(List
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('MASTER_ADDRESS', {[VarSub 1 test_op=VS_TEST_COLON_HYPHEN {[DQ [LIT_CHARS 8.8.8.18]]}]})])
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('ETCD_SERVERS', {[VarSub 2 test_op=VS_TEST_COLON_HYPHEN {[DQ [LIT_CHARS "http://8.8.8.18:2379"]]}]})])
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('SERVICE_CLUSTER_IP_RANGE', {[VarSub 3 test_op=VS_TEST_COLON_HYPHEN {[DQ [LIT_CHARS 10.10.10.0/24]]}]})])
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('ADMISSION_CONTROL', {[VarSub 4 test_op=VS_TEST_COLON_HYPHEN {[DQ ]}]})])
  (Com {[LIT_CHARS cat]}
    <
    (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "# --logtostderr=true: log to standard error instead of files\n"][LIT_CHARS "KUBE_LOGTOSTDERR="][RIGHT_D_QUOTE "\""][LIT_CHARS "--logtostderr=true"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --v=0: log level for V logs\n"][LIT_CHARS "KUBE_LOG_LEVEL="][RIGHT_D_QUOTE "\""][LIT_CHARS "--v=4"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --etcd-servers=[]: List of etcd servers to watch (http://ip:port), \n"][LIT_CHARS "# comma separated. Mutually exclusive with -etcd-config\n"][LIT_CHARS "KUBE_ETCD_SERVERS="][RIGHT_D_QUOTE "\""][LIT_CHARS "--etcd-servers="][VarSub ETCD_SERVERS][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --insecure-bind-address=127.0.0.1: The IP address on which to serve the --insecure-port.\n"][LIT_CHARS "KUBE_API_ADDRESS="][RIGHT_D_QUOTE "\""][LIT_CHARS "--insecure-bind-address="][VarSub MASTER_ADDRESS][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --insecure-port=8080: The port on which to serve unsecured, unauthenticated access.\n"][LIT_CHARS "KUBE_API_PORT="][RIGHT_D_QUOTE "\""][LIT_CHARS "--insecure-port=8080"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --kubelet-port=10250: Kubelet port\n"][LIT_CHARS "NODE_PORT="][RIGHT_D_QUOTE "\""][LIT_CHARS "--kubelet-port=10250"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --advertise-address=<nil>: The IP address on which to advertise \n"][LIT_CHARS "# the apiserver to members of the cluster.\n"][LIT_CHARS "KUBE_ADVERTISE_ADDR="][RIGHT_D_QUOTE "\""][LIT_CHARS "--advertise-address="][VarSub MASTER_ADDRESS][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --allow-privileged=false: If true, allow privileged containers.\n"][LIT_CHARS "KUBE_ALLOW_PRIV="][RIGHT_D_QUOTE "\""][LIT_CHARS "--allow-privileged=false"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --service-cluster-ip-range=<nil>: A CIDR notation IP range from which to assign service cluster IPs. \n"][LIT_CHARS "# This must not overlap with any IP ranges assigned to nodes for pods.\n"][LIT_CHARS "KUBE_SERVICE_ADDRESSES="][RIGHT_D_QUOTE "\""][LIT_CHARS "--service-cluster-ip-range="][VarSub SERVICE_CLUSTER_IP_RANGE][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --admission-control="][RIGHT_D_QUOTE "\""][LIT_CHARS AlwaysAdmit][RIGHT_D_QUOTE "\""][LIT_CHARS ": Ordered list of plug-ins \n"][LIT_CHARS "# to do admission control of resources into cluster. \n"][LIT_CHARS "# Comma-delimited list of: \n"][LIT_CHARS "#   LimitRanger, AlwaysDeny, SecurityContextDeny, NamespaceExists, \n"][LIT_CHARS "#   NamespaceLifecycle, NamespaceAutoProvision,\n"][LIT_CHARS "#   AlwaysAdmit, ServiceAccount, ResourceQuota, DefaultStorageClass\n"][LIT_CHARS "KUBE_ADMISSION_CONTROL="][RIGHT_D_QUOTE "\""][LIT_CHARS "--admission-control="][VarSub ADMISSION_CONTROL][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --client-ca-file="][RIGHT_D_QUOTE "\""][RIGHT_D_QUOTE "\""][LIT_CHARS ": If set, any request presenting a client certificate signed\n"][LIT_CHARS "# by one of the authorities in the client-ca-file is authenticated with an identity\n"][LIT_CHARS "# corresponding to the CommonName of the client certificate.\n"][LIT_CHARS "KUBE_API_CLIENT_CA_FILE="][RIGHT_D_QUOTE "\""][LIT_CHARS "--client-ca-file=/srv/kubernetes/ca.crt"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --tls-cert-file="][RIGHT_D_QUOTE "\""][RIGHT_D_QUOTE "\""][LIT_CHARS ": File containing x509 Certificate for HTTPS.  (CA cert, if any,\n"][LIT_CHARS "# concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file\n"][LIT_CHARS "# and --tls-private-key-file are not provided, a self-signed certificate and key are\n"][LIT_CHARS "# generated for the public address and saved to /var/run/kubernetes.\n"][LIT_CHARS "KUBE_API_TLS_CERT_FILE="][RIGHT_D_QUOTE "\""][LIT_CHARS "--tls-cert-file=/srv/kubernetes/server.cert"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"][LIT_CHARS "\n"][LIT_CHARS "# --tls-private-key-file="][RIGHT_D_QUOTE "\""][RIGHT_D_QUOTE "\""][LIT_CHARS ": File containing x509 private key matching --tls-cert-file.\n"][LIT_CHARS "KUBE_API_TLS_PRIVATE_KEY_FILE="][RIGHT_D_QUOTE "\""][LIT_CHARS "--tls-private-key-file=/srv/kubernetes/server.key"][RIGHT_D_QUOTE "\""][LIT_CHARS "\n"]]} <REDIR_DLESS "<<"> 0),
    (FilenameRedirectNode filename={[LIT_CHARS /opt/kubernetes/cfg/kube-apiserver]} <REDIR_GREAT ">"> 1),
    >
  )
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('KUBE_APISERVER_OPTS', {[DQ [LIT_CHARS "   "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_LOGTOSTDERR}         "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_LOG_LEVEL}           "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_ETCD_SERVERS}        "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_API_ADDRESS}         "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_API_PORT}            "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{NODE_PORT}                "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_ADVERTISE_ADDR}      "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_ALLOW_PRIV}          "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_SERVICE_ADDRESSES}   "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_ADMISSION_CONTROL}   "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_API_CLIENT_CA_FILE}  "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_API_TLS_CERT_FILE}   "][\ LIT_ESCAPED_CHAR "\\\\"][LIT_CHARS "\n"][LIT_CHARS "                        "][\ LIT_ESCAPED_CHAR "\\$"][LIT_CHARS "{KUBE_API_TLS_PRIVATE_KEY_FILE}"]]})])
  (Com {[LIT_CHARS cat]}
    <
    (HereDocRedirectNode here_end='EOF' do_expansion=True body_word={[DQ [LIT_CHARS "[Unit]\n"][LIT_CHARS "Description=Kubernetes API Server\n"][LIT_CHARS "Documentation=https://github.com/kubernetes/kubernetes\n"][LIT_CHARS "\n"][LIT_CHARS "[Service]\n"][LIT_CHARS "EnvironmentFile=-/opt/kubernetes/cfg/kube-apiserver\n"][LIT_CHARS "ExecStart=/opt/kubernetes/bin/kube-apiserver "][VarSub KUBE_APISERVER_OPTS][LIT_CHARS "\n"][LIT_CHARS "Restart=on-failure\n"][LIT_CHARS "\n"][LIT_CHARS "[Install]\n"][LIT_CHARS "WantedBy=multi-user.target\n"]]} <REDIR_DLESS "<<"> 0),
    (FilenameRedirectNode filename={[LIT_CHARS /usr/lib/systemd/system/kube-apiserver.service]} <REDIR_GREAT ">"> 1),
    >
  )
  (Com {[LIT_CHARS systemctl]} {[LIT_CHARS daemon-reload]}  )
  (Com {[LIT_CHARS systemctl]} {[LIT_CHARS enable]} {[LIT_CHARS kube-apiserver]}  )
  (Com {[LIT_CHARS systemctl]} {[LIT_CHARS start]} {[LIT_CHARS kube-apiserver]}  )
)