diff --git a/classes/cluster/k8s-aio-calico/kubernetes/control.yml b/classes/cluster/k8s-aio-calico/kubernetes/control.yml
index dc719bd..cd49cca 100644
--- a/classes/cluster/k8s-aio-calico/kubernetes/control.yml
+++ b/classes/cluster/k8s-aio-calico/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.single
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server_single
 - system.salt.minion.cert.k8s_server_single
 - system.kubernetes.master.single
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-aio-calico.kubernetes.compute
 - cluster.k8s-aio-calico
 parameters:
diff --git a/classes/cluster/k8s-aio-contrail/kubernetes/control.yml b/classes/cluster/k8s-aio-contrail/kubernetes/control.yml
index 08791f1..c108c6e 100644
--- a/classes/cluster/k8s-aio-contrail/kubernetes/control.yml
+++ b/classes/cluster/k8s-aio-contrail/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-aio-contrail.kubernetes
 - cluster.k8s-aio-contrail.kubernetes.compute
 - cluster.overrides
diff --git a/classes/cluster/k8s-compact/kubernetes/control.yml b/classes/cluster/k8s-compact/kubernetes/control.yml
index 3a8012f..c0cc065 100644
--- a/classes/cluster/k8s-compact/kubernetes/control.yml
+++ b/classes/cluster/k8s-compact/kubernetes/control.yml
@@ -3,8 +3,8 @@
 - system.salt.minion.cert.k8s_server_single
 - service.etcd.server.single
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.kubernetes.master.single
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-compact.kubernetes.compute
 parameters:
   helm:
diff --git a/classes/cluster/k8s-ha-calico-cloudprovider/kubernetes/control.yml b/classes/cluster/k8s-ha-calico-cloudprovider/kubernetes/control.yml
index 5144fe6..6d70146 100644
--- a/classes/cluster/k8s-ha-calico-cloudprovider/kubernetes/control.yml
+++ b/classes/cluster/k8s-ha-calico-cloudprovider/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-ha-calico-cloudprovider.kubernetes.compute
 - cluster.k8s-ha-calico-cloudprovider
 parameters:
diff --git a/classes/cluster/k8s-ha-calico-flannel-virtlet/kubernetes/control.yml b/classes/cluster/k8s-ha-calico-flannel-virtlet/kubernetes/control.yml
index 6f6229c..9547241 100644
--- a/classes/cluster/k8s-ha-calico-flannel-virtlet/kubernetes/control.yml
+++ b/classes/cluster/k8s-ha-calico-flannel-virtlet/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-ha-calico-flannel-virtlet.kubernetes.compute
 - cluster.k8s-ha-calico-flannel-virtlet
 parameters:
diff --git a/classes/cluster/k8s-ha-calico-syndic/kubernetes/control.yml b/classes/cluster/k8s-ha-calico-syndic/kubernetes/control.yml
index 485b274..9785cc4 100644
--- a/classes/cluster/k8s-ha-calico-syndic/kubernetes/control.yml
+++ b/classes/cluster/k8s-ha-calico-syndic/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-ha-calico-syndic.kubernetes.compute
 - cluster.k8s-ha-calico-syndic
 parameters:
diff --git a/classes/cluster/k8s-ha-calico/kubernetes/control.yml b/classes/cluster/k8s-ha-calico/kubernetes/control.yml
index f685589..c6ccca6 100644
--- a/classes/cluster/k8s-ha-calico/kubernetes/control.yml
+++ b/classes/cluster/k8s-ha-calico/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-ha-calico.kubernetes.compute
 - cluster.k8s-ha-calico
 parameters:
diff --git a/classes/cluster/k8s-ha-contrail/kubernetes/control.yml b/classes/cluster/k8s-ha-contrail/kubernetes/control.yml
index 78cd765..5468b98 100644
--- a/classes/cluster/k8s-ha-contrail/kubernetes/control.yml
+++ b/classes/cluster/k8s-ha-contrail/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
 - cluster.k8s-ha-contrail.kubernetes.compute
 - cluster.k8s-ha-contrail
 parameters:
diff --git a/classes/cluster/sl-k8s-calico/kubernetes/control.yml b/classes/cluster/sl-k8s-calico/kubernetes/control.yml
index 9093496..0dc70b6 100644
--- a/classes/cluster/sl-k8s-calico/kubernetes/control.yml
+++ b/classes/cluster/sl-k8s-calico/kubernetes/control.yml
@@ -4,6 +4,8 @@
 - system.linux.system.repo.mcp.apt_mirantis.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
+- system.kubernetes.control.roles.fluentd-view
 - cluster.sl-k8s-calico.kubernetes.compute
 - cluster.sl-k8s-calico.infra
 - cluster.sl-k8s-calico
diff --git a/classes/cluster/sl-k8s-contrail/kubernetes/control.yml b/classes/cluster/sl-k8s-contrail/kubernetes/control.yml
index 2cf6932..7cd47fb 100644
--- a/classes/cluster/sl-k8s-contrail/kubernetes/control.yml
+++ b/classes/cluster/sl-k8s-contrail/kubernetes/control.yml
@@ -4,6 +4,8 @@
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
+- system.kubernetes.control.roles.fluentd-view
 - cluster.sl-k8s-contrail.kubernetes.compute
 - cluster.sl-k8s-contrail
 parameters:
diff --git a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml
index 250d608..3823e73 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml
@@ -1,11 +1,12 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
+- system.kubernetes.control.roles.fluentd-view
 - cluster.virtual-mcp11-k8s-calico-dyn.kubernetes.compute
 - cluster.virtual-mcp11-k8s-calico-dyn
 - cluster.overrides
diff --git a/classes/cluster/virtual-mcp11-k8s-calico-minimal/kubernetes/control.yml b/classes/cluster/virtual-mcp11-k8s-calico-minimal/kubernetes/control.yml
index aea660b..295bca6 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico-minimal/kubernetes/control.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico-minimal/kubernetes/control.yml
@@ -1,11 +1,11 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
 - cluster.virtual-mcp11-k8s-calico-minimal.kubernetes.compute
 - cluster.virtual-mcp11-k8s-calico-minimal
 - cluster.overrides
diff --git a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml
index 95462f1..b93fd2a 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml
@@ -1,11 +1,12 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.mcp.apt_mirantis.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
+- system.kubernetes.control.roles.fluentd-view
 - cluster.virtual-mcp11-k8s-calico.kubernetes.compute
 - cluster.virtual-mcp11-k8s-calico.infra
 - cluster.virtual-mcp11-k8s-calico
diff --git a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml
index 552047c..82d9206 100644
--- a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml
+++ b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml
@@ -1,11 +1,12 @@
 classes:
 - service.etcd.server.cluster
 - service.kubernetes.control.cluster
-- service.kubernetes.control.cluster-admin
 - system.haproxy.proxy.listen.kubernetes.apiserver
 - system.linux.system.repo.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
+- system.kubernetes.control.roles.cluster-admin
+- system.kubernetes.control.roles.fluentd-view
 - cluster.virtual-mcp11-k8s-contrail.kubernetes.compute
 - cluster.virtual-mcp11-k8s-contrail
 parameters:
diff --git a/classes/system b/classes/system
index 6cc775b..70e0c9e 160000
--- a/classes/system
+++ b/classes/system
@@ -1 +1 @@
-Subproject commit 6cc775ba29a97368865130b1cd678f7a267b9556
+Subproject commit 70e0c9ed7ac92701e5c750662f5761e2d4048d43