apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: kube-apiserver
    app.kubernetes.io/name: dedicated-api-server
  name: dedicated-api-server
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/component: kube-apiserver
      app.kubernetes.io/name: dedicated-api-server
  template:
    metadata:
      labels:
        app.kubernetes.io/component: kube-apiserver
        app.kubernetes.io/name: dedicated-api-server
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app.kubernetes.io/name
                      operator: In
                      values:
                        - dedicated-api-server
                    - key: app.kubernetes.io/component
                      operator: In
                      values:
                        - kube-apiserver
                topologyKey: kubernetes.io/hostname
              weight: 100
      containers:
        - command:
            - kube-apiserver
            - --tls-cert-file=/srv/kubernetes/apiserver/tls.crt
            - --tls-private-key-file=/srv/kubernetes/apiserver/tls.key
            - --etcd-cafile=/srv/kubernetes/etcd/ca/ca.crt
            - --etcd-certfile=/srv/kubernetes/etcd/client/tls.crt
            - --etcd-keyfile=/srv/kubernetes/etcd/client/tls.key
            - --etcd-servers=https://etcd:2379
            - --enable-admission-plugins=Priority,NamespaceLifecycle,LimitRanger,PodSecurityPolicy,ServiceAccount,NodeRestriction,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota,StorageObjectInUseProtection,MutatingAdmissionWebhook,ValidatingAdmissionWebhook
            - --allow-privileged=true
            - --anonymous-auth=false
            - --authorization-mode=Node,RBAC
            - --client-ca-file=/srv/kubernetes/ca/tls.crt
            - --enable-bootstrap-token-auth=true
            - --token-auth-file=/srv/kubernetes/token/probe
            - --kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP
            - --requestheader-client-ca-file=/srv/kubernetes/aggregator-ca/tls.crt
            - --proxy-client-cert-file=/srv/kubernetes/aggregator/tls.crt
            - --proxy-client-key-file=/srv/kubernetes/aggregator/tls.key
            - --requestheader-extra-headers-prefix=X-Remote-Extra-
            - --requestheader-group-headers=X-Remote-Group
            - --requestheader-username-headers=X-Remote-User
            - --secure-port=443
            - --service-cluster-ip-range=100.64.0.0/13
            - --service-account-issuer=https://api-server.api-server.svc.cluster.local
            - --service-account-key-file=/srv/kubernetes/service-account-key/tls.key
            - --service-account-signing-key-file=/srv/kubernetes/service-account-key/tls.key
            - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
            - --v=2
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/kube-apiserver:v1.21.1
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
                - name: Authorization
                  value: Bearer u18rxGCaR88cz9tgJZG4q4SkegIAAiKn
              path: /livez
              port: 443
              scheme: HTTPS
            initialDelaySeconds: 15
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 15
          name: kube-apiserver
          ports:
            - containerPort: 443
              name: https
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
                - name: Authorization
                  value: Bearer u18rxGCaR88cz9tgJZG4q4SkegIAAiKn
              path: /readyz
              port: 443
              scheme: HTTPS
            initialDelaySeconds: 10
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 15
          resources:
            limits:
              memory: 10Gi
            requests:
              memory: 2Gi
          volumeMounts:
            - mountPath: /srv/kubernetes/ca
              name: ca-kube-apiserver
            - mountPath: /srv/kubernetes/apiserver
              name: kube-apiserver
            - mountPath: /srv/kubernetes/service-account-key
              name: service-account-key
            - mountPath: /srv/kubernetes/etcd/ca
              name: ca-etcd
            - mountPath: /srv/kubernetes/etcd/client
              name: etcd-client-tls
            - mountPath: /srv/kubernetes/token
              name: kube-apiserver-token
            - mountPath: /srv/kubernetes/aggregator-ca
              name: ca-front-proxy
            - mountPath: /srv/kubernetes/aggregator
              name: kube-aggregator
        - command:
            - kube-controller-manager
            - --cluster-signing-cert-file=/srv/kubernetes/ca/tls.crt
            - --cluster-signing-key-file=/srv/kubernetes/ca/tls.key
            - --controllers=namespace,serviceaccount,serviceaccount-token,clusterrole-aggregation,garbagecollector,csrapproving,csrcleaner,csrsigning,bootstrapsigner,tokencleaner
            - --authorization-kubeconfig=/srv/kubernetes/controller-manager/kubeconfig
            - --authentication-kubeconfig=/srv/kubernetes/controller-manager/kubeconfig
            - --kubeconfig=/srv/kubernetes/controller-manager/kubeconfig
            - --root-ca-file=/srv/kubernetes/ca/tls.crt
            - --service-account-private-key-file=/srv/kubernetes/service-account-key/tls.key
            - --use-service-account-credentials=true
            - --v=2
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/kube-controller-manager:v1.21.1
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 2
            httpGet:
              path: /healthz
              port: 10252
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 15
          name: kube-controller-manager
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /srv/kubernetes/ca
              name: ca-kube-apiserver
            - mountPath: /srv/kubernetes/service-account-key
              name: service-account-key
            - mountPath: srv/kubernetes/controller-manager
              name: kube-controller-manager-kubeconfig
      dnsPolicy: ClusterFirst
      initContainers:
        - command:
            - /bin/sh
            - -c
            - |
              #!/usr/bin/env bash
              set -euo pipefail

              KUBECONFIG=/srv/kubernetes/controller-manager/kubeconfig
              CA_CRT_FILE=/tmp/kube-controller-manager-secret/ca.crt
              TLS_CRT_FILE=/tmp/kube-controller-manager-secret/tls.crt
              TLS_KEY_FILE=/tmp/kube-controller-manager-secret/tls.key

              CA_CRT=$( cat $CA_CRT_FILE | base64 -w 0 )
              TLS_CRT=$( cat $TLS_CRT_FILE | base64 -w 0 )
              TLS_KEY=$( cat $TLS_KEY_FILE | base64 -w 0 )

              cat >> $KUBECONFIG << EOF
              apiVersion: v1
              kind: Config
              clusters:
              - cluster:
                  certificate-authority-data: ${CA_CRT}
                  server: https://localhost:443
                name: kubernetes
              contexts:
              - context:
                  cluster: kubernetes
                  user: system:kube-controller-manager
                name: system:kube-controller-manager@kubernetes
              current-context: system:kube-controller-manager@kubernetes
              users:
              - name: system:kube-controller-manager
                user:
                  client-certificate-data: ${TLS_CRT}
                  client-key-data: ${TLS_KEY}
              EOF

              TOKEN_AUTH_FILE=/srv/kubernetes/token/probe
              cat >> $TOKEN_AUTH_FILE << EOF
              u18rxGCaR88cz9tgJZG4q4SkegIAAiKn,probe,10001,system:unauthenticated
              EOF
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/busybox:1.34.1
          imagePullPolicy: IfNotPresent
          name: init
          resources: {}
          volumeMounts:
            - mountPath: /tmp/kube-controller-manager-secret
              name: kube-controller-manager-secret
            - mountPath: srv/kubernetes/controller-manager
              name: kube-controller-manager-kubeconfig
            - mountPath: /srv/kubernetes/token
              name: kube-apiserver-token
      tolerations:
        - effect: NoExecute
          operator: Exists
      volumes:
        - name: ca-kube-apiserver
          secret:
            defaultMode: 420
            secretName: api-server-ca
        - name: kube-apiserver
          secret:
            defaultMode: 420
            secretName: dedicated-api-server
        - name: service-account-key
          secret:
            defaultMode: 420
            secretName: api-server-service-account-key
        - emptyDir: {}
          name: kube-controller-manager-kubeconfig
        - name: kube-controller-manager-secret
          secret:
            defaultMode: 420
            secretName: api-server-kube-controller-manager
        - emptyDir: {}
          name: kube-apiserver-token
        - name: ca-front-proxy
          secret:
            defaultMode: 420
            secretName: api-server-aggregator-ca
        - name: kube-aggregator
          secret:
            defaultMode: 420
            secretName: api-server-aggregator
        - name: ca-etcd
          secret:
            defaultMode: 420
            secretName: etcd-ca
        - name: etcd-client-tls
          secret:
            defaultMode: 420
            secretName: etcd-client