{ config, pkgs, ... }:

{
  services.kube-proxy = {
    enable = true;
    bind-address = "[bind-address]";
    bind-address-hard-fail = true;
    boot-id-file = [ /proc/sys/kernel/random/boot_id ];
    cleanup = true;
    cluster-cidr = "[cluster-cidr]";
    configFile = ./kube-proxy.nix;
    config-sync-period = "[config-sync-period]";
    conntrack-max-per-core = 1;
    conntrack-min = 2;
    conntrack-tcp-timeout-close-wait = "[conntrack-tcp-timeout-close-wait]";
    conntrack-tcp-timeout-established = "[conntrack-tcp-timeout-established]";
    detect-local-mode = "[detect-local-mode]";
    feature-gates = [
      "APIListChunking=true"
      "APIPriorityAndFairness=true"
      "APIResponseCompression=true"
      "APIServerIdentity=true"
      "APIServerTracing=true"
      "AdmissionWebhookMatchConditions=true"
      "AggregatedDiscoveryEndpoint=true"
      "AllAlpha=true"
      "AllBeta=true"
      "AnyVolumeDataSource=true"
      "AppArmor=true"
      "CPUManagerPolicyAlphaOptions=true"
      "CPUManagerPolicyBetaOptions=true"
      "CPUManagerPolicyOptions=true"
      "CRDValidationRatcheting=true"
      "CSIMigrationPortworx=true"
      "CSINodeExpandSecret=true"
      "CSIVolumeHealth=true"
      "CloudControllerManagerWebhook=true"
      "CloudDualStackNodeIPs=true"
      "ClusterTrustBundle=true"
      "ComponentSLIs=true"
      "ConsistentListFromCache=true"
      "ContainerCheckpoint=true"
      "ContextualLogging=true"
      "CronJobsScheduledAnnotation=true"
      "CrossNamespaceVolumeDataSource=true"
      "CustomCPUCFSQuotaPeriod=true"
      "CustomResourceValidationExpressions=true"
      "DevicePluginCDIDevices=true"
      "DisableCloudProviders=true"
      "DisableKubeletCloudCredentialProviders=true"
      "DynamicResourceAllocation=true"
      "ElasticIndexedJob=true"
      "EventedPLEG=true"
      "GracefulNodeShutdown=true"
      "GracefulNodeShutdownBasedOnPodPriority=true"
      "HPAContainerMetrics=true"
      "HPAScaleToZero=true"
      "HonorPVReclaimPolicy=true"
      "InPlacePodVerticalScaling=true"
      "InTreePluginAWSUnregister=true"
      "InTreePluginAzureDiskUnregister=true"
      "InTreePluginAzureFileUnregister=true"
      "InTreePluginGCEUnregister=true"
      "InTreePluginOpenStackUnregister=true"
      "InTreePluginPortworxUnregister=true"
      "InTreePluginvSphereUnregister=true"
      "JobBackoffLimitPerIndex=true"
      "JobPodFailurePolicy=true"
      "JobPodReplacementPolicy=true"
      "JobReadyPods=true"
      "KMSv2=true"
      "KMSv2KDF=true"
      "KubeProxyDrainingTerminatingNodes=true"
      "KubeletCgroupDriverFromCRI=true"
      "KubeletInUserNamespace=true"
      "KubeletPodResourcesDynamicResources=true"
      "KubeletPodResourcesGet=true"
      "KubeletTracing=true"
      "LegacyServiceAccountTokenCleanUp=true"
      "LocalStorageCapacityIsolationFSQuotaMonitoring=true"
      "LogarithmicScaleDown=true"
      "LoggingAlphaOptions=true"
      "LoggingBetaOptions=true"
      "MatchLabelKeysInPodTopologySpread=true"
      "MaxUnavailableStatefulSet=true"
      "MemoryManager=true"
      "MemoryQoS=true"
      "MinDomainsInPodTopologySpread=true"
      "MultiCIDRRangeAllocator=true"
      "MultiCIDRServiceAllocator=true"
      "NewVolumeManagerReconstruction=true"
      "NodeInclusionPolicyInPodTopologySpread=true"
      "NodeLogQuery=true"
      "NodeSwap=true"
      "OpenAPIEnums=true"
      "PDBUnhealthyPodEvictionPolicy=true"
      "PersistentVolumeLastPhaseTransitionTime=true"
      "PodAndContainerStatsFromCRI=true"
      "PodDeletionCost=true"
      "PodDisruptionConditions=true"
      "PodHostIPs=true"
      "PodIndexLabel=true"
      "PodReadyToStartContainersCondition=true"
      "PodSchedulingReadiness=true"
      "ProcMountType=true"
      "QOSReserved=true"
      "ReadWriteOncePod=true"
      "RecoverVolumeExpansionFailure=true"
      "RemainingItemCount=true"
      "RotateKubeletServerCertificate=true"
      "SELinuxMountReadWriteOncePod=true"
      "SchedulerQueueingHints=true"
      "SecurityContextDeny=true"
      "SeparateCacheWatchRPC=true"
      "ServiceNodePortStaticSubrange=true"
      "SidecarContainers=true"
      "SizeMemoryBackedVolumes=true"
      "SkipReadOnlyValidationGCE=true"
      "StableLoadBalancerNodeSet=true"
      "StatefulSetAutoDeletePVC=true"
      "StatefulSetStartOrdinal=true"
      "StorageVersionAPI=true"
      "StorageVersionHash=true"
      "TopologyAwareHints=true"
      "TopologyManagerPolicyAlphaOptions=true"
      "TopologyManagerPolicyBetaOptions=true"
      "TopologyManagerPolicyOptions=true"
      "UnauthenticatedHTTP2DOSMitigation=true"
      "UnknownVersionInteroperabilityProxy=true"
      "UserNamespacesSupport=true"
      "ValidatingAdmissionPolicy=true"
      "VolumeCapacityPriority=true"
      "WatchFromStorageWithoutResourceVersion=true"
      "WatchList=true"
      "WinDSR=true"
      "WinOverlay=true"
      "WindowsHostNetwork=true"
    ];
    healthz-bind-address = "[healthz-bind-address]";
    hostname-override = "[hostname-override]";
    iptables-localhost-nodeports = true;
    iptables-masquerade-bit = 3;
    iptables-min-sync-period = "[iptables-min-sync-period]";
    iptables-sync-period = "[iptables-sync-period]";
    ipvs-exclude-cidrs = [ "cidr1" "cidr2" ];
    ipvs-min-sync-period = "[ipvs-min-sync-period]";
    ipvs-scheduler = "[ipvs-scheduler]";
    ipvs-strict-arp = true;
    ipvs-sync-period = "[ipvs-sync-period]";
    ipvs-tcp-timeout = "[ipvs-tcp-timeout]";
    ipvs-tcpfin-timeout = "[ipvs-tcpfin-timeout]";
    ipvs-udp-timeout = "[ipvs-udp-timeout]";
    kube-api-burst = 4;
    kube-api-content-type = "[kube-api-content-type]";
    kube-api-qps = 0.1;
    kubeconfig = ./kube-proxy.nix;
    kubeConfigOpts = {
      caFile = ./raw-kube-proxy.nix;
      server = "server";
      certFile = ./raw-kube-proxy.nix;
      keyFile = ./raw-kube-proxy.nix;
    };
    log-flush-frequency = "[log-flush-frequency]";
    log-json-info-buffer-size = "[log-json-info-buffer-size]";
    log-json-split-stream = true;
    logging-format = "json";
    machine-id-file = [ ./kube-proxy.nix ./kube-proxy.nix ];
    masquerade-all = true;
    master = "[master]";
    metrics-bind-address = "[metrics-bind-address]";
    nodeport-addresses = [ "1.2.3.0/24" "1.2.3.4/32" ];
    oom-score-adj = 5;
    pod-bridge-interface = "[pod-bridge-interface]";
    pod-interface-name-prefix = "[pod-interface-name-prefix]";
    profiling = true;
    proxy-mode = "iptables";
    proxy-port-range = "[proxy-port-range]";
    show-hidden-metrics-for-version = "[show-hidden-metrics-for-version]";
    v = 6;
    vmodule = [ "pattern=1" ];
  };
}
