apiVersion: v1
kind: ConfigMap
metadata:
  name: config
  namespace: system
data:
  kubelet.service: |
    [Unit]
    Description=kubelet: The Kubernetes Node Agent
    Documentation=http://kubernetes.io/docs/

    [Service]
    ExecStart=/usr/local/bin/kubelet
    Restart=always
    StartLimitInterval=0
    RestartSec=10

    [Install]
    WantedBy=multi-user.target
  10-kubeadm.conf: |
    # Note: This dropin only works with kubelet v1.11+
    [Service]
    Environment="KUBELET_KUBECONFIG_ARGS=--kubeconfig=/var/lib/kubelet/kubeconfig"
    Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml --dynamic-config-dir=/var/lib/kubelet/dyncfg"
    EnvironmentFile=-/var/lib/kubelet/flags.env
    EnvironmentFile=-/etc/default/kubelet
    ExecStart=
    ExecStart=/usr/local/bin/kubelet $KUBELET_KUBECONFIG_ARGS --node-labels="${KUBELET_NODE_LABELS}" --volume-plugin-dir=/etc/kubernetes/volumeplugins $KUBELET_CONFIG_ARGS $KUBELET_AZURE_ARGS $KUBELET_EXTRA_ARGS 
  flags.env: |
    KUBELET_EXTRA_ARGS=--network-plugin=kubenet --non-masquerade-cidr=10.244.0.0/16
    KUBELET_AZURE_ARGS=--azure-container-registry-config=/etc/kubernetes/azure.json --cloud-provider=azure --cloud-config=/etc/kubernetes/azure.json --pod-infra-container-image=aksrepos.azurecr.io/mirror/pause-amd64:3.1
  config.yaml: |
    apiVersion: kubelet.config.k8s.io/v1beta1
    kind: KubeletConfiguration
    readOnlyPort: 10255
    clusterDNS:
    - 10.0.0.10
    clusterDomain: cluster.local
    authentication:
      webhook:
        enabled: true
      x509:
        clientCAFile: "/etc/kubernetes/certs/ca.crt"
    authorization:
      mode: Webhook
    tlsCertFile: "/etc/kubernetes/certs/kubeletserver.crt"
    tlsPrivateKeyFile: "/etc/kubernetes/certs/kubeletserver.key"
    tlsCipherSuites:
    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    - TLS_RSA_WITH_AES_256_GCM_SHA384
    - TLS_RSA_WITH_AES_128_GCM_SHA256
  runtime.slice: |
    [Unit]
    Description=Limited resources slice for Kubernetes services
    Documentation=man:systemd.special(7)
    DefaultDependencies=no
    Before=slices.target
    Requires=-.slice
    After=-.slice
  docker-10-cgroup.conf: |
    [Service]
    CPUAccounting=true
    MemoryAccounting=true
    Slice=runtime.slice
  kubelet-10-cgroup.conf: |
    [Service]
    CPUAccounting=true
    MemoryAccounting=true
    Slice=runtime.slice
