anchor.diff:          type = types.nullOr types.path;
         };
   
  -      tokenAuth = mkOption {
  +      tokenAuthFile = mkOption {
           description = ''
             Kubernetes apiserver token authentication file. See
             <link xlink:href="http://kubernetes.io/docs/admin/authentication.html"/>
           '';
           default = null;
  -        example = ''token,user,uid,"group1,group2,group3"'';
  -        type = types.nullOr types.lines;
  +        type = types.nullOr types.path;
  +      };
  +
  +      basicAuthFile = mkOption {
  +        description = ''
  +          Kubernetes apiserver basic authentication file. See
  +          <link xlink:href="http://kubernetes.io/docs/admin/authentication.html"/>
  +        '';
  +        default = pkgs.writeText "users" ''
  +          kubernetes,admin,0
  +        '';
  +        type = types.nullOr types.path;
         };
   
         authorizationMode = mkOption {
           description = ''
  -          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC). See
  -          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
  -        '';
  -        default = "AlwaysAllow";
  -        type = types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC"];
  +          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
  +          <link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/>
  +        '';
  +        default = ["ABAC" "RBAC"];
  +        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]);
         };
   
         authorizationPolicy = mkOption {
  
positive.code:     }];
    });
  
    policyFile = pkgs.writeText "kube-policy"
      (concatStringsSep "\n" (map builtins.toJSON cfg.apiserver.authorizationPolicy));
  
    cniConfig = pkgs.buildEnv {
      name = "kubernetes-cni-config";
      paths = imap1 (i: entry:
        pkgs.writeTextDir "${toString (10+i)}-${entry.type}.conf" (builtins.toJSON entry)
      ) cfg.kubelet.cni.config;
    };
  
negative.code:           Kubernetes apiserver authorization policy file. See
            <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
          '';
          default = [
            {
              apiVersion = "abac.authorization.kubernetes.io/v1beta1";
              kind = "Policy";
              spec = {
                user  = "admin";
                namespace = "*";
                resource = "*";
                apiGroup = "*";
                nonResourcePath = "*";
              };
            }
            {
              apiVersion = "abac.authorization.kubernetes.io/v1beta1";
              kind = "Policy";
              spec = {
                user  = "kubecfg";
                namespace = "*";
                resource = "*";
                apiGroup = "*";
                nonResourcePath = "*";
              };
            }
            {
              apiVersion = "abac.authorization.kubernetes.io/v1beta1";
              kind = "Policy";
              spec = {
                user  = "kubelet";
                namespace = "*";
                resource = "*";
                apiGroup = "*";
                nonResourcePath = "*";
              };
            }
            {
              apiVersion = "abac.authorization.kubernetes.io/v1beta1";
              kind = "Policy";
              spec = {
                user  = "kube";
                namespace = "*";
                resource = "*";
                apiGroup = "*";
                nonResourcePath = "*";
              };
            }
            {
              apiVersion = "abac.authorization.kubernetes.io/v1beta1";
              kind = "Policy";
              spec = {
                user  = "system:serviceaccount:kube-system:default";
                namespace = "*";
                resource = "*";
                apiGroup = "*";
                nonResourcePath = "*";
              };
            }
          ];
          type = types.listOf types.attrs;
        };
  
        autorizationRBACSuperAdmin = mkOption {
          description = "Role based authorization super admin";
          default = "admin";
          type = types.str;
        };
  
        allowPrivileged = mkOption {
  