runAsNonRoot: true
      capabilities:
        add:
        - NET_BIND_SERVICE
        drop:
        - ALL
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /kube-dns-config
      name: kube-dns-config
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-s8rz5
      readOnly: true
  - args:
    - -v=2

		for _, volumeMount := range container.VolumeMounts {
			// Existing mounts at the default mount path prevent mounting of the API token
			if volumeMount.MountPath == DefaultAPITokenMountPath {
				existingContainerMount = true
				break
			}
		}
		if !existingContainerMount {
			pod.Spec.InitContainers[i].VolumeMounts = append(pod.Spec.InitContainers[i].VolumeMounts, volumeMount)
			needsTokenVolume = true
		}
	}

    terminationMessagePath: terminationMessagePathValue
    terminationMessagePolicy: terminationMessagePolicyValue
    tty: true
    volumeDevices:
    - devicePath: devicePathValue
      name: nameValue
    volumeMounts:
    - mountPath: mountPathValue
      mountPropagation: mountPropagationValue
      name: nameValue
      readOnly: true
      recursiveReadOnly: recursiveReadOnlyValue
      subPath: subPathValue

      runAsGroup: 1001
      capabilities:
        add:
        - NET_BIND_SERVICE
        drop:
        - ALL
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /kube-dns-config
      name: kube-dns-config
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-s8rz5
      readOnly: true
  - args:
    - -v=2

    terminationMessagePath: terminationMessagePathValue
    terminationMessagePolicy: terminationMessagePolicyValue
    tty: true
    volumeDevices:
    - devicePath: devicePathValue
      name: nameValue
    volumeMounts:
    - mountPath: mountPathValue
      mountPropagation: mountPropagationValue
      name: nameValue
      readOnly: true
      recursiveReadOnly: recursiveReadOnlyValue
      subPath: subPathValue

			delete(mounts.volumeMounts[kubeadmconstants.KubeControllerManager], flexvolumeDirVolumeName)
			if !reflect.DeepEqual(mounts.volumes, rt.vol) {
				t.Errorf(
					"failed getHostPathVolumesForTheControlPlane:\n\texpected: %v\n\t  actual: %v",
					rt.vol,
					mounts.volumes,
				)
			}
			if !reflect.DeepEqual(mounts.volumeMounts, rt.volMount) {
				t.Errorf(

	b.RestartPolicy = &value
	return b
}

// WithVolumeMounts adds the given value to the VolumeMounts field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the VolumeMounts field.

		for i := range podSpec.Containers {
			for j := range podSpec.Containers[i].VolumeMounts {
				podSpec.Containers[i].VolumeMounts[j].RecursiveReadOnly = nil
			}
		}
		for i := range podSpec.InitContainers {
			for j := range podSpec.InitContainers[i].VolumeMounts {
				podSpec.InitContainers[i].VolumeMounts[j].RecursiveReadOnly = nil
			}
		}
		for i := range podSpec.EphemeralContainers {

          startupProbe:
            failureThreshold: 600
            httpGet:
              path: /healthz/ready
              port: 15021
            periodSeconds: 1
            timeoutSeconds: 3
          volumeMounts:
          - mountPath: /var/run/secrets/workload-spiffe-uds
            name: workload-socket
          - mountPath: /var/run/secrets/credential-uds
            name: credential-socket

			Image:           images.GetKubernetesImage(kubeadmconstants.KubeAPIServer, cfg),
			ImagePullPolicy: v1.PullIfNotPresent,
			Command:         getAPIServerCommand(cfg, endpoint),
			VolumeMounts:    staticpodutil.VolumeMountMapToSlice(mounts.GetVolumeMounts(kubeadmconstants.KubeAPIServer)),