apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
  namespace: kube-system
  labels:
    tier: control-plane
    component: kube-apiserver
spec:
  priorityClassName: system-node-critical
  hostNetwork: true
  containers:
    - name: kube-apiserver
      image: k8s.gcr.io/kube-apiserver:v1.18.0-alpha.2
      imagePullPolicy: IfNotPresent
      command: ["kube-apiserver"]
      args: ["--advertise-address=10.255.255.5", "--allow-privileged=true", "--anonymous-auth=false", "--audit-log-maxage=30", "--audit-log-maxbackup=10", "--audit-log-maxsize=100", "--audit-log-path=/var/log/kubeaudit/audit.log", "--audit-policy-file=/etc/kubernetes/addons/audit-policy.yaml", "--authorization-mode=Node,RBAC", "--bind-address=0.0.0.0", "--client-ca-file=/etc/kubernetes/certs/ca.crt", "--cloud-config=/etc/kubernetes/azure.json", "--cloud-provider=azure", "--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ValidatingAdmissionWebhook,ResourceQuota,ExtendedResourceToleration,PodSecurityPolicy", "--enable-bootstrap-token-auth=true", "--etcd-cafile=/etc/kubernetes/certs/ca.crt", "--etcd-certfile=/etc/kubernetes/certs/etcdclient.crt", "--etcd-keyfile=/etc/kubernetes/certs/etcdclient.key", "--etcd-servers=https://127.0.0.1:2379", "--insecure-port=8080", "--kubelet-client-certificate=/etc/kubernetes/certs/client.crt", "--kubelet-client-key=/etc/kubernetes/certs/client.key", "--profiling=false", "--proxy-client-cert-file=/etc/kubernetes/certs/proxy.crt", "--proxy-client-key-file=/etc/kubernetes/certs/proxy.key", "--requestheader-allowed-names=", "--requestheader-client-ca-file=/etc/kubernetes/certs/proxy-ca.crt", "--requestheader-extra-headers-prefix=X-Remote-Extra-", "--requestheader-group-headers=X-Remote-Group", "--requestheader-username-headers=X-Remote-User", "--secure-port=443", "--service-account-key-file=/etc/kubernetes/certs/apiserver.key", "--service-account-lookup=true", "--service-cluster-ip-range=10.0.0.0/16", "--storage-backend=etcd3", "--tls-cert-file=/etc/kubernetes/certs/apiserver.crt", "--tls-cipher-suites=TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "--tls-private-key-file=/etc/kubernetes/certs/apiserver.key", "--v=4", "--feature-gates=CSIMigrationAzureDisk=true"]
      volumeMounts:
        - name: etc-kubernetes
          mountPath: /etc/kubernetes
        - name: var-lib-kubelet
          mountPath: /var/lib/kubelet
        - name: msi
          mountPath: /var/lib/waagent/ManagedIdentity-Settings
          readOnly: true
        - name: sock
          mountPath: /opt
        - name: auditlog
          mountPath: /var/log/kubeaudit
  volumes:
    - name: etc-kubernetes
      hostPath:
        path: /etc/kubernetes
    - name: var-lib-kubelet
      hostPath:
        path: /var/lib/kubelet
    - name: msi
      hostPath:
        path: /var/lib/waagent/ManagedIdentity-Settings
    - name: sock
      hostPath:
        path: /opt
    - name: auditlog
      hostPath:
        path: /var/log/kubeaudit
