---
apiVersion: "apps/v1"
kind: DaemonSet
metadata:
  name: kube-apiserver
  namespace: kube-system
  labels:
    app.kubernetes.io/component: kube-apiserver
    app.kubernetes.io/instance: kube-apiserver-porkadot
    app.kubernetes.io/managed-by: porkadot
    app.kubernetes.io/name: kube-apiserver
    app.kubernetes.io/version: v1.21.3
    app.kubernetes.io/part-of: kubernetes
    k8s-app: kube-apiserver
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: kube-apiserver
      app.kubernetes.io/instance: kube-apiserver-porkadot
      app.kubernetes.io/managed-by: porkadot
  template:
    metadata:
      labels:
        app.kubernetes.io/component: kube-apiserver
        app.kubernetes.io/instance: kube-apiserver-porkadot
        app.kubernetes.io/managed-by: porkadot
        app.kubernetes.io/name: kube-apiserver
        app.kubernetes.io/version: v1.21.3
        app.kubernetes.io/part-of: kubernetes
        k8s-app: kube-apiserver
      annotations:
        checkpointer.alpha.coreos.com/checkpoint: "true"
    spec:
      containers:
      - name: kube-apiserver
        resources:
          requests:
            cpu: 250m
        image: k8s.gcr.io/kube-apiserver:v1.21.3
        command:
        - kube-apiserver
        - --advertise-address=$(POD_IP)
        - --allow-privileged=true
        - --authorization-mode=Node,RBAC
        - --bind-address=0.0.0.0
        - --client-ca-file=/etc/kubernetes/pki/kubernetes/ca.crt
        - --enable-admission-plugins=NodeRestriction
        - --enable-bootstrap-token-auth=true
        - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
        - --etcd-certfile=/etc/kubernetes/pki/etcd/etcd-client.crt
        - --etcd-keyfile=/etc/kubernetes/pki/etcd/etcd-client.key
        - --etcd-servers=https://192.168.1.111:2379,https://192.168.1.112:2379,https://192.168.1.113:2379
        - --kubelet-certificate-authority=/etc/kubernetes/pki/kubernetes/ca.crt
        - --kubelet-client-certificate=/etc/kubernetes/pki/kubernetes/kubelet-client.crt
        - --kubelet-client-key=/etc/kubernetes/pki/kubernetes/kubelet-client.key
        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
        - --proxy-client-cert-file=/etc/kubernetes/pki/kubernetes/front-proxy-client.crt
        - --proxy-client-key-file=/etc/kubernetes/pki/kubernetes/front-proxy-client.key
        - --requestheader-allowed-names=aggregator-client
        - --requestheader-client-ca-file=/etc/kubernetes/pki/kubernetes/front-proxy-ca.crt
        - --requestheader-extra-headers-prefix=X-Remote-Extra-
        - --requestheader-group-headers=X-Remote-Group
        - --requestheader-username-headers=X-Remote-User
        - --secure-port=6443
        - --service-account-issuer=https://kubernetes.default.svccluster.local
        - --service-account-key-file=/etc/kubernetes/pki/kubernetes/sa.pub
        - --service-account-signing-key-file=/etc/kubernetes/pki/kubernetes/sa.key
        - --service-cluster-ip-range=10.254.0.0/24,fd20:afc2:7c09::/108
        - --storage-backend=etcd3
        - --tls-cert-file=/etc/kubernetes/pki/kubernetes/apiserver.crt
        - --tls-private-key-file=/etc/kubernetes/pki/kubernetes/apiserver.key
        - --v=2
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        volumeMounts:
        - mountPath: /etc/ca-certificates
          name: etc-ca-certificates
          readOnly: true
        - mountPath: /etc/ssl/certs
          name: ca-certs
          readOnly: true
        - mountPath: /usr/share/ca-certificates
          name: usr-share-ca-certificates
          readOnly: true
        - mountPath: /etc/kubernetes/pki/kubernetes
          name: k8s-tls
          readOnly: true
        - mountPath: /etc/kubernetes/pki/etcd
          name: etcd-tls
          readOnly: true
        - mountPath: /var/lock
          name: var-lock
          readOnly: false
      hostNetwork: true
      priorityClassName: system-cluster-critical
      nodeSelector:
        k8s.unstable.cloud/master: ""
      tolerations:
      - key: CriticalAddonsOnly
        operator: Exists
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      volumes:
      - hostPath:
          path: /etc/ssl/certs
          type: DirectoryOrCreate
        name: ca-certs
      - hostPath:
          path: /usr/share/ca-certificates
          type: DirectoryOrCreate
        name: usr-share-ca-certificates
      - hostPath:
          path: /etc/ca-certificates
          type: DirectoryOrCreate
        name: etc-ca-certificates
      - name: k8s-tls
        secret:
          secretName: kube-apiserver
      - name: etcd-tls
        secret:
          secretName: etcd-tls
      - name: var-lock
        hostPath:
          path: /var/lock
