https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #4 from Jan Chaloupka jchaloup@redhat.com --- kube-apiserver needs the directory as well (--cert-dir="/var/run/kubernetes") [1].
As kube-apiserver service is run under kube user and kubelet can be installed on the same host, the owner of the directory must be kube. Contrib is already covering that [2]. So, only the ownership of the directory is really missing.
[1] http://kubernetes.io/docs/admin/kube-apiserver/ [2] https://github.com/kubernetes/contrib/blob/master/init/systemd/tmpfiles.d/ku...