sys-cluster/kube-apiserver: security cleanup