options

type AdmissionOptions struct {
	// GenericAdmission holds the generic admission options.
	GenericAdmission *genericoptions.AdmissionOptions
}

type AnonymousAuthenticationOptions struct {
	Allow bool
}

type BootstrapTokenAuthenticationOptions struct {
	Enable bool
}

type BuiltInAuthenticationOptions struct {
	APIAudiences    []string
	Anonymous       *AnonymousAuthenticationOptions
	BootstrapToken  *BootstrapTokenAuthenticationOptions
	ClientCert      *genericoptions.ClientCertAuthenticationOptions
	OIDC            *OIDCAuthenticationOptions
	RequestHeader   *genericoptions.RequestHeaderAuthenticationOptions
	ServiceAccounts *ServiceAccountAuthenticationOptions
	TokenFile       *TokenFileAuthenticationOptions
	WebHook         *WebHookAuthenticationOptions

	TokenSuccessCacheTTL time.Duration
	TokenFailureCacheTTL time.Duration

	DelegatingAuthenticatorConfig *DelegatingAuthenticatorConfig
}

type BuiltInAuthorizationOptions struct {
	Modes                       []string
	PolicyFile                  string
	WebhookConfigFile           string
	WebhookVersion              string
	WebhookCacheAuthorizedTTL   time.Duration
	WebhookCacheUnauthorizedTTL time.Duration
	// WebhookRetryBackoff specifies the backoff parameters for the authorization webhook retry logic.
	// This allows us to configure the sleep time at each iteration and the maximum number of retries allowed
	// before we fail the webhook call in order to limit the fan out that ensues when the system is degraded.
	WebhookRetryBackoff *wait.Backoff
}

type DelegatingAuthenticatorConfig struct {
	// TokenAccessReviewTimeout specifies a time limit for requests made by the authorization webhook client.
	TokenAccessReviewTimeout time.Duration

	// WebhookRetryBackoff specifies the backoff parameters for the authentication webhook retry logic.
	// This allows us to configure the sleep time at each iteration and the maximum number of retries allowed
	// before we fail the webhook call in order to limit the fan out that ensues when the system is degraded.
	WebhookRetryBackoff *wait.Backoff

	// CacheTTL is the length of time that a token authentication answer will be cached.
	CacheTTL time.Duration

	APIAudiences authenticator.Audiences
	// contains filtered or unexported fields
}

type EmbeddedEtcd struct {
	Enabled bool

	Directory    string
	PeerPort     string
	ClientPort   string
	WalSizeBytes int64
}

type ExtraOptions struct {
	EmbeddedEtcd  *EmbeddedEtcd
	ClientKeyFile string
}

type OIDCAuthenticationOptions struct {
	CAFile         string
	ClientID       string
	IssuerURL      string
	UsernameClaim  string
	UsernamePrefix string
	GroupsClaim    string
	GroupsPrefix   string
	SigningAlgs    []string
	RequiredClaims map[string]string
}

type ServerRunOptions struct {
	GenericServerRunOptions *genericoptions.ServerRunOptions
	Etcd                    *genericoptions.EtcdOptions
	SecureServing           *genericoptions.SecureServingOptionsWithLoopback
	Audit                   *genericoptions.AuditOptions
	Features                *genericoptions.FeatureOptions
	Traces                  *genericoptions.TracingOptions
	APIEnablement           *genericoptions.APIEnablementOptions
	EgressSelector          *genericoptions.EgressSelectorOptions

	Admission      *AdmissionOptions
	Authentication *BuiltInAuthenticationOptions
	Authorization  *BuiltInAuthorizationOptions

	ServiceClusterIPRanges string // ServiceClusterIPRange is mapped to input provided by user
	// PrimaryServiceClusterIPRange and SecondaryServiceClusterIPRange are the results
	// of parsing ServiceClusterIPRange into actual values
	PrimaryServiceClusterIPRange   net.IPNet
	APIServerServiceIP             net.IP // APIServerServiceIP is the first valid IP from PrimaryServiceClusterIPRange
	SecondaryServiceClusterIPRange net.IPNet

	Metrics                           *metrics.Options
	Logs                              *logs.Options
	EventTTL                          time.Duration
	IdentityLeaseDurationSeconds      int
	IdentityLeaseRenewIntervalSeconds int
	EndpointReconcilerType            string

	EnableAggregatorRouting  bool
	AllowPrivileged          bool
	MaxConnectionBytesPerSec int64

	ServiceAccountSigningKeyFile     string
	ServiceAccountIssuer             serviceaccount.TokenGenerator
	ServiceAccountTokenMaxExpiration time.Duration

	KubeletConfig kubeletclient.KubeletClientConfig
	ExtraOptions  *ExtraOptions

	KubeControllerManagerOptions *kubectrmgroptions.KubeControllerManagerOptions

	// ControlplaneConfigDir contains minimum requried configurations for server
	ControlplaneConfigDir string
	// ControlplaneDataDir is used for saving controlplane data
	ControlplaneDataDir string

	// EnableSelfManagement register the current cluster self as a managed cluster
	EnableSelfManagement bool
	// SelfManagementClusterName is the name of self management cluster, by default, it's local-cluster
	SelfManagementClusterName string

	// options for registration hub controller
	RegistrationOpts *registrationhub.HubManagerOptions

	// EnableDelegatingAuthentication delegate the authentication with controlplane hosing cluster
	EnableDelegatingAuthentication bool

	ProxyClientCertFile string
	ProxyClientKeyFile  string
}

type ServiceAccountAuthenticationOptions struct {
	KeyFiles         []string
	Lookup           bool
	Issuers          []string
	JWKSURI          string
	MaxExpiration    time.Duration
	ExtendExpiration bool
}

type TokenFileAuthenticationOptions struct {
	TokenFile string
}

type WebHookAuthenticationOptions struct {
	ConfigFile string
	Version    string
	CacheTTL   time.Duration

	// RetryBackoff specifies the backoff parameters for the authentication webhook retry logic.
	// This allows us to configure the sleep time at each iteration and the maximum number of retries allowed
	// before we fail the webhook call in order to limit the fan out that ensues when the system is degraded.
	RetryBackoff *wait.Backoff
}