anchor.diff:                "--tls-private-key-file=${cfg.apiserver.tlsPrivateKeyFile}"} \
               ${optionalString (cfg.apiserver.tokenAuth!=[])
                 "--token-auth-file=${tokenAuthFile}"} \
  +            ${optionalString (cfg.apiserver.clientCaFile!="")
  +              "--client-ca-file=${cfg.apiserver.clientCaFile}"} \
               --authorization-mode=${cfg.apiserver.authorizationMode} \
               ${optionalString (cfg.apiserver.authorizationMode == "ABAC")
                 "--authorization-policy-file=${authorizationPolicyFile}"} \
               --secure-port=${toString cfg.apiserver.securePort} \
               --service-cluster-ip-range=${cfg.apiserver.portalNet} \
  +            ${optionalString (cfg.apiserver.runtimeConfig!="")
  +              "--runtime-config=${cfg.apiserver.runtimeConfig}"} \
  +            --admission_control=${cfg.apiserver.admissionControl} \
               --logtostderr=true \
               ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
               ${cfg.apiserver.extraOpts}
  
positive.code:         type = types.str;
        };
  
        machines = mkOption {
          description = "Kubernetes controller list of machines to schedule to schedule onto";
          default = [];
          type = types.listOf types.str;
        };
  
        extraOpts = mkOption {
          description = "Kubernetes controller extra command line options.";
          default = "";
  
negative.code:             --address=${cfg.controllerManager.address} \
              --port=${toString cfg.controllerManager.port} \
              --master=${cfg.controllerManager.master} \
              --logtostderr=true \
              ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
              ${cfg.controllerManager.extraOpts}
  