Fix broken metrics-server deployment not starting (#4651)

* Fix metrics-server deployment

* Make metrics server work

* Fix sample inventory

roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2

@@ -32,6 +32,9 @@ spec:
         image: {{ metrics_server_image_repo }}:{{ metrics_server_image_tag }}
         command:
         - /metrics-server
+        - --logtostderr
+        - --cert-dir=/tmp
+        - --secure-port=8443
 {% if metrics_server_kubelet_preferred_address_types %}
         - --kubelet-preferred-address-types={{ metrics_server_kubelet_preferred_address_types }}
 {% endif %}
@@ -40,9 +43,12 @@ spec:
 {% endif %}
         - --metric-resolution={{ metrics_server_metric_resolution }}
         ports:
-        - containerPort: 443
+        - containerPort: 8443
           name: https
           protocol: TCP
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
         livenessProbe:
           httpGet:
             path: /healthz
@@ -55,23 +61,20 @@ spec:
         readinessProbe:
           httpGet:
             path: /healthz
-            port: 443
+            port: https
             scheme: HTTPS
           successThreshold: 1
           initialDelaySeconds: 20
           failureThreshold: 3
           timeoutSeconds: 10
         securityContext:
-          # Currently non root is not supported:
-          #   https://github.com/kubernetes-incubator/metrics-server/issues/37
-          #
-          # runAsNonRoot: true
-          # runAsUser: 65534
+          allowPrivilegeEscalation: false
           capabilities:
-            drop:
-            - ALL
-            add:
-            - NET_BIND_SERVICE
+            drop: ["all"]
+          readOnlyRootFilesystem: true
+          runAsGroup: 10001
+          runAsNonRoot: true
+          runAsUser: 10001
       - name: metrics-server-nanny
         image: {{ addon_resizer_image_repo }}:{{ addon_resizer_image_tag }}
         resources:
@@ -112,6 +115,8 @@ spec:
         - name: metrics-server-config-volume
           configMap:
             name: metrics-server-config
+        - name: tmp
+          emptyDir: {}
 {% if not masters_are_not_tainted %}
       tolerations:
         - key: node-role.kubernetes.io/master