anchor.diff:                  (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.apiserver.authorizationPolicy)
                 }"
               } \
  +            ${optionalString (elem "Webhook" cfg.apiserver.authorizationMode)
  +              "--authorization-webhook-config-file=${cfg.apiserver.webhookConfig}"
  +            } \
               --secure-port=${toString cfg.apiserver.securePort} \
               --service-cluster-ip-range=${cfg.apiserver.serviceClusterIpRange} \
               ${optionalString (cfg.apiserver.runtimeConfig != "")
  
positive.code:         '';
          default = [];
          type = types.listOf types.attrs;
        };
  
        allowPrivileged = mkOption {
  
negative.code: 
        authorizationMode = mkOption {
          description = ''
            Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/Webhook/RBAC/Node). See
            <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/"/>
          '';
          default = ["RBAC" "Node"];
          type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "Webhook" "RBAC" "Node"]);
        };
  
        authorizationPolicy = mkOption {
  