As discussed with @liggitt @deads2k and @pires on Slack, kubeadm should not make the API Server listen on localhost:8080 insecurely with root access.

scheduler and controller-manager talks to the API Server with their own credentials (client certs), ref: kubernetes/kubernetes#41897

For normal admin users, /etc/kubernetes/admin.conf, a KubeConfig file is generated with full access to the cluster.

This will dramatically reduce the attack area.