<p>I am trying to add the two flags below to apiserver in the /etc/kubernetes/manifests/kube-apiserver.yaml file:</p>
<pre><code>spec:
   containers:
   - command:
     - kube-apiserver
     - --enable-admission-plugins=NodeRestriction,PodNodeSelector
     - --admission-control-config-file=/vagrant/admission-control.yaml

[...]
</code></pre>
<p>I am not mounting a volume or mount point for the /vagrant/admission-control.yaml file. It is completely accessible from the node master, since it is shared by the VM created by vagrant:</p>
<pre><code>vagrant@master-1:~$ cat /vagrant/admission-control.yaml 
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodNodeSelector
  path: /vagrant/podnodeselector.yaml
vagrant@master-1:~$
</code></pre>
<p>Kubernetes version:</p>
<pre><code>vagrant@master-1:~$ kubectl version

Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;21&quot;, GitVersion:&quot;v1.21.0&quot;, GitCommit:&quot;cb303e613a121a29364f75cc67d3d580833a7479&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2021-04-08T16:31:21Z&quot;, GoVersion:&quot;go1.16.1&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}

Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;21&quot;, GitVersion:&quot;v1.21.0&quot;, GitCommit:&quot;cb303e613a121a29364f75cc67d3d580833a7479&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2021-04-08T16:25:06Z&quot;, GoVersion:&quot;go1.16.1&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
</code></pre>
<p>Link to the /etc/kubernetes/manifests/kube-apiserver.yaml file being used by the running cluster <a href="https://drive.google.com/file/d/1NajGU-ANFVV-PalLnvEcaX_d8pncF3j9/view?usp=sharing" rel="nofollow noreferrer">Here</a></p>
<pre><code>vagrant@master-1:~$ kubectl delete pods kube-apiserver-master-1 -n kube-system

pod &quot;kube-apiserver-master-1&quot; deleted
</code></pre>
<p>Unfortunately &quot;kubectl describe pods kube-apiserver-master-1 -n kube-system&quot; only informs that the pod has been recreated. Flags do not appear as desired. No errors reported.</p>
<p>Any suggestion will be helpful,</p>
<p>Thank you.</p>
<p>NOTES:</p>
<ol>
<li>I also tried to make a patch on the apiserver's configmap.
The patch is applied,  but it does not take effect in the new
running pod.</li>
<li>I also tried to pass the two flags in a file via kubeadm
init --config, but there is little documentation on how to put these
two flags and all the other ones of the apiserver that I need in a configuration file in order to reinstall the master node.</li>
</ol>
<p><strong>UPDATE:</strong></p>
<p>I hope that be useful for everyone facing the same issue...</p>
<p>After 2 days of searching the internet, and lots and lots of tests, I only managed to make it work with the procedure below:</p>
<pre><code>sudo tee ${KUBEADM_INIT_CONFIG_FILE} &lt;&lt;EOF
apiVersion: kubeadm.k8s.io/v1beta2
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: &quot;${INTERNAL_IP}&quot;
  bindPort: 6443
---
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
kubernetesVersion: ${KUBERNETES_VERSION}
controlPlaneEndpoint: &quot;${LOADBALANCER_ADDRESS}:6443&quot;
networking:
  podSubnet: &quot;10.244.0.0/16&quot;
apiServer:
  extraArgs:
    advertise-address: ${INTERNAL_IP}
    enable-admission-plugins: NodeRestriction,PodNodeSelector
    admission-control-config-file: ${ADMISSION_CONTROL_CONFIG_FILE}
  extraVolumes:
    - name: admission-file
      hostPath: ${ADMISSION_CONTROL_CONFIG_FILE}
      mountPath: ${ADMISSION_CONTROL_CONFIG_FILE}
      readOnly: true
    - name: podnodeselector-file
      hostPath: ${PODNODESELECTOR_CONFIG_FILE}
      mountPath: ${PODNODESELECTOR_CONFIG_FILE}
      readOnly: true
EOF


sudo kubeadm init phase control-plane apiserver --config=${KUBEADM_INIT_CONFIG_FILE}
</code></pre>

<p>You need to create a <code>hostPath</code> volume mount like below</p>
<pre><code>volumeMounts:
- mountPath: /vagrant
  name: admission
  readOnly: true
...
volumes:
- hostPath:
    path: /vagrant
    type: DirectoryOrCreate
  name: admission
</code></pre>
