Subpath mounts in kubelet require more mount options to be
taken into account, which is still manageable without importing
a full mount command

Use a post-start-hook waiting for crd to be ready, then discover
the apiserver status by actually checking the healthz endpoint,
which accounts for post-start-hook success

Removing them does not improve performance significatively,
plus basic roles are actually needed for proper API
authorizations on non resource endpoints