diff --git a/nodeup/pkg/model/tests/protokube/containerd/tasks-protokube.yaml b/nodeup/pkg/model/tests/protokube/containerd/tasks-protokube.yaml
index e129f6bf68..84703a3d38 100644
--- a/nodeup/pkg/model/tests/protokube/containerd/tasks-protokube.yaml
+++ b/nodeup/pkg/model/tests/protokube/containerd/tasks-protokube.yaml
@@ -86,7 +86,7 @@ definition: |
   ExecStartPre=/bin/true
   ExecStartPre=-/usr/bin/ctr --namespace k8s.io container rm protokube
   ExecStartPre=/bin/true
-  ExecStart=/usr/bin/ctr --namespace k8s.io run --net-host --with-ns pid:/proc/1/ns/pid --privileged --mount type=bind,src=/,dst=/rootfs,options=rbind:rslave --mount type=bind,src=/var/run/dbus,dst=/var/run/dbus,options=rbind:rprivate --mount type=bind,src=/run/systemd,dst=/run/systemd,options=rbind:rprivate --env KUBECONFIG=/rootfs/var/lib/kops/kubeconfig --mount type=bind,src=/usr/local/bin,dst=/opt/kops/bin,options=rbind:ro:rprivate --env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/kops/bin docker.io/library/protokube image name protokube /usr/bin/protokube --bootstrap-master-node-labels=true --cloud=aws --containerized=true --dns-internal-suffix=.internal.minimal.example.com --dns=aws-route53 --etcd-backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd/main --etcd-image=k8s.gcr.io/etcd:3.4.3 --initialize-rbac=true --manage-etcd=true --master=true --node-name=master.hostname.invalid --peer-ca=/srv/kubernetes/ca.crt --peer-cert=/srv/kubernetes/etcd-peer.pem --peer-key=/srv/kubernetes/etcd-peer-key.pem --tls-auth=true --tls-ca=/srv/kubernetes/ca.crt --tls-cert=/srv/kubernetes/etcd.pem --tls-key=/srv/kubernetes/etcd-key.pem --v=4 --zone=*/Z1AFAKE1ZON3YO
+  ExecStart=/usr/bin/ctr --namespace k8s.io run --net-host --with-ns pid:/proc/1/ns/pid --privileged --mount type=bind,src=/,dst=/rootfs,options=rbind:rslave --env KUBECONFIG=/rootfs/var/lib/kops/kubeconfig --mount type=bind,src=/bin,dst=/bin,options=rbind:ro:rprivate --mount type=bind,src=/lib,dst=/lib,options=rbind:ro:rprivate --mount type=bind,src=/lib64,dst=/lib64,options=rbind:ro:rprivate --mount type=bind,src=/sbin,dst=/sbin,options=rbind:ro:rprivate --mount type=bind,src=/usr/bin,dst=/usr/bin,options=rbind:ro:rprivate --mount type=bind,src=/var/run/dbus,dst=/var/run/dbus,options=rbind:rprivate --mount type=bind,src=/run/systemd,dst=/run/systemd,options=rbind:rprivate --mount type=bind,src=/usr/local/bin,dst=/opt/kops/bin,options=rbind:ro:rprivate --env PATH=/opt/kops/bin:/usr/bin:/sbin:/bin docker.io/library/protokube image name protokube /protokube --bootstrap-master-node-labels=true --cloud=aws --containerized=true --dns-internal-suffix=.internal.minimal.example.com --dns=aws-route53 --etcd-backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd/main --etcd-image=k8s.gcr.io/etcd:3.4.3 --initialize-rbac=true --manage-etcd=true --master=true --node-name=master.hostname.invalid --peer-ca=/srv/kubernetes/ca.crt --peer-cert=/srv/kubernetes/etcd-peer.pem --peer-key=/srv/kubernetes/etcd-peer-key.pem --tls-auth=true --tls-ca=/srv/kubernetes/ca.crt --tls-cert=/srv/kubernetes/etcd.pem --tls-key=/srv/kubernetes/etcd-key.pem --v=4 --zone=*/Z1AFAKE1ZON3YO
   Restart=always
   RestartSec=2s
   StartLimitInterval=0
diff --git a/nodeup/pkg/model/tests/protokube/docker/cluster.yaml b/nodeup/pkg/model/tests/protokube/docker/cluster.yaml
index d2acdf03c9..243537533b 100644
--- a/nodeup/pkg/model/tests/protokube/docker/cluster.yaml
+++ b/nodeup/pkg/model/tests/protokube/docker/cluster.yaml
@@ -47,7 +47,7 @@ apiVersion: kops.k8s.io/v1alpha2
 kind: InstanceGroup
 metadata:
   creationTimestamp: "2016-12-10T22:42:28Z"
-  name: nodes
+  name: master-1a
   labels:
     kops.k8s.io/cluster: minimal.example.com
 spec:
@@ -56,6 +56,6 @@ spec:
   machineType: t2.medium
   maxSize: 2
   minSize: 2
-  role: Node
+  role: Master
   subnets:
   - us-test-1a
diff --git a/nodeup/pkg/model/tests/protokube/docker/tasks-protokube.yaml b/nodeup/pkg/model/tests/protokube/docker/tasks-protokube.yaml
index 8bb1bb124c..7763ff9d4d 100644
--- a/nodeup/pkg/model/tests/protokube/docker/tasks-protokube.yaml
+++ b/nodeup/pkg/model/tests/protokube/docker/tasks-protokube.yaml
@@ -1,3 +1,76 @@
+contents:
+  task:
+    CA:
+      task:
+        Name: kops
+        signer: ca
+        subject:
+          CommonName: kops
+          Organization:
+          - system:masters
+        type: client
+    Cert:
+      task:
+        Name: kops
+        signer: ca
+        subject:
+          CommonName: kops
+          Organization:
+          - system:masters
+        type: client
+    Key:
+      task:
+        Name: kops
+        signer: ca
+        subject:
+          CommonName: kops
+          Organization:
+          - system:masters
+        type: client
+    Name: kops
+    ServerURL: https://127.0.0.1
+mode: "0400"
+path: /var/lib/kops/kubeconfig
+type: file
+---
+Name: kops
+signer: ca
+subject:
+  CommonName: kops
+  Organization:
+  - system:masters
+type: client
+---
+CA:
+  task:
+    Name: kops
+    signer: ca
+    subject:
+      CommonName: kops
+      Organization:
+      - system:masters
+    type: client
+Cert:
+  task:
+    Name: kops
+    signer: ca
+    subject:
+      CommonName: kops
+      Organization:
+      - system:masters
+    type: client
+Key:
+  task:
+    Name: kops
+    signer: ca
+    subject:
+      CommonName: kops
+      Organization:
+      - system:masters
+    type: client
+Name: kops
+ServerURL: https://127.0.0.1
+---
 Hash: ""
 Name: protokube
 Runtime: docker
@@ -13,7 +86,7 @@ definition: |
   ExecStartPre=-/usr/bin/docker stop protokube
   ExecStartPre=-/usr/bin/docker rm protokube
   ExecStartPre=/bin/true
-  ExecStart=/usr/bin/docker run --net=host --pid=host --privileged --volume /:/rootfs/ --volume /var/run/dbus:/var/run/dbus --volume /run/systemd:/run/systemd --env KUBECONFIG=/rootfs/var/lib/kops/kubeconfig --name protokube protokube image name /usr/bin/protokube --bootstrap-master-node-labels=true --cloud=aws --containerized=true --dns-internal-suffix=internal.minimal.k8s.local --dns=gossip --etcd-backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd/main --etcd-image=k8s.gcr.io/etcd:3.4.3 --initialize-rbac=true --manage-etcd=true --master=false --node-name=master.override.invalid --peer-ca=/srv/kubernetes/ca.crt --peer-cert=/srv/kubernetes/etcd-peer.pem --peer-key=/srv/kubernetes/etcd-peer-key.pem --tls-auth=true --tls-ca=/srv/kubernetes/ca.crt --tls-cert=/srv/kubernetes/etcd.pem --tls-key=/srv/kubernetes/etcd-key.pem --v=4 --zone=*/Z1AFAKE1ZON3YO
+  ExecStart=/usr/bin/docker run --net=host --pid=host --privileged --volume /:/rootfs --env KUBECONFIG=/rootfs/var/lib/kops/kubeconfig --volume /bin:/bin:ro --volume /lib:/lib:ro --volume /lib64:/lib64:ro --volume /sbin:/sbin:ro --volume /usr/bin:/usr/bin:ro --volume /var/run/dbus:/var/run/dbus --volume /run/systemd:/run/systemd --volume /usr/local/bin:/opt/kops/bin:ro --env PATH=/opt/kops/bin:/usr/bin:/sbin:/bin --name protokube protokube image name /protokube --bootstrap-master-node-labels=true --cloud=aws --containerized=true --dns-internal-suffix=internal.minimal.k8s.local --dns=gossip --etcd-backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd/main --etcd-image=k8s.gcr.io/etcd:3.4.3 --initialize-rbac=true --manage-etcd=true --master=true --node-name=master.override.invalid --peer-ca=/srv/kubernetes/ca.crt --peer-cert=/srv/kubernetes/etcd-peer.pem --peer-key=/srv/kubernetes/etcd-peer-key.pem --tls-auth=true --tls-ca=/srv/kubernetes/ca.crt --tls-cert=/srv/kubernetes/etcd.pem --tls-key=/srv/kubernetes/etcd-key.pem --v=4 --zone=*/Z1AFAKE1ZON3YO
   Restart=always
   RestartSec=2s
   StartLimitInterval=0