Subpath mounts in kubelet require more mount options to be
taken into account, which is still manageable without importing
a full mount command

Use a post-start-hook waiting for crd to be ready, then discover
the apiserver status by actually checking the healthz endpoint,
which accounts for post-start-hook success

Removing them does not improve performance significatively,
plus basic roles are actually needed for proper API
authorizations on non resource endpoints

See: https://github.com/containerd/containerd/issues/8984

Sandboxes plugin is mandatory and otherwise containerd clients fail
to discover the runtime service. Other plugins like streaming,
transfer and nri, are not enabled although they are included in
containerd 1.7.