apiVersion: kubecontrolplane.config.openshift.io/v1
kind: KubeAPIServerConfig
servingInfo:
  bindAddress: "{{.BindAddress}}"
  bindNetwork: {{.BindNetwork}}
  namedCertificates:
    - names:
      - "kubernetes"
      - "kubernetes.default"
      - "kubernetes.default.svc"
      - "kubernetes.default.svc.cluster.local"
      certFile: /etc/kubernetes/secrets/kube-apiserver-service-network-server.crt
      keyFile: /etc/kubernetes/secrets/kube-apiserver-service-network-server.key
    - names:
        - "localhost"
        - "127.0.0.1"
        - "::1"
      certFile: /etc/kubernetes/secrets/kube-apiserver-localhost-server.crt
      keyFile: /etc/kubernetes/secrets/kube-apiserver-localhost-server.key
    - certFile: /etc/kubernetes/secrets/kube-apiserver-lb-server.crt
      keyFile: /etc/kubernetes/secrets/kube-apiserver-lb-server.key
    - certFile: /etc/kubernetes/secrets/kube-apiserver-internal-lb-server.crt
      keyFile: /etc/kubernetes/secrets/kube-apiserver-internal-lb-server.key
{{- if .ServiceCIDR | len}}
servicesSubnet: {{index .ServiceCIDR 0 -}}
{{- if .ServiceCIDR | len | eq 2}},{{index .ServiceCIDR 1}}{{end -}}
{{- end}}
admission:
  pluginConfig:
    {{if .ServiceCIDR }}
    network.openshift.io/RestrictedEndpointsAdmission:
      configuration:
        apiVersion: network.openshift.io/v1
        kind: RestrictedEndpointsAdmissionConfig
        restrictedCIDRs: {{range .ServiceCIDR}}
        - {{.}}{{end}}{{range .ClusterCIDR}}
        - {{.}}{{end}}
    {{end}}
apiServerArguments:
  client-ca-file:
    - /etc/kubernetes/secrets/kube-apiserver-complete-client-ca-bundle.crt
  etcd-cafile:
    - /etc/kubernetes/secrets/{{.EtcdServingCA}}
  etcd-certfile:
    - /etc/kubernetes/secrets/etcd-client.crt
  etcd-keyfile:
    - /etc/kubernetes/secrets/etcd-client.key
  etcd-servers: {{range .EtcdServerURLs}}
    - {{.}}{{end}}
  feature-gates:
    - "APIPriorityAndFairness=true"
    - "RotateKubeletServerCertificate=true"
    - "SupportPodPidsLimit=true"
    - "NodeDisruptionExclusion=true"
    - "ServiceNodeExclusion=true"
    - "SCTPSupport=true"
    - "LegacyNodeRoleBehavior=false"
{{- if .ServiceCIDR | len | eq 2}}
    - "IPv6DualStack=true"
{{- end}}
  kubelet-certificate-authority:
    - /etc/kubernetes/secrets/kubelet-client-ca-bundle.crt # this is wired to the KCM CSR, which signs serving and client certs for kubelet
  kubelet-client-certificate:
    - /etc/kubernetes/secrets/kube-apiserver-to-kubelet-client.crt
  kubelet-client-key:
    - /etc/kubernetes/secrets/kube-apiserver-to-kubelet-client.key
  proxy-client-cert-file:
    - /etc/kubernetes/secrets/apiserver-proxy.crt
  proxy-client-key-file:
    - /etc/kubernetes/secrets/apiserver-proxy.key
  requestheader-client-ca-file:
    - /etc/kubernetes/secrets/aggregator-signer.crt
  service-account-key-file:
    - /etc/kubernetes/secrets/service-account.pub
  tls-cert-file:
    - /etc/kubernetes/secrets/kube-apiserver-service-network-server.crt
  tls-private-key-file:
    - /etc/kubernetes/secrets/kube-apiserver-service-network-server.key
