New files

cmd/agent/agent.go

+package agent
+
+import (
+	"math/rand"
+	"net"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"k8s.io/apiserver/pkg/util/logs"
+	app2 "k8s.io/kubernetes/cmd/kube-proxy/app"
+	"k8s.io/kubernetes/cmd/kubelet/app"
+	_ "k8s.io/kubernetes/pkg/client/metrics/prometheus" // for client metric registration
+	_ "k8s.io/kubernetes/pkg/version/prometheus"        // for version metric registration
+)
+
+type AgentConfig struct {
+	NodeName      string
+	ClusterCIDR   net.IPNet
+	KubeConfig    string
+	RuntimeSocket string
+	ListenAddress string
+	CACertPath    string
+	CNIBinDir     string
+	CNIConfDir    string
+}
+
+func Agent(config *AgentConfig) error {
+	rand.Seed(time.Now().UTC().UnixNano())
+
+	prepare(config)
+
+	kubelet(config)
+	kubeProxy(config)
+
+	return nil
+}
+
+func prepare(config *AgentConfig) {
+	if config.CNIBinDir == "" {
+		config.CNIBinDir = "/opt/cni/bin"
+	}
+	if config.CNIConfDir == "" {
+		config.CNIConfDir = "/etc/cni/net.d"
+	}
+}
+
+func kubeProxy(config *AgentConfig) {
+	command := app2.NewProxyCommand()
+	command.SetArgs([]string{
+		"--proxy-mode", "iptables",
+		"--healthz-bind-address", "127.0.0.1",
+		"--kubeconfig", config.KubeConfig,
+		"--cluster-cidr", config.ClusterCIDR.String(),
+	})
+
+	go func() {
+		err := command.Execute()
+		logrus.Fatalf("kube-proxy exited: %v", err)
+	}()
+}
+
+func kubelet(config *AgentConfig) {
+	command := app.NewKubeletCommand()
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	args := []string{
+		"--healthz-bind-address", "127.0.0.1",
+		"--read-only-port", "0",
+		"--allow-privileged=true",
+		"--cluster-domain", "cluster.local",
+		"--cluster-dns", "10.43.0.10",
+		"--kubeconfig", config.KubeConfig,
+		"--eviction-hard", "imagefs.available<5%,nodefs.available<5%",
+		"--eviction-minimum-reclaim", "imagefs.available=10%,nodefs.available=10%",
+		"--fail-swap-on=false",
+		"--cgroup-root", "/k3s",
+		"--cgroup-driver", "cgroupfs",
+		"--container-runtime-endpoint", config.RuntimeSocket,
+		"--cni-conf-dir", config.CNIConfDir,
+		"--cni-bin-dir", config.CNIBinDir,
+	}
+	if config.ListenAddress != "" {
+		args = append(args, "--address", config.ListenAddress)
+	}
+	if config.CACertPath != "" {
+		args = append(args, "--anonymous-auth=false", "--client-ca-file", config.CACertPath)
+	}
+	if config.NodeName != "" {
+		args = append(args, "--hostname-override", config.NodeName)
+	}
+
+	command.SetArgs(args)
+
+	go func() {
+		logrus.Fatalf("kubelet exited: %v", command.Execute())
+	}()
+}

cmd/server/server.go

+package server
+
+import (
+	"context"
+	cryptorand "crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/csv"
+	"encoding/hex"
+	"fmt"
+	"html/template"
+	"io"
+	"io/ioutil"
+	"math/rand"
+	"net"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"k8s.io/apiserver/pkg/authentication/authenticator"
+	apiserveroptions "k8s.io/apiserver/pkg/server/options"
+	certutil "k8s.io/client-go/util/cert"
+	"k8s.io/kubernetes/cmd/kube-apiserver/app"
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+	cmapp "k8s.io/kubernetes/cmd/kube-controller-manager/app"
+	cmoptions "k8s.io/kubernetes/cmd/kube-controller-manager/app/options"
+	sapp "k8s.io/kubernetes/cmd/kube-scheduler/app"
+	"k8s.io/kubernetes/pkg/apis/componentconfig"
+	_ "k8s.io/kubernetes/pkg/client/metrics/prometheus" // for client metric registration
+	"k8s.io/kubernetes/pkg/controller/nodeipam/ipam"
+	"k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
+	"k8s.io/kubernetes/pkg/master"
+	_ "k8s.io/kubernetes/pkg/util/reflector/prometheus" // for reflector metric registration
+	_ "k8s.io/kubernetes/pkg/util/workqueue/prometheus" // for workqueue metric registration
+	_ "k8s.io/kubernetes/pkg/version/prometheus"        // for version metric registration
+)
+
+var (
+	kubeconfigTemplate = template.Must(template.New("kubeconfig").Parse(`apiVersion: v1
+clusters:
+- cluster:
+    server: {{.URL}}
+    certificate-authority-data: {{.CACert}}
+  name: local
+contexts:
+- context:
+    cluster: local
+    namespace: default
+    user: user
+  name: Default
+current-context: Default
+kind: Config
+preferences: {}
+users:
+- name: user
+  user:
+    username: {{.User}}
+    password: {{.Password}}
+`))
+)
+
+type ServerConfig struct {
+	PublicHostname string
+	PublicIP       *net.IP
+	PublicPort     int
+	ListenAddr     net.IP
+	ListenPort     int
+	ClusterIPRange net.IPNet
+	ServiceIPRange net.IPNet
+	DataDir        string
+	LeaderElect    bool
+
+	tlsCert          string
+	tlsKey           string
+	tlsCA            string
+	tlsCAKey         string
+	tokenCA          string
+	tokenCAKey       string
+	serviceKey       string
+	passwdFile       string
+	kubeConfigSystem string
+	kubeConfigNode   string
+
+	NodeCert      string
+	NodeKey       string
+	ClientToken   string
+	NodeToken     string
+	KubeConfig    string
+	Handler       http.Handler
+	Authenticator authenticator.Request
+}
+
+func Server(ctx context.Context, config *ServerConfig) error {
+	rand.Seed(time.Now().UTC().UnixNano())
+
+	auth, handler, err := apiServer(ctx, config)
+	if err != nil {
+		return err
+	}
+
+	config.Handler = handler
+	config.Authenticator = auth
+
+	if err := scheduler(ctx, config); err != nil {
+		return err
+	}
+
+	if err := controllerManager(ctx, config); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func controllerManager(ctx context.Context, cfg *ServerConfig) error {
+	s := cmoptions.NewKubeControllerManagerOptions()
+	s.Generic.Kubeconfig = cfg.kubeConfigSystem
+	s.Generic.ComponentConfig.LeaderElection.LeaderElect = cfg.LeaderElect
+	s.Generic.ComponentConfig.ServiceAccountKeyFile = cfg.serviceKey
+	s.Generic.ComponentConfig.AllocateNodeCIDRs = true
+	s.Generic.ComponentConfig.ClusterCIDR = cfg.ClusterIPRange.String()
+	s.Generic.ComponentConfig.CIDRAllocatorType = string(ipam.RangeAllocatorType)
+	s.Generic.ComponentConfig.RootCAFile = cfg.tokenCA
+
+	c, err := s.Config(cmapp.KnownControllers(), cmapp.ControllersDisabledByDefault.List())
+	if err != nil {
+		return err
+	}
+
+	go func() {
+		err := cmapp.Run(c.Complete())
+		logrus.Fatalf("controller-manager exited: %v", err)
+	}()
+
+	return nil
+}
+
+func scheduler(ctx context.Context, cfg *ServerConfig) error {
+	options, err := sapp.NewOptions()
+	if err != nil {
+		return err
+	}
+
+	config, err := options.ApplyDefaults(&componentconfig.KubeSchedulerConfiguration{})
+	if err != nil {
+		return err
+	}
+
+	config.ClientConnection.KubeConfigFile = cfg.kubeConfigSystem
+	s, err := sapp.NewSchedulerServer(config, "")
+	if err != nil {
+		return err
+	}
+
+	go func() {
+		logrus.Fatalf("scheduler exited: %v", s.Run(ctx.Done()))
+	}()
+
+	return nil
+}
+
+func apiServer(ctx context.Context, config *ServerConfig) (authenticator.Request, http.Handler, error) {
+	if err := prepare(config); err != nil {
+		return nil, nil, err
+	}
+
+	s := options.NewServerRunOptions()
+	s.InsecureServing.BindPort = 0
+	s.AllowPrivileged = true
+	s.Authorization.Mode = modes.ModeNode + "," + modes.ModeRBAC // + "," + modes.ModeAlwaysAllow
+	s.ServiceAccountSigningKeyFile = config.serviceKey
+	s.ServiceClusterIPRange = config.ServiceIPRange
+	s.SecureServing.PublicPort = config.PublicPort
+	s.SecureServing.PublicIP = config.PublicIP
+	s.SecureServing.BindPort = config.ListenPort
+	s.SecureServing.BindAddress = config.ListenAddr
+	s.SecureServing.ServerCert = apiserveroptions.GeneratableKeyCert{
+		CertKey: apiserveroptions.CertKey{
+			CertFile: config.tlsCert,
+			KeyFile:  config.tlsKey,
+		},
+	}
+	s.Authentication.ServiceAccounts.KeyFiles = []string{config.serviceKey}
+	s.Authentication.PasswordFile.BasicAuthFile = config.passwdFile
+	s.KubeletConfig.CertFile = config.NodeCert
+	s.KubeletConfig.KeyFile = config.NodeKey
+
+	os.Chdir(config.DataDir)
+
+	serverConfig, server, err := app.CreateServerChain(s, ctx.Done())
+	if err != nil {
+		return nil, nil, err
+	}
+
+	prepared := server.PrepareRun()
+
+	go func() {
+		err := prepared.Run(ctx.Done())
+		logrus.Fatalf("apiserver exited: %v", err)
+	}()
+
+	return serverConfig.GenericConfig.Authentication.Authenticator, prepared.Handler, nil
+}
+
+func prepare(config *ServerConfig) error {
+	var err error
+
+	if _, err := os.Stat(config.DataDir); os.IsNotExist(err) {
+		if err := os.MkdirAll(config.DataDir, 0700); err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	}
+
+	config.DataDir, err = filepath.Abs(config.DataDir)
+	if err != nil {
+		return err
+	}
+
+	os.MkdirAll(path.Join(config.DataDir, "tls"), 0700)
+	os.MkdirAll(path.Join(config.DataDir, "cred"), 0700)
+
+	name := config.PublicHostname
+	config.tlsCert = path.Join(config.DataDir, "tls", name+".crt")
+	config.tlsKey = path.Join(config.DataDir, "tls", name+".key")
+	config.tlsCA = path.Join(config.DataDir, "tls", "ca.crt")
+	config.tlsCAKey = path.Join(config.DataDir, "tls", "ca.key")
+	config.tokenCA = path.Join(config.DataDir, "tls", "token-ca.crt")
+	config.tokenCAKey = path.Join(config.DataDir, "tls", "token-ca.key")
+	config.serviceKey = path.Join(config.DataDir, "tls", "service.key")
+	config.passwdFile = path.Join(config.DataDir, "cred", "passwd")
+	config.KubeConfig = path.Join(config.DataDir, "cred", "kubeconfig.yaml")
+	config.kubeConfigSystem = path.Join(config.DataDir, "cred", "kubeconfig-system.yaml")
+	config.kubeConfigNode = path.Join(config.DataDir, "cred", "kubeconfig-node.yaml")
+	config.NodeKey = path.Join(config.DataDir, "tls", "token-node.key")
+	config.NodeCert = path.Join(config.DataDir, "tls", "token-node.crt")
+
+	regen := false
+	if _, err := os.Stat(config.tlsCA); err != nil {
+		regen = true
+		if err := genCA(config); err != nil {
+			return err
+		}
+	}
+
+	if err := genServiceAccount(config); err != nil {
+		return err
+	}
+
+	if err := genTLS(regen, config); err != nil {
+		return err
+	}
+
+	if err := genTokenTLS(config); err != nil {
+		return err
+	}
+
+	if err := genUsers(config); err != nil {
+		return err
+	}
+
+	return readTokens(config)
+}
+
+func readTokens(config *ServerConfig) error {
+	f, err := os.Open(config.passwdFile)
+	if err != nil {
+		return err
+	}
+	reader := csv.NewReader(f)
+	reader.FieldsPerRecord = -1
+
+	for {
+		record, err := reader.Read()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+		if len(record) < 2 {
+			continue
+		}
+
+		switch record[1] {
+		case "node":
+			config.NodeToken = "node:" + record[0]
+		case "admin":
+			config.ClientToken = "admin:" + record[0]
+		}
+	}
+
+	return nil
+}
+
+func genUsers(config *ServerConfig) error {
+	if s, err := os.Stat(config.passwdFile); err == nil && s.Size() > 0 {
+		return nil
+	}
+
+	adminToken, err := getToken()
+	if err != nil {
+		return err
+	}
+	systemToken, err := getToken()
+	if err != nil {
+		return err
+	}
+	nodeToken, err := getToken()
+	if err != nil {
+		return err
+	}
+
+	passwd := fmt.Sprintf(`%s,admin,admin,system:masters
+%s,system,system,system:masters
+%s,node,node,system:masters
+`, adminToken, systemToken, nodeToken)
+
+	caCertBytes, err := ioutil.ReadFile(config.tlsCA)
+	if err != nil {
+		return err
+	}
+
+	caCert := base64.StdEncoding.EncodeToString(caCertBytes)
+
+	if err := kubeConfig(config.KubeConfig, fmt.Sprintf("https://%s:%d", config.PublicHostname, config.ListenPort), caCert,
+		"admin", adminToken); err != nil {
+		return err
+	}
+
+	if err := kubeConfig(config.kubeConfigSystem, fmt.Sprintf("https://localhost:%d", config.ListenPort), caCert,
+		"system", systemToken); err != nil {
+		return err
+	}
+
+	if err := kubeConfig(config.kubeConfigNode, fmt.Sprintf("https://%s:%d", config.PublicHostname, config.ListenPort), caCert,
+		"node", nodeToken); err != nil {
+		return err
+	}
+
+	return ioutil.WriteFile(config.passwdFile, []byte(passwd), 0600)
+}
+
+func getToken() (string, error) {
+	token := make([]byte, 16, 16)
+	_, err := cryptorand.Read(token)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(token), err
+}
+
+func genTokenTLS(config *ServerConfig) error {
+	regen := false
+	if _, err := os.Stat(config.tokenCA); err != nil {
+		regen = true
+		if err := genTokenCA(config); err != nil {
+			return err
+		}
+	}
+
+	_, apiServerServiceIP, err := master.DefaultServiceIPRange(config.ServiceIPRange)
+	if err != nil {
+		return err
+	}
+
+	cfg := certutil.Config{
+		CommonName: "kubernetes",
+		AltNames: certutil.AltNames{
+			DNSNames: []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes", "localhost"},
+			IPs:      []net.IP{net.ParseIP("127.0.0.1"), apiServerServiceIP},
+		},
+		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+	}
+
+	if _, err := os.Stat(config.NodeCert); err == nil && !regen {
+		return nil
+	}
+
+	caKeyBytes, err := ioutil.ReadFile(config.tokenCAKey)
+	if err != nil {
+		return err
+	}
+
+	caBytes, err := ioutil.ReadFile(config.tokenCA)
+	if err != nil {
+		return err
+	}
+
+	caKey, err := certutil.ParsePrivateKeyPEM(caKeyBytes)
+	if err != nil {
+		return err
+	}
+
+	caCert, err := certutil.ParseCertsPEM(caBytes)
+	if err != nil {
+		return err
+	}
+
+	key, err := certutil.NewPrivateKey()
+	if err != nil {
+		return err
+	}
+
+	cert, err := certutil.NewSignedCert(cfg, key, caCert[0], caKey.(*rsa.PrivateKey))
+	if err != nil {
+		return err
+	}
+
+	if err := certutil.WriteKey(config.NodeKey, certutil.EncodePrivateKeyPEM(key)); err != nil {
+		return err
+	}
+
+	return certutil.WriteCert(config.NodeCert, append(certutil.EncodeCertPEM(cert), certutil.EncodeCertPEM(caCert[0])...))
+}
+
+func genTLS(regen bool, config *ServerConfig) error {
+	if !regen {
+		_, certErr := os.Stat(config.tlsCert)
+		_, keyErr := os.Stat(config.tlsKey)
+		if certErr == nil && keyErr == nil {
+			return nil
+		}
+	}
+
+	_, apiServerServiceIP, err := master.DefaultServiceIPRange(config.ServiceIPRange)
+	if err != nil {
+		return err
+	}
+
+	cfg := certutil.Config{
+		CommonName: config.PublicHostname,
+		AltNames: certutil.AltNames{
+			DNSNames: []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes", config.PublicHostname},
+			IPs:      []net.IP{apiServerServiceIP},
+		},
+		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+
+	bindIP := config.ListenAddr.String()
+	if bindIP == "0.0.0.0" {
+		cfg.AltNames.DNSNames = append(cfg.AltNames.DNSNames, "localhost")
+	} else {
+		cfg.AltNames.IPs = append(cfg.AltNames.IPs, config.ListenAddr)
+	}
+
+	caKeyBytes, err := ioutil.ReadFile(config.tlsCAKey)
+	if err != nil {
+		return err
+	}
+
+	caBytes, err := ioutil.ReadFile(config.tlsCA)
+	if err != nil {
+		return err
+	}
+
+	caKey, err := certutil.ParsePrivateKeyPEM(caKeyBytes)
+	if err != nil {
+		return err
+	}
+
+	caCert, err := certutil.ParseCertsPEM(caBytes)
+	if err != nil {
+		return err
+	}
+
+	key, err := certutil.NewPrivateKey()
+	if err != nil {
+		return err
+	}
+
+	cert, err := certutil.NewSignedCert(cfg, key, caCert[0], caKey.(*rsa.PrivateKey))
+	if err != nil {
+		return err
+	}
+
+	if err := certutil.WriteKey(config.tlsKey, certutil.EncodePrivateKeyPEM(key)); err != nil {
+		return err
+	}
+
+	return certutil.WriteCert(config.tlsCert, append(certutil.EncodeCertPEM(cert), certutil.EncodeCertPEM(caCert[0])...))
+}
+
+func genServiceAccount(config *ServerConfig) error {
+	_, keyErr := os.Stat(config.serviceKey)
+	if keyErr == nil {
+		return nil
+	}
+
+	key, err := certutil.NewPrivateKey()
+	if err != nil {
+		return err
+	}
+
+	return certutil.WriteKey(config.serviceKey, certutil.EncodePrivateKeyPEM(key))
+}
+
+func genTokenCA(config *ServerConfig) error {
+	caKey, err := certutil.NewPrivateKey()
+	if err != nil {
+		return err
+	}
+
+	cfg := certutil.Config{
+		CommonName: fmt.Sprintf("%s-ca@%d", "k3s-token", time.Now().Unix()),
+	}
+
+	cert, err := certutil.NewSelfSignedCACert(cfg, caKey)
+	if err != nil {
+		return err
+	}
+
+	if err := certutil.WriteKey(config.tokenCAKey, certutil.EncodePrivateKeyPEM(caKey)); err != nil {
+		return err
+	}
+
+	return certutil.WriteCert(config.tokenCA, certutil.EncodeCertPEM(cert))
+}
+
+func genCA(config *ServerConfig) error {
+	caKey, err := certutil.NewPrivateKey()
+	if err != nil {
+		return err
+	}
+
+	cfg := certutil.Config{
+		CommonName: fmt.Sprintf("%s-ca@%d", "k3s", time.Now().Unix()),
+	}
+
+	cert, err := certutil.NewSelfSignedCACert(cfg, caKey)
+	if err != nil {
+		return err
+	}
+
+	if err := certutil.WriteKey(config.tlsCAKey, certutil.EncodePrivateKeyPEM(caKey)); err != nil {
+		return err
+	}
+
+	return certutil.WriteCert(config.tlsCA, certutil.EncodeCertPEM(cert))
+}
+
+func kubeConfig(dest, url, cert, user, password string) error {
+	data := struct {
+		URL      string
+		CACert   string
+		User     string
+		Password string
+	}{
+		URL:      url,
+		CACert:   cert,
+		User:     user,
+		Password: password,
+	}
+
+	output, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+	defer output.Close()
+
+	return kubeconfigTemplate.Execute(output, &data)
+}

delete.sh

+#!/bin/bash
+set -e
+
+F="
+.bazelrc
+.github
+.kazelcfg.json
+BUILD.bazel
+CHANGELOG-1.10.md
+CHANGELOG.md
+CONTRIBUTING.md
+Makefile
+Makefile.generated_files
+OWNERS
+OWNERS_ALIASES
+SUPPORT.md
+WORKSPACE
+api
+build
+cluster
+cmd/clicheck
+cmd/cloud-controller-manager
+cmd/gendocs
+cmd/genkubedocs
+cmd/genman
+cmd/genswaggertypedocs
+cmd/genutils
+cmd/genyaml
+cmd/hyperkube
+cmd/importverifier
+cmd/kubeadm
+cmd/kubemark
+cmd/linkcheck
+code-of-conduct.md
+docs
+examples
+hack
+labels.yaml
+logo
+pkg/auth/authorizer
+pkg/cloudprovider/providers
+pkg/controller/nodeipam/ipam/adapter.go
+pkg/controller/nodeipam/ipam/cloud_cidr_allocator.go
+pkg/controller/nodeipam/ipam/controller.go
+pkg/credentialprovider/aws
+pkg/credentialprovider/azure
+pkg/credentialprovider/gcp
+pkg/credentialprovider/rancher
+pkg/kubelet/dockershim
+pkg/kubelet/gpu/nvidia
+pkg/kubelet/network/hairpin
+pkg/kubelet/network/kubenet
+pkg/kubelet/rkt
+pkg/util/filesystem/fakefs.go
+pkg/volume/aws_ebs
+pkg/volume/azure_dd
+pkg/volume/azure_file
+pkg/volume/cephfs
+pkg/volume/cinder
+pkg/volume/fc
+pkg/volume/flocker
+pkg/volume/gce_pd
+pkg/volume/glusterfs
+pkg/volume/iscsi
+pkg/volume/photon_pd
+pkg/volume/portworx
+pkg/volume/quobyte
+pkg/volume/rbd
+pkg/volume/scaleio
+pkg/volume/storageos
+pkg/volume/vsphere_volume
+plugin/pkg/admission/admit
+plugin/pkg/admission/alwayspullimages
+plugin/pkg/admission/antiaffinity
+plugin/pkg/admission/defaulttolerationseconds
+plugin/pkg/admission/deny
+plugin/pkg/admission/eventratelimit
+plugin/pkg/admission/exec
+plugin/pkg/admission/extendedresourcetoleration
+plugin/pkg/admission/gc
+plugin/pkg/admission/imagepolicy
+plugin/pkg/admission/initialresources
+plugin/pkg/admission/limitranger
+plugin/pkg/admission/namespace
+plugin/pkg/admission/noderestriction
+plugin/pkg/admission/persistentvolume
+plugin/pkg/admission/podnodeselector
+plugin/pkg/admission/podpreset
+plugin/pkg/admission/podtolerationrestriction
+plugin/pkg/admission/priority
+plugin/pkg/admission/resourcequota
+plugin/pkg/admission/security
+plugin/pkg/admission/securitycontext
+plugin/pkg/admission/storage/storageobjectinuseprotection
+staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating
+staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating
+staging/src/k8s.io/apiserver/pkg/authorization/authorizerfactory/delegating.go
+staging/src/k8s.io/apiserver/pkg/server/options/audit.go
+staging/src/k8s.io/apiserver/pkg/server/options/authentication.go
+staging/src/k8s.io/apiserver/pkg/server/options/authorization.go
+staging/src/k8s.io/apiserver/pkg/storage/storagebackend/factory/etcd2.go
+staging/src/k8s.io/apiserver/plugin/pkg/audit
+staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token
+staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook
+staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure
+staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp
+staging/src/k8s.io/client-go/plugin/pkg/client/auth/openstack
+staging/src/k8s.io/sample-apiserver
+staging/src/k8s.io/sample-controller
+test
+third_party/BUILD
+third_party/OWNERS
+third_party/etcd.BUILD
+third_party/forked/etcd221
+third_party/forked/etcd237
+third_party/forked/golang/LICENSE
+third_party/forked/golang/PATENTS
+third_party/forked/golang/go
+third_party/forked/golang/reflect
+third_party/forked/golang/template
+third_party/forked/shell2junit
+third_party/htpasswd
+third_party/intemp
+third_party/protobuf
+third_party/swagger-ui
+translations
+"
+
+./hack/update-codegen.sh
+git add pkg/generated/openapi/zz_generated.openapi.go
+git rm -r $F
+rm -rf $F
+git commit -m "Generated: Delete files"

main.go

+package main
+
+import (
+	"context"
+	"net"
+	"os"
+
+	"github.com/sirupsen/logrus"
+	"k8s.io/kubernetes/cmd/agent"
+	"k8s.io/kubernetes/cmd/server"
+)
+
+func runAgent() {
+	_, ipNet, err := net.ParseCIDR("10.43.0.0/16")
+	if err != nil {
+		panic(err)
+	}
+
+	err = agent.Agent(&agent.AgentConfig{
+		KubeConfig:    "./data/cred/kubeconfig-node.yaml",
+		RuntimeSocket: "unix:///run/containerd/containerd.sock",
+		ClusterCIDR:   *ipNet,
+	})
+	logrus.Fatal(err)
+}
+
+func runServer() {
+	hostname, err := os.Hostname()
+	if err != nil {
+		panic(err)
+	}
+
+	_, cidr, err := net.ParseCIDR("10.43.0.0/16")
+	if err != nil {
+		panic(err)
+	}
+
+	_, clusterCidr, err := net.ParseCIDR("10.42.0.0/16")
+	if err != nil {
+		panic(err)
+	}
+	cfg := server.ServerConfig{
+		DataDir:        "./data",
+		ListenAddr:     net.ParseIP("0.0.0.0"),
+		ListenPort:     6443,
+		ClusterIPRange: *clusterCidr,
+		ServiceIPRange: *cidr,
+		PublicHostname: hostname,
+	}
+
+	ctx := context.Background()
+	err = server.Server(ctx, &cfg)
+	if err != nil {
+		panic(err)
+	}
+
+	<-ctx.Done()
+
+}
+
+func main() {
+	if len(os.Args) > 1 && os.Args[1] == "agent" {
+		runAgent()
+	}
+	runServer()
+}

vendor.conf

+# package
+k8s.io/kubernetes
+
+bitbucket.org/ww/goautoneg                        a547fc61f48d567d5b4ec6f8aee5573d8efce11d  https://github.com/rancher/goautoneg.git
+cloud.google.com/go                               3b1ae45394a234c385be014e9a488f2bb6eef821
+github.com/Azure/go-ansiterm                      19f72df4d05d31cbe1c56bfc8045c96babff6c7e
+github.com/Azure/go-autorest                      d4e6b95c12a08b4de2d48b45d5b4d594e5d32fab
+github.com/JeffAshton/win_pdh                     76bb4ee9f0ab50f77826f2a2ee7fb9d3880d6ec2
+github.com/MakeNowJust/heredoc                    bb23615498cded5e105af4ce27de75b089cbe851
+github.com/Microsoft/go-winio                     78439966b38d69bf38227fbf57ac8a6fee70f69a
+github.com/Microsoft/hcsshim                      6ea7fe54f719d95721e7d9b26ac0add224c9b923
+github.com/NYTimes/gziphandler                    56545f4a5d46df9a6648819d1664c3a03a13ffdb
+github.com/PuerkitoBio/purell                     8a290539e2e8629dbc4e6bad948158f790ec31f4
+github.com/PuerkitoBio/urlesc                     5bd2802263f21d8788851d5305584c82a5c75d7e
+github.com/abbot/go-http-auth                     c0ef4539dfab4d21c8ef20ba2924f9fc6f186d35
+github.com/armon/circbuf                          bbbad097214e2918d8543d5201d12bfd7bca254d
+github.com/asaskevich/govalidator                 593d64559f7600f29581a3ee42177f5dbded27a9
+github.com/aws/aws-sdk-go                         760741802ad40f49ae9fc4a69ef6706d2527d62e
+github.com/beorn7/perks                           3ac7bf7a47d159a033b107610db8a1b6575507a4
+github.com/blang/semver                           b38d23b8782a487059e8fc8773e9a5b228a77cb6
+github.com/chai2010/gettext-go                    c6fed771bfd517099caf0f7a961671fa8ed08723
+github.com/cloudflare/cfssl                       db0d0650b6496bfe8061ec56a92edd32d8e75c30
+github.com/cockroachdb/cmux                       112f0506e7743d64a6eb8fedbcff13d9979bbf92
+github.com/container-storage-interface/spec       35d9f9d77954980e449e52c3f3e43c21bd8171f5
+github.com/containerd/console                     84eeaae905fa414d03e07bcd6c8d3f19e7cf180e
+github.com/containerd/containerd                  27d450a01bb533d7ebc5701eb52792565396b084
+github.com/containernetworking/cni                a7885cb6f8ab03fba07852ded351e4f5e7a112bf
+github.com/coreos/bbolt                           48ea1b39c25fc1bab3506fbc712ecbaa842c4d2d
+github.com/coreos/etcd                            8485de345dd4380ccee1122f672853aade2f088c  https://github.com/ibuildthecloud/etcd.git
+github.com/coreos/go-semver                       568e959cd89871e61434c1143528d9162da89ef2
+github.com/coreos/go-systemd                      48702e0da86bd25e76cfef347e2adeb434a0d0a6
+github.com/coreos/pkg                             fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8
+github.com/coreos/rkt                             ec37f3cb649bfb72408906e7cbf330e4aeda1075
+github.com/cyphar/filepath-securejoin             ae69057f2299fb9e5ba2df738607e6a505b74ab6
+github.com/davecgh/go-spew                        782f4967f2dc4564575ca782fe2d04090b5faca8
+github.com/daviddengcn/go-colortext               511bcaf42ccd42c38aba7427b6673277bf19e2a1
+github.com/dchest/safefile                        855e8d98f1852d48dde521e0522408d1fe7e836a
+github.com/dgrijalva/jwt-go                       01aeca54ebda6e0fbfafd0a524d234159c05ec20
+github.com/docker/distribution                    edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c
+github.com/docker/docker                          4f3616fb1c112e206b88cb7a9922bf49067a7756
+github.com/docker/go-connections                  3ede32e2033de7505e6500d6c868c2b9ed9f169d
+github.com/docker/go-units                        9e638d38cf6977a37a8ea0078f3ee75a7cdb2dd1
+github.com/docker/libnetwork                      ba46b928444931e6865d8618dc03622cac79aa6f
+github.com/docker/libtrust                        9cbd2a1374f46905c68a4eb3694a130610adc62a
+github.com/docker/spdystream                      449fdfce4d962303d702fec724ef0ad181c92528
+github.com/elazarl/go-bindata-assetfs             3dcc96556217539f50599357fb481ac0dc7439b9
+github.com/elazarl/goproxy                        c4fc26588b6ef8af07a191fcb6476387bdd46711
+github.com/emicklei/go-restful                    ff4f55a206334ef123e4f79bbf348980da81ca46
+github.com/emicklei/go-restful-swagger12          dcef7f55730566d41eae5db10e7d6981829720f6
+github.com/euank/go-kmsg-parser                   5ba4d492e455a77d25dcf0d2c4acc9f2afebef4e
+github.com/evanphx/json-patch                     944e07253867aacae43c04b2e6a239005443f33a
+github.com/exponent-io/jsonpath                   d6023ce2651d8eafb5c75bb0c7167536102ec9f5
+github.com/fatih/camelcase                        f6a740d52f961c60348ebb109adde9f4635d7540
+github.com/fsnotify/fsnotify                      f12c6236fe7b5cf6bcf30e5935d08cb079d78334
+github.com/ghodss/yaml                            73d445a93680fa1a78ae23a5839bad48f32ba1ee
+github.com/go-ini/ini                             300e940a926eb277d3901b20bdfcc54928ad3642
+github.com/go-openapi/analysis                    b44dc874b601d9e4e2f6e19140e794ba24bead3b
+github.com/go-openapi/errors                      d24ebc2075bad502fac3a8ae27aa6dd58e1952dc
+github.com/go-openapi/jsonpointer                 46af16f9f7b149af66e5d1bd010e3574dc06de98
+github.com/go-openapi/jsonreference               13c6e3589ad90f49bd3e3bbe2c2cb3d7a4142272
+github.com/go-openapi/loads                       a80dea3052f00e5f032e860dd7355cd0cc67e24d
+github.com/go-openapi/runtime                     11e322eeecc1032d5a0a96c566ed53f2b5c26e22
+github.com/go-openapi/spec                        1de3e0542de65ad8d75452a595886fdd0befb363
+github.com/go-openapi/strfmt                      d65c7fdb29eca313476e529628176fe17e58c488
+github.com/go-openapi/swag                        f3f9494671f93fcff853e3c6e9e948b3eb71e590
+github.com/go-openapi/validate                    d509235108fcf6ab4913d2dcb3a2260c0db2108e
+github.com/godbus/dbus                            c7fdd8b5cd55e87b4e1f4e372cdb1db61dd6c66f
+github.com/gogo/protobuf                          c0656edd0d9eab7c66d1eb0c568f9039345796f7
+github.com/golang/glog                            44145f04b68cf362d9c4df2182967c2275eaefed
+github.com/golang/groupcache                      02826c3e79038b59d737d3b1c0a1d937f71a4433
+github.com/golang/mock                            bd3c8e81be01eef76d4b503f5e687d2d1354d2d9
+github.com/golang/protobuf                        1643683e1b54a9e88ad26d98f81400c8c9d9f4f9
+github.com/google/btree                           7d79101e329e5a3adf994758c578dab82b90c017
+github.com/google/cadvisor                        2e02d28350c5fbbad9cfb7e5a1733468b75ab3f9
+github.com/google/certificate-transparency        af98904302724c29aa6659ca372d41c9687de2b7
+github.com/google/gofuzz                          44d81051d367757e1c7c6a5a86423ece9afcf63c
+github.com/googleapis/gnostic                     0c5108395e2debce0d731cf0287ddf7242066aba
+github.com/gregjones/httpcache                    787624de3eb7bd915c329cba748687a3b22666a6
+github.com/grpc-ecosystem/go-grpc-prometheus      2500245aa6110c562d17020fb31a2c133d737799
+github.com/grpc-ecosystem/grpc-gateway            8cc3a55af3bcf171a1c23a90c4df9cf591706104
+github.com/hashicorp/golang-lru                   a0d98a5f288019575c6d1f4bb1573fef2d1fcdc4
+github.com/howeyc/gopass                          bf9dde6d0d2c004a008c27aaee91170c786f6db8
+github.com/imdario/mergo                          6633656539c1639d9d78127b7d47c622b5d7b6dc
+github.com/inconshreveable/mousetrap              76626ae9c91c4f2a10f34cad8ce83ea42c93bb75
+github.com/jmespath/go-jmespath                   0b12d6b521d83fc7f755e7cfc1b1fbdd35a01a74
+github.com/jonboulle/clockwork                    72f9bd7c4e0c2a40055ab3d0f09654f730cce982
+github.com/json-iterator/go                       13f86432b882000a51c6e610c620974462691a97
+github.com/kr/fs                                  2788f0dbd16903de03cb8186e5c7d97b69ad387b
+github.com/kr/pty                                 f7ee69f31298ecbe5d2b349c711e2547a617d398
+github.com/mailru/easyjson                        2f5df55504ebc322e4d52d34df6a1f5b503bf26d
+github.com/mattn/go-sqlite3                       master
+github.com/matttproud/golang_protobuf_extensions  fc2b8d3a73c4867e51861bbdd5ae3c1f0869dd6a
+github.com/miekg/dns                              5d001d020961ae1c184f9f8152fdc73810481677
+github.com/mindprince/gonvml                      fee913ce8fb235edf54739d259ca0ecc226c7b8a
+github.com/mistifyio/go-zfs                       1b4ae6fb4e77b095934d4430860ff202060169f8
+github.com/mitchellh/go-wordwrap                  ad45545899c7b13c020ea92b2072220eefad42b8
+github.com/mreiferson/go-httpclient               31f0106b4474f14bc441575c19d3a5fa21aa1f6c
+github.com/mrunalp/fileutils                      4ee1cc9a80582a0c75febdd5cfa779ee4361cbca
+github.com/mxk/go-flowrate                        cca7078d478f8520f85629ad7c68962d31ed7682
+github.com/onsi/ginkgo                            67b9df7f55fe1165fd9ad49aca7754cce01a42b8
+github.com/onsi/gomega                            d59fa0ac68bb5dd932ee8d24eed631cdd519efc3
+github.com/opencontainers/go-digest               a6d0ee40d4207ea02364bd3b9e8e77b9159ba1eb
+github.com/opencontainers/image-spec              372ad780f63454fbbbbcc7cf80e5b90245c13e13
+github.com/opencontainers/runc                    595bea022f077a9e17d7473b34fbaf1adaed9e43
+github.com/opencontainers/runtime-spec            02137cd4e50b37a01665e1731fcd4ac2d2178230
+github.com/opencontainers/selinux                 4a2974bf1ee960774ffd517717f1f45325af0206
+github.com/pborman/uuid                           ca53cad383cad2479bbba7f7a1a05797ec1386e4
+github.com/peterbourgon/diskv                     5f041e8faa004a95c88a202771f4cc3e991971e6
+github.com/pkg/errors                             645ef00459ed84a119197bfb8d8205042c6df63d
+github.com/pkg/sftp                               4d0e916071f68db74f8a73926335f809396d6b42
+github.com/pmezard/go-difflib                     d8ed2627bdf02c080bf22230dbb337003b7aba2d
+github.com/prometheus/client_golang               e7e903064f5e9eb5da98208bae10b475d4db0f8c
+github.com/prometheus/client_model                fa8ad6fec33561be4280a8f0514318c79d7f6cb6
+github.com/prometheus/common                      13ba4ddd0caa9c28ca7b7bffe1dfa9ed8d5ef207
+github.com/prometheus/procfs                      65c1f6f8f0fc1e2185eb9863a3bc751496404259
+github.com/rancher/norman                         79b91ea33c9ce18094018b26e86fa2577cac2bdd
+github.com/renstrom/dedent                        020d11c3b9c0c7a3c2efcc8e5cf5b9ef7bcea21f
+github.com/robfig/cron                            df38d32658d8788cd446ba74db4bb5375c4b0cb3
+github.com/russross/blackfriday                   300106c228d52c8941d4b3de6054a6062a86dda3
+github.com/seccomp/libseccomp-golang              1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1
+github.com/shurcooL/sanitized_anchor_name         10ef21a441db47d8b13ebcc5fd2310f636973c77
+github.com/sirupsen/logrus                        89742aefa4b206dcf400792f3bd35b542998eb3b
+github.com/spf13/afero                            b28a7effac979219c2a2ed6205a4d70e4b1bcd02
+github.com/spf13/cobra                            6644d46b81fa1831979c4cded0106e774e0ef0ab
+github.com/spf13/pflag                            4c012f6dcd9546820e378d0bdda4d8fc772cdfea
+github.com/stretchr/objx                          1a9d0bb9f541897e62256577b352fdbc1fb4fd94
+github.com/stretchr/testify                       f6abca593680b2315d2075e0f5e2a9751e3f431a
+github.com/syndtr/gocapability                    e7cb7fa329f456b3855136a2642b197bad7366ba
+github.com/ugorji/go                              ded73eae5db7e7a0ef6f55aace87a2873c5d2b74
+github.com/vishvananda/netlink                    f67b75edbf5e3bb7dfe70bb788610693a71be3d1
+github.com/vishvananda/netns                      be1fbeda19366dea804f00efff2dd73a1642fdcc
+github.com/xiang90/probing                        07dd2e8dfe18522e9c447ba95f2fe95262f63bb2
+golang.org/x/crypto                               81e90905daefcd6fd217b62423c0908922eadb30
+golang.org/x/exp                                  292a51b8d262487dab23a588950e8052d63d9113
+golang.org/x/net                                  1c05540f6879653db88113bc4a2b70aec4bd491f
+golang.org/x/oauth2                               a6bd8cefa1811bd24b86f8902872e4e8225f74c4
+golang.org/x/sys                                  95c6576299259db960f6c5b9b69ea52422860fce
+golang.org/x/text                                 b19bf474d317b857955b12035d2c5acb57ce8b01
+golang.org/x/time                                 f51c12702a4d776e4c1fa9b0fabab841babae631
+golang.org/x/tools                                2382e3994d48b1d22acc2c86bcad0a2aff028e32
+google.golang.org/genproto/googleapis             09f6ed296fc66555a25fe4ce95173148778dfa85
+google.golang.org/grpc                            5b3c4e850e90a4cf6a20ebd46c8b32a0a3afcb9e
+gopkg.in/inf.v0                                   3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4
+gopkg.in/square/go-jose.v2                        f8f38de21b4dcd69d0413faf231983f5fd6634b1
+gopkg.in/yaml.v2                                  670d4cfef0544295bc27a114dbac37980d83185a
+k8s.io/gengo                                      01a732e01d00cb9a81bb0ca050d3e6d2b947927b
+k8s.io/heapster                                   c2ac40f1adf8c42a79badddb2a2acd673cae3bcb
+k8s.io/kube-openapi                               39cb288412c48cb533ba4be5d6c28620b9a0c1b4
+k8s.io/utils                                      aedf551cdb8b0119df3a19c65fde413a13b34997
+vbom.ml/util/sortorder                            db5cfe13f5cc80a4990d98e2e1b0707a4d1a5394