Repository: k3s-io/k3s
File: pkg/cli/cmds/server.go (Go)

Code before:
	FlannelIfaceFlag,
	FlannelConfFlag,
	FlannelCniConfFileFlag,
	VPNAuth,
	VPNAuthFile,
	ExtraKubeletArgs,
	ExtraKubeProxyArgs,
	ProtectKernelDefaultsFlag,
	&cli.BoolFlag{
		Name:        "secrets-encryption",
		Usage:       "Enable secret encryption at rest",
		Destination: &ServerConfig.EncryptSecrets,
	},
	// Experimental flags
	EnablePProfFlag,
	&cli.BoolFlag{
		Name:        "rootless",
		Usage:       "(experimental) Run rootless",
		Destination: &ServerConfig.Rootless,
	},
	&cli.StringFlag{
		Name:        "secrets-encryption-key-type",
		Usage:       "(experimental) Secret encryption key type (valid values: 'aescbc', 'secretbox')",
		Destination: &ServerConfig.EncryptKeyType,
		Value:       "aescbc",
	},
	PreferBundledBin,
	SELinuxFlag,
	LBServerPortFlag,

	// Hidden/Deprecated flags below

	&cli.BoolFlag{
		Name:        "disable-agent",
		Usage:       "Do not run a local agent and register a local kubelet",
		Hidden:      true,
		Destination: &ServerConfig.DisableAgent,
	},
	&cli.StringSliceFlag{
		Hidden:      true,
		Name:        "kube-controller-arg",
		Usage:       "(flags) Customized flag for kube-controller-manager process",
		Destination: &ServerConfig.ExtraControllerArgs,
	},
	&cli.StringSliceFlag{
		Hidden:      true,
		Name:        "kube-cloud-controller-arg",
		Usage:       "(flags) Customized flag for kube-cloud-controller-manager process",
		Destination: &ServerConfig.ExtraCloudControllerArgs,
	},
}

Review comment (security):
Nit: these are documented upstream as "encryption providers", not key types. Ref: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers
```suggestion
	&cli.StringFlag{
		Name:        "secrets-encryption-provider",
		Usage:       "(experimental) Secret encryption provider (valid values: 'aescbc', 'secretbox')",
		Destination: &ServerConfig.EncryptProviderName,
		Value:       "aescbc",
	},
```

Code after:
	FlannelIfaceFlag,
	FlannelConfFlag,
	FlannelCniConfFileFlag,
	VPNAuth,
	VPNAuthFile,
	ExtraKubeletArgs,
	ExtraKubeProxyArgs,
	ProtectKernelDefaultsFlag,
	&cli.BoolFlag{
		Name:        "secrets-encryption",
		Usage:       "Enable secret encryption at rest",
		Destination: &ServerConfig.EncryptSecrets,
	},
	// Experimental flags
	EnablePProfFlag,
	&cli.BoolFlag{
		Name:        "rootless",
		Usage:       "(experimental) Run rootless",
		Destination: &ServerConfig.Rootless,
	},
	&cli.StringFlag{
		Name:        "secrets-encryption-provider",
		Usage:       "(experimental) Secret encryption provider (valid values: 'aescbc', 'secretbox')",
		Destination: &ServerConfig.EncryptProvider,
		Value:       "aescbc",
	},
	PreferBundledBin,
	SELinuxFlag,
	LBServerPortFlag,

	// Hidden/Deprecated flags below

	&cli.BoolFlag{
		Name:        "disable-agent",
		Usage:       "Do not run a local agent and register a local kubelet",
		Hidden:      true,
		Destination: &ServerConfig.DisableAgent,
	},
	&cli.StringSliceFlag{
		Hidden:      true,
		Name:        "kube-controller-arg",
		Usage:       "(flags) Customized flag for kube-controller-manager process",
		Destination: &ServerConfig.ExtraControllerArgs,
	},
	&cli.StringSliceFlag{
		Hidden:      true,
		Name:        "kube-cloud-controller-arg",
		Usage:       "(flags) Customized flag for kube-cloud-controller-manager process",
		Destination: &ServerConfig.ExtraCloudControllerArgs,
	},
}