<p>I'm using <code>hyperkube</code> to start <code>kube-controller-manager</code> docker container. In order to rotate the kubernetes CA I followed <a href="https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/" rel="nofollow noreferrer">this doc</a>. I have to point the KCM <code>client-ca</code> and <code>cluster-signing-cert</code> to different certs. Automating this is difficult because KCM process uses command line arguments.</p>
<p>I don't see any option <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/" rel="nofollow noreferrer">here</a>. Does anyone know a way of migrating command line arguments to a <code>config.yaml</code> file for <code>kube-controller-manager</code>?</p>
<p>NOTE: My question is about starting the KCM process with config file just like how we have one for kubelets <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/#start-a-kubelet-process-configured-via-the-config-file" rel="nofollow noreferrer">here</a>.</p>

<p>There are two possible ways of starting kube-controller-manager with customized settings, by providing YAML files.</p>
<h4>Method #1</h4>
<p>The <code>kube-controller-manager</code> runs as a pod in your control plane. It's config file is located in <code>/etc/kubernetes/manifests</code>, a <code>kube-controller-manager.yaml</code>. By adding <code>.spec.containers.command</code> like so:</p>
<pre class="lang-yaml prettyprint-override"><code>spec:
  containers:
  - command:
    - kube-controller-manager
    - --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
...
</code></pre>
<p>you can change the defaults.</p>
<p>Then you would have to restart docker (or containerd)</p>
<pre class="lang-text prettyprint-override"><code>sudo systemctl restart docker (or containerd)
</code></pre>
<p>or, if you want to restart just <code>kube-controller-manager</code></p>
<pre class="lang-text prettyprint-override"><code>docker restart kube-controller-mamnager
</code></pre>
<h4>Method #2</h4>
<p>You can change use <code>ClusterConfiguration</code> with <code>extraArgs</code> like so<sup>[<a href="https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/control-plane-flags/#controllermanager-flags" rel="nofollow noreferrer">reference</a>]</sup>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: v1.16.0
controllerManager:
  extraArgs:
    cluster-signing-key-file: /home/johndoe/keys/ca.key
    deployment-controller-sync-period: &quot;50&quot;
</code></pre>
<p>For this you would have to extract your current cluster configuration</p>
<pre class="lang-text prettyprint-override"><code>kubeadm config view &gt; kubeadm-config.yaml
</code></pre>
<p>edit this file accordingly, and then upgrade the control plane</p>
<pre class="lang-text prettyprint-override"><code>kubeadm upgrade apply --config kubeadm-config.yaml
</code></pre>
<hr />
<p>Now, to answer your question - <code>kube-controller-manager</code> does not support <code>--config</code> or any other flag that would allow you to pass a YAML file as it's argument (you can check all available flags <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/#options" rel="nofollow noreferrer">here</a>).</p>
<p>The only possible solutions are the two above.</p>
