apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
  namespace: kube-system
  labels:
    k8s-app: kube-apiserver
    tier: control-plane
spec:
  hostNetwork: true
  priorityClassName: system-cluster-critical
  securityContext:
    runAsNonRoot: true
    runAsUser: 65534
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: kube-apiserver
    image: ${kube_apiserver_image}
    command:
    - kube-apiserver
    - --advertise-address=$(POD_IP)
    - --allow-privileged=true
    - --anonymous-auth=false
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd-client-ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/etcd-client.key
    - --etcd-servers=${etcd_servers}
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname${aggregation_flags}
    - --secure-port=6443
    - --service-account-issuer=https://kubernetes.default.svc.cluster.local
    - --service-account-jwks-uri=https://kubernetes.default.svc.cluster.local/openid/v1/jwks
    - --service-account-key-file=/etc/kubernetes/pki/service-account.pub
    - --service-account-signing-key-file=/etc/kubernetes/pki/service-account.key
    - --service-cluster-ip-range=${service_cidr}
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    env:
    - name: POD_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    resources:
      requests:
        cpu: 150m
    volumeMounts:
    - name: secrets
      mountPath: /etc/kubernetes/pki
      readOnly: true
    - name: etc-ssl
      mountPath: /etc/ssl/certs
      readOnly: true
    - name: etc-pki
      mountPath: /etc/pki
      readOnly: true
  volumes:
  - name: secrets
    hostPath:
      path: /etc/kubernetes/pki
  - name: etc-ssl
    hostPath:
      path: /etc/ssl/certs
  - name: etc-pki
    hostPath:
      path: /etc/pki
