apiVersion: v1
kind: Pod
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  hostNetwork: true
  priorityClassName: system-cluster-critical
  containers :
  - name: kube-apiserver
    image: k8s.gcr.io/kube-apiserver-amd64:v1.11.1
    command:
      - kube-apiserver
      - --v=0
      - --logtostderr=true
      - --allow-privileged=true
      - --bind-address=0.0.0.0
      - --secure-port=6443
      - --insecure-port=0
      - --advertise-address=${ADVERTISE_VIP}
      - --service-cluster-ip-range=10.96.0.0/12
      - --service-node-port-range=30000-32767
      - --etcd-servers=${ETCD_SERVERS}
      - --etcd-cafile=/etc/etcd/ssl/etcd-ca.pem
      - --etcd-certfile=/etc/etcd/ssl/etcd.pem
      - --etcd-keyfile=/etc/etcd/ssl/etcd-key.pem
      - --client-ca-file=/etc/kubernetes/pki/ca.pem
      - --tls-cert-file=/etc/kubernetes/pki/apiserver.pem
      - --tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem
      - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver.pem
      - --kubelet-client-key=/etc/kubernetes/pki/apiserver-key.pem
      - --service-account-key-file=/etc/kubernetes/pki/sa.pub
      - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem
      - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.pem
      - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client-key.pem
      - --requestheader-allowed-names=front-proxy-client
      - --requestheader-group-headers=X-Remote-Group
      - --requestheader-extra-headers-prefix=X-Remote-Extra-
      - --requestheader-username-headers=X-Remote-User
      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      - --disable-admission-plugins=PersistentVolumeLabel
      - --enable-admission-plugins=NodeRestriction
      - --authorization-mode=Node,RBAC
      - --enable-bootstrap-token-auth=true
      - --audit-log-maxage=30
      - --audit-log-maxbackup=3
      - --audit-log-maxsize=128
      - --audit-log-path=/var/log/kubernetes/audit.log
      - --audit-policy-file=/etc/kubernetes/audit/policy.yml
      - --experimental-encryption-provider-config=/etc/kubernetes/encryption/config.yml
      - --event-ttl=1h
    livenessProbe:
      failureThreshold: 8
      httpGet:
        host: 127.0.0.1
        path: /healthz
        port: 6443
        scheme: HTTPS
      initialDelaySeconds: 15
      timeoutSeconds: 15
    resources:
      requests:
        cpu: 250m
    volumeMounts:
    - mountPath: /var/log/kubernetes
      name: k8s-audit-log
    - mountPath: /etc/kubernetes/pki
      name: k8s-certs
      readOnly: true
    - mountPath: /etc/ssl/certs
      name: ca-certs
      readOnly: true
    - mountPath: /etc/kubernetes/encryption/config.yml
      name: encryption-config
      readOnly: true
    - mountPath: /etc/kubernetes/audit/policy.yml
      name: audit-policy
      readOnly: true
    - mountPath: /etc/etcd/ssl
      name: etcd-ca-certs
      readOnly: true
  volumes:
  - hostPath:
      path: /var/log/kubernetes
      type: DirectoryOrCreate
    name: k8s-audit-log
  - hostPath:
      path: /etc/kubernetes/pki
      type: DirectoryOrCreate
    name: k8s-certs
  - hostPath:
      path: /etc/kubernetes/encryption/config.yml
      type: FileOrCreate
    name: encryption-config
  - hostPath:
      path: /etc/kubernetes/audit/policy.yml
      type: FileOrCreate
    name: audit-policy
  - hostPath:
      path: /etc/ssl/certs
      type: DirectoryOrCreate
    name: ca-certs
  - hostPath:
      path: /etc/etcd/ssl
      type: DirectoryOrCreate
    name: etcd-ca-certs
