apiVersion: "v1"
kind: "Pod"
metadata:
  name: "kube-apiserver"
  namespace: "kube-system"
  labels:
    tier: control-plane
    component: kube-apiserver
spec:
  hostNetwork: true
  containers:
    - name: "kube-apiserver"
      image: "k8s-gcrio.azureedge.net/hyperkube-amd64:v1.10.0"
      command: ["/hyperkube", "apiserver"]
      args: ["--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,DenyEscalatingExec,AlwaysPullImages", "--advertise-address=10.255.255.5", "--allow-privileged=true", "--anonymous-auth=false", "--audit-log-maxage=30", "--audit-log-maxbackup=10", "--audit-log-maxsize=100", "--audit-log-path=/var/log/audit.log", "--audit-policy-file=/etc/kubernetes/manifests/audit-policy.yaml", "--authorization-mode=Node,RBAC", "--bind-address=0.0.0.0", "--client-ca-file=/etc/kubernetes/certs/ca.crt", "--cloud-config=/etc/kubernetes/azure.json", "--cloud-provider=azure", "--etcd-cafile=/etc/kubernetes/certs/ca.crt", "--etcd-certfile=/etc/kubernetes/certs/etcdclient.crt", "--etcd-keyfile=/etc/kubernetes/certs/etcdclient.key", "--etcd-quorum-read=true", "--etcd-servers=https://127.0.0.1:2379", "--insecure-port=8080", "--kubelet-client-certificate=/etc/kubernetes/certs/client.crt", "--kubelet-client-key=/etc/kubernetes/certs/client.key", "--profiling=false", "--proxy-client-cert-file=/etc/kubernetes/certs/proxy.crt", "--proxy-client-key-file=/etc/kubernetes/certs/proxy.key", "--repair-malformed-updates=false", "--requestheader-allowed-names=", "--requestheader-client-ca-file=/etc/kubernetes/certs/proxy-ca.crt", "--requestheader-extra-headers-prefix=X-Remote-Extra-", "--requestheader-group-headers=X-Remote-Group", "--requestheader-username-headers=X-Remote-User", "--secure-port=443", "--service-account-key-file=/etc/kubernetes/certs/apiserver.key", "--service-account-lookup=true", "--service-cluster-ip-range=10.0.0.0/16", "--storage-backend=etcd3", "--tls-cert-file=/etc/kubernetes/certs/apiserver.crt", "--tls-private-key-file=/etc/kubernetes/certs/apiserver.key", "--v=4"]
      volumeMounts:
        - name: "etc-kubernetes"
          mountPath: "/etc/kubernetes"
        - name: "var-lib-kubelet"
          mountPath: "/var/lib/kubelet"
        - name: "msi"
          mountPath: "/var/lib/waagent/ManagedIdentity-Settings"
          readOnly: true
  volumes:
    - name: "etc-kubernetes"
      hostPath:
        path: "/etc/kubernetes"
    - name: "var-lib-kubelet"
      hostPath:
        path: "/var/lib/kubelet"
    - name: msi
      hostPath:
        path: "/var/lib/waagent/ManagedIdentity-Settings"
