anchor.diff:              --address=${cfg.controllerManager.address} \
               --port=${toString cfg.controllerManager.port} \
               --master=${cfg.controllerManager.master} \
  +            ${optionalString (cfg.controllerManager.serviceAccountPrivateKey!=null)
  +              "--service-account-private-key-file=${cfg.controllerManager.serviceAccountPrivateKey}"} \
  +            ${optionalString (cfg.controllerManager.rootCaFile!=null)
  +              "--root-ca-file=${cfg.controllerManager.rootCaFile}"} \
               --logtostderr=true \
               ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
               ${cfg.controllerManager.extraOpts}
  
positive.code:       authorizationPolicy = mkOption {
          description = ''
            Kubernetes apiserver authorization policy file. See
            <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authorization.md"/>
          '';
          default = [];
          example = literalExample ''
  
negative.code:       };
  
        apiServers = mkOption {
          description = ''
            Kubernetes kubelet list of Kubernetes API servers for publishing events,
            and reading pods and services.
          '';
          default = ["${cfg.apiserver.address}:${toString cfg.apiserver.port}"];
          type = types.listOf types.str;
        };
  