diff --git a/cluster.yml b/cluster.yml
index 1b93addf4..d9b969641 100644
--- a/cluster.yml
+++ b/cluster.yml
@@ -4,9 +4,12 @@
   roles:
     - { role: download, tags: download }
 
-- hosts: k8s-cluster
+- hosts: etcd
   roles:
     - { role: etcd, tags: etcd }
+
+- hosts: k8s-cluster
+  roles:
     - { role: docker, tags: docker }
     - { role: dnsmasq, tags: dnsmasq }
     - { role: network_plugin, tags: ['calico', 'flannel', 'network'] }
diff --git a/roles/etcd/tasks/install.yml b/roles/etcd/tasks/install.yml
index f02dc93db..ac3522f4d 100644
--- a/roles/etcd/tasks/install.yml
+++ b/roles/etcd/tasks/install.yml
@@ -7,7 +7,7 @@
      src={{ local_release_dir }}/etcd/bin/{{ item }}
      dest={{ bin_dir }}
      owner=etcd
-     mode=u+x
+     mode=0755
   with_items:
     - etcdctl
     - etcd
diff --git a/roles/kubernetes/master/tasks/main.yml b/roles/kubernetes/master/tasks/main.yml
index d0aa31877..987c41c6e 100644
--- a/roles/kubernetes/master/tasks/main.yml
+++ b/roles/kubernetes/master/tasks/main.yml
@@ -9,7 +9,7 @@
      src={{ local_release_dir }}/kubernetes/bin/kubectl
      dest={{ bin_dir }}
      owner=kube
-     mode=u+x
+     mode=0755
 
 - name: populate users for basic auth in API
   lineinfile:
diff --git a/roles/kubernetes/node/tasks/install.yml b/roles/kubernetes/node/tasks/install.yml
index e1f45460a..6c0a75470 100644
--- a/roles/kubernetes/node/tasks/install.yml
+++ b/roles/kubernetes/node/tasks/install.yml
@@ -8,6 +8,6 @@
      src={{ local_release_dir }}/kubernetes/bin/kubelet
      dest={{ bin_dir }}
      owner=kube
-     mode=u+x
+     mode=0755
   notify:
     - restart kubelet
diff --git a/roles/network_plugin/tasks/calico.yml b/roles/network_plugin/tasks/calico.yml
index eba8967d1..4a935c5af 100644
--- a/roles/network_plugin/tasks/calico.yml
+++ b/roles/network_plugin/tasks/calico.yml
@@ -3,7 +3,7 @@
   copy:
      src={{ local_release_dir }}/calico/bin/calicoctl
      dest={{ bin_dir }}
-     mode=u+x
+     mode=0755
   notify: restart calico-node
 
 - name: Calico | Create calicoctl symlink (needed by kubelet)