMUAwPgYDVQQDEzdz
+eXN0ZW06bm9kZTppcC0xNzItMzEtMTE0LTQ4LmV1LXdlc3QtMy5jb21wdXRlLmlu
+dGVybmFsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEA9/qlNDkHRRv/MMvqGDv
+glwVIepZ1nXpA72XmwT9eKGKIGhvYkU5y6HkpkLv45niTxhhYN4EbSwAC7651ZsK
+6qB8MHoGCSqGSIb3DQEJDjFtMGswaQYDVR0RBGIwYIIraXAtMTcyLTMxLTExNC00
+OC5ldS13ZXN0LTMuY29tcHV0ZS5pbnRlcm5hbIIraXAtMTcyLTMxLTExNC00OC5l
+dS1lYXN0LTMuY29tcHV0ZS5pbnRlcm5hbIcEwAACGDAKBggqhkjOPQQDAgNIADBF
+AiAr5gSITnVYXOFmvEU+mcHk8w/8/cbKwMHWtLZ0ZLN+igIhAP0BE//qz0lAFINS
+Su19WQIpe9VR/dGJvXfsgaLjyPyJ
+-----END CERTIFICATE REQUEST-----
+`
+
+	testAdditionalIPAddressCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBazCCARACAQAwWTEVMBMGA1UEChMMc3lzdGVtOm5vZGVzMUAwPgYDVQQDEzdz
+eXN0ZW06bm9kZTppcC0xNzItMzEtMTE0LTQ4LmV1LXdlc3QtMy5jb21wdXRlLmlu
+dGVybmFsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPg/O69m6AjfXB8XoKjAx
+2RqAdKzt1aJ9u0rbOcoa2QkTcFeMY2GbAZ/6IVWnTDsqORJeJrHP5WYNUFgBjQ2c
+gaBVMFMGCSqGSIb3DQEJDjFGMEQwQgYDVR0RBDswOYIraXAtMTcyLTMxLTExNC00
+OC5ldS13ZXN0LTMuY29tcHV0ZS5pbnRlcm5hbIcEwAACGIcEwAACGTAKBggqhkjO
+PQQDAgNJADBGAiEA3HDpVRYYgcmdCzq5o6mwkMzegZ0P0aZNPdCQLyJt3GoCIQDo
+/iL1+piFJXAOI2GjsZNpeQJ4rPJ7l/t95tzgcVAUtw==
+-----END CERTIFICATE REQUEST-----
+`
+
+	testNoDNSNameCSR = `-----BEGIN CERTIFICATE REQUEST-----
+MIIBNjCB3QIBADBZMRUwEwYDVQQKEwxzeXN0ZW06bm9kZXMxQDA+BgNVBAMTN3N5
+c3RlbTpub2RlOmlwLTE3Mi0zMS0xMTQtNDguZXUtd2VzdC0zLmNvbXB1dGUuaW50
+ZXJuYWwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATjbIZVQA/A+lki63bMCgVR
+UrkCqtVufWtKU5KPTD9BGZ6/dNW/uUdVftLe7Vp4+8cp2YoZIQA5NfMGYMtcE9PV
+oCIwIAYJKoZIhvcNAQkOMRMwETAPBgNVHREECDAGhwTAAAIYMAoGCCqGSM49BAMC
+A0gAMEUCIQDxZpheeDW9azYm0T0OoOyFCFslJsRf9uvJM66byWr0KwIgduhJVRog
+ELloyxg3KHxPJi8TYkTPkB+Pc9XiUGmhkzE=
+-----END CERTIFICATE REQUEST-----
+`
 )
 
-func TestReconciler_Reconcile(t *testing.T) {
-	reaction := &fakeApproveReaction{}
-	simpleReactor := &fakeclienttest.SimpleReactor{
-		Verb:     "*",
-		Resource: "*",
-		Reaction: reaction.approveReaction,
-	}
+func TestValidateCSRObject(t *testing.T) {
 	testCases := []struct {
-		name       string
-		reconciler reconciler
+		name     string
+		csr      *certificatesv1beta1.CertificateSigningRequest
+		nodeName string
+		err      error
 	}{
 		{
-			name: "test approving a created certificate",
-			reconciler: reconciler{
-				Client: k8sclientfake.NewFakeClient(&certificatesv1beta1.CertificateSigningRequest{
-					ObjectMeta: metav1.ObjectMeta{
-						ResourceVersion: "123456",
-						Name:            "csr",
-						Namespace:       metav1.NamespaceSystem,
-					},
-					Spec: certificatesv1beta1.CertificateSigningRequestSpec{
-						Request: []byte(testCertificateRequest),
-						Usages: []certificatesv1beta1.KeyUsage{
-							certificatesv1beta1.UsageDigitalSignature,
-							certificatesv1beta1.UsageKeyEncipherment,
-							certificatesv1beta1.UsageServerAuth,
-						},
-						Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
-						Groups: []string{
-							"system:nodes",
-						},
+			name: "test validating a valid csr",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testValidCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
 					},
-				}),
-				certClient: &fake.FakeCertificateSigningRequests{
-					Fake: &fake.FakeCertificatesV1beta1{
-						Fake: &fakeclienttest.Fake{
-							RWMutex:       sync.RWMutex{},
-							ReactionChain: []fakeclienttest.Reactor{simpleReactor},
-						},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			nodeName: "ip-172-31-114-48.eu-west-3.compute.internal",
+			err:      nil,
+		},
+		{
+			name: "test validating a valid csr with more than 2 groups",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testValidCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+						"test-group",
+					},
+				},
+			},
+			nodeName: "ip-172-31-114-48.eu-west-3.compute.internal",
+			err:      nil,
+		},
+		{
+			name: "test validating an invalid csr (missing prefix)",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Username: "node:ip-172-31-114-48.eu-west-3.compute.internal",
+				},
+			},
+			nodeName: "",
+			err:      fmt.Errorf("username must have the '%s' prefix", nodeUserPrefix),
+		},
+		{
+			name: "validate with missing node name in username",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Username: "system:node:",
+				},
+			},
+			nodeName: "",
+			err:      fmt.Errorf("node name is empty"),
+		},
+		{
+			name: "validate csr with with missing system:nodes group",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:authenticated",
+					},
+				},
+			},
+			nodeName: "",
+			err:      fmt.Errorf("there are less than 2 groups"),
+		},
+		{
+			name: "validate csr with two invalid groups",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"group-1",
+						"group-2",
 					},
 				},
 			},
+			nodeName: "",
+			err:      fmt.Errorf("'%s' and/or '%s' are not in its groups", nodeGroup, authenticatedGroup),
+		},
+		{
+			name: "validate csr with less than 3 usages",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testValidCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			nodeName: "",
+			err:      fmt.Errorf("there are no exactly three usages defined"),
+		},
+		{
+			name: "validate csr with more than 3 usages",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testValidCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+						certificatesv1beta1.UsageClientAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			nodeName: "",
+			err:      fmt.Errorf("there are no exactly three usages defined"),
+		},
+		{
+			name: "validate csr with usages not matching expected usages",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testValidCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageClientAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			nodeName: "",
+			err:      fmt.Errorf("usage %v is not in the list of allowed usages (%v)", "client auth", allowedUsages),
 		},
 	}
-
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx := context.Background()
-			if err := tc.reconciler.reconcile(ctx, reconcile.Request{
-				NamespacedName: types.NamespacedName{Name: "csr", Namespace: metav1.NamespaceSystem}}); err != nil {
-				t.Fatalf("failed executing test: %v", err)
+			r := &reconciler{}
+			nodeName, err := r.validateCSRObject(tc.csr)
+			if err != nil && err.Error() != tc.err.Error() {
+				t.Errorf("expected error '%v', but got '%v'", tc.err, err)
+			} else if err == nil && tc.err != nil {
+				t.Errorf("expected error '%v'", tc.err)
 			}
-
-			for _, cond := range reaction.expectedCSR.Status.Conditions {
-				if cond.Type != certificatesv1beta1.CertificateApproved {
-					t.Fatalf("failed updating csr condition")
-				}
+			if nodeName != tc.nodeName {
+				t.Errorf("expected node name '%s', but got '%s'", tc.nodeName, nodeName)
 			}
 		})
 	}
 }
 
-type fakeApproveReaction struct {
-	expectedCSR *certificatesv1beta1.CertificateSigningRequest
-}
+func TestValidateX509CSR(t *testing.T) {
+	machine := v1alpha1.Machine{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-machine",
+			Namespace: metav1.NamespaceSystem,
+		},
+		Spec: v1alpha1.MachineSpec{},
+		Status: v1alpha1.MachineStatus{
+			NodeRef: &corev1.ObjectReference{
+				APIVersion: "v1",
+				Kind:       "Node",
+				Name:       "ip-172-31-114-48.eu-west-3.compute.internal",
+			},
+			Addresses: []corev1.NodeAddress{
+				{
+					Address: "ip-172-31-114-48.eu-west-3.compute.internal",
+					Type:    corev1.NodeExternalDNS,
+				},
+				{
+					Address: "192.0.2.24",
+					Type:    corev1.NodeExternalIP,
+				},
+			},
+		},
+	}
+
+	testCases := []struct {
+		name    string
+		csr     *certificatesv1beta1.CertificateSigningRequest
+		machine v1alpha1.Machine
+		err     error
+	}{
+		{
+			name: "validate valid csr",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testValidCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     nil,
+		},
+		{
+			name: "validate csr with no dns name in machine object",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testNoDNSNameCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: v1alpha1.Machine{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-machine",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: v1alpha1.MachineSpec{},
+				Status: v1alpha1.MachineStatus{
+					NodeRef: &corev1.ObjectReference{
+						APIVersion: "v1",
+						Kind:       "Node",
+						Name:       "ip-172-31-114-48.eu-west-3.compute.internal",
+					},
+					Addresses: []corev1.NodeAddress{
+						{
+							Address: "192.0.2.24",
+							Type:    corev1.NodeExternalIP,
+						},
+					},
+				},
+			},
+			err: nil,
+		},
+		{
+			name: "validate csr with different common name than username",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testInvalidCommonNameCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("commonName '%s' is different then CSR username '%s'", "test", "system:node:ip-172-31-114-48.eu-west-3.compute.internal"),
+		},
+		{
+			name: "validate csr with different username than common name",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testValidCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "test-username",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("commonName '%s' is different then CSR username '%s'", "system:node:ip-172-31-114-48.eu-west-3.compute.internal", "test-username"),
+		},
+		{
+			name: "validate csr with multiple organizations",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testMultipleOrganizationsCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("expected only one organization but got %d instead", 2),
+		},
+		{
+			name: "validate csr with no organization",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testNoOrganizationCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("expected only one organization but got %d instead", 0),
+		},
+		{
+			name: "validate csr with organization not matching system:nodes",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testInvalidOrganizationCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("organization '%s' doesn't match node group '%s'", "test", nodeGroup),
+		},
+		{
+			name: "validate csr with invalid dns name",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testInvalidDNSNameCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("dns name '%s' cannot be associated with node '%s'", "ip-172-31-114-48.eu-east-3.compute.internal", machine.Status.NodeRef.Name),
+		},
+		{
+			name: "validate csr with invalid ip address",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testInvalidIPAddressCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("ip address '%v' cannot be associated with node '%s'", "192.0.2.2", machine.Status.NodeRef.Name),
+		},
+		{
+			name: "validate csr with dns name not defined in the machine object",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testAdditionalDNSNameCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("dns name '%s' cannot be associated with node '%s'", "ip-172-31-114-48.eu-east-3.compute.internal", machine.Status.NodeRef.Name),
+		},
+		{
+			name: "validate csr with ip address not defined in the machine object",
+			csr: &certificatesv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "csr",
+					Namespace: metav1.NamespaceSystem,
+				},
+				Spec: certificatesv1beta1.CertificateSigningRequestSpec{
+					Request: []byte(testAdditionalIPAddressCSR),
+					Usages: []certificatesv1beta1.KeyUsage{
+						certificatesv1beta1.UsageDigitalSignature,
+						certificatesv1beta1.UsageKeyEncipherment,
+						certificatesv1beta1.UsageServerAuth,
+					},
+					Username: "system:node:ip-172-31-114-48.eu-west-3.compute.internal",
+					Groups: []string{
+						"system:nodes",
+						"system:authenticated",
+					},
+				},
+			},
+			machine: machine,
+			err:     fmt.Errorf("ip address '%v' cannot be associated with node '%s'", "192.0.2.25", machine.Status.NodeRef.Name),
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := &reconciler{}
 
-func (f *fakeApproveReaction) approveReaction(action fakeclienttest.Action) (bool, runtime.Object, error) {
-	f.expectedCSR = action.(fakeclienttest.UpdateActionImpl).Object.(*certificatesv1beta1.CertificateSigningRequest)
-	return true, f.expectedCSR, nil
+			// Parse the certificate request
+			csrBlock, rest := pem.Decode(tc.csr.Spec.Request)
+			if csrBlock == nil {
+				t.Fatal("no certificate request found for the given CSR")
+			}
+			if len(rest) != 0 {
+				t.Fatal("found more than one PEM encoded block in the result")
+			}
+			certReq, err := x509.ParseCertificateRequest(csrBlock.Bytes)
+			if err != nil {
+				t.Fatalf("failed to parse x509 certificate request: %v", err)
+			}
+
+			err = r.validateX509CSR(tc.csr, certReq, tc.machine)
+			if err != nil && err.Error() != tc.err.Error() {
+				t.Errorf("expected error '%v', but got '%v'", tc.err, err)
+			} else if err == nil && tc.err != nil {
+				t.Errorf("expected error '%v'", tc.err)
+			}
+		})
+	}
 }
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.10-aws.yaml b/pkg/userdata/centos/testdata/kubelet-v1.10-aws.yaml
index 31b4cb31..95fb7f5b 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.10-aws.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.10-aws.yaml
@@ -69,7 +69,10 @@ write_files:
     swapoff -a
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -97,7 +100,6 @@ write_files:
         curl -Lfo /opt/bin/health-monitor.sh https://raw.githubusercontent.com/kubermatic/machine-controller/8b5b66e4910a6228dfaecccaa0a3b05ec4902f8e/pkg/userdata/scripts/health-monitor.sh
         chmod +x /opt/bin/health-monitor.sh
     fi
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -179,28 +181,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -252,6 +267,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.11-aws.yaml b/pkg/userdata/centos/testdata/kubelet-v1.11-aws.yaml
index a9b3da7a..8da69ad0 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.11-aws.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.11-aws.yaml
@@ -69,7 +69,10 @@ write_files:
     swapoff -a
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -97,7 +100,6 @@ write_files:
         curl -Lfo /opt/bin/health-monitor.sh https://raw.githubusercontent.com/kubermatic/machine-controller/8b5b66e4910a6228dfaecccaa0a3b05ec4902f8e/pkg/userdata/scripts/health-monitor.sh
         chmod +x /opt/bin/health-monitor.sh
     fi
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -179,28 +181,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -252,6 +267,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.12-aws-external.yaml b/pkg/userdata/centos/testdata/kubelet-v1.12-aws-external.yaml
index 3f121521..f3c628fc 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.12-aws-external.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.12-aws-external.yaml
@@ -69,7 +69,10 @@ write_files:
     swapoff -a
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -97,7 +100,6 @@ write_files:
         curl -Lfo /opt/bin/health-monitor.sh https://raw.githubusercontent.com/kubermatic/machine-controller/8b5b66e4910a6228dfaecccaa0a3b05ec4902f8e/pkg/userdata/scripts/health-monitor.sh
         chmod +x /opt/bin/health-monitor.sh
     fi
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -177,28 +179,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -250,6 +265,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.12-aws.yaml b/pkg/userdata/centos/testdata/kubelet-v1.12-aws.yaml
index 83518f51..13ab4997 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.12-aws.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.12-aws.yaml
@@ -69,7 +69,10 @@ write_files:
     swapoff -a
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -97,7 +100,6 @@ write_files:
         curl -Lfo /opt/bin/health-monitor.sh https://raw.githubusercontent.com/kubermatic/machine-controller/8b5b66e4910a6228dfaecccaa0a3b05ec4902f8e/pkg/userdata/scripts/health-monitor.sh
         chmod +x /opt/bin/health-monitor.sh
     fi
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -178,28 +180,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -251,6 +266,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-mirrors.yaml b/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-mirrors.yaml
index 4a8608ed..059d4ac8 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-mirrors.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-mirrors.yaml
@@ -81,7 +81,10 @@ write_files:
     hostnamectl set-hostname node1
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -112,7 +115,6 @@ write_files:
     fi
 
     systemctl enable --now vmtoolsd.service
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -195,28 +197,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -268,6 +283,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"registry-mirrors":["https://registry.docker-cn.com"]}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-proxy.yaml b/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-proxy.yaml
index 1e4916f3..873460d7 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-proxy.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere-proxy.yaml
@@ -81,7 +81,10 @@ write_files:
     hostnamectl set-hostname node1
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -112,7 +115,6 @@ write_files:
     fi
 
     systemctl enable --now vmtoolsd.service
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -195,28 +197,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -268,6 +283,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"]}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere.yaml b/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere.yaml
index ed93d64d..2bcdd92b 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.12-vsphere.yaml
@@ -73,7 +73,10 @@ write_files:
     hostnamectl set-hostname node1
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -104,7 +107,6 @@ write_files:
     fi
 
     systemctl enable --now vmtoolsd.service
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -186,28 +188,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -259,6 +274,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/centos/testdata/kubelet-v1.9-aws.yaml b/pkg/userdata/centos/testdata/kubelet-v1.9-aws.yaml
index 77ab2780..35b4578c 100644
--- a/pkg/userdata/centos/testdata/kubelet-v1.9-aws.yaml
+++ b/pkg/userdata/centos/testdata/kubelet-v1.9-aws.yaml
@@ -69,7 +69,10 @@ write_files:
     swapoff -a
 
 
-    yum install -y docker-1.13.1 \
+    yum install -y yum-utils
+    yum-config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+
+    yum install -y docker-ce-18.09.9-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -97,7 +100,6 @@ write_files:
         curl -Lfo /opt/bin/health-monitor.sh https://raw.githubusercontent.com/kubermatic/machine-controller/8b5b66e4910a6228dfaecccaa0a3b05ec4902f8e/pkg/userdata/scripts/health-monitor.sh
         chmod +x /opt/bin/health-monitor.sh
     fi
-    sed -i 's/journald/json-file/g' /etc/sysconfig/docker
     systemctl enable --now docker
     systemctl enable --now kubelet
     systemctl enable --now --no-block kubelet-healthcheck.service
@@ -179,28 +181,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -252,6 +267,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/coreos/testdata/auto-update-openstack-kubelet-v-version-prefix.yaml b/pkg/userdata/coreos/testdata/auto-update-openstack-kubelet-v-version-prefix.yaml
index 0684c9d7..aa5d110e 100644
--- a/pkg/userdata/coreos/testdata/auto-update-openstack-kubelet-v-version-prefix.yaml
+++ b/pkg/userdata/coreos/testdata/auto-update-openstack-kubelet-v-version-prefix.yaml
@@ -147,29 +147,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -316,7 +330,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.10.3-auto-update-openstack-multiple-dns.yaml b/pkg/userdata/coreos/testdata/v1.10.3-auto-update-openstack-multiple-dns.yaml
index a996daa0..973a7f4e 100644
--- a/pkg/userdata/coreos/testdata/v1.10.3-auto-update-openstack-multiple-dns.yaml
+++ b/pkg/userdata/coreos/testdata/v1.10.3-auto-update-openstack-multiple-dns.yaml
@@ -147,31 +147,45 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-            - "10.10.10.11"
-            - "10.10.10.12"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          - 10.10.10.11
+          - 10.10.10.12
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -318,7 +332,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.11.2-vsphere-static-ipconfig.yaml b/pkg/userdata/coreos/testdata/v1.11.2-vsphere-static-ipconfig.yaml
index 55a6e658..6f2f075f 100644
--- a/pkg/userdata/coreos/testdata/v1.11.2-vsphere-static-ipconfig.yaml
+++ b/pkg/userdata/coreos/testdata/v1.11.2-vsphere-static-ipconfig.yaml
@@ -167,29 +167,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -336,7 +350,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.12.0-vsphere-mirrors.yaml b/pkg/userdata/coreos/testdata/v1.12.0-vsphere-mirrors.yaml
index eb4ae76c..c42776f1 100644
--- a/pkg/userdata/coreos/testdata/v1.12.0-vsphere-mirrors.yaml
+++ b/pkg/userdata/coreos/testdata/v1.12.0-vsphere-mirrors.yaml
@@ -184,29 +184,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -353,7 +367,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":["https://registry.docker-cn.com"]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"registry-mirrors":["https://registry.docker-cn.com"]}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.12.0-vsphere-overwrite-cloudconfig.yaml b/pkg/userdata/coreos/testdata/v1.12.0-vsphere-overwrite-cloudconfig.yaml
index 5fd76036..ad95ba02 100644
--- a/pkg/userdata/coreos/testdata/v1.12.0-vsphere-overwrite-cloudconfig.yaml
+++ b/pkg/userdata/coreos/testdata/v1.12.0-vsphere-overwrite-cloudconfig.yaml
@@ -166,29 +166,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -337,7 +351,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.12.0-vsphere-proxy.yaml b/pkg/userdata/coreos/testdata/v1.12.0-vsphere-proxy.yaml
index 3f710f3e..ad524738 100644
--- a/pkg/userdata/coreos/testdata/v1.12.0-vsphere-proxy.yaml
+++ b/pkg/userdata/coreos/testdata/v1.12.0-vsphere-proxy.yaml
@@ -184,29 +184,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -353,7 +367,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"]}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.15.0-vsphere.yaml b/pkg/userdata/coreos/testdata/v1.15.0-vsphere.yaml
index d118ba1c..298e1479 100644
--- a/pkg/userdata/coreos/testdata/v1.15.0-vsphere.yaml
+++ b/pkg/userdata/coreos/testdata/v1.15.0-vsphere.yaml
@@ -143,29 +143,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -312,7 +326,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.17.0.yaml b/pkg/userdata/coreos/testdata/v1.17.0.yaml
index 8fa9e727..c6106e7f 100644
--- a/pkg/userdata/coreos/testdata/v1.17.0.yaml
+++ b/pkg/userdata/coreos/testdata/v1.17.0.yaml
@@ -166,29 +166,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -335,7 +349,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws-external.yaml b/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws-external.yaml
index 52f1a65c..872a2f9a 100644
--- a/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws-external.yaml
+++ b/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws-external.yaml
@@ -149,29 +149,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -313,7 +327,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws.yaml b/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws.yaml
index 735c9c73..7301d714 100644
--- a/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws.yaml
+++ b/pkg/userdata/coreos/testdata/v1.9.2-disable-auto-update-aws.yaml
@@ -150,29 +150,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -314,7 +328,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.9.2-disable-locksmith-aws.yaml b/pkg/userdata/coreos/testdata/v1.9.2-disable-locksmith-aws.yaml
index 25a8809c..1fdae003 100644
--- a/pkg/userdata/coreos/testdata/v1.9.2-disable-locksmith-aws.yaml
+++ b/pkg/userdata/coreos/testdata/v1.9.2-disable-locksmith-aws.yaml
@@ -148,29 +148,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -312,7 +326,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/coreos/testdata/v1.9.2-disable-update-engine-aws.yaml b/pkg/userdata/coreos/testdata/v1.9.2-disable-update-engine-aws.yaml
index b7e876c1..8645a924 100644
--- a/pkg/userdata/coreos/testdata/v1.9.2-disable-update-engine-aws.yaml
+++ b/pkg/userdata/coreos/testdata/v1.9.2-disable-update-engine-aws.yaml
@@ -148,29 +148,43 @@ storage:
       mode: 0644
       contents:
         inline: |
-          kind: KubeletConfiguration
           apiVersion: kubelet.config.k8s.io/v1beta1
-          cgroupDriver: systemd
-          clusterDomain: cluster.local
-          clusterDNS:
-            - "10.10.10.10"
-          rotateCertificates: true
-          podManifestPath: /etc/kubernetes/manifests
-          readOnlyPort: 0
-          featureGates:
-            RotateKubeletServerCertificate: true
-          serverTLSBootstrap: true
-          rotateCertificates: true
-          authorization:
-            mode: Webhook
           authentication:
+            anonymous:
+              enabled: false
+            webhook:
+              cacheTTL: 0s
+              enabled: true
             x509:
               clientCAFile: /etc/kubernetes/pki/ca.crt
+          authorization:
+            mode: Webhook
             webhook:
-              enabled: true
-            anonymous:
-              enabled: false
+              cacheAuthorizedTTL: 0s
+              cacheUnauthorizedTTL: 0s
+          cgroupDriver: systemd
+          clusterDNS:
+          - 10.10.10.10
+          clusterDomain: cluster.local
+          cpuManagerReconcilePeriod: 0s
+          evictionPressureTransitionPeriod: 0s
+          featureGates:
+            RotateKubeletServerCertificate: true
+          fileCheckFrequency: 0s
+          httpCheckFrequency: 0s
+          imageMinimumGCAge: 0s
+          kind: KubeletConfiguration
+          nodeStatusReportFrequency: 0s
+          nodeStatusUpdateFrequency: 0s
           protectKernelDefaults: true
+          rotateCertificates: true
+          runtimeRequestTimeout: 0s
+          serverTLSBootstrap: true
+          staticPodPath: /etc/kubernetes/manifests
+          streamingConnectionIdleTimeout: 0s
+          syncFrequency: 0s
+          volumeStatsAggPeriod: 0s
+
 
     - path: /opt/load-kernel-modules.sh
       filesystem: root
@@ -312,7 +326,7 @@ storage:
       mode: 0644
       contents:
         inline: |
-          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
     - path: /opt/bin/download.sh
       filesystem: root
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.10-aws.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.10-aws.yaml
index e9ac03d7..af1554a5 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.10-aws.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.10-aws.yaml
@@ -77,9 +77,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -90,20 +88,6 @@ write_files:
       curl \
       ipvsadm
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -202,28 +186,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -275,6 +272,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.11-aws.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.11-aws.yaml
index f50f6917..f56d5ff8 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.11-aws.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.11-aws.yaml
@@ -77,9 +77,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -90,20 +88,6 @@ write_files:
       curl \
       ipvsadm
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -202,28 +186,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -275,6 +272,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.12-aws-external.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.12-aws-external.yaml
index a14e0592..fdf74e26 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.12-aws-external.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.12-aws-external.yaml
@@ -77,9 +77,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -90,20 +88,6 @@ write_files:
       curl \
       ipvsadm
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -200,28 +184,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -273,6 +270,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.12-aws.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.12-aws.yaml
index 3de4c87e..6237ea92 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.12-aws.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.12-aws.yaml
@@ -77,9 +77,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -90,20 +88,6 @@ write_files:
       curl \
       ipvsadm
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -201,28 +185,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -274,6 +271,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-mirrors.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-mirrors.yaml
index e08aa779..0339fec5 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-mirrors.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-mirrors.yaml
@@ -89,9 +89,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -103,20 +101,6 @@ write_files:
       ipvsadm \
       open-vm-tools
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -218,28 +202,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -291,6 +288,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"registry-mirrors":["https://registry.docker-cn.com"]}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-proxy.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-proxy.yaml
index 76be8c8b..edefc526 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-proxy.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere-proxy.yaml
@@ -89,9 +89,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -103,20 +101,6 @@ write_files:
       ipvsadm \
       open-vm-tools
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -218,28 +202,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -291,6 +288,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"]}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere.yaml
index b4eb271f..1f30ef11 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.12-vsphere.yaml
@@ -81,9 +81,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -95,20 +93,6 @@ write_files:
       ipvsadm \
       open-vm-tools
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -209,28 +193,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -282,6 +279,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/rhel/testdata/kubelet-v1.9-aws.yaml b/pkg/userdata/rhel/testdata/kubelet-v1.9-aws.yaml
index c93160a6..602cb2e9 100644
--- a/pkg/userdata/rhel/testdata/kubelet-v1.9-aws.yaml
+++ b/pkg/userdata/rhel/testdata/kubelet-v1.9-aws.yaml
@@ -77,9 +77,7 @@ write_files:
 
     yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
 
-    mkdir -p "/etc/docker"
-
-    yum install -y docker-ce-3:18.09.1-3.el7 \
+    yum install -y docker-ce-18.09.1-3.el7 \
       ebtables \
       ethtool \
       nfs-utils \
@@ -90,20 +88,6 @@ write_files:
       curl \
       ipvsadm
 
-    cat > /etc/docker/daemon.json <<EOF
-    {
-      "exec-opts": ["native.cgroupdriver=systemd"],
-      "log-driver": "json-file",
-      "log-opts": {
-        "max-size": "100m"
-      },
-      "storage-driver": "overlay2",
-      "storage-opts": [
-        "overlay2.override_kernel_check=true"
-      ]
-    }
-    EOF
-
     mkdir -p /opt/bin/
     mkdir -p /var/lib/calico
     mkdir -p /etc/kubernetes/manifests
@@ -202,28 +186,41 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/kubernetes/pki/ca.crt"
   content: |
@@ -275,6 +272,11 @@ write_files:
   content: |
     export PATH="/opt/bin:$PATH"
 
+- path: /etc/docker/daemon.json
+  permissions: "0644"
+  content: |
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
+
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
   content: |
diff --git a/pkg/userdata/sles/testdata/dist-upgrade-on-boot.yaml b/pkg/userdata/sles/testdata/dist-upgrade-on-boot.yaml
index d89e5e1f..df2a98f9 100644
--- a/pkg/userdata/sles/testdata/dist-upgrade-on-boot.yaml
+++ b/pkg/userdata/sles/testdata/dist-upgrade-on-boot.yaml
@@ -216,29 +216,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -248,7 +262,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/kubelet-version-without-v-prefix.yaml b/pkg/userdata/sles/testdata/kubelet-version-without-v-prefix.yaml
index 66c60280..3f3e1867 100644
--- a/pkg/userdata/sles/testdata/kubelet-version-without-v-prefix.yaml
+++ b/pkg/userdata/sles/testdata/kubelet-version-without-v-prefix.yaml
@@ -215,29 +215,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -247,7 +261,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/multiple-dns-servers.yaml b/pkg/userdata/sles/testdata/multiple-dns-servers.yaml
index fed9eeff..f66d3c05 100644
--- a/pkg/userdata/sles/testdata/multiple-dns-servers.yaml
+++ b/pkg/userdata/sles/testdata/multiple-dns-servers.yaml
@@ -215,31 +215,45 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-      - "10.10.10.11"
-      - "10.10.10.12"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    - 10.10.10.11
+    - 10.10.10.12
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -249,7 +263,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/multiple-ssh-keys.yaml b/pkg/userdata/sles/testdata/multiple-ssh-keys.yaml
index 712c8b30..2713bd37 100644
--- a/pkg/userdata/sles/testdata/multiple-ssh-keys.yaml
+++ b/pkg/userdata/sles/testdata/multiple-ssh-keys.yaml
@@ -217,29 +217,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -249,7 +263,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/openstack-overwrite-cloud-config.yaml b/pkg/userdata/sles/testdata/openstack-overwrite-cloud-config.yaml
index 30e9919e..ab299575 100644
--- a/pkg/userdata/sles/testdata/openstack-overwrite-cloud-config.yaml
+++ b/pkg/userdata/sles/testdata/openstack-overwrite-cloud-config.yaml
@@ -219,29 +219,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -251,7 +265,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/openstack.yaml b/pkg/userdata/sles/testdata/openstack.yaml
index 86212ec8..91a47830 100644
--- a/pkg/userdata/sles/testdata/openstack.yaml
+++ b/pkg/userdata/sles/testdata/openstack.yaml
@@ -217,31 +217,45 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-      - "10.10.10.11"
-      - "10.10.10.12"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    - 10.10.10.11
+    - 10.10.10.12
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -251,7 +265,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/version-1.10.10.yaml b/pkg/userdata/sles/testdata/version-1.10.10.yaml
index 676c8c87..6d1c23c4 100644
--- a/pkg/userdata/sles/testdata/version-1.10.10.yaml
+++ b/pkg/userdata/sles/testdata/version-1.10.10.yaml
@@ -215,29 +215,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -247,7 +261,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/version-1.11.3.yaml b/pkg/userdata/sles/testdata/version-1.11.3.yaml
index 66c60280..3f3e1867 100644
--- a/pkg/userdata/sles/testdata/version-1.11.3.yaml
+++ b/pkg/userdata/sles/testdata/version-1.11.3.yaml
@@ -215,29 +215,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -247,7 +261,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/version-1.12.1.yaml b/pkg/userdata/sles/testdata/version-1.12.1.yaml
index 4307344a..d1b1b4fb 100644
--- a/pkg/userdata/sles/testdata/version-1.12.1.yaml
+++ b/pkg/userdata/sles/testdata/version-1.12.1.yaml
@@ -214,29 +214,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -246,7 +260,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/version-1.9.10.yaml b/pkg/userdata/sles/testdata/version-1.9.10.yaml
index b08172b6..985f056b 100644
--- a/pkg/userdata/sles/testdata/version-1.9.10.yaml
+++ b/pkg/userdata/sles/testdata/version-1.9.10.yaml
@@ -215,29 +215,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -247,7 +261,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/vsphere-mirrors.yaml b/pkg/userdata/sles/testdata/vsphere-mirrors.yaml
index 2e63b8a2..917d8209 100644
--- a/pkg/userdata/sles/testdata/vsphere-mirrors.yaml
+++ b/pkg/userdata/sles/testdata/vsphere-mirrors.yaml
@@ -230,29 +230,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -262,7 +276,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":["https://registry.docker-cn.com"]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"registry-mirrors":["https://registry.docker-cn.com"]}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/vsphere-proxy.yaml b/pkg/userdata/sles/testdata/vsphere-proxy.yaml
index 3819c55d..17b0f23a 100644
--- a/pkg/userdata/sles/testdata/vsphere-proxy.yaml
+++ b/pkg/userdata/sles/testdata/vsphere-proxy.yaml
@@ -230,29 +230,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -262,7 +276,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"]}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/sles/testdata/vsphere.yaml b/pkg/userdata/sles/testdata/vsphere.yaml
index 2ecfe3f5..4f025dab 100644
--- a/pkg/userdata/sles/testdata/vsphere.yaml
+++ b/pkg/userdata/sles/testdata/vsphere.yaml
@@ -220,29 +220,43 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: "/etc/profile.d/opt-bin-path.sh"
   permissions: "0644"
@@ -252,7 +266,7 @@ write_files:
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/dist-upgrade-on-boot.yaml b/pkg/userdata/ubuntu/testdata/dist-upgrade-on-boot.yaml
index 20d9092d..2b7a1fcb 100644
--- a/pkg/userdata/ubuntu/testdata/dist-upgrade-on-boot.yaml
+++ b/pkg/userdata/ubuntu/testdata/dist-upgrade-on-boot.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -323,34 +323,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/kubelet-version-without-v-prefix.yaml b/pkg/userdata/ubuntu/testdata/kubelet-version-without-v-prefix.yaml
index 501abead..5d28ee33 100644
--- a/pkg/userdata/ubuntu/testdata/kubelet-version-without-v-prefix.yaml
+++ b/pkg/userdata/ubuntu/testdata/kubelet-version-without-v-prefix.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -322,34 +322,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/multiple-dns-servers.yaml b/pkg/userdata/ubuntu/testdata/multiple-dns-servers.yaml
index 519a2a16..09cfbbb7 100644
--- a/pkg/userdata/ubuntu/testdata/multiple-dns-servers.yaml
+++ b/pkg/userdata/ubuntu/testdata/multiple-dns-servers.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -322,36 +322,50 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-      - "10.10.10.11"
-      - "10.10.10.12"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    - 10.10.10.11
+    - 10.10.10.12
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/multiple-ssh-keys.yaml b/pkg/userdata/ubuntu/testdata/multiple-ssh-keys.yaml
index 05bd2427..5616d3bc 100644
--- a/pkg/userdata/ubuntu/testdata/multiple-ssh-keys.yaml
+++ b/pkg/userdata/ubuntu/testdata/multiple-ssh-keys.yaml
@@ -54,7 +54,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -139,7 +139,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -324,34 +324,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/openstack-overwrite-cloud-config.yaml b/pkg/userdata/ubuntu/testdata/openstack-overwrite-cloud-config.yaml
index 0535b5d9..54376bd8 100644
--- a/pkg/userdata/ubuntu/testdata/openstack-overwrite-cloud-config.yaml
+++ b/pkg/userdata/ubuntu/testdata/openstack-overwrite-cloud-config.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -326,34 +326,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/openstack.yaml b/pkg/userdata/ubuntu/testdata/openstack.yaml
index 0f3c7b10..5f9dcb4a 100644
--- a/pkg/userdata/ubuntu/testdata/openstack.yaml
+++ b/pkg/userdata/ubuntu/testdata/openstack.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -324,36 +324,50 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-      - "10.10.10.11"
-      - "10.10.10.12"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    - 10.10.10.11
+    - 10.10.10.12
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/version-1.10.10.yaml b/pkg/userdata/ubuntu/testdata/version-1.10.10.yaml
index d0ac3b6a..d509f0a0 100644
--- a/pkg/userdata/ubuntu/testdata/version-1.10.10.yaml
+++ b/pkg/userdata/ubuntu/testdata/version-1.10.10.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -322,34 +322,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/version-1.11.3.yaml b/pkg/userdata/ubuntu/testdata/version-1.11.3.yaml
index 501abead..5d28ee33 100644
--- a/pkg/userdata/ubuntu/testdata/version-1.11.3.yaml
+++ b/pkg/userdata/ubuntu/testdata/version-1.11.3.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -322,34 +322,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/version-1.12.1.yaml b/pkg/userdata/ubuntu/testdata/version-1.12.1.yaml
index 4ba2a43d..d0df8861 100644
--- a/pkg/userdata/ubuntu/testdata/version-1.12.1.yaml
+++ b/pkg/userdata/ubuntu/testdata/version-1.12.1.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -321,34 +321,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/version-1.9.10.yaml b/pkg/userdata/ubuntu/testdata/version-1.9.10.yaml
index 6b408179..8dfd0f57 100644
--- a/pkg/userdata/ubuntu/testdata/version-1.9.10.yaml
+++ b/pkg/userdata/ubuntu/testdata/version-1.9.10.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -322,34 +322,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/vsphere-mirrors.yaml b/pkg/userdata/ubuntu/testdata/vsphere-mirrors.yaml
index 8ea0c7df..a70ae1a3 100644
--- a/pkg/userdata/ubuntu/testdata/vsphere-mirrors.yaml
+++ b/pkg/userdata/ubuntu/testdata/vsphere-mirrors.yaml
@@ -61,7 +61,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -146,7 +146,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -337,34 +337,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":["https://registry.docker-cn.com"]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"registry-mirrors":["https://registry.docker-cn.com"]}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/vsphere-proxy.yaml b/pkg/userdata/ubuntu/testdata/vsphere-proxy.yaml
index da957deb..4b6b1dff 100644
--- a/pkg/userdata/ubuntu/testdata/vsphere-proxy.yaml
+++ b/pkg/userdata/ubuntu/testdata/vsphere-proxy.yaml
@@ -61,7 +61,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -146,7 +146,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -337,34 +337,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"},"insecure-registries":["192.168.100.100:5000","10.0.0.1:5000"]}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/pkg/userdata/ubuntu/testdata/vsphere.yaml b/pkg/userdata/ubuntu/testdata/vsphere.yaml
index 3307df61..5f82c070 100644
--- a/pkg/userdata/ubuntu/testdata/vsphere.yaml
+++ b/pkg/userdata/ubuntu/testdata/vsphere.yaml
@@ -52,7 +52,7 @@ write_files:
 
 - path: "/etc/apt/sources.list.d/docker.list"
   permissions: "0644"
-  content: deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
+  content: deb https://download.docker.com/linux/ubuntu bionic stable
 
 - path: "/opt/docker.asc"
   permissions: "0400"
@@ -137,7 +137,7 @@ write_files:
     mv /etc/fstab.noswap /etc/fstab
     swapoff -a
 
-    export CR_PKG='docker-ce=5:18.09.2~3-0~ubuntu-bionic'
+    export CR_PKG='docker-ce=5:18.09.9~3-0~ubuntu-bionic'
 
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install -y \
       curl \
@@ -327,34 +327,48 @@ write_files:
 
 - path: "/etc/kubernetes/kubelet.conf"
   content: |
-    kind: KubeletConfiguration
     apiVersion: kubelet.config.k8s.io/v1beta1
-    cgroupDriver: systemd
-    clusterDomain: cluster.local
-    clusterDNS:
-      - "10.10.10.10"
-    rotateCertificates: true
-    podManifestPath: /etc/kubernetes/manifests
-    readOnlyPort: 0
-    featureGates:
-      RotateKubeletServerCertificate: true
-    serverTLSBootstrap: true
-    rotateCertificates: true
-    authorization:
-      mode: Webhook
     authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
       x509:
         clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
       webhook:
-        enabled: true
-      anonymous:
-        enabled: false
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.10.10.10
+    clusterDomain: cluster.local
+    cpuManagerReconcilePeriod: 0s
+    evictionPressureTransitionPeriod: 0s
+    featureGates:
+      RotateKubeletServerCertificate: true
+    fileCheckFrequency: 0s
+    httpCheckFrequency: 0s
+    imageMinimumGCAge: 0s
+    kind: KubeletConfiguration
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
     protectKernelDefaults: true
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    serverTLSBootstrap: true
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 0s
+
 
 - path: /etc/docker/daemon.json
   permissions: "0644"
   content: |
-    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","insecure-registries":[],"registry-mirrors":[]}
+    {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}
 
 - path: /etc/systemd/system/kubelet-healthcheck.service
   permissions: "0644"
diff --git a/test/e2e/provisioning/helper.go b/test/e2e/provisioning/helper.go
index 39ff12ad..1ac4e190 100644
--- a/test/e2e/provisioning/helper.go
+++ b/test/e2e/provisioning/helper.go
@@ -179,7 +179,7 @@ func testScenario(t *testing.T, testCase scenario, cloudProvider string, testPar
 	// we decided to keep this time lower that the global timeout to prevent the following:
 	// the global timeout is set to 20 minutes and the verify tool waits up to 60 hours for a machine to show up.
 	// thus one faulty scenario prevents from showing the results for the whole group, which is confusing because it looks like all tests are broken.
-	if err := testCase.executor(kubeConfig, manifestPath, scenarioParams, 25*time.Minute); err != nil {
+	if err := testCase.executor(kubeConfig, manifestPath, scenarioParams, 35*time.Minute); err != nil {
 		t.Errorf("verify failed due to error=%v", err)
 	}
 }
diff --git a/test/e2e/provisioning/testdata/machinedeployment-azure.yaml b/test/e2e/provisioning/testdata/machinedeployment-azure.yaml
index 30c4a38b..c0e29b09 100644
--- a/test/e2e/provisioning/testdata/machinedeployment-azure.yaml
+++ b/test/e2e/provisioning/testdata/machinedeployment-azure.yaml
@@ -30,7 +30,7 @@ spec:
             subscriptionID: "<< AZURE_SUBSCRIPTION_ID >>"
             location: "westeurope"
             resourceGroup: "machine-controller-e2e"
-            vmSize: "Standard_F1"
+            vmSize: "Standard_F2"
             # optional disk size values in GB. If not set, the defaults for the vmSize will be used.
             osDiskSize: 30
             dataDiskSize: 30