Comments addressed and PR updated. ptal.

LGTM
can be merged during business hours.

I didn't test the container with the readonly mounts, but I am guessing that Brendan manually verified it.

updated, to actually activate the container via Salt.

Please wait to merge tomorrow, I want to run e2e. Will ping this PR when I have a passing e2e.

Are you introducing this for gce only as a rollout strategy ? or is this change only for gce ?

yes, only gce is a rollout strategy. I'll move to AWS and others next.

Ok, this now passes e2e. I actually added back in the install of the nginx .deb since it provides much of the /etc/nginx/... (e.g. mime types) files that we rely on. We should really package all of this except the kubernetes site in the container image, but deferring that to a different PR (or when we eliminate nginx)

ptal.

Thanks!
--brendan

LGTM except I wish we have a Makefile introduced, so that we could track the versions of all bundled components including nginx here.

To do this, you can simple convert the README file to a Makefile.

Also have you make sure cluster upgrade works too?

@brendanburns You would need to disable service explicitly for gce so that nginx in a pod, can start successfully.

@dchen1107
Makefile added.
Tested upgrade with:

git checkout master
make clean; make quick-release
cluster/kube-up.sh

git checkout nginx
make clean; make quick-release
cluster/kube-push.sh

And validate that the cluster came up ok in both cases.

@ArtfulCoder nginx disabled by salt.

ptal.
THanks
--brendan

Fixed after problems pointed out by @ArtfulCoder over IM.

LGTM

Great! one more step move forward for #5011.

@brendanburns can we roll this out for other cloud providers too ?

#6618

never mind.
we are getting rid of nginx