anchor.diff:            Api runtime configuration. See
             <link xlink:href="http://kubernetes.io/v1.0/docs/admin/cluster-management.html"/>
           '';
  -        default = "";
  +        default = "rbac.authorization.k8s.io/v1alpha1";
           example = "api/all=false,api/v1=true";
           type = types.str;
         };
  
positive.code:     }];
    });
  
    policyFile = pkgs.writeText "kube-policy"
      (concatStringsSep "\n" (map builtins.toJSON cfg.apiserver.authorizationPolicy));
  
    cniConfig = pkgs.buildEnv {
      name = "kubernetes-cni-config";
      paths = imap1 (i: entry:
        pkgs.writeTextDir "${toString (10+i)}-${entry.type}.conf" (builtins.toJSON entry)
      ) cfg.kubelet.cni.config;
    };
  
negative.code:               "--kubelet-client-key=${cfg.apiserver.kubeletClientKeyFile}"} \
              ${optionalString (cfg.apiserver.clientCaFile != null)
                "--client-ca-file=${cfg.apiserver.clientCaFile}"} \
              --authorization-mode=${concatStringsSep "," cfg.apiserver.authorizationMode} \
              ${optionalString (elem "ABAC" cfg.apiserver.authorizationMode)
                "--authorization-policy-file=${
                  pkgs.writeText "kube-auth-policy"
                  (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.apiserver.authorizationPolicy)
                }"
              } \
              ${optionalString (elem "RBAC" cfg.apiserver.authorizationMode)
                "--authorization-rbac-super-user=${cfg.apiserver.autorizationRBACSuperAdmin}"} \
              --secure-port=${toString cfg.apiserver.securePort} \
              --service-cluster-ip-range=${cfg.apiserver.portalNet} \
              ${optionalString (cfg.apiserver.runtimeConfig != "")
  