88 lines
4.5 KiB
Go
88 lines
4.5 KiB
Go
/*
|
|
Copyright 2016 The Kubernetes Authors All rights reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package genericapiserver
|
|
|
|
import (
|
|
"net"
|
|
|
|
"github.com/spf13/pflag"
|
|
)
|
|
|
|
const (
|
|
// TODO: This can be tightened up. It still matches objects named watch or proxy.
|
|
defaultLongRunningRequestRE = "(/|^)((watch|proxy)(/|$)|(logs?|portforward|exec|attach)/?$)"
|
|
)
|
|
|
|
// ServerRunOptions contains the options while running a generic api server.
|
|
type ServerRunOptions struct {
|
|
BindAddress net.IP
|
|
CertDirectory string
|
|
ClientCAFile string
|
|
InsecureBindAddress net.IP
|
|
InsecurePort int
|
|
LongRunningRequestRE string
|
|
MaxRequestsInFlight int
|
|
SecurePort int
|
|
TLSCertFile string
|
|
TLSPrivateKeyFile string
|
|
}
|
|
|
|
func NewServerRunOptions() *ServerRunOptions {
|
|
return &ServerRunOptions{
|
|
BindAddress: net.ParseIP("0.0.0.0"),
|
|
CertDirectory: "/var/run/kubernetes",
|
|
InsecureBindAddress: net.ParseIP("127.0.0.1"),
|
|
InsecurePort: 8080,
|
|
LongRunningRequestRE: defaultLongRunningRequestRE,
|
|
SecurePort: 6443,
|
|
MaxRequestsInFlight: 400,
|
|
}
|
|
}
|
|
|
|
// AddFlags adds flags for a specific APIServer to the specified FlagSet
|
|
func (s *ServerRunOptions) AddFlags(fs *pflag.FlagSet) {
|
|
// Note: the weird ""+ in below lines seems to be the only way to get gofmt to
|
|
// arrange these text blocks sensibly. Grrr.
|
|
fs.IPVar(&s.BindAddress, "bind-address", s.BindAddress, ""+
|
|
"The IP address on which to listen for the --secure-port port. The "+
|
|
"associated interface(s) must be reachable by the rest of the cluster, and by CLI/web "+
|
|
"clients. If blank, all interfaces will be used (0.0.0.0).")
|
|
fs.StringVar(&s.CertDirectory, "cert-dir", s.CertDirectory, "The directory where the TLS certs are located (by default /var/run/kubernetes). "+
|
|
"If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored.")
|
|
fs.StringVar(&s.ClientCAFile, "client-ca-file", s.ClientCAFile, "If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.")
|
|
fs.IPVar(&s.InsecureBindAddress, "insecure-bind-address", s.InsecureBindAddress, ""+
|
|
"The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). "+
|
|
"Defaults to localhost.")
|
|
fs.IPVar(&s.InsecureBindAddress, "address", s.InsecureBindAddress, "DEPRECATED: see --insecure-bind-address instead")
|
|
fs.IntVar(&s.InsecurePort, "insecure-port", s.InsecurePort, ""+
|
|
"The port on which to serve unsecured, unauthenticated access. Default 8080. It is assumed "+
|
|
"that firewall rules are set up such that this port is not reachable from outside of "+
|
|
"the cluster and that port 443 on the cluster's public address is proxied to this "+
|
|
"port. This is performed by nginx in the default setup.")
|
|
fs.IntVar(&s.InsecurePort, "port", s.InsecurePort, "DEPRECATED: see --insecure-port instead")
|
|
fs.StringVar(&s.LongRunningRequestRE, "long-running-request-regexp", s.LongRunningRequestRE, "A regular expression matching long running requests which should be excluded from maximum inflight request handling.")
|
|
fs.IntVar(&s.MaxRequestsInFlight, "max-requests-inflight", s.MaxRequestsInFlight, "The maximum number of requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit.")
|
|
fs.IntVar(&s.SecurePort, "secure-port", s.SecurePort, ""+
|
|
"The port on which to serve HTTPS with authentication and authorization. If 0, "+
|
|
"don't serve HTTPS at all.")
|
|
fs.StringVar(&s.TLSCertFile, "tls-cert-file", s.TLSCertFile, ""+
|
|
"File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). "+
|
|
"If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, "+
|
|
"a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.")
|
|
fs.StringVar(&s.TLSPrivateKeyFile, "tls-private-key-file", s.TLSPrivateKeyFile, "File containing x509 private key matching --tls-cert-file.")
|
|
}
|