apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
  namespace: kube-system
  labels:
    tier: control-plane
    component: kube-apiserver
spec:
  hostNetwork: true
  containers:
    - name: kube-apiserver
      image: k8s.gcr.io/hyperkube-amd64:v1.18.0
      imagePullPolicy: IfNotPresent
      command: ["/hyperkube", "kube-apiserver"]
      args:
        - "--advertise-address=10.241.255.5"
        - "--allow-privileged=true"
        - "--anonymous-auth=false"
        - "--audit-log-maxage=30"
        - "--audit-log-maxbackup=10"
        - "--audit-log-maxsize=100"
        - "--audit-log-path=/var/log/kubeaudit/audit.log"
        - "--audit-policy-file=/etc/kubernetes/addons/audit-policy.yaml"
        - "--authorization-mode=Node,RBAC"
        - "--bind-address=0.0.0.0"
        - "--client-ca-file=/etc/kubernetes/certs/ca.crt"
        - "--cloud-config=/etc/kubernetes/azure.json"
        - "--cloud-provider=azure"
        - "--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ValidatingAdmissionWebhook,ResourceQuota,ExtendedResourceToleration,PodSecurityPolicy"
        - "--enable-bootstrap-token-auth=true"
        - "--etcd-cafile=/etc/kubernetes/certs/ca.crt"
        - "--etcd-certfile=/etc/kubernetes/certs/etcdclient.crt"
        - "--etcd-keyfile=/etc/kubernetes/certs/etcdclient.key"
        - "--etcd-servers=https://127.0.0.1:2379"
        - "--insecure-port=8080"
        - "--kubelet-client-certificate=/etc/kubernetes/certs/client.crt"
        - "--kubelet-client-key=/etc/kubernetes/certs/client.key"
        - "--profiling=false"
        - "--proxy-client-cert-file=/etc/kubernetes/certs/proxy.crt"
        - "--proxy-client-key-file=/etc/kubernetes/certs/proxy.key"
        - "--requestheader-allowed-names="
        - "--requestheader-client-ca-file=/etc/kubernetes/certs/proxy-ca.crt"
        - "--requestheader-extra-headers-prefix=X-Remote-Extra-"
        - "--requestheader-group-headers=X-Remote-Group"
        - "--requestheader-username-headers=X-Remote-User"
        - "--secure-port=443"
        - "--service-account-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--service-account-lookup=true"
        - "--service-cluster-ip-range=10.0.0.0/16"
        - "--storage-backend=etcd3"
        - "--tls-cert-file=/etc/kubernetes/certs/apiserver.crt"
        - "--tls-cipher-suites=TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
        - "--tls-private-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--v=3"
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 8
          memory: 4Gi
      volumeMounts:
        - name: etc-kubernetes
          mountPath: /etc/kubernetes
        - name: var-lib-kubelet
          mountPath: /var/lib/kubelet
        - name: msi
          mountPath: /var/lib/waagent/ManagedIdentity-Settings
          readOnly: true
        - name: sock
          mountPath: /opt
        - name: auditlog
          mountPath: /var/log/kubeaudit
  volumes:
    - name: etc-kubernetes
      hostPath:
        path: /etc/kubernetes
    - name: var-lib-kubelet
      hostPath:
        path: /var/lib/kubelet
    - name: msi
      hostPath:
        path: /var/lib/waagent/ManagedIdentity-Settings
    - name: sock
      hostPath:
        path: /opt
    - name: auditlog
      hostPath:
        path: /var/log/kubeaudit