anchor.diff:        };
   
         runtimeConfig = mkOption {
  -        description = "Api runtime configuration";
  +        description = ''
  +          Api runtime configuration. See
  +          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/cluster-management.html"/>
  +        '';
           default = "";
           example = "api/all=false,api/v1=true";
           type = types.str;
         };
   
         admissionControl = mkOption {
  -        description = "Kubernetes admission control plugins to use.";
  +        description = ''
  +          Kubernetes admission control plugins to use. See
  +          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/admission-controllers.html"/>
  +        '';
           default = ["AlwaysAdmit"];
  +        example = [
  +          "NamespaceLifecycle" "NamespaceExists" "LimitRanger"
  +          "SecurityContextDeny" "ServiceAccount" "ResourceQuota"
  +        ];
           type = types.listOf types.str;
  +      };
  +
  +      serviceAccountKey = mkOption {
  +        description = ''
  +          Kubernetes apiserver PEM-encoded x509 RSA private or public key file,
  +          used to verify ServiceAccount tokens.
  +        '';
  +        default = null;
  +        type = types.nullOr types.path;
         };
   
         extraOpts = mkOption {
  
positive.code:       tokenAuth = mkOption {
          description = ''
            Kubernetes apiserver token authentication file. See
            <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authentication.md"/>
          '';
          default = {};
          example = literalExample ''
  
negative.code:         type = types.str;
        };
  
        serviceAccountPrivateKey = mkOption {
          description = ''
            Kubernetes controller manager PEM-encoded private RSA key file used to
            sign service account tokens
          '';
          default = null;
          type = types.nullOr types.path;
        };
  
        rootCaFile = mkOption {
          description = ''
            Kubernetes controller manager certificate authority file included in
            service account's token secret.
          '';
          default = null;
          type = types.nullOr types.path;
        };
  
        extraOpts = mkOption {
          description = "Kubernetes controller manager extra command line options.";
          default = "";
          type = types.str;
        };
  