diff --git a/cluster/saltbase/salt/kube-controller-manager/default b/cluster/saltbase/salt/kube-controller-manager/default
deleted file mode 100644
index baf8efb3633..00000000000
--- a/cluster/saltbase/salt/kube-controller-manager/default
+++ /dev/null
@@ -1,58 +0,0 @@
-{% set daemon_args = "$DAEMON_ARGS" -%}
-{% if grains['os_family'] == 'RedHat' -%}
-	{% set daemon_args = "" -%}
-{% endif -%}
-
-{% set master="--master=127.0.0.1:8080" -%}
-
-{% set machines = ""-%}
-{% set cluster_name = "" -%}
-{% set minion_regexp = "--minion_regexp=.*" -%}
-{% set sync_nodes = "--sync_nodes=true" -%}
-
-{% if pillar['node_instance_prefix'] is defined -%}
-  {% set minion_regexp = "--minion_regexp='" + pillar['node_instance_prefix'] + ".*'" -%}
-{% endif -%}
-{% if pillar['instance_prefix'] is defined -%}
-  {% set cluster_name = "--cluster_name=" + pillar['instance_prefix'] -%}
-{% endif -%}
-
-{% set cloud_provider = "" -%}
-{% set cloud_config = "" -%}
-
-{% if grains.cloud is defined -%}
-{% set cloud_provider = "--cloud_provider=" + grains.cloud -%}
-
-{% if grains.cloud == 'gce' -%}
-  {% if grains.cloud_config is defined -%}
-    {% set cloud_config = "--cloud_config=" + grains.cloud_config -%}
-  {% endif -%}
-
-{% elif grains.cloud == 'aws' -%}
-  {% if grains.cloud_config is defined -%}
-    {% set cloud_config = "--cloud_config=" + grains.cloud_config -%}
-  {% endif -%}
-  {% set machines = "--machines=" + ','.join(salt['mine.get']('roles:kubernetes-pool', 'network.ip_addrs', expr_form='grain').keys()) -%}
-
-{% elif grains.cloud == 'azure' -%}
-  MACHINES="{{ salt['mine.get']('roles:kubernetes-pool', 'grains.items', expr_form='grain').values()|join(',', attribute='hostnamef') }}"
-  {% set machines = "--machines=$MACHINES" -%}
-
-{% elif grains.cloud == 'vsphere' -%}
-  # Collect IPs of minions as machines list.
-  #
-  # Use a bash array to build the value we need. Jinja 2.7 does support a 'map'
-  # filter that would simplify this.  However, some installations (specifically
-  # Debian Wheezy) only install Jinja 2.6.
-  MACHINE_IPS=()
-  {% for addrs in salt['mine.get']('roles:kubernetes-pool', 'network.ip_addrs', expr_form='grain').values() -%}
-  MACHINE_IPS+=( {{ addrs[0] }} )
-  {% endfor -%}
-  {% set machines = "--machines=$(echo ${MACHINE_IPS[@]} | xargs -n1 echo | paste -sd,)" -%}
-  {% set minion_regexp = "" -%}
-
-{% endif -%} # grains.cloud switch
-
-{% endif -%} # grains.cloud is defined
-
-DAEMON_ARGS="{{daemon_args}} {{master}} {{machines}} {{cluster_name}} {{ minion_regexp }} {{ cloud_provider }} {{ sync_nodes }} {{ cloud_config }} {{pillar['log_level']}}"
diff --git a/cluster/saltbase/salt/kube-controller-manager/init.sls b/cluster/saltbase/salt/kube-controller-manager/init.sls
index 1857e1ded2d..a80f0e9ad1d 100644
--- a/cluster/saltbase/salt/kube-controller-manager/init.sls
+++ b/cluster/saltbase/salt/kube-controller-manager/init.sls
@@ -1,60 +1,15 @@
-{% if grains['os_family'] == 'RedHat' %}
-{% set environment_file = '/etc/sysconfig/kube-controller-manager' %}
-{% else %}
-{% set environment_file = '/etc/default/kube-controller-manager' %}
-{% endif %}
-
-{{ environment_file }}:
+/etc/kubernetes/manifests/kube-controller-manager.manifest:
   file.managed:
-    - source: salt://kube-controller-manager/default
+    - source: salt://kube-controller-manager/kube-controller-manager.manifest
     - template: jinja
     - user: root
     - group: root
     - mode: 644
+    - makedirs: true
+    - dir_mode: 755
 
-/usr/local/bin/kube-controller-manager:
-  file.managed:
-    - source: salt://kube-bins/kube-controller-manager
-    - user: root
-    - group: root
-    - mode: 755
-
-{% if grains['os_family'] == 'RedHat' %}
-
-/usr/lib/systemd/system/kube-controller-manager.service:
-  file.managed:
-    - source: salt://kube-controller-manager/kube-controller-manager.service
-    - user: root
-    - group: root
-
-{% else %}
-
-/etc/init.d/kube-controller-manager:
-  file.managed:
-    - source: salt://kube-controller-manager/initd
-    - user: root
-    - group: root
-    - mode: 755
-
-{% endif %}
-
-kube-controller-manager:
-  group.present:
-    - system: True
-  user.present:
-    - system: True
-    - gid_from_name: True
-    - shell: /sbin/nologin
-    - home: /var/kube-controller-manager
-    - require:
-      - group: kube-controller-manager
-  service.running:
-    - enable: True
-    - watch:
-      - file: /usr/local/bin/kube-controller-manager
-      - file: {{ environment_file }}
-{% if grains['os_family'] != 'RedHat' %}
-      - file: /etc/init.d/kube-controller-manager
-{% endif %}
-
+stop-legacy-kube_controller_manager:
+  service.dead:
+    - name: kube-controller-manager
+    - enable: None
 
diff --git a/cluster/saltbase/salt/kube-controller-manager/initd b/cluster/saltbase/salt/kube-controller-manager/initd
deleted file mode 100644
index 7cd2500008f..00000000000
--- a/cluster/saltbase/salt/kube-controller-manager/initd
+++ /dev/null
@@ -1,120 +0,0 @@
-#!/bin/bash
-#
-### BEGIN INIT INFO
-# Provides:    kube-controller-manager
-# Required-Start:    $local_fs $network $syslog
-# Required-Stop:
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: The Kubernetes controller manager
-# Description:
-#   The Kubernetes controller manager is responsible for monitoring replication
-#   controllers, and creating corresponding pods to achieve the desired state.
-### END INIT INFO
-
-
-# PATH should only include /usr/* if it runs after the mountnfs.sh script
-PATH=/sbin:/usr/sbin:/bin:/usr/bin
-DESC="The Kubernetes container manager"
-NAME=kube-controller-manager
-DAEMON=/usr/local/bin/kube-controller-manager
-DAEMON_ARGS=""
-DAEMON_LOG_FILE=/var/log/$NAME.log
-PIDFILE=/var/run/$NAME.pid
-SCRIPTNAME=/etc/init.d/$NAME
-DAEMON_USER=kube-controller-manager
-
-# Exit if the package is not installed
-[ -x "$DAEMON" ] || exit 0
-
-# Read configuration variable file if it is present
-[ -r /etc/default/$NAME ] && . /etc/default/$NAME
-
-# Define LSB log_* functions.
-# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
-# and status_of_proc is working.
-. /lib/lsb/init-functions
-
-#
-# Function that starts the daemon/service
-#
-do_start()
-{
-        # Return
-        #   0 if daemon has been started
-        #   1 if daemon was already running
-        #   2 if daemon could not be started
-        start-stop-daemon --start --quiet --background --no-close \
-                --make-pidfile --pidfile $PIDFILE \
-                --exec $DAEMON -c $DAEMON_USER --test > /dev/null \
-                || return 1
-        start-stop-daemon --start --quiet --background --no-close \
-                --make-pidfile --pidfile $PIDFILE \
-                --exec $DAEMON -c $DAEMON_USER -- \
-                $DAEMON_ARGS >> $DAEMON_LOG_FILE 2>&1 \
-                || return 2
-}
-
-#
-# Function that stops the daemon/service
-#
-do_stop()
-{
-        # Return
-        #   0 if daemon has been stopped
-        #   1 if daemon was already stopped
-        #   2 if daemon could not be stopped
-        #   other if a failure occurred
-        start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --exec $DAEMON
-        RETVAL="$?"
-        [ "$RETVAL" = 2 ] && return 2
-        # Many daemons don't delete their pidfiles when they exit.
-        rm -f $PIDFILE
-        return "$RETVAL"
-}
-
-
-case "$1" in
-  start)
-        log_daemon_msg "Starting $DESC" "$NAME"
-        do_start
-        case "$?" in
-                0|1) log_end_msg 0 || exit 0 ;;
-                2) log_end_msg 1 || exit 1 ;;
-        esac
-        ;;
-  stop)
-        log_daemon_msg "Stopping $DESC" "$NAME"
-        do_stop
-        case "$?" in
-                0|1) log_end_msg 0 ;;
-                2) exit 1 ;;
-        esac
-        ;;
-  status)
-        status_of_proc -p $PIDFILE "$DAEMON" "$NAME" && exit 0 || exit $?
-        ;;
-
-  restart|force-reload)
-        log_daemon_msg "Restarting $DESC" "$NAME"
-        do_stop
-        case "$?" in
-          0|1)
-                do_start
-                case "$?" in
-                        0) log_end_msg 0 ;;
-                        1) log_end_msg 1 ;; # Old process is still running
-                        *) log_end_msg 1 ;; # Failed to start
-                esac
-                ;;
-          *)
-                # Failed to stop
-                log_end_msg 1
-                ;;
-        esac
-        ;;
-  *)
-        echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
-        exit 3
-        ;;
-esac
diff --git a/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest b/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest
new file mode 100644
index 00000000000..ff22da0b156
--- /dev/null
+++ b/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest
@@ -0,0 +1,140 @@
+{% set machines = ""-%}
+{% set cluster_name = "" -%}
+{% set minion_regexp = "--minion_regexp=.*" -%}
+{% set sync_nodes = "--sync_nodes=true" -%}
+
+{% if pillar['node_instance_prefix'] is defined -%}
+  {% set minion_regexp = "--minion_regexp='" + pillar['node_instance_prefix'] + ".*'" -%}
+{% endif -%}
+{% if pillar['instance_prefix'] is defined -%}
+  {% set cluster_name = "--cluster_name=" + pillar['instance_prefix'] -%}
+{% endif -%}
+
+{% set cloud_provider = "" -%}
+{% set cloud_config = "" -%}
+
+{% if grains.cloud is defined -%}
+{% set cloud_provider = "--cloud_provider=" + grains.cloud -%}
+
+{% if grains.cloud == 'gce' -%}
+  {% if grains.cloud_config is defined -%}
+    {% set cloud_config = "--cloud_config=" + grains.cloud_config -%}
+  {% endif -%}
+
+{% elif grains.cloud == 'aws' -%}
+  {% if grains.cloud_config is defined -%}
+    {% set cloud_config = "--cloud_config=" + grains.cloud_config -%}
+  {% endif -%}
+  {% set machines = "--machines=" + ','.join(salt['mine.get']('roles:kubernetes-pool', 'network.ip_addrs', expr_form='grain').keys()) -%}
+
+{% elif grains.cloud == 'azure' -%}
+  {% set machines = "--machines=" + salt['mine.get']('roles:kubernetes-pool', 'grains.items', expr_form='grain').values()|join(',', attribute='hostnamef') -%}
+
+{% elif grains.cloud == 'vsphere' -%}
+  # Collect IPs of minions as machines list.
+  {% set machines= "" -%}
+  {% for addrs in salt['mine.get']('roles:kubernetes-pool', 'network.ip_addrs', expr_form='grain').values() -%}
+    {% if loop.first -%}
+      machines="--machines=";
+    {% endif -%}
+    {% set machines = machines + addrs[0] %}
+    {% if not loop.last -%}
+      {% set machines = machines + "," %}
+    {% endif -%}
+  {% endfor -%}
+  {% set minion_regexp = "" -%}
+
+{% endif -%}
+{% endif -%}
+
+{
+"apiVersion": "v1beta3",
+"kind": "Pod",
+"metadata": {"name":"kube-controller-manager"},
+"spec":{
+"hostNetwork": true,
+"containers":[
+    {
+    "name": "kube-controller-manager",
+    "image": "gcr.io/google_containers/kube-controller-manager:{{pillar['kube-controller-manager_docker_tag']}}",
+    "command": [
+                 "/kube-controller-manager",
+                 "--master=127.0.0.1:8080",
+                 "{{machines}}",
+                 "{{cluster_name}}",
+                 "{{minion_regexp}}",
+                 "{{cloud_provider}}",
+                 "{{sync_nodes}}",
+                 "{{cloud_config}}",
+                 "{{pillar['log_level']}}"
+               ],
+    "volumeMounts": [
+        { "name": "srvkube",
+        "mountPath": "/srv/kubernetes",
+        "readOnly": true},
+        { "name": "etcssl",
+        "mountPath": "/etc/ssl",
+        "readOnly": true},
+        { "name": "usrsharessl",
+        "mountPath": "/usr/share/ssl",
+        "readOnly": true},
+        { "name": "varssl",
+        "mountPath": "/var/ssl",
+        "readOnly": true},
+        { "name": "usrssl",
+        "mountPath": "/usr/ssl",
+        "readOnly": true},
+        { "name": "usrlibssl",
+        "mountPath": "/usr/lib/ssl",
+        "readOnly": true},
+        { "name": "usrlocalopenssl",
+        "mountPath": "/usr/local/openssl",
+        "readOnly": true},
+        { "name": "etcopenssl",
+        "mountPath": "/etc/openssl",
+        "readOnly": true},
+        { "name": "etcpkitls",
+        "mountPath": "/etc/pki/tls",
+        "readOnly": true}
+      ]
+    }
+],
+"volumes":[
+  { "name": "srvkube",
+    "hostPath": {
+        "path": "/srv/kubernetes"}
+  },
+  { "name": "etcssl",
+    "hostPath": {
+        "path": "/etc/ssl"}
+  },
+  { "name": "usrsharessl",
+    "hostPath": {
+        "path": "/usr/share/ssl"}
+  },
+  { "name": "varssl",
+    "hostPath": {
+        "path": "/var/ssl"}
+  },
+  { "name": "usrssl",
+    "hostPath": {
+        "path": "/usr/ssl"}
+  },
+  { "name": "usrlibssl",
+    "hostPath": {
+        "path": "/usr/lib/ssl"}
+  },
+  { "name": "usrlocalopenssl",
+    "hostPath": {
+        "path": "/usr/local/openssl"}
+  },
+  { "name": "etcopenssl",
+    "hostPath": {
+        "path": "/etc/openssl"}
+  },
+  { "name": "etcpkitls",
+    "hostPath": {
+        "path": "/etc/pki/tls"}
+  }
+]
+}}
diff --git a/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.service b/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.service
deleted file mode 100644
index fb8ab9a8291..00000000000
--- a/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.service
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=Kubernetes Controller Manager
-Documentation=https://github.com/GoogleCloudPlatform/kubernetes
-
-[Service]
-EnvironmentFile=-/etc/sysconfig/kube-controller-manager
-ExecStart=/usr/local/bin/kube-controller-manager "$DAEMON_ARGS"
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target
diff --git a/cluster/vagrant/util.sh b/cluster/vagrant/util.sh
index f18975ecf3a..33340c93d07 100644
--- a/cluster/vagrant/util.sh
+++ b/cluster/vagrant/util.sh
@@ -179,7 +179,7 @@ function verify-cluster {
   # verify master has all required daemons
   echo "Validating master"
   local machine="master"
-  local -a required_daemon=("salt-master" "salt-minion" "nginx" "kube-controller-manager" "kubelet")
+  local -a required_daemon=("salt-master" "salt-minion" "nginx" "kubelet")
   local validated="1"
   until [[ "$validated" == "0" ]]; do
     validated="0"