{ config, pkgs, ... }:

{
  services.kube-controller-manager = {
    enable = true;
    contention-profiling = true;
    profiling = true;
    enable-leader-migration = true;
    leader-migration-config = ./kube-controller-manager.nix;
    allocate-node-cidrs = true;
    cidr-allocator-type = "[cidr-allocator-type]";
    cloud-config = ./kube-controller-manager.nix;
    cloud-provider = "[cloud-provider]";
    cluster-cidr = "[cluster-cidr]";
    cluster-name = "[cluster-name]";
    configure-cloud-routes = true;
    controller-start-interval = "[controller-start-interval]";
    controllers = [ "foo" "-bar" "*" ];
    external-cloud-volume-plugin = "[external-cloud-volume-plugin]";
    feature-gates = [ "feature1" "feature2" ];
    kube-api-burst = 1;
    kube-api-content-type = "[kube-api-content-type]";
    kube-api-qps = 0.1;
    leader-elect = true;
    leader-elect-lease-duration = "[leader-elect-lease-duration]";
    leader-elect-renew-deadline = "[leader-elect-renew-deadline]";
    leader-elect-resource-lock = "configmapsleases";
    leader-elect-resource-name = "[leader-elect-resource-name]";
    leader-elect-resource-namespace = "[leader-elect-resource-namespace]";
    leader-elect-retry-period = "[leader-elect-retry-period]";
    min-resync-period = "[min-resync-period]";
    node-monitor-period = "[node-monitor-period]";
    route-reconciliation-period = "[route-reconciliation-period]";
    use-service-account-credentials = true;
    concurrent-service-syncs = 2;
    bind-address = "[bind-address]";
    cert-dir = ./.;
    http2-max-streams-per-connection = 3;
    permit-address-sharing = true;
    permit-port-sharing = true;
    secure-port = 4;
    tls-cert-file = ./kube-controller-manager.nix;
    tls-cipher-suites = [ "cipher1" "cipher2" "cipher3" ];
    tls-min-version = "VersionTLS11";
    tls-private-key-file = ./kube-controller-manager.nix;
    tls-sni-cert-key = [ "example.crt,example.key" "foo.crt,foo.key:*.foo.com,foo.com" ];
    authentication-kubeconfig = ./kube-controller-manager.nix;
    authentication-skip-lookup = true;
    authentication-token-webhook-cache-ttl = "[authentication-token-webhook-cache-ttl]";
    authentication-tolerate-lookup-failure = true;
    client-ca-file = ./kube-controller-manager.nix;
    requestheader-allowed-names = [ "name1" "name2" ];
    requestheader-client-ca-file = ./kube-controller-manager.nix;
    requestheader-extra-headers-prefix = [ "prefix1" "prefix2" ];
    requestheader-group-headers = [ "groupHeader1" "groupHeader2" ];
    requestheader-username-headers = [ "usernameHeader1" "usernameHeader2" "usernameHeader3" "usernameHeader4" ];
    authorization-always-allow-paths = [ "/healthz" "/readyz" "/livez" ];
    authorization-kubeconfig = ./kube-controller-manager.nix;
    authorization-webhook-cache-authorized-ttl = "[authorization-webhook-cache-authorized-ttl]";
    authorization-webhook-cache-unauthorized-ttl = "[authorization-webhook-cache-unauthorized-ttl]";
    attach-detach-reconcile-sync-period = "[attach-detach-reconcile-sync-period]";
    disable-attach-detach-reconcile-sync = true;
    cluster-signing-cert-file = ./kube-controller-manager.nix;
    cluster-signing-duration = "[cluster-signing-duration]";
    cluster-signing-key-file = ./kube-controller-manager.nix;
    cluster-signing-kube-apiserver-client-cert-file = ./kube-controller-manager.nix;
    cluster-signing-kube-apiserver-client-key-file = ./kube-controller-manager.nix;
    cluster-signing-kubelet-client-cert-file = ./kube-controller-manager.nix;
    cluster-signing-kubelet-client-key-file = ./kube-controller-manager.nix;
    cluster-signing-kubelet-serving-cert-file = ./kube-controller-manager.nix;
    cluster-signing-kubelet-serving-key-file = ./kube-controller-manager.nix;
    cluster-signing-legacy-unknown-cert-file = ./kube-controller-manager.nix;
    cluster-signing-legacy-unknown-key-file = ./kube-controller-manager.nix;
    concurrent-deployment-syncs = 5;
    concurrent-statefulset-syncs = 6;
    concurrent-endpoint-syncs = 7;
    endpoint-updates-batch-period = "[endpoint-updates-batch-period]";
    concurrent-service-endpoint-syncs = 8;
    endpointslice-updates-batch-period = "[endpointslice-updates-batch-period]";
    max-endpoints-per-slice = 9;
    mirroring-concurrent-service-endpoint-syncs = 10;
    mirroring-endpointslice-updates-batch-period = "[mirroring-endpointslice-updates-batch-period]";
    mirroring-max-endpoints-per-subset = 11;
    concurrent-ephemeralvolume-syncs = 12;
    concurrent-gc-syncs = 13;
    enable-garbage-collector = true;
    concurrent-horizontal-pod-autoscaler-syncs = 14;
    horizontal-pod-autoscaler-cpu-initialization-period = "[horizontal-pod-autoscaler-cpu-initialization-period]";
    horizontal-pod-autoscaler-downscale-stabilization = "[horizontal-pod-autoscaler-downscale-stabilization]";
    horizontal-pod-autoscaler-initial-readiness-delay = "[horizontal-pod-autoscaler-initial-readiness-delay]";
    horizontal-pod-autoscaler-sync-period = "[horizontal-pod-autoscaler-sync-period]";
    horizontal-pod-autoscaler-tolerance = 0.2;
    concurrent-job-syncs = 15;
    concurrent-cron-job-syncs = 16;
    legacy-service-account-token-clean-up-period = "[legacy-service-account-token-clean-up-period]";
    concurrent-namespace-syncs = 17;
    namespace-sync-period = "[namespace-sync-period]";
    node-cidr-mask-size = 18;
    node-cidr-mask-size-ipv4 = 19;
    node-cidr-mask-size-ipv6 = 20;
    service-cluster-ip-range = "[service-cluster-ip-range]";
    large-cluster-size-threshold = "[large-cluster-size-threshold]";
    node-eviction-rate = 0.3;
    node-monitor-grace-period = "[node-monitor-grace-period]";
    node-startup-grace-period = "[node-startup-grace-period]";
    secondary-node-eviction-rate = 0.4;
    unhealthy-zone-threshold = 0.5;
    enable-dynamic-provisioning = true;
    enable-hostpath-provisioner = true;
    flex-volume-plugin-dir = ./.;
    pv-recycler-increment-timeout-nfs = 21;
    pv-recycler-minimum-timeout-hostpath = 22;
    pv-recycler-minimum-timeout-nfs = 23;
    pv-recycler-pod-template-filepath-hostpath = ./kube-controller-manager.nix;
    pv-recycler-pod-template-filepath-nfs = ./kube-controller-manager.nix;
    pv-recycler-timeout-increment-hostpath = 24;
    pvclaimbinder-sync-period = "[pvclaimbinder-sync-period]";
    terminated-pod-gc-threshold = 25;
    concurrent-replicaset-syncs = 26;
    concurrent-rc-syncs = 27;
    concurrent-resource-quota-syncs = 28;
    resource-quota-sync-period = "[resource-quota-sync-period]";
    concurrent-serviceaccount-token-syncs = 29;
    root-ca-file = ./kube-controller-manager.nix;
    service-account-private-key-file = ./kube-controller-manager.nix;
    concurrent-ttl-after-finished-syncs = 30;
    concurrent-validating-admission-policy-status-syncs = 31;
    allow-metric-labels = [ "metric1,label1='v1,v2,v3'" "metric1,label2='v1,v2,v3'" "metric2,label1='v1,v2,v3'" ];
    disabled-metrics = [ "metric1" "metric2" ];
    show-hidden-metrics-for-version = "[show-hidden-metrics-for-version]";
    log-flush-frequency = "[log-flush-frequency]";
    log-json-info-buffer-size = "[log-json-info-buffer-size]";
    log-json-split-stream = true;
    logging-format = "text";
    v = 32;
    vmodule = [ "pattern=1" ];
    kubeconfig = ./kube-controller-manager.nix;
    master = "[master]";
  };
}
