apiVersion: "v1"
kind: "Pod"
metadata:
  name: "kube-apiserver"
  namespace: "kube-system"
  labels:
    tier: control-plane
    component: kube-apiserver
spec:
  hostNetwork: true
  containers:
    - name: "kube-apiserver"
      image: "<kubernetesHyperkubeSpec>"
      command: 
        - "/hyperkube"
        - "apiserver"
        - "--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
        - "--address=0.0.0.0"
        - "--allow-privileged"
        - "--insecure-port=8080"
        - "--secure-port=443"
        - "--cloud-provider=azure"
        - "--cloud-config=/etc/kubernetes/azure.json"
        - "--service-cluster-ip-range=<kubeServiceCidr>"
        - "--etcd-servers=http://127.0.0.1:<masterEtcdClientPort>"
        - "--etcd-quorum-read=true"
        - "--advertise-address=<kubernetesAPIServerIP>"
        - "--tls-cert-file=/etc/kubernetes/certs/apiserver.crt"
        - "--tls-private-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--client-ca-file=/etc/kubernetes/certs/ca.crt"
        - "--requestheader-client-ca-file=/etc/kubernetes/certs/proxy-ca.crt"
        - "--proxy-client-cert-file=/etc/kubernetes/certs/proxy.crt"
        - "--proxy-client-key-file=/etc/kubernetes/certs/proxy.key"
        - "--service-account-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--oidc-client-id="
        - "--oidc-issuer-url="
        - "--oidc-username-claim=oid"
        - "--storage-backend=<etcdApiVersion>"
        - "--v=4"
        - "<kubernetesEnableRbac>"
        - "--requestheader-allowed-names="
        - "--requestheader-extra-headers-prefix=X-Remote-Extra-"
        - "--requestheader-group-headers=X-Remote-Group"
        - "--requestheader-username-headers=X-Remote-User"
      volumeMounts:
        - name: "etc-kubernetes"
          mountPath: "/etc/kubernetes"
        - name: "var-lib-kubelet"
          mountPath: "/var/lib/kubelet"
        - name: "msi"
          mountPath: "/var/lib/waagent/ManagedIdentity-Settings"
          readOnly: true
  volumes:
    - name: "etc-kubernetes"
      hostPath:
        path: "/etc/kubernetes"
    - name: "var-lib-kubelet"
      hostPath:
        path: "/var/lib/kubelet"
    - name: msi
      hostPath:
        path: "/var/lib/waagent/ManagedIdentity-Settings"
