anchor.diff:  
         authorizationMode = mkOption {
           description = ''
  -          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
  +          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/Webhook/RBAC/Node). See
             <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/"/>
           '';
           default = ["RBAC" "Node"];
  -        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]);
  +        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "Webhook" "RBAC" "Node"]);
         };
   
         authorizationPolicy = mkOption {
  
positive.code:         '';
          default = [];
          type = types.listOf types.attrs;
        };
  
        allowPrivileged = mkOption {
  
negative.code:                 (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.apiserver.authorizationPolicy)
                }"
              } \
              ${optionalString (elem "Webhook" cfg.apiserver.authorizationMode)
                "--authorization-webhook-config-file=${cfg.apiserver.webhookConfig}"
              } \
              --secure-port=${toString cfg.apiserver.securePort} \
              --service-cluster-ip-range=${cfg.apiserver.serviceClusterIpRange} \
              ${optionalString (cfg.apiserver.runtimeConfig != "")
  