kind: Pod
apiVersion: v1
metadata:
  name: bootstrap-kube-apiserver
  namespace: kube-system
  labels:
    openshift.io/control-plane: "true"
    openshift.io/component: "api"
  annotations:
    openshift.io/run-level: "0"
    kubectl.kubernetes.io/default-logs-container: kube-apiserver
spec:
  restartPolicy: Always
  hostNetwork: true
  initContainers:
  - name: setup
    terminationMessagePolicy: FallbackToLogsOnError
    image: {{ .Image }}
    imagePullPolicy: IfNotPresent
    volumeMounts:
    - mountPath: /var/log/kube-apiserver
      name: audit-dir
    command: ['/bin/bash', '-ec']
    args:
    - |
      echo -n "Fixing audit permissions."
      chmod 0700 /var/log/kube-apiserver
    securityContext:
      privileged: true
  containers:
  - name: kube-apiserver
    image: {{ .Image }}
    imagePullPolicy: {{ .ImagePullPolicy }}
    terminationMessagePolicy: FallbackToLogsOnError
    command: ["hyperkube", "kube-apiserver"]
    args:
    - --openshift-config=/etc/kubernetes/config/{{ .ConfigFileName }}
    - --logtostderr=false
    - --alsologtostderr
    - --v=2
    - --log-file=/var/log/bootstrap-control-plane/kube-apiserver.log
    volumeMounts:
    - mountPath: /etc/ssl/certs
      name: ssl-certs-host
      readOnly: true
    - mountPath: /etc/kubernetes/secrets
      name: secrets
      readOnly: true
    - mountPath: /etc/kubernetes/cloud
      name: etc-kubernetes-cloud
      readOnly: true
    - mountPath: /etc/kubernetes/config
      name: config
      readOnly: true
    - mountPath: /var/log/bootstrap-control-plane
      name: logs
    - mountPath: /var/log/kube-apiserver
      name: audit-dir
    livenessProbe:
      httpGet:
        scheme: HTTPS
        port: 6443
        path: healthz
      initialDelaySeconds: 45
      timeoutSeconds: 10
    readinessProbe:
      httpGet:
        scheme: HTTPS
        port: 6443
        path: healthz
      initialDelaySeconds: 10
      timeoutSeconds: 10
{{if .OperatorImage}}
  - name: kube-apiserver-insecure-readyz
    image: {{.OperatorImage}}
    imagePullPolicy: IfNotPresent
    terminationMessagePolicy: FallbackToLogsOnError
    command: ["cluster-kube-apiserver-operator", "insecure-readyz"]
    args:
    - --insecure-port=6080
    - --delegate-url=https://localhost:6443/readyz
    ports:
    - containerPort: 6080
{{end}}
  terminationGracePeriodSeconds: 135 # bit more than 70s (minimal termination period) + 60s (apiserver graceful termination)
  volumes:
  - hostPath:
      path: {{ .SecretsHostPath }}
    name: secrets
  - hostPath:
      path: {{ .CloudProviderHostPath }}
    name: etc-kubernetes-cloud
  - hostPath:
      path: {{ .ConfigHostPath }}
    name: config
  - hostPath:
      path: /etc/ssl/certs
    name: ssl-certs-host
  - hostPath:
      path: /var/log/bootstrap-control-plane
    name: logs
  - hostPath:
      path: /var/log/kube-apiserver
    name: audit-dir