apiVersion: v1
kind: Pod
metadata:
  name: kube-controller-manager
  namespace: kube-system
  labels:
    tier: control-plane
    component: kube-controller-manager
spec:
  hostNetwork: true
  containers:
    - name: kube-controller-manager
      image: k8s.gcr.io/hyperkube-amd64:v1.18.0
      imagePullPolicy: IfNotPresent
      command: ["/hyperkube", "kube-controller-manager"]
      args:
        - "--allocate-node-cidrs=true"       # "false" for Azure CNI and "true" for other network plugins
        - "--cluster-cidr=10.244.0.0/16"
        - "--cluster-name=k8s"
        - "--cluster-signing-cert-file=/etc/kubernetes/certs/ca.crt"
        - "--cluster-signing-key-file=/etc/kubernetes/certs/ca.key"
        - "--configure-cloud-routes=false"
        - "--controllers=*,bootstrapsigner,tokencleaner"
        - "--feature-gates=LocalStorageCapacityIsolation=true,ServiceNodeExclusion=true"
        - "--kubeconfig=/var/lib/kubelet/kubeconfig"
        - "--leader-elect=true"
        - "--node-monitor-grace-period=40s"
        - "--pod-eviction-timeout=5m0s"
        - "--profiling=false"
        - "--root-ca-file=/etc/kubernetes/certs/ca.crt"
        - "--service-account-private-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--terminated-pod-gc-threshold=5000"
        - "--use-service-account-credentials=true"
        - "--v=2"
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 4
          memory: 2Gi
      volumeMounts:
        - name: etc-kubernetes
          mountPath: /etc/kubernetes
        - name: var-lib-kubelet
          mountPath: /var/lib/kubelet
        - name: msi
          mountPath: /var/lib/waagent/ManagedIdentity-Settings
          readOnly: true
  volumes:
    - name: etc-kubernetes
      hostPath:
        path: /etc/kubernetes
    - name: var-lib-kubelet
      hostPath:
        path: /var/lib/kubelet
    - name: msi
      hostPath:
        path: /var/lib/waagent/ManagedIdentity-Settings
