apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-apiserver
  labels:
    component: kube-apiserver
    tier: control-plane
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kube-apiserver
  template:
    metadata:
      labels:
        app: kube-apiserver
    spec:
      containers:
      - name: kine
        image: rancher/kine:v0.8.1-amd64
        command:
          - kine
          - --endpoint
          - postgres://postgres:{{ .DBPassword }}@{{ .DBReleaseName }}-postgresql.{{ .vksNS }}.svc/postgres?sslmode=disable
        ports:
        - containerPort: 2379
      - name: kube-apiserver
        image: k8s.gcr.io/kube-apiserver:v1.22.4
        imagePullPolicy: IfNotPresent 
        command:
        - kube-apiserver
        - --allow-privileged=true
        - --authorization-mode=Node,RBAC
        - --client-ca-file=/etc/kubernetes/pki/ca.crt
        - --enable-admission-plugins=NodeRestriction
        - --enable-bootstrap-token-auth=true
        - --etcd-servers=http://127.0.0.1:2379
        - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
        - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
        - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
        - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
        - --requestheader-allowed-names=front-proxy-client
        - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
        - --requestheader-extra-headers-prefix=X-Remote-Extra-
        - --requestheader-group-headers=X-Remote-Group
        - --requestheader-username-headers=X-Remote-User
        - --secure-port={{ .securePort }}
        - --service-account-issuer=https://kubernetes.default.svc.cluster.local
        - --service-account-key-file=/etc/kubernetes/pki/sa.pub
        - --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
        - --service-cluster-ip-range=10.96.0.0/12
        - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
        - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
        ports:
        - containerPort: 7443
        resources:
          requests:
            cpu: 250m
        livenessProbe:
          failureThreshold: 8
          httpGet:
            path: /livez
            port: 7443
            scheme: HTTPS
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 15
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: 7443
            scheme: HTTPS
          periodSeconds: 1
          timeoutSeconds: 15
        startupProbe:
          failureThreshold: 24
          httpGet:
            path: /livez
            port: 7443
            scheme: HTTPS
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 15
        volumeMounts:  
        - mountPath: /etc/kubernetes/pki
          name: k8s-certs
          readOnly: true     
      volumes: 
      - name: k8s-certs
        secret: 
          secretName: k8s-certs
