Use a post-start-hook waiting for crd to be ready, then discover
the apiserver status by actually checking the healthz endpoint,
which accounts for post-start-hook success

Removing them does not improve performance significatively,
plus basic roles are actually needed for proper API
authorizations on non resource endpoints

Now master services (scheduler and controller manager) all authenticate
using the master bearer token. This goes against the least privilege
principle but those run in the same process as the master itself, so
very little harm is to expect from this simplification.