f507bc2553
This change updates the API server code to load the encryption config once at start up instead of multiple times. Previously the code would set up the storage transformers and the etcd healthz checks in separate parse steps. This is problematic for KMS v2 key ID based staleness checks which need to be able to assert that the API server has a single view into the KMS plugin's current key ID. Signed-off-by: Monis Khan <mok@microsoft.com>
109 lines
4.8 KiB
Go
109 lines
4.8 KiB
Go
/*
|
|
Copyright 2017 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
// Package app does all of the work necessary to create a Kubernetes
|
|
// APIServer by binding together the API, master and APIServer infrastructure.
|
|
// It can be configured and called directly or via the hyperkube framework.
|
|
package app
|
|
|
|
import (
|
|
v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
|
|
"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
|
|
apiextensionsapiserver "k8s.io/apiextensions-apiserver/pkg/apiserver"
|
|
apiextensionsoptions "k8s.io/apiextensions-apiserver/pkg/cmd/server/options"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
|
"k8s.io/apiserver/pkg/admission"
|
|
"k8s.io/apiserver/pkg/features"
|
|
genericapiserver "k8s.io/apiserver/pkg/server"
|
|
utilfeature "k8s.io/apiserver/pkg/util/feature"
|
|
"k8s.io/apiserver/pkg/util/webhook"
|
|
kubeexternalinformers "k8s.io/client-go/informers"
|
|
"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
|
|
)
|
|
|
|
func createAPIExtensionsConfig(
|
|
kubeAPIServerConfig genericapiserver.Config,
|
|
externalInformers kubeexternalinformers.SharedInformerFactory,
|
|
pluginInitializers []admission.PluginInitializer,
|
|
commandOptions *options.ServerRunOptions,
|
|
masterCount int,
|
|
serviceResolver webhook.ServiceResolver,
|
|
authResolverWrapper webhook.AuthenticationInfoResolverWrapper,
|
|
) (*apiextensionsapiserver.Config, error) {
|
|
// make a shallow copy to let us twiddle a few things
|
|
// most of the config actually remains the same. We only need to mess with a couple items related to the particulars of the apiextensions
|
|
genericConfig := kubeAPIServerConfig
|
|
genericConfig.PostStartHooks = map[string]genericapiserver.PostStartHookConfigEntry{}
|
|
genericConfig.RESTOptionsGetter = nil
|
|
|
|
// override genericConfig.AdmissionControl with apiextensions' scheme,
|
|
// because apiextensions apiserver should use its own scheme to convert resources.
|
|
err := commandOptions.Admission.ApplyTo(
|
|
&genericConfig,
|
|
externalInformers,
|
|
genericConfig.LoopbackClientConfig,
|
|
utilfeature.DefaultFeatureGate,
|
|
pluginInitializers...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// copy the etcd options so we don't mutate originals.
|
|
// we assume that the etcd options have been completed already. avoid messing with anything outside
|
|
// of changes to StorageConfig as that may lead to unexpected behavior when the options are applied.
|
|
etcdOptions := *commandOptions.Etcd
|
|
etcdOptions.StorageConfig.Paging = utilfeature.DefaultFeatureGate.Enabled(features.APIListChunking)
|
|
// this is where the true decodable levels come from.
|
|
etcdOptions.StorageConfig.Codec = apiextensionsapiserver.Codecs.LegacyCodec(v1beta1.SchemeGroupVersion, v1.SchemeGroupVersion)
|
|
// prefer the more compact serialization (v1beta1) for storage until https://issue.k8s.io/82292 is resolved for objects whose v1 serialization is too big but whose v1beta1 serialization can be stored
|
|
etcdOptions.StorageConfig.EncodeVersioner = runtime.NewMultiGroupVersioner(v1beta1.SchemeGroupVersion, schema.GroupKind{Group: v1beta1.GroupName})
|
|
etcdOptions.SkipHealthEndpoints = true // avoid double wiring of health checks
|
|
if err := etcdOptions.ApplyTo(&genericConfig); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// override MergedResourceConfig with apiextensions defaults and registry
|
|
if err := commandOptions.APIEnablement.ApplyTo(
|
|
&genericConfig,
|
|
apiextensionsapiserver.DefaultAPIResourceConfigSource(),
|
|
apiextensionsapiserver.Scheme); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
apiextensionsConfig := &apiextensionsapiserver.Config{
|
|
GenericConfig: &genericapiserver.RecommendedConfig{
|
|
Config: genericConfig,
|
|
SharedInformerFactory: externalInformers,
|
|
},
|
|
ExtraConfig: apiextensionsapiserver.ExtraConfig{
|
|
CRDRESTOptionsGetter: apiextensionsoptions.NewCRDRESTOptionsGetter(etcdOptions),
|
|
MasterCount: masterCount,
|
|
AuthResolverWrapper: authResolverWrapper,
|
|
ServiceResolver: serviceResolver,
|
|
},
|
|
}
|
|
|
|
// we need to clear the poststarthooks so we don't add them multiple times to all the servers (that fails)
|
|
apiextensionsConfig.GenericConfig.PostStartHooks = map[string]genericapiserver.PostStartHookConfigEntry{}
|
|
|
|
return apiextensionsConfig, nil
|
|
}
|
|
|
|
func createAPIExtensionsServer(apiextensionsConfig *apiextensionsapiserver.Config, delegateAPIServer genericapiserver.DelegationTarget) (*apiextensionsapiserver.CustomResourceDefinitions, error) {
|
|
return apiextensionsConfig.Complete().New(delegateAPIServer)
|
|
}
|