anchor.diff:          type = types.nullOr types.path;
         };
   
  -      tokenAuth = mkOption {
  +      tokenAuthFile = mkOption {
           description = ''
             Kubernetes apiserver token authentication file. See
             <link xlink:href="http://kubernetes.io/docs/admin/authentication.html"/>
           '';
           default = null;
  -        example = ''token,user,uid,"group1,group2,group3"'';
  -        type = types.nullOr types.lines;
  +        type = types.nullOr types.path;
  +      };
  +
  +      basicAuthFile = mkOption {
  +        description = ''
  +          Kubernetes apiserver basic authentication file. See
  +          <link xlink:href="http://kubernetes.io/docs/admin/authentication.html"/>
  +        '';
  +        default = pkgs.writeText "users" ''
  +          kubernetes,admin,0
  +        '';
  +        type = types.nullOr types.path;
         };
   
         authorizationMode = mkOption {
           description = ''
  -          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC). See
  -          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
  -        '';
  -        default = "AlwaysAllow";
  -        type = types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC"];
  +          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
  +          <link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/>
  +        '';
  +        default = ["ABAC" "RBAC"];
  +        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]);
         };
   
         authorizationPolicy = mkOption {
  
positive.code:               "--kubelet-client-key=${cfg.apiserver.kubeletClientKeyFile}"} \
              ${optionalString (cfg.apiserver.clientCaFile != null)
                "--client-ca-file=${cfg.apiserver.clientCaFile}"} \
              --authorization-mode=${cfg.apiserver.authorizationMode} \
              ${optionalString (cfg.apiserver.authorizationMode == "ABAC")
                "--authorization-policy-file=${policyFile}"} \
              --secure-port=${toString cfg.apiserver.securePort} \
              --service-cluster-ip-range=${cfg.apiserver.portalNet} \
              ${optionalString (cfg.apiserver.runtimeConfig != "")
  
negative.code:     }];
    });
  
    cniConfig = pkgs.buildEnv {
      name = "kubernetes-cni-config";
      paths = imap (i: entry:
        pkgs.writeTextDir "${toString (10+i)}-${entry.type}.conf" (builtins.toJSON entry)
      ) cfg.kubelet.cni.config;
    };
  