anchor.diff:                "--kubelet-client-key=${cfg.apiserver.kubeletClientKeyFile}"} \
               ${optionalString (cfg.apiserver.clientCaFile != null)
                 "--client-ca-file=${cfg.apiserver.clientCaFile}"} \
  -            --authorization-mode=${cfg.apiserver.authorizationMode} \
  -            ${optionalString (cfg.apiserver.authorizationMode == "ABAC")
  -              "--authorization-policy-file=${policyFile}"} \
  +            --authorization-mode=${concatStringsSep "," cfg.apiserver.authorizationMode} \
  +            ${optionalString (elem "ABAC" cfg.apiserver.authorizationMode)
  +              "--authorization-policy-file=${
  +                pkgs.writeText "kube-auth-policy"
  +                (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.apiserver.authorizationPolicy)
  +              }"
  +            } \
  +            ${optionalString (elem "RBAC" cfg.apiserver.authorizationMode)
  +              "--authorization-rbac-super-user=${cfg.apiserver.autorizationRBACSuperAdmin}"} \
               --secure-port=${toString cfg.apiserver.securePort} \
               --service-cluster-ip-range=${cfg.apiserver.portalNet} \
               ${optionalString (cfg.apiserver.runtimeConfig != "")
  
positive.code:             ${if (cfg.controllerManager.serviceAccountKeyFile!=null)
                then "--service-account-private-key-file=${cfg.controllerManager.serviceAccountKeyFile}"
                else "--service-account-private-key-file=/var/run/kubernetes/apiserver.key"} \
              ${optionalString (cfg.controllerManager.rootCaFile!=null)
                "--root-ca-file=${cfg.controllerManager.rootCaFile}"} \
              ${optionalString (cfg.controllerManager.clusterCidr!=null)
                "--cluster-cidr=${cfg.controllerManager.clusterCidr}"} \
              --allocate-node-cidrs=true \
  
negative.code:               "--tls-cert-file=${cfg.apiserver.tlsCertFile}"} \
              ${optionalString (cfg.apiserver.tlsKeyFile != null)
                "--tls-private-key-file=${cfg.apiserver.tlsKeyFile}"} \
              ${optionalString (cfg.apiserver.tokenAuthFile != null)
                "--token-auth-file=${cfg.apiserver.tokenAuthFile}"} \
              ${optionalString (cfg.apiserver.basicAuthFile != null)
                "--basic-auth-file=${cfg.apiserver.basicAuthFile}"} \
              --kubelet-https=${if cfg.apiserver.kubeletHttps then "true" else "false"} \
              ${optionalString (cfg.apiserver.kubeletClientCaFile != null)
                "--kubelet-certificate-authority=${cfg.apiserver.kubeletClientCaFile}"} \
              ${optionalString (cfg.apiserver.kubeletClientCertFile != null)
  