rebase: update kubernetes to v1.20.0

updated kubernetes packages to latest
release.

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>

vendor/k8s.io/apiserver/pkg/admission/config.go

@@ -25,7 +25,7 @@ import (
 	"path"
 	"path/filepath"
 
-	"k8s.io/klog"
+	"k8s.io/klog/v2"
 	"sigs.k8s.io/yaml"
 
 	"k8s.io/apimachinery/pkg/runtime"

vendor/k8s.io/apiserver/pkg/admission/initializer/interfaces.go

@@ -19,6 +19,7 @@ package initializer
 import (
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
+	quota "k8s.io/apiserver/pkg/quota/v1"
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/component-base/featuregate"
@@ -42,6 +43,12 @@ type WantsAuthorizer interface {
 	admission.InitializationValidator
 }
 
+// WantsQuotaConfiguration defines a function which sets quota configuration for admission plugins that need it.
+type WantsQuotaConfiguration interface {
+	SetQuotaConfiguration(quota.Configuration)
+	admission.InitializationValidator
+}
+
 // WantsFeatureGate defines a function which passes the featureGates for inspection by an admission plugin.
 // Admission plugins should not hold a reference to the featureGates.  Instead, they should query a particular one
 // and assign it to a simple bool in the admission plugin struct.

vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook.go

@@ -141,7 +141,18 @@ func (a *Webhook) ValidateInitialization() error {
 // ShouldCallHook returns invocation details if the webhook should be called, nil if the webhook should not be called,
 // or an error if an error was encountered during evaluation.
 func (a *Webhook) ShouldCallHook(h webhook.WebhookAccessor, attr admission.Attributes, o admission.ObjectInterfaces) (*WebhookInvocation, *apierrors.StatusError) {
-	var err *apierrors.StatusError
+	matches, matchNsErr := a.namespaceMatcher.MatchNamespaceSelector(h, attr)
+	// Should not return an error here for webhooks which do not apply to the request, even if err is an unexpected scenario.
+	if !matches && matchNsErr == nil {
+		return nil, nil
+	}
+
+	// Should not return an error here for webhooks which do not apply to the request, even if err is an unexpected scenario.
+	matches, matchObjErr := a.objectMatcher.MatchObjectSelector(h, attr)
+	if !matches && matchObjErr == nil {
+		return nil, nil
+	}
+
 	var invocation *WebhookInvocation
 	for _, r := range h.GetRules() {
 		m := rules.Matcher{Rule: r, Attr: attr}
@@ -189,15 +200,11 @@ func (a *Webhook) ShouldCallHook(h webhook.WebhookAccessor, attr admission.Attri
 	if invocation == nil {
 		return nil, nil
 	}
-
-	matches, err := a.namespaceMatcher.MatchNamespaceSelector(h, attr)
-	if !matches || err != nil {
-		return nil, err
+	if matchNsErr != nil {
+		return nil, matchNsErr
 	}
-
-	matches, err = a.objectMatcher.MatchObjectSelector(h, attr)
-	if !matches || err != nil {
-		return nil, err
+	if matchObjErr != nil {
+		return nil, matchObjErr
 	}
 
 	return invocation, nil

vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/dispatcher.go

@@ -26,7 +26,7 @@ import (
 	jsonpatch "github.com/evanphx/json-patch"
 
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
-	"k8s.io/klog"
+	"k8s.io/klog/v2"
 
 	admissionv1 "k8s.io/api/admission/v1"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
@@ -43,6 +43,7 @@ import (
 	webhookrequest "k8s.io/apiserver/pkg/admission/plugin/webhook/request"
 	auditinternal "k8s.io/apiserver/pkg/apis/audit"
 	webhookutil "k8s.io/apiserver/pkg/util/webhook"
+	"k8s.io/apiserver/pkg/warning"
 	utiltrace "k8s.io/utils/trace"
 )
 
@@ -56,7 +57,7 @@ const (
 	MutationAuditAnnotationPrefix = "mutation.webhook.admission.k8s.io/"
 )
 
-var encodingjson = json.CaseSensitiveJsonIterator()
+var encodingjson = json.CaseSensitiveJSONIterator()
 
 type mutatingDispatcher struct {
 	cm     *webhookutil.ClientManager
@@ -267,6 +268,9 @@ func (a *mutatingDispatcher) callAttrMutatingHook(ctx context.Context, h *admiss
 			klog.Warningf("Failed to set admission audit annotation %s to %s for mutating webhook %s: %v", key, v, h.Name, err)
 		}
 	}
+	for _, w := range result.Warnings {
+		warning.AddWarning(ctx, "", w)
+	}
 
 	if !result.Allowed {
 		return false, &webhookutil.ErrWebhookRejection{Status: webhookerrors.ToStatusErr(h.Name, result.Result)}

vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/object/matcher.go

@@ -23,7 +23,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook"
-	"k8s.io/klog"
+	"k8s.io/klog/v2"
 )
 
 // Matcher decides if a request selected by the ObjectSelector.

vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request/admissionreview.go

@@ -36,6 +36,7 @@ type AdmissionResponse struct {
 	Patch            []byte
 	PatchType        admissionv1.PatchType
 	Result           *metav1.Status
+	Warnings         []string
 }
 
 // VerifyAdmissionResponse checks the validity of the provided admission review object, and returns the
@@ -93,6 +94,7 @@ func VerifyAdmissionResponse(uid types.UID, mutating bool, review runtime.Object
 			Patch:            patch,
 			PatchType:        patchType,
 			Result:           r.Response.Result,
+			Warnings:         r.Response.Warnings,
 		}, nil
 
 	case *admissionv1beta1.AdmissionReview:
@@ -118,6 +120,7 @@ func VerifyAdmissionResponse(uid types.UID, mutating bool, review runtime.Object
 			Patch:            patch,
 			PatchType:        patchType,
 			Result:           r.Response.Result,
+			Warnings:         r.Response.Warnings,
 		}, nil
 
 	default:

vendor/k8s.io/apiserver/pkg/admission/plugins.go

@@ -26,7 +26,7 @@ import (
 	"strings"
 	"sync"
 
-	"k8s.io/klog"
+	"k8s.io/klog/v2"
 )
 
 // Factory is a function that returns an Interface for admission decisions.

vendor/k8s.io/apiserver/pkg/apis/apiserver/types.go

@@ -62,7 +62,8 @@ type EgressSelectorConfiguration struct {
 // EgressSelection provides the configuration for a single egress selection client.
 type EgressSelection struct {
 	// Name is the name of the egress selection.
-	// Currently supported values are "Master", "Etcd" and "Cluster"
+	// Currently supported values are "controlplane", "master", "etcd" and "cluster"
+	// The "master" egress selector is deprecated in favor of "controlplane"
 	Name string
 
 	// Connection is the exact information used to configure the egress selection

vendor/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go

@@ -62,7 +62,8 @@ type EgressSelectorConfiguration struct {
 // EgressSelection provides the configuration for a single egress selection client.
 type EgressSelection struct {
 	// name is the name of the egress selection.
-	// Currently supported values are "Master", "Etcd" and "Cluster"
+	// Currently supported values are "controlplane", "master", "etcd" and "cluster"
+	// The "master" egress selector is deprecated in favor of "controlplane"
 	Name string `json:"name"`
 
 	// connection is the exact information used to configure the egress selection

vendor/k8s.io/apiserver/pkg/apis/apiserver/v1beta1/types.go

@@ -33,7 +33,8 @@ type EgressSelectorConfiguration struct {
 // EgressSelection provides the configuration for a single egress selection client.
 type EgressSelection struct {
 	// name is the name of the egress selection.
-	// Currently supported values are "Master", "Etcd" and "Cluster"
+	// Currently supported values are "controlplane", "master", "etcd" and "cluster"
+	// The "master" egress selector is deprecated in favor of "controlplane"
 	Name string `json:"name"`
 
 	// connection is the exact information used to configure the egress selection

vendor/k8s.io/apiserver/pkg/apis/audit/v1/generated.proto

@@ -17,7 +17,7 @@ limitations under the License.
 
 // This file was autogenerated by go-to-protobuf. Do not edit it manually!
 
-syntax = 'proto2';
+syntax = "proto2";
 
 package k8s.io.apiserver.pkg.apis.audit.v1;
 

vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1/generated.proto

@@ -17,7 +17,7 @@ limitations under the License.
 
 // This file was autogenerated by go-to-protobuf. Do not edit it manually!
 
-syntax = 'proto2';
+syntax = "proto2";
 
 package k8s.io.apiserver.pkg.apis.audit.v1alpha1;
 

vendor/k8s.io/apiserver/pkg/apis/audit/v1beta1/generated.proto

@@ -17,7 +17,7 @@ limitations under the License.
 
 // This file was autogenerated by go-to-protobuf. Do not edit it manually!
 
-syntax = 'proto2';
+syntax = "proto2";
 
 package k8s.io.apiserver.pkg.apis.audit.v1beta1;
 

vendor/k8s.io/apiserver/pkg/audit/context.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package audit
+
+import (
+	"context"
+
+	genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
+)
+
+// The key type is unexported to prevent collisions
+type key int
+
+const (
+	// auditAnnotationsKey is the context key for the audit annotations.
+	auditAnnotationsKey key = iota
+)
+
+// annotations = *[]annotation instead of a map to preserve order of insertions
+type annotation struct {
+	key, value string
+}
+
+// WithAuditAnnotations returns a new context that can store audit annotations
+// via the AddAuditAnnotation function.  This function is meant to be called from
+// an early request handler to allow all later layers to set audit annotations.
+// This is required to support flows where handlers that come before WithAudit
+// (such as WithAuthentication) wish to set audit annotations.
+func WithAuditAnnotations(parent context.Context) context.Context {
+	// this should never really happen, but prevent double registration of this slice
+	if _, ok := parent.Value(auditAnnotationsKey).(*[]annotation); ok {
+		return parent
+	}
+
+	var annotations []annotation // avoid allocations until we actually need it
+	return genericapirequest.WithValue(parent, auditAnnotationsKey, &annotations)
+}
+
+// AddAuditAnnotation sets the audit annotation for the given key, value pair.
+// It is safe to call at most parts of request flow that come after WithAuditAnnotations.
+// The notable exception being that this function must not be called via a
+// defer statement (i.e. after ServeHTTP) in a handler that runs before WithAudit
+// as at that point the audit event has already been sent to the audit sink.
+// Handlers that are unaware of their position in the overall request flow should
+// prefer AddAuditAnnotation over LogAnnotation to avoid dropping annotations.
+func AddAuditAnnotation(ctx context.Context, key, value string) {
+	// use the audit event directly if we have it
+	if ae := genericapirequest.AuditEventFrom(ctx); ae != nil {
+		LogAnnotation(ae, key, value)
+		return
+	}
+
+	annotations, ok := ctx.Value(auditAnnotationsKey).(*[]annotation)
+	if !ok {
+		return // adding audit annotation is not supported at this call site
+	}
+
+	*annotations = append(*annotations, annotation{key: key, value: value})
+}
+
+// This is private to prevent reads/write to the slice from outside of this package.
+// The audit event should be directly read to get access to the annotations.
+func auditAnnotationsFrom(ctx context.Context) []annotation {
+	annotations, ok := ctx.Value(auditAnnotationsKey).(*[]annotation)
+	if !ok {
+		return nil // adding audit annotation is not supported at this call site
+	}
+
+	return *annotations
+}

vendor/k8s.io/apiserver/pkg/audit/metrics.go

@@ -22,7 +22,7 @@ import (
 	auditinternal "k8s.io/apiserver/pkg/apis/audit"
 	"k8s.io/component-base/metrics"
 	"k8s.io/component-base/metrics/legacyregistry"
-	"k8s.io/klog"
+	"k8s.io/klog/v2"
 )
 
 const (

vendor/k8s.io/apiserver/pkg/audit/request.go

@@ -24,7 +24,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	"k8s.io/klog"
+	"k8s.io/klog/v2"
 
 	authnv1 "k8s.io/api/authentication/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -43,9 +43,9 @@ const (
 	userAgentTruncateSuffix = "...TRUNCATED"
 )
 
-func NewEventFromRequest(req *http.Request, level auditinternal.Level, attribs authorizer.Attributes) (*auditinternal.Event, error) {
+func NewEventFromRequest(req *http.Request, requestReceivedTimestamp time.Time, level auditinternal.Level, attribs authorizer.Attributes) (*auditinternal.Event, error) {
 	ev := &auditinternal.Event{
-		RequestReceivedTimestamp: metav1.NewMicroTime(time.Now()),
+		RequestReceivedTimestamp: metav1.NewMicroTime(requestReceivedTimestamp),
 		Verb:                     attribs.GetVerb(),
 		RequestURI:               req.URL.RequestURI(),
 		UserAgent:                maybeTruncateUserAgent(req),
@@ -88,6 +88,10 @@ func NewEventFromRequest(req *http.Request, level auditinternal.Level, attribs a
 		}
 	}
 
+	for _, kv := range auditAnnotationsFrom(req.Context()) {
+		LogAnnotation(ev, kv.key, kv.value)
+	}
+
 	return ev, nil
 }
 

vendor/k8s.io/apiserver/pkg/authentication/authenticator/audagnostic.go

@@ -1,90 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package authenticator
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-)
-
-func authenticate(ctx context.Context, implicitAuds Audiences, authenticate func() (*Response, bool, error)) (*Response, bool, error) {
-	targetAuds, ok := AudiencesFrom(ctx)
-	// We can remove this once api audiences is never empty. That will probably
-	// be N releases after TokenRequest is GA.
-	if !ok {
-		return authenticate()
-	}
-	auds := implicitAuds.Intersect(targetAuds)
-	if len(auds) == 0 {
-		return nil, false, nil
-	}
-	resp, ok, err := authenticate()
-	if err != nil || !ok {
-		return nil, false, err
-	}
-	if len(resp.Audiences) > 0 {
-		// maybe the authenticator was audience aware after all.
-		return nil, false, fmt.Errorf("audience agnostic authenticator wrapped an authenticator that returned audiences: %q", resp.Audiences)
-	}
-	resp.Audiences = auds
-	return resp, true, nil
-}
-
-type audAgnosticRequestAuthenticator struct {
-	implicit Audiences
-	delegate Request
-}
-
-var _ = Request(&audAgnosticRequestAuthenticator{})
-
-func (a *audAgnosticRequestAuthenticator) AuthenticateRequest(req *http.Request) (*Response, bool, error) {
-	return authenticate(req.Context(), a.implicit, func() (*Response, bool, error) {
-		return a.delegate.AuthenticateRequest(req)
-	})
-}
-
-// WrapAudienceAgnosticRequest wraps an audience agnostic request authenticator
-// to restrict its accepted audiences to a set of implicit audiences.
-func WrapAudienceAgnosticRequest(implicit Audiences, delegate Request) Request {
-	return &audAgnosticRequestAuthenticator{
-		implicit: implicit,
-		delegate: delegate,
-	}
-}
-
-type audAgnosticTokenAuthenticator struct {
-	implicit Audiences
-	delegate Token
-}
-
-var _ = Token(&audAgnosticTokenAuthenticator{})
-
-func (a *audAgnosticTokenAuthenticator) AuthenticateToken(ctx context.Context, tok string) (*Response, bool, error) {
-	return authenticate(ctx, a.implicit, func() (*Response, bool, error) {
-		return a.delegate.AuthenticateToken(ctx, tok)
-	})
-}
-
-// WrapAudienceAgnosticToken wraps an audience agnostic token authenticator to
-// restrict its accepted audiences to a set of implicit audiences.
-func WrapAudienceAgnosticToken(implicit Audiences, delegate Token) Token {
-	return &audAgnosticTokenAuthenticator{
-		implicit: implicit,
-		delegate: delegate,
-	}
-}

vendor/k8s.io/apiserver/pkg/authentication/authenticator/audiences.go

@@ -1,63 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package authenticator
-
-import "context"
-
-// Audiences is a container for the Audiences of a token.
-type Audiences []string
-
-// The key type is unexported to prevent collisions
-type key int
-
-const (
-	// audiencesKey is the context key for request audiences.
-	audiencesKey key = iota
-)
-
-// WithAudiences returns a context that stores a request's expected audiences.
-func WithAudiences(ctx context.Context, auds Audiences) context.Context {
-	return context.WithValue(ctx, audiencesKey, auds)
-}
-
-// AudiencesFrom returns a request's expected audiences stored in the request context.
-func AudiencesFrom(ctx context.Context) (Audiences, bool) {
-	auds, ok := ctx.Value(audiencesKey).(Audiences)
-	return auds, ok
-}
-
-// Has checks if Audiences contains a specific audiences.
-func (a Audiences) Has(taud string) bool {
-	for _, aud := range a {
-		if aud == taud {
-			return true
-		}
-	}
-	return false
-}
-
-// Intersect intersects Audiences with a target Audiences and returns all
-// elements in both.
-func (a Audiences) Intersect(tauds Audiences) Audiences {
-	selected := Audiences{}
-	for _, taud := range tauds {
-		if a.Has(taud) {
-			selected = append(selected, taud)
-		}
-	}
-	return selected
-}

vendor/k8s.io/apiserver/pkg/authentication/authenticator/interfaces.go

@@ -1,80 +0,0 @@
-/*
-Copyright 2014 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package authenticator
-
-import (
-	"context"
-	"net/http"
-
-	"k8s.io/apiserver/pkg/authentication/user"
-)
-
-// Token checks a string value against a backing authentication store and
-// returns a Response or an error if the token could not be checked.
-type Token interface {
-	AuthenticateToken(ctx context.Context, token string) (*Response, bool, error)
-}
-
-// Request attempts to extract authentication information from a request and
-// returns a Response or an error if the request could not be checked.
-type Request interface {
-	AuthenticateRequest(req *http.Request) (*Response, bool, error)
-}
-
-// Password checks a username and password against a backing authentication
-// store and returns a Response or an error if the password could not be
-// checked.
-type Password interface {
-	AuthenticatePassword(ctx context.Context, user, password string) (*Response, bool, error)
-}
-
-// TokenFunc is a function that implements the Token interface.
-type TokenFunc func(ctx context.Context, token string) (*Response, bool, error)
-
-// AuthenticateToken implements authenticator.Token.
-func (f TokenFunc) AuthenticateToken(ctx context.Context, token string) (*Response, bool, error) {
-	return f(ctx, token)
-}
-
-// RequestFunc is a function that implements the Request interface.
-type RequestFunc func(req *http.Request) (*Response, bool, error)
-
-// AuthenticateRequest implements authenticator.Request.
-func (f RequestFunc) AuthenticateRequest(req *http.Request) (*Response, bool, error) {
-	return f(req)
-}
-
-// PasswordFunc is a function that implements the Password interface.
-type PasswordFunc func(ctx context.Context, user, password string) (*Response, bool, error)
-
-// AuthenticatePassword implements authenticator.Password.
-func (f PasswordFunc) AuthenticatePassword(ctx context.Context, user, password string) (*Response, bool, error) {
-	return f(ctx, user, password)
-}
-
-// Response is the struct returned by authenticator interfaces upon successful
-// authentication. It contains information about whether the authenticator
-// authenticated the request, information about the context of the
-// authentication, and information about the authenticated user.
-type Response struct {
-	// Audiences is the set of audiences the authenticator was able to validate
-	// the token against. If the authenticator is not audience aware, this field
-	// will be empty.
-	Audiences Audiences
-	// User is the UserInfo associated with the authentication context.
-	User user.Info
-}

vendor/k8s.io/apiserver/pkg/authentication/serviceaccount/util.go

@@ -17,10 +17,18 @@ limitations under the License.
 package serviceaccount
 
 import (
+	"context"
 	"fmt"
 	"strings"
 
+	v1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	apimachineryvalidation "k8s.io/apimachinery/pkg/api/validation"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/authentication/user"
+	v1core "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	"k8s.io/klog/v2"
 )
 
 const (
@@ -28,6 +36,12 @@ const (
 	ServiceAccountUsernameSeparator = ":"
 	ServiceAccountGroupPrefix       = "system:serviceaccounts:"
 	AllServiceAccountsGroup         = "system:serviceaccounts"
+	// PodNameKey is the key used in a user's "extra" to specify the pod name of
+	// the authenticating request.
+	PodNameKey = "authentication.kubernetes.io/pod-name"
+	// PodUIDKey is the key used in a user's "extra" to specify the pod UID of
+	// the authenticating request.
+	PodUIDKey = "authentication.kubernetes.io/pod-uid"
 )
 
 // MakeUsername generates a username from the given namespace and ServiceAccount name.
@@ -92,3 +106,78 @@ func MakeGroupNames(namespace string) []string {
 func MakeNamespaceGroupName(namespace string) string {
 	return ServiceAccountGroupPrefix + namespace
 }
+
+// UserInfo returns a user.Info interface for the given namespace, service account name and UID
+func UserInfo(namespace, name, uid string) user.Info {
+	return (&ServiceAccountInfo{
+		Name:      name,
+		Namespace: namespace,
+		UID:       uid,
+	}).UserInfo()
+}
+
+type ServiceAccountInfo struct {
+	Name, Namespace, UID string
+	PodName, PodUID      string
+}
+
+func (sa *ServiceAccountInfo) UserInfo() user.Info {
+	info := &user.DefaultInfo{
+		Name:   MakeUsername(sa.Namespace, sa.Name),
+		UID:    sa.UID,
+		Groups: MakeGroupNames(sa.Namespace),
+	}
+	if sa.PodName != "" && sa.PodUID != "" {
+		info.Extra = map[string][]string{
+			PodNameKey: {sa.PodName},
+			PodUIDKey:  {sa.PodUID},
+		}
+	}
+	return info
+}
+
+// IsServiceAccountToken returns true if the secret is a valid api token for the service account
+func IsServiceAccountToken(secret *v1.Secret, sa *v1.ServiceAccount) bool {
+	if secret.Type != v1.SecretTypeServiceAccountToken {
+		return false
+	}
+
+	name := secret.Annotations[v1.ServiceAccountNameKey]
+	uid := secret.Annotations[v1.ServiceAccountUIDKey]
+	if name != sa.Name {
+		// Name must match
+		return false
+	}
+	if len(uid) > 0 && uid != string(sa.UID) {
+		// If UID is specified, it must match
+		return false
+	}
+
+	return true
+}
+
+func GetOrCreateServiceAccount(coreClient v1core.CoreV1Interface, namespace, name string) (*v1.ServiceAccount, error) {
+	sa, err := coreClient.ServiceAccounts(namespace).Get(context.TODO(), name, metav1.GetOptions{})
+	if err == nil {
+		return sa, nil
+	}
+	if !apierrors.IsNotFound(err) {
+		return nil, err
+	}
+
+	// Create the namespace if we can't verify it exists.
+	// Tolerate errors, since we don't know whether this component has namespace creation permissions.
+	if _, err := coreClient.Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{}); apierrors.IsNotFound(err) {
+		if _, err = coreClient.Namespaces().Create(context.TODO(), &v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: namespace}}, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
+			klog.Warningf("create non-exist namespace %s failed:%v", namespace, err)
+		}
+	}
+
+	// Create the service account
+	sa, err = coreClient.ServiceAccounts(namespace).Create(context.TODO(), &v1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Namespace: namespace, Name: name}}, metav1.CreateOptions{})
+	if apierrors.IsAlreadyExists(err) {
+		// If we're racing to init and someone else already created it, re-fetch
+		return coreClient.ServiceAccounts(namespace).Get(context.TODO(), name, metav1.GetOptions{})
+	}
+	return sa, err
+}

vendor/k8s.io/apiserver/pkg/authentication/user/user.go

@@ -70,6 +70,7 @@ func (i *DefaultInfo) GetExtra() map[string][]string {
 const (
 	SystemPrivilegedGroup = "system:masters"
 	NodesGroup            = "system:nodes"
+	MonitoringGroup       = "system:monitoring"
 	AllUnauthenticated    = "system:unauthenticated"
 	AllAuthenticated      = "system:authenticated"
 

vendor/k8s.io/apiserver/pkg/endpoints/request/OWNERS

@@ -1,7 +1,4 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 reviewers:
-- wojtek-t
-- timothysc
-- madhusudancs
-- hongchaodeng
+- sttts

vendor/k8s.io/apiserver/pkg/endpoints/request/context.go

@@ -0,0 +1,96 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package request
+
+import (
+	"context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/apis/audit"
+	"k8s.io/apiserver/pkg/authentication/user"
+)
+
+// The key type is unexported to prevent collisions
+type key int
+
+const (
+	// namespaceKey is the context key for the request namespace.
+	namespaceKey key = iota
+
+	// userKey is the context key for the request user.
+	userKey
+
+	// auditKey is the context key for the audit event.
+	auditKey
+
+	// audiencesKey is the context key for request audiences.
+	audiencesKey
+)
+
+// NewContext instantiates a base context object for request flows.
+func NewContext() context.Context {
+	return context.TODO()
+}
+
+// NewDefaultContext instantiates a base context object for request flows in the default namespace
+func NewDefaultContext() context.Context {
+	return WithNamespace(NewContext(), metav1.NamespaceDefault)
+}
+
+// WithValue returns a copy of parent in which the value associated with key is val.
+func WithValue(parent context.Context, key interface{}, val interface{}) context.Context {
+	return context.WithValue(parent, key, val)
+}
+
+// WithNamespace returns a copy of parent in which the namespace value is set
+func WithNamespace(parent context.Context, namespace string) context.Context {
+	return WithValue(parent, namespaceKey, namespace)
+}
+
+// NamespaceFrom returns the value of the namespace key on the ctx
+func NamespaceFrom(ctx context.Context) (string, bool) {
+	namespace, ok := ctx.Value(namespaceKey).(string)
+	return namespace, ok
+}
+
+// NamespaceValue returns the value of the namespace key on the ctx, or the empty string if none
+func NamespaceValue(ctx context.Context) string {
+	namespace, _ := NamespaceFrom(ctx)
+	return namespace
+}
+
+// WithUser returns a copy of parent in which the user value is set
+func WithUser(parent context.Context, user user.Info) context.Context {
+	return WithValue(parent, userKey, user)
+}
+
+// UserFrom returns the value of the user key on the ctx
+func UserFrom(ctx context.Context) (user.Info, bool) {
+	user, ok := ctx.Value(userKey).(user.Info)
+	return user, ok
+}
+
+// WithAuditEvent returns set audit event struct.
+func WithAuditEvent(parent context.Context, ev *audit.Event) context.Context {
+	return WithValue(parent, auditKey, ev)
+}
+
+// AuditEventFrom returns the audit event struct on the ctx
+func AuditEventFrom(ctx context.Context) *audit.Event {
+	ev, _ := ctx.Value(auditKey).(*audit.Event)
+	return ev
+}

vendor/k8s.io/apiserver/pkg/endpoints/request/doc.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2015 The Kubernetes Authors.
+Copyright 2016 The Kubernetes Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,5 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Interfaces for database-related operations.
-package storage // import "k8s.io/apiserver/pkg/storage"
+// Package request contains everything around extracting info from
+// a http request object.
+// TODO: this package is temporary. Handlers must move into pkg/apiserver/handlers to avoid dependency cycle
+package request // import "k8s.io/apiserver/pkg/endpoints/request"

vendor/k8s.io/apiserver/pkg/endpoints/request/received_time.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package request
+
+import (
+	"context"
+	"time"
+)
+
+type requestReceivedTimestampKeyType int
+
+// requestReceivedTimestampKey is the ReceivedTimestamp (the time the request reached the apiserver)
+// key for the context.
+const requestReceivedTimestampKey requestReceivedTimestampKeyType = iota
+
+// WithReceivedTimestamp returns a copy of parent context in which the ReceivedTimestamp
+// (the time the request reached the apiserver) is set.
+//
+// If the specified ReceivedTimestamp is zero, no value is set and the parent context is returned as is.
+func WithReceivedTimestamp(parent context.Context, receivedTimestamp time.Time) context.Context {
+	if receivedTimestamp.IsZero() {
+		return parent
+	}
+	return WithValue(parent, requestReceivedTimestampKey, receivedTimestamp)
+}
+
+// ReceivedTimestampFrom returns the value of the ReceivedTimestamp key from the specified context.
+func ReceivedTimestampFrom(ctx context.Context) (time.Time, bool) {
+	info, ok := ctx.Value(requestReceivedTimestampKey).(time.Time)
+	return info, ok
+}

vendor/k8s.io/apiserver/pkg/endpoints/request/requestinfo.go

@@ -0,0 +1,274 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package request
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/validation/path"
+	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metainternalversionscheme "k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
+
+	"k8s.io/klog/v2"
+)
+
+// LongRunningRequestCheck is a predicate which is true for long-running http requests.
+type LongRunningRequestCheck func(r *http.Request, requestInfo *RequestInfo) bool
+
+type RequestInfoResolver interface {
+	NewRequestInfo(req *http.Request) (*RequestInfo, error)
+}
+
+// RequestInfo holds information parsed from the http.Request
+type RequestInfo struct {
+	// IsResourceRequest indicates whether or not the request is for an API resource or subresource
+	IsResourceRequest bool
+	// Path is the URL path of the request
+	Path string
+	// Verb is the kube verb associated with the request for API requests, not the http verb.  This includes things like list and watch.
+	// for non-resource requests, this is the lowercase http verb
+	Verb string
+
+	APIPrefix  string
+	APIGroup   string
+	APIVersion string
+	Namespace  string
+	// Resource is the name of the resource being requested.  This is not the kind.  For example: pods
+	Resource string
+	// Subresource is the name of the subresource being requested.  This is a different resource, scoped to the parent resource, but it may have a different kind.
+	// For instance, /pods has the resource "pods" and the kind "Pod", while /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod"
+	// (because status operates on pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource "binding", and kind "Binding".
+	Subresource string
+	// Name is empty for some verbs, but if the request directly indicates a name (not in body content) then this field is filled in.
+	Name string
+	// Parts are the path parts for the request, always starting with /{resource}/{name}
+	Parts []string
+}
+
+// specialVerbs contains just strings which are used in REST paths for special actions that don't fall under the normal
+// CRUDdy GET/POST/PUT/DELETE actions on REST objects.
+// TODO: find a way to keep this up to date automatically.  Maybe dynamically populate list as handlers added to
+// master's Mux.
+var specialVerbs = sets.NewString("proxy", "watch")
+
+// specialVerbsNoSubresources contains root verbs which do not allow subresources
+var specialVerbsNoSubresources = sets.NewString("proxy")
+
+// namespaceSubresources contains subresources of namespace
+// this list allows the parser to distinguish between a namespace subresource, and a namespaced resource
+var namespaceSubresources = sets.NewString("status", "finalize")
+
+// NamespaceSubResourcesForTest exports namespaceSubresources for testing in pkg/controlplane/master_test.go, so we never drift
+var NamespaceSubResourcesForTest = sets.NewString(namespaceSubresources.List()...)
+
+type RequestInfoFactory struct {
+	APIPrefixes          sets.String // without leading and trailing slashes
+	GrouplessAPIPrefixes sets.String // without leading and trailing slashes
+}
+
+// TODO write an integration test against the swagger doc to test the RequestInfo and match up behavior to responses
+// NewRequestInfo returns the information from the http request.  If error is not nil, RequestInfo holds the information as best it is known before the failure
+// It handles both resource and non-resource requests and fills in all the pertinent information for each.
+// Valid Inputs:
+// Resource paths
+// /apis/{api-group}/{version}/namespaces
+// /api/{version}/namespaces
+// /api/{version}/namespaces/{namespace}
+// /api/{version}/namespaces/{namespace}/{resource}
+// /api/{version}/namespaces/{namespace}/{resource}/{resourceName}
+// /api/{version}/{resource}
+// /api/{version}/{resource}/{resourceName}
+//
+// Special verbs without subresources:
+// /api/{version}/proxy/{resource}/{resourceName}
+// /api/{version}/proxy/namespaces/{namespace}/{resource}/{resourceName}
+//
+// Special verbs with subresources:
+// /api/{version}/watch/{resource}
+// /api/{version}/watch/namespaces/{namespace}/{resource}
+//
+// NonResource paths
+// /apis/{api-group}/{version}
+// /apis/{api-group}
+// /apis
+// /api/{version}
+// /api
+// /healthz
+// /
+func (r *RequestInfoFactory) NewRequestInfo(req *http.Request) (*RequestInfo, error) {
+	// start with a non-resource request until proven otherwise
+	requestInfo := RequestInfo{
+		IsResourceRequest: false,
+		Path:              req.URL.Path,
+		Verb:              strings.ToLower(req.Method),
+	}
+
+	currentParts := splitPath(req.URL.Path)
+	if len(currentParts) < 3 {
+		// return a non-resource request
+		return &requestInfo, nil
+	}
+
+	if !r.APIPrefixes.Has(currentParts[0]) {
+		// return a non-resource request
+		return &requestInfo, nil
+	}
+	requestInfo.APIPrefix = currentParts[0]
+	currentParts = currentParts[1:]
+
+	if !r.GrouplessAPIPrefixes.Has(requestInfo.APIPrefix) {
+		// one part (APIPrefix) has already been consumed, so this is actually "do we have four parts?"
+		if len(currentParts) < 3 {
+			// return a non-resource request
+			return &requestInfo, nil
+		}
+
+		requestInfo.APIGroup = currentParts[0]
+		currentParts = currentParts[1:]
+	}
+
+	requestInfo.IsResourceRequest = true
+	requestInfo.APIVersion = currentParts[0]
+	currentParts = currentParts[1:]
+
+	// handle input of form /{specialVerb}/*
+	if specialVerbs.Has(currentParts[0]) {
+		if len(currentParts) < 2 {
+			return &requestInfo, fmt.Errorf("unable to determine kind and namespace from url, %v", req.URL)
+		}
+
+		requestInfo.Verb = currentParts[0]
+		currentParts = currentParts[1:]
+
+	} else {
+		switch req.Method {
+		case "POST":
+			requestInfo.Verb = "create"
+		case "GET", "HEAD":
+			requestInfo.Verb = "get"
+		case "PUT":
+			requestInfo.Verb = "update"
+		case "PATCH":
+			requestInfo.Verb = "patch"
+		case "DELETE":
+			requestInfo.Verb = "delete"
+		default:
+			requestInfo.Verb = ""
+		}
+	}
+
+	// URL forms: /namespaces/{namespace}/{kind}/*, where parts are adjusted to be relative to kind
+	if currentParts[0] == "namespaces" {
+		if len(currentParts) > 1 {
+			requestInfo.Namespace = currentParts[1]
+
+			// if there is another step after the namespace name and it is not a known namespace subresource
+			// move currentParts to include it as a resource in its own right
+			if len(currentParts) > 2 && !namespaceSubresources.Has(currentParts[2]) {
+				currentParts = currentParts[2:]
+			}
+		}
+	} else {
+		requestInfo.Namespace = metav1.NamespaceNone
+	}
+
+	// parsing successful, so we now know the proper value for .Parts
+	requestInfo.Parts = currentParts
+
+	// parts look like: resource/resourceName/subresource/other/stuff/we/don't/interpret
+	switch {
+	case len(requestInfo.Parts) >= 3 && !specialVerbsNoSubresources.Has(requestInfo.Verb):
+		requestInfo.Subresource = requestInfo.Parts[2]
+		fallthrough
+	case len(requestInfo.Parts) >= 2:
+		requestInfo.Name = requestInfo.Parts[1]
+		fallthrough
+	case len(requestInfo.Parts) >= 1:
+		requestInfo.Resource = requestInfo.Parts[0]
+	}
+
+	// if there's no name on the request and we thought it was a get before, then the actual verb is a list or a watch
+	if len(requestInfo.Name) == 0 && requestInfo.Verb == "get" {
+		opts := metainternalversion.ListOptions{}
+		if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), metav1.SchemeGroupVersion, &opts); err != nil {
+			// An error in parsing request will result in default to "list" and not setting "name" field.
+			klog.Errorf("Couldn't parse request %#v: %v", req.URL.Query(), err)
+			// Reset opts to not rely on partial results from parsing.
+			// However, if watch is set, let's report it.
+			opts = metainternalversion.ListOptions{}
+			if values := req.URL.Query()["watch"]; len(values) > 0 {
+				switch strings.ToLower(values[0]) {
+				case "false", "0":
+				default:
+					opts.Watch = true
+				}
+			}
+		}
+
+		if opts.Watch {
+			requestInfo.Verb = "watch"
+		} else {
+			requestInfo.Verb = "list"
+		}
+
+		if opts.FieldSelector != nil {
+			if name, ok := opts.FieldSelector.RequiresExactMatch("metadata.name"); ok {
+				if len(path.IsValidPathSegmentName(name)) == 0 {
+					requestInfo.Name = name
+				}
+			}
+		}
+	}
+	// if there's no name on the request and we thought it was a delete before, then the actual verb is deletecollection
+	if len(requestInfo.Name) == 0 && requestInfo.Verb == "delete" {
+		requestInfo.Verb = "deletecollection"
+	}
+
+	return &requestInfo, nil
+}
+
+type requestInfoKeyType int
+
+// requestInfoKey is the RequestInfo key for the context. It's of private type here. Because
+// keys are interfaces and interfaces are equal when the type and the value is equal, this
+// does not conflict with the keys defined in pkg/api.
+const requestInfoKey requestInfoKeyType = iota
+
+// WithRequestInfo returns a copy of parent in which the request info value is set
+func WithRequestInfo(parent context.Context, info *RequestInfo) context.Context {
+	return WithValue(parent, requestInfoKey, info)
+}
+
+// RequestInfoFrom returns the value of the RequestInfo key on the ctx
+func RequestInfoFrom(ctx context.Context) (*RequestInfo, bool) {
+	info, ok := ctx.Value(requestInfoKey).(*RequestInfo)
+	return info, ok
+}
+
+// splitPath returns the segments for a URL path.
+func splitPath(path string) []string {
+	path = strings.Trim(path, "/")
+	if path == "" {
+		return []string{}
+	}
+	return strings.Split(path, "/")
+}

vendor/k8s.io/apiserver/pkg/features/kube_features.go

@@ -59,15 +59,9 @@ const (
 	// audited.
 	AdvancedAuditing featuregate.Feature = "AdvancedAuditing"
 
-	// owner: @pbarker
-	// alpha: v1.13
-	//
-	// DynamicAuditing enables configuration of audit policy and webhook backends through an
-	// AuditSink API object.
-	DynamicAuditing featuregate.Feature = "DynamicAuditing"
-
 	// owner: @ilackams
 	// alpha: v1.7
+	// beta: v1.16
 	//
 	// Enables compression of REST responses (GET and LIST only)
 	APIResponseCompression featuregate.Feature = "APIResponseCompression"
@@ -83,6 +77,7 @@ const (
 	// owner: @apelisse
 	// alpha: v1.12
 	// beta: v1.13
+	// stable: v1.18
 	//
 	// Allow requests to be processed but not stored, so that
 	// validation, merging, mutation can be tested without
@@ -91,6 +86,7 @@ const (
 
 	// owner: @caesarxuchao
 	// alpha: v1.15
+	// beta: v1.16
 	//
 	// Allow apiservers to show a count of remaining items in the response
 	// to a chunking list request.
@@ -111,17 +107,11 @@ const (
 	// document.
 	StorageVersionHash featuregate.Feature = "StorageVersionHash"
 
-	// owner: @ksubrmnn
-	// alpha: v1.14
+	// owner: @caesarxuchao @roycaihw
+	// alpha: v1.20
 	//
-	// Allows kube-proxy to run in Overlay mode for Windows
-	WinOverlay featuregate.Feature = "WinOverlay"
-
-	// owner: @ksubrmnn
-	// alpha: v1.14
-	//
-	// Allows kube-proxy to create DSR loadbalancers for Windows
-	WinDSR featuregate.Feature = "WinDSR"
+	// Enable the storage version API.
+	StorageVersionAPI featuregate.Feature = "StorageVersionAPI"
 
 	// owner: @wojtek-t
 	// alpha: v1.15
@@ -140,15 +130,36 @@ const (
 
 	// owner: @wojtek-t
 	// alpha: v1.16
+	// beta: v1.20
 	//
 	// Deprecates and removes SelfLink from ObjectMeta and ListMeta.
 	RemoveSelfLink featuregate.Feature = "RemoveSelfLink"
 
-	// owner: @shaloulcy
+	// owner: @shaloulcy, @wojtek-t
 	// alpha: v1.18
+	// beta: v1.19
+	// GA: v1.20
 	//
 	// Allows label and field based indexes in apiserver watch cache to accelerate list operations.
 	SelectorIndex featuregate.Feature = "SelectorIndex"
+
+	// owner: @liggitt
+	// beta: v1.19
+	//
+	// Allows sending warning headers in API responses.
+	WarningHeaders featuregate.Feature = "WarningHeaders"
+
+	// owner: @wojtek-t
+	// alpha: v1.20
+	//
+	// Allows for updating watchcache resource version with progress notify events.
+	EfficientWatchResumption featuregate.Feature = "EfficientWatchResumption"
+
+	// owner: @roycaihw
+	// alpha: v1.20
+	//
+	// Assigns each kube-apiserver an ID in a cluster.
+	APIServerIdentity featuregate.Feature = "APIServerIdentity"
 )
 
 func init() {
@@ -159,20 +170,21 @@ func init() {
 // To add a new feature, define a key for it above and add it here. The features will be
 // available throughout Kubernetes binaries.
 var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
-	StreamingProxyRedirects: {Default: true, PreRelease: featuregate.Deprecated},
-	ValidateProxyRedirects:  {Default: true, PreRelease: featuregate.Beta},
-	AdvancedAuditing:        {Default: true, PreRelease: featuregate.GA},
-	DynamicAuditing:         {Default: false, PreRelease: featuregate.Alpha},
-	APIResponseCompression:  {Default: true, PreRelease: featuregate.Beta},
-	APIListChunking:         {Default: true, PreRelease: featuregate.Beta},
-	DryRun:                  {Default: true, PreRelease: featuregate.Beta},
-	RemainingItemCount:      {Default: true, PreRelease: featuregate.Beta},
-	ServerSideApply:         {Default: true, PreRelease: featuregate.Beta},
-	StorageVersionHash:      {Default: true, PreRelease: featuregate.Beta},
-	WinOverlay:              {Default: false, PreRelease: featuregate.Alpha},
-	WinDSR:                  {Default: false, PreRelease: featuregate.Alpha},
-	WatchBookmark:           {Default: true, PreRelease: featuregate.GA, LockToDefault: true},
-	APIPriorityAndFairness:  {Default: false, PreRelease: featuregate.Alpha},
-	RemoveSelfLink:          {Default: false, PreRelease: featuregate.Alpha},
-	SelectorIndex:           {Default: false, PreRelease: featuregate.Alpha},
+	StreamingProxyRedirects:  {Default: true, PreRelease: featuregate.Deprecated},
+	ValidateProxyRedirects:   {Default: true, PreRelease: featuregate.Beta},
+	AdvancedAuditing:         {Default: true, PreRelease: featuregate.GA},
+	APIResponseCompression:   {Default: true, PreRelease: featuregate.Beta},
+	APIListChunking:          {Default: true, PreRelease: featuregate.Beta},
+	DryRun:                   {Default: true, PreRelease: featuregate.GA},
+	RemainingItemCount:       {Default: true, PreRelease: featuregate.Beta},
+	ServerSideApply:          {Default: true, PreRelease: featuregate.Beta},
+	StorageVersionHash:       {Default: true, PreRelease: featuregate.Beta},
+	StorageVersionAPI:        {Default: false, PreRelease: featuregate.Alpha},
+	WatchBookmark:            {Default: true, PreRelease: featuregate.GA, LockToDefault: true},
+	APIPriorityAndFairness:   {Default: true, PreRelease: featuregate.Beta},
+	RemoveSelfLink:           {Default: true, PreRelease: featuregate.Beta},
+	SelectorIndex:            {Default: true, PreRelease: featuregate.GA, LockToDefault: true},
+	WarningHeaders:           {Default: true, PreRelease: featuregate.Beta},
+	EfficientWatchResumption: {Default: false, PreRelease: featuregate.Alpha},
+	APIServerIdentity:        {Default: false, PreRelease: featuregate.Alpha},
 }

vendor/k8s.io/apiserver/pkg/quota/v1/OWNERS

@@ -0,0 +1,13 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+- deads2k
+- derekwaynecarr
+- vishh
+reviewers:
+- deads2k
+- derekwaynecarr
+- smarterclayton
+- vishh
+labels:
+- sig/api-machinery

vendor/k8s.io/apiserver/pkg/quota/v1/interfaces.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/client-go/tools/cache"
+)
+
+// UsageStatsOptions is an options structs that describes how stats should be calculated
+type UsageStatsOptions struct {
+	// Namespace where stats should be calculate
+	Namespace string
+	// Scopes that must match counted objects
+	Scopes []corev1.ResourceQuotaScope
+	// Resources are the set of resources to include in the measurement
+	Resources     []corev1.ResourceName
+	ScopeSelector *corev1.ScopeSelector
+}
+
+// UsageStats is result of measuring observed resource use in the system
+type UsageStats struct {
+	// Used maps resource to quantity used
+	Used corev1.ResourceList
+}
+
+// Evaluator knows how to evaluate quota usage for a particular group resource
+type Evaluator interface {
+	// Constraints ensures that each required resource is present on item
+	Constraints(required []corev1.ResourceName, item runtime.Object) error
+	// GroupResource returns the groupResource that this object knows how to evaluate
+	GroupResource() schema.GroupResource
+	// Handles determines if quota could be impacted by the specified attribute.
+	// If true, admission control must perform quota processing for the operation, otherwise it is safe to ignore quota.
+	Handles(operation admission.Attributes) bool
+	// Matches returns true if the specified quota matches the input item
+	Matches(resourceQuota *corev1.ResourceQuota, item runtime.Object) (bool, error)
+	// MatchingScopes takes the input specified list of scopes and input object and returns the set of scopes that matches input object.
+	MatchingScopes(item runtime.Object, scopes []corev1.ScopedResourceSelectorRequirement) ([]corev1.ScopedResourceSelectorRequirement, error)
+	// UncoveredQuotaScopes takes the input matched scopes which are limited by configuration and the matched quota scopes. It returns the scopes which are in limited scopes but dont have a corresponding covering quota scope
+	UncoveredQuotaScopes(limitedScopes []corev1.ScopedResourceSelectorRequirement, matchedQuotaScopes []corev1.ScopedResourceSelectorRequirement) ([]corev1.ScopedResourceSelectorRequirement, error)
+	// MatchingResources takes the input specified list of resources and returns the set of resources evaluator matches.
+	MatchingResources(input []corev1.ResourceName) []corev1.ResourceName
+	// Usage returns the resource usage for the specified object
+	Usage(item runtime.Object) (corev1.ResourceList, error)
+	// UsageStats calculates latest observed usage stats for all objects
+	UsageStats(options UsageStatsOptions) (UsageStats, error)
+}
+
+// Configuration defines how the quota system is configured.
+type Configuration interface {
+	// IgnoredResources are ignored by quota.
+	IgnoredResources() map[schema.GroupResource]struct{}
+	// Evaluators for quota evaluation.
+	Evaluators() []Evaluator
+}
+
+// Registry maintains a list of evaluators
+type Registry interface {
+	// Add to registry
+	Add(e Evaluator)
+	// Remove from registry
+	Remove(e Evaluator)
+	// Get by group resource
+	Get(gr schema.GroupResource) Evaluator
+	// List from registry
+	List() []Evaluator
+}
+
+// ListerForResourceFunc knows how to get a lister for a specific resource
+type ListerForResourceFunc func(schema.GroupVersionResource) (cache.GenericLister, error)

vendor/k8s.io/apiserver/pkg/quota/v1/resources.go

@@ -0,0 +1,293 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"sort"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// Equals returns true if the two lists are equivalent
+func Equals(a corev1.ResourceList, b corev1.ResourceList) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for key, value1 := range a {
+		value2, found := b[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
+// LessThanOrEqual returns true if a < b for each key in b
+// If false, it returns the keys in a that exceeded b
+func LessThanOrEqual(a corev1.ResourceList, b corev1.ResourceList) (bool, []corev1.ResourceName) {
+	result := true
+	resourceNames := []corev1.ResourceName{}
+	for key, value := range b {
+		if other, found := a[key]; found {
+			if other.Cmp(value) > 0 {
+				result = false
+				resourceNames = append(resourceNames, key)
+			}
+		}
+	}
+	return result, resourceNames
+}
+
+// Max returns the result of Max(a, b) for each named resource
+func Max(a corev1.ResourceList, b corev1.ResourceList) corev1.ResourceList {
+	result := corev1.ResourceList{}
+	for key, value := range a {
+		if other, found := b[key]; found {
+			if value.Cmp(other) <= 0 {
+				result[key] = other.DeepCopy()
+				continue
+			}
+		}
+		result[key] = value.DeepCopy()
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			result[key] = value.DeepCopy()
+		}
+	}
+	return result
+}
+
+// Add returns the result of a + b for each named resource
+func Add(a corev1.ResourceList, b corev1.ResourceList) corev1.ResourceList {
+	result := corev1.ResourceList{}
+	for key, value := range a {
+		quantity := value.DeepCopy()
+		if other, found := b[key]; found {
+			quantity.Add(other)
+		}
+		result[key] = quantity
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			result[key] = value.DeepCopy()
+		}
+	}
+	return result
+}
+
+// SubtractWithNonNegativeResult - subtracts and returns result of a - b but
+// makes sure we don't return negative values to prevent negative resource usage.
+func SubtractWithNonNegativeResult(a corev1.ResourceList, b corev1.ResourceList) corev1.ResourceList {
+	zero := resource.MustParse("0")
+
+	result := corev1.ResourceList{}
+	for key, value := range a {
+		quantity := value.DeepCopy()
+		if other, found := b[key]; found {
+			quantity.Sub(other)
+		}
+		if quantity.Cmp(zero) > 0 {
+			result[key] = quantity
+		} else {
+			result[key] = zero
+		}
+	}
+
+	for key := range b {
+		if _, found := result[key]; !found {
+			result[key] = zero
+		}
+	}
+	return result
+}
+
+// Subtract returns the result of a - b for each named resource
+func Subtract(a corev1.ResourceList, b corev1.ResourceList) corev1.ResourceList {
+	result := corev1.ResourceList{}
+	for key, value := range a {
+		quantity := value.DeepCopy()
+		if other, found := b[key]; found {
+			quantity.Sub(other)
+		}
+		result[key] = quantity
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			quantity := value.DeepCopy()
+			quantity.Neg()
+			result[key] = quantity
+		}
+	}
+	return result
+}
+
+// Mask returns a new resource list that only has the values with the specified names
+func Mask(resources corev1.ResourceList, names []corev1.ResourceName) corev1.ResourceList {
+	nameSet := ToSet(names)
+	result := corev1.ResourceList{}
+	for key, value := range resources {
+		if nameSet.Has(string(key)) {
+			result[key] = value.DeepCopy()
+		}
+	}
+	return result
+}
+
+// ResourceNames returns a list of all resource names in the ResourceList
+func ResourceNames(resources corev1.ResourceList) []corev1.ResourceName {
+	result := []corev1.ResourceName{}
+	for resourceName := range resources {
+		result = append(result, resourceName)
+	}
+	return result
+}
+
+// Contains returns true if the specified item is in the list of items
+func Contains(items []corev1.ResourceName, item corev1.ResourceName) bool {
+	for _, i := range items {
+		if i == item {
+			return true
+		}
+	}
+	return false
+}
+
+// ContainsPrefix returns true if the specified item has a prefix that contained in given prefix Set
+func ContainsPrefix(prefixSet []string, item corev1.ResourceName) bool {
+	for _, prefix := range prefixSet {
+		if strings.HasPrefix(string(item), prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+// Intersection returns the intersection of both list of resources, deduped and sorted
+func Intersection(a []corev1.ResourceName, b []corev1.ResourceName) []corev1.ResourceName {
+	result := make([]corev1.ResourceName, 0, len(a))
+	for _, item := range a {
+		if Contains(result, item) {
+			continue
+		}
+		if !Contains(b, item) {
+			continue
+		}
+		result = append(result, item)
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i] < result[j] })
+	return result
+}
+
+// Difference returns the list of resources resulting from a-b, deduped and sorted
+func Difference(a []corev1.ResourceName, b []corev1.ResourceName) []corev1.ResourceName {
+	result := make([]corev1.ResourceName, 0, len(a))
+	for _, item := range a {
+		if Contains(b, item) || Contains(result, item) {
+			continue
+		}
+		result = append(result, item)
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i] < result[j] })
+	return result
+}
+
+// IsZero returns true if each key maps to the quantity value 0
+func IsZero(a corev1.ResourceList) bool {
+	zero := resource.MustParse("0")
+	for _, v := range a {
+		if v.Cmp(zero) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// IsNegative returns the set of resource names that have a negative value.
+func IsNegative(a corev1.ResourceList) []corev1.ResourceName {
+	results := []corev1.ResourceName{}
+	zero := resource.MustParse("0")
+	for k, v := range a {
+		if v.Cmp(zero) < 0 {
+			results = append(results, k)
+		}
+	}
+	return results
+}
+
+// ToSet takes a list of resource names and converts to a string set
+func ToSet(resourceNames []corev1.ResourceName) sets.String {
+	result := sets.NewString()
+	for _, resourceName := range resourceNames {
+		result.Insert(string(resourceName))
+	}
+	return result
+}
+
+// CalculateUsage calculates and returns the requested ResourceList usage.
+// If an error is returned, usage only contains the resources which encountered no calculation errors.
+func CalculateUsage(namespaceName string, scopes []corev1.ResourceQuotaScope, hardLimits corev1.ResourceList, registry Registry, scopeSelector *corev1.ScopeSelector) (corev1.ResourceList, error) {
+	// find the intersection between the hard resources on the quota
+	// and the resources this controller can track to know what we can
+	// look to measure updated usage stats for
+	hardResources := ResourceNames(hardLimits)
+	potentialResources := []corev1.ResourceName{}
+	evaluators := registry.List()
+	for _, evaluator := range evaluators {
+		potentialResources = append(potentialResources, evaluator.MatchingResources(hardResources)...)
+	}
+	// NOTE: the intersection just removes duplicates since the evaluator match intersects with hard
+	matchedResources := Intersection(hardResources, potentialResources)
+
+	errors := []error{}
+
+	// sum the observed usage from each evaluator
+	newUsage := corev1.ResourceList{}
+	for _, evaluator := range evaluators {
+		// only trigger the evaluator if it matches a resource in the quota, otherwise, skip calculating anything
+		intersection := evaluator.MatchingResources(matchedResources)
+		if len(intersection) == 0 {
+			continue
+		}
+
+		usageStatsOptions := UsageStatsOptions{Namespace: namespaceName, Scopes: scopes, Resources: intersection, ScopeSelector: scopeSelector}
+		stats, err := evaluator.UsageStats(usageStatsOptions)
+		if err != nil {
+			// remember the error
+			errors = append(errors, err)
+			// exclude resources which encountered calculation errors
+			matchedResources = Difference(matchedResources, intersection)
+			continue
+		}
+		newUsage = Add(newUsage, stats.Used)
+	}
+
+	// mask the observed usage to only the set of resources tracked by this quota
+	// merge our observed usage with the quota usage status
+	// if the new usage is different than the last usage, we will need to do an update
+	newUsage = Mask(newUsage, matchedResources)
+	return newUsage, utilerrors.NewAggregate(errors)
+}

vendor/k8s.io/apiserver/pkg/server/egressselector/config.go

@@ -22,6 +22,7 @@ import (
 	"strings"
 
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apiserver/pkg/apis/apiserver"
 	"k8s.io/apiserver/pkg/apis/apiserver/install"
@@ -32,6 +33,10 @@ import (
 
 var cfgScheme = runtime.NewScheme()
 
+// validEgressSelectorNames contains the set of valid egress selctor names.
+// 'master' is deprecated in favor of 'controlplane' and will be removed in v1.22.
+var validEgressSelectorNames = sets.NewString("master", "controlplane", "cluster", "etcd")
+
 func init() {
 	install.Install(cfgScheme)
 }
@@ -97,6 +102,30 @@ func ValidateEgressSelectorConfiguration(config *apiserver.EgressSelectorConfigu
 				}))
 		}
 	}
+
+	var foundControlPlane, foundMaster bool
+	for _, service := range config.EgressSelections {
+		canonicalName := strings.ToLower(service.Name)
+
+		if !validEgressSelectorNames.Has(canonicalName) {
+			allErrs = append(allErrs, field.NotSupported(field.NewPath("egressSelection", "name"), canonicalName, validEgressSelectorNames.List()))
+			continue
+		}
+
+		if canonicalName == "master" {
+			foundMaster = true
+		}
+
+		if canonicalName == "controlplane" {
+			foundControlPlane = true
+		}
+	}
+
+	// error if both master and controlplane egress selectors are set
+	if foundMaster && foundControlPlane {
+		allErrs = append(allErrs, field.Forbidden(field.NewPath("egressSelection", "name"), "both egressSelection names 'master' and 'controlplane' are specified, only one is allowed"))
+	}
+
 	return allErrs
 }
 
@@ -199,7 +228,7 @@ func validateTLSConfig(tlsConfig *apiserver.TLSConfig, fldPath *field.Path) fiel
 		return allErrs
 	}
 	if tlsConfig.CABundle != "" {
-		if exists, err := path.Exists(path.CheckFollowSymlink, tlsConfig.CABundle); exists == false || err != nil {
+		if exists, err := path.Exists(path.CheckFollowSymlink, tlsConfig.CABundle); !exists || err != nil {
 			allErrs = append(allErrs, field.Invalid(
 				fldPath.Child("tlsConfig", "caBundle"),
 				tlsConfig.CABundle,
@@ -211,7 +240,7 @@ func validateTLSConfig(tlsConfig *apiserver.TLSConfig, fldPath *field.Path) fiel
 			fldPath.Child("tlsConfig", "clientCert"),
 			"nil",
 			"Using TLS requires clientCert"))
-	} else if exists, err := path.Exists(path.CheckFollowSymlink, tlsConfig.ClientCert); exists == false || err != nil {
+	} else if exists, err := path.Exists(path.CheckFollowSymlink, tlsConfig.ClientCert); !exists || err != nil {
 		allErrs = append(allErrs, field.Invalid(
 			fldPath.Child("tlsConfig", "clientCert"),
 			tlsConfig.ClientCert,
@@ -222,7 +251,7 @@ func validateTLSConfig(tlsConfig *apiserver.TLSConfig, fldPath *field.Path) fiel
 			fldPath.Child("tlsConfig", "clientKey"),
 			"nil",
 			"Using TLS requires requires clientKey"))
-	} else if exists, err := path.Exists(path.CheckFollowSymlink, tlsConfig.ClientKey); exists == false || err != nil {
+	} else if exists, err := path.Exists(path.CheckFollowSymlink, tlsConfig.ClientKey); !exists || err != nil {
 		allErrs = append(allErrs, field.Invalid(
 			fldPath.Child("tlsConfig", "clientKey"),
 			tlsConfig.ClientKey,

vendor/k8s.io/apiserver/pkg/server/egressselector/egress_selector.go

@@ -34,7 +34,7 @@ import (
 	utilnet "k8s.io/apimachinery/pkg/util/net"
 	"k8s.io/apiserver/pkg/apis/apiserver"
 	egressmetrics "k8s.io/apiserver/pkg/server/egressselector/metrics"
-	"k8s.io/klog"
+	"k8s.io/klog/v2"
 	utiltrace "k8s.io/utils/trace"
 	client "sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client"
 )
@@ -51,8 +51,8 @@ type EgressSelector struct {
 type EgressType int
 
 const (
-	// Master is the EgressType for traffic intended to go to the control plane.
-	Master EgressType = iota
+	// ControlPlane is the EgressType for traffic intended to go to the control plane.
+	ControlPlane EgressType = iota
 	// Etcd is the EgressType for traffic intended to go to Kubernetes persistence store.
 	Etcd
 	// Cluster is the EgressType for traffic intended to go to the system being managed by Kubernetes.
@@ -73,8 +73,8 @@ type Lookup func(networkContext NetworkContext) (utilnet.DialFunc, error)
 // String returns the canonical string representation of the egress type
 func (s EgressType) String() string {
 	switch s {
-	case Master:
-		return "master"
+	case ControlPlane:
+		return "controlplane"
 	case Etcd:
 		return "etcd"
 	case Cluster:
@@ -91,8 +91,12 @@ func (s EgressType) AsNetworkContext() NetworkContext {
 
 func lookupServiceName(name string) (EgressType, error) {
 	switch strings.ToLower(name) {
+	// 'master' is deprecated, interpret "master" as controlplane internally until removed in v1.22.
 	case "master":
-		return Master, nil
+		klog.Warning("EgressSelection name 'master' is deprecated, use 'controlplane' instead")
+		return ControlPlane, nil
+	case "controlplane":
+		return ControlPlane, nil
 	case "etcd":
 		return Etcd, nil
 	case "cluster":
@@ -199,7 +203,7 @@ func (u *udsGRPCConnector) connect() (proxier, error) {
 		return c, err
 	})
 
-	tunnel, err := client.CreateGrpcTunnel(udsName, dialOption, grpc.WithInsecure())
+	tunnel, err := client.CreateSingleUseGrpcTunnel(udsName, dialOption, grpc.WithInsecure())
 	if err != nil {
 		return nil, err
 	}
@@ -364,5 +368,6 @@ func (cs *EgressSelector) Lookup(networkContext NetworkContext) (utilnet.DialFun
 		// The round trip wrapper will over-ride the dialContext method appropriately
 		return nil, nil
 	}
+
 	return cs.egressToDialer[networkContext.EgressSelectionName], nil
 }

vendor/k8s.io/apiserver/pkg/storage/OWNERS

@@ -1,29 +0,0 @@
-# See the OWNERS docs at https://go.k8s.io/owners
-
-approvers:
-- lavalamp
-- liggitt
-- timothysc
-- wojtek-t
-- xiang90
-reviewers:
-- lavalamp
-- smarterclayton
-- wojtek-t
-- deads2k
-- caesarxuchao
-- mikedanese
-- liggitt
-- ncdc
-- tallclair
-- timothysc
-- hongchaodeng
-- krousey
-- xiang90
-- mml
-- ingvagabund
-- resouer
-- mbohlool
-- mqliang
-- rrati
-- enj

vendor/k8s.io/apiserver/pkg/storage/errors.go

@@ -1,195 +0,0 @@
-/*
-Copyright 2015 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package storage
-
-import (
-	"fmt"
-
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/validation/field"
-)
-
-const (
-	ErrCodeKeyNotFound int = iota + 1
-	ErrCodeKeyExists
-	ErrCodeResourceVersionConflicts
-	ErrCodeInvalidObj
-	ErrCodeUnreachable
-)
-
-var errCodeToMessage = map[int]string{
-	ErrCodeKeyNotFound:              "key not found",
-	ErrCodeKeyExists:                "key exists",
-	ErrCodeResourceVersionConflicts: "resource version conflicts",
-	ErrCodeInvalidObj:               "invalid object",
-	ErrCodeUnreachable:              "server unreachable",
-}
-
-func NewKeyNotFoundError(key string, rv int64) *StorageError {
-	return &StorageError{
-		Code:            ErrCodeKeyNotFound,
-		Key:             key,
-		ResourceVersion: rv,
-	}
-}
-
-func NewKeyExistsError(key string, rv int64) *StorageError {
-	return &StorageError{
-		Code:            ErrCodeKeyExists,
-		Key:             key,
-		ResourceVersion: rv,
-	}
-}
-
-func NewResourceVersionConflictsError(key string, rv int64) *StorageError {
-	return &StorageError{
-		Code:            ErrCodeResourceVersionConflicts,
-		Key:             key,
-		ResourceVersion: rv,
-	}
-}
-
-func NewUnreachableError(key string, rv int64) *StorageError {
-	return &StorageError{
-		Code:            ErrCodeUnreachable,
-		Key:             key,
-		ResourceVersion: rv,
-	}
-}
-
-func NewInvalidObjError(key, msg string) *StorageError {
-	return &StorageError{
-		Code:               ErrCodeInvalidObj,
-		Key:                key,
-		AdditionalErrorMsg: msg,
-	}
-}
-
-type StorageError struct {
-	Code               int
-	Key                string
-	ResourceVersion    int64
-	AdditionalErrorMsg string
-}
-
-func (e *StorageError) Error() string {
-	return fmt.Sprintf("StorageError: %s, Code: %d, Key: %s, ResourceVersion: %d, AdditionalErrorMsg: %s",
-		errCodeToMessage[e.Code], e.Code, e.Key, e.ResourceVersion, e.AdditionalErrorMsg)
-}
-
-// IsNotFound returns true if and only if err is "key" not found error.
-func IsNotFound(err error) bool {
-	return isErrCode(err, ErrCodeKeyNotFound)
-}
-
-// IsNodeExist returns true if and only if err is an node already exist error.
-func IsNodeExist(err error) bool {
-	return isErrCode(err, ErrCodeKeyExists)
-}
-
-// IsUnreachable returns true if and only if err indicates the server could not be reached.
-func IsUnreachable(err error) bool {
-	return isErrCode(err, ErrCodeUnreachable)
-}
-
-// IsConflict returns true if and only if err is a write conflict.
-func IsConflict(err error) bool {
-	return isErrCode(err, ErrCodeResourceVersionConflicts)
-}
-
-// IsInvalidObj returns true if and only if err is invalid error
-func IsInvalidObj(err error) bool {
-	return isErrCode(err, ErrCodeInvalidObj)
-}
-
-func isErrCode(err error, code int) bool {
-	if err == nil {
-		return false
-	}
-	if e, ok := err.(*StorageError); ok {
-		return e.Code == code
-	}
-	return false
-}
-
-// InvalidError is generated when an error caused by invalid API object occurs
-// in the storage package.
-type InvalidError struct {
-	Errs field.ErrorList
-}
-
-func (e InvalidError) Error() string {
-	return e.Errs.ToAggregate().Error()
-}
-
-// IsInvalidError returns true if and only if err is an InvalidError.
-func IsInvalidError(err error) bool {
-	_, ok := err.(InvalidError)
-	return ok
-}
-
-func NewInvalidError(errors field.ErrorList) InvalidError {
-	return InvalidError{errors}
-}
-
-// InternalError is generated when an error occurs in the storage package, i.e.,
-// not from the underlying storage backend (e.g., etcd).
-type InternalError struct {
-	Reason string
-}
-
-func (e InternalError) Error() string {
-	return e.Reason
-}
-
-// IsInternalError returns true if and only if err is an InternalError.
-func IsInternalError(err error) bool {
-	_, ok := err.(InternalError)
-	return ok
-}
-
-func NewInternalError(reason string) InternalError {
-	return InternalError{reason}
-}
-
-func NewInternalErrorf(format string, a ...interface{}) InternalError {
-	return InternalError{fmt.Sprintf(format, a...)}
-}
-
-var tooLargeResourceVersionCauseMsg = "Too large resource version"
-
-// NewTooLargeResourceVersionError returns a timeout error with the given retrySeconds for a request for
-// a minimum resource version that is larger than the largest currently available resource version for a requested resource.
-func NewTooLargeResourceVersionError(minimumResourceVersion, currentRevision uint64, retrySeconds int) error {
-	err := errors.NewTimeoutError(fmt.Sprintf("Too large resource version: %d, current: %d", minimumResourceVersion, currentRevision), retrySeconds)
-	err.ErrStatus.Details.Causes = []metav1.StatusCause{
-		{
-			Type:    metav1.CauseTypeResourceVersionTooLarge,
-			Message: tooLargeResourceVersionCauseMsg,
-		},
-	}
-	return err
-}
-
-// IsTooLargeResourceVersion returns true if the error is a TooLargeResourceVersion error.
-func IsTooLargeResourceVersion(err error) bool {
-	if !errors.IsTimeout(err) {
-		return false
-	}
-	return errors.HasStatusCause(err, metav1.CauseTypeResourceVersionTooLarge)
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/api_object_versioner.go

@@ -1,130 +0,0 @@
-/*
-Copyright 2014 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"strconv"
-
-	"k8s.io/apimachinery/pkg/api/meta"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/util/validation/field"
-	"k8s.io/apiserver/pkg/storage"
-)
-
-// APIObjectVersioner implements versioning and extracting etcd node information
-// for objects that have an embedded ObjectMeta or ListMeta field.
-type APIObjectVersioner struct{}
-
-// UpdateObject implements Versioner
-func (a APIObjectVersioner) UpdateObject(obj runtime.Object, resourceVersion uint64) error {
-	accessor, err := meta.Accessor(obj)
-	if err != nil {
-		return err
-	}
-	versionString := ""
-	if resourceVersion != 0 {
-		versionString = strconv.FormatUint(resourceVersion, 10)
-	}
-	accessor.SetResourceVersion(versionString)
-	return nil
-}
-
-// UpdateList implements Versioner
-func (a APIObjectVersioner) UpdateList(obj runtime.Object, resourceVersion uint64, nextKey string, count *int64) error {
-	listAccessor, err := meta.ListAccessor(obj)
-	if err != nil || listAccessor == nil {
-		return err
-	}
-	versionString := ""
-	if resourceVersion != 0 {
-		versionString = strconv.FormatUint(resourceVersion, 10)
-	}
-	listAccessor.SetResourceVersion(versionString)
-	listAccessor.SetContinue(nextKey)
-	listAccessor.SetRemainingItemCount(count)
-	return nil
-}
-
-// PrepareObjectForStorage clears resource version and self link prior to writing to etcd.
-func (a APIObjectVersioner) PrepareObjectForStorage(obj runtime.Object) error {
-	accessor, err := meta.Accessor(obj)
-	if err != nil {
-		return err
-	}
-	accessor.SetResourceVersion("")
-	accessor.SetSelfLink("")
-	return nil
-}
-
-// ObjectResourceVersion implements Versioner
-func (a APIObjectVersioner) ObjectResourceVersion(obj runtime.Object) (uint64, error) {
-	accessor, err := meta.Accessor(obj)
-	if err != nil {
-		return 0, err
-	}
-	version := accessor.GetResourceVersion()
-	if len(version) == 0 {
-		return 0, nil
-	}
-	return strconv.ParseUint(version, 10, 64)
-}
-
-// ParseResourceVersion takes a resource version argument and converts it to
-// the etcd version. For watch we should pass to helper.Watch(). Because resourceVersion is
-// an opaque value, the default watch behavior for non-zero watch is to watch
-// the next value (if you pass "1", you will see updates from "2" onwards).
-func (a APIObjectVersioner) ParseResourceVersion(resourceVersion string) (uint64, error) {
-	if resourceVersion == "" || resourceVersion == "0" {
-		return 0, nil
-	}
-	version, err := strconv.ParseUint(resourceVersion, 10, 64)
-	if err != nil {
-		return 0, storage.NewInvalidError(field.ErrorList{
-			// Validation errors are supposed to return version-specific field
-			// paths, but this is probably close enough.
-			field.Invalid(field.NewPath("resourceVersion"), resourceVersion, err.Error()),
-		})
-	}
-	return version, nil
-}
-
-// Versioner implements Versioner
-var Versioner storage.Versioner = APIObjectVersioner{}
-
-// CompareResourceVersion compares etcd resource versions.  Outside this API they are all strings,
-// but etcd resource versions are special, they're actually ints, so we can easily compare them.
-func (a APIObjectVersioner) CompareResourceVersion(lhs, rhs runtime.Object) int {
-	lhsVersion, err := Versioner.ObjectResourceVersion(lhs)
-	if err != nil {
-		// coder error
-		panic(err)
-	}
-	rhsVersion, err := Versioner.ObjectResourceVersion(rhs)
-	if err != nil {
-		// coder error
-		panic(err)
-	}
-
-	if lhsVersion == rhsVersion {
-		return 0
-	}
-	if lhsVersion < rhsVersion {
-		return -1
-	}
-
-	return 1
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/compact.go

@@ -1,162 +0,0 @@
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"context"
-	"strconv"
-	"sync"
-	"time"
-
-	"go.etcd.io/etcd/clientv3"
-	"k8s.io/klog"
-)
-
-const (
-	compactRevKey = "compact_rev_key"
-)
-
-var (
-	endpointsMapMu sync.Mutex
-	endpointsMap   map[string]struct{}
-)
-
-func init() {
-	endpointsMap = make(map[string]struct{})
-}
-
-// StartCompactor starts a compactor in the background to compact old version of keys that's not needed.
-// By default, we save the most recent 10 minutes data and compact versions > 10minutes ago.
-// It should be enough for slow watchers and to tolerate burst.
-// TODO: We might keep a longer history (12h) in the future once storage API can take advantage of past version of keys.
-func StartCompactor(ctx context.Context, client *clientv3.Client, compactInterval time.Duration) {
-	endpointsMapMu.Lock()
-	defer endpointsMapMu.Unlock()
-
-	// In one process, we can have only one compactor for one cluster.
-	// Currently we rely on endpoints to differentiate clusters.
-	for _, ep := range client.Endpoints() {
-		if _, ok := endpointsMap[ep]; ok {
-			klog.V(4).Infof("compactor already exists for endpoints %v", client.Endpoints())
-			return
-		}
-	}
-	for _, ep := range client.Endpoints() {
-		endpointsMap[ep] = struct{}{}
-	}
-
-	if compactInterval != 0 {
-		go compactor(ctx, client, compactInterval)
-	}
-}
-
-// compactor periodically compacts historical versions of keys in etcd.
-// It will compact keys with versions older than given interval.
-// In other words, after compaction, it will only contain keys set during last interval.
-// Any API call for the older versions of keys will return error.
-// Interval is the time interval between each compaction. The first compaction happens after "interval".
-func compactor(ctx context.Context, client *clientv3.Client, interval time.Duration) {
-	// Technical definitions:
-	// We have a special key in etcd defined as *compactRevKey*.
-	// compactRevKey's value will be set to the string of last compacted revision.
-	// compactRevKey's version will be used as logical time for comparison. THe version is referred as compact time.
-	// Initially, because the key doesn't exist, the compact time (version) is 0.
-	//
-	// Algorithm:
-	// - Compare to see if (local compact_time) = (remote compact_time).
-	// - If yes, increment both local and remote compact_time, and do a compaction.
-	// - If not, set local to remote compact_time.
-	//
-	// Technical details/insights:
-	//
-	// The protocol here is lease based. If one compactor CAS successfully, the others would know it when they fail in
-	// CAS later and would try again in 10 minutes. If an APIServer crashed, another one would "take over" the lease.
-	//
-	// For example, in the following diagram, we have a compactor C1 doing compaction in t1, t2. Another compactor C2
-	// at t1' (t1 < t1' < t2) would CAS fail, set its known oldRev to rev at t1', and try again in t2' (t2' > t2).
-	// If C1 crashed and wouldn't compact at t2, C2 would CAS successfully at t2'.
-	//
-	//                 oldRev(t2)     curRev(t2)
-	//                                  +
-	//   oldRev        curRev           |
-	//     +             +              |
-	//     |             |              |
-	//     |             |    t1'       |     t2'
-	// +---v-------------v----^---------v------^---->
-	//     t0           t1             t2
-	//
-	// We have the guarantees:
-	// - in normal cases, the interval is 10 minutes.
-	// - in failover, the interval is >10m and <20m
-	//
-	// FAQ:
-	// - What if time is not accurate? We don't care as long as someone did the compaction. Atomicity is ensured using
-	//   etcd API.
-	// - What happened under heavy load scenarios? Initially, each apiserver will do only one compaction
-	//   every 10 minutes. This is very unlikely affecting or affected w.r.t. server load.
-
-	var compactTime int64
-	var rev int64
-	var err error
-	for {
-		select {
-		case <-time.After(interval):
-		case <-ctx.Done():
-			return
-		}
-
-		compactTime, rev, err = compact(ctx, client, compactTime, rev)
-		if err != nil {
-			klog.Errorf("etcd: endpoint (%v) compact failed: %v", client.Endpoints(), err)
-			continue
-		}
-	}
-}
-
-// compact compacts etcd store and returns current rev.
-// It will return the current compact time and global revision if no error occurred.
-// Note that CAS fail will not incur any error.
-func compact(ctx context.Context, client *clientv3.Client, t, rev int64) (int64, int64, error) {
-	resp, err := client.KV.Txn(ctx).If(
-		clientv3.Compare(clientv3.Version(compactRevKey), "=", t),
-	).Then(
-		clientv3.OpPut(compactRevKey, strconv.FormatInt(rev, 10)), // Expect side effect: increment Version
-	).Else(
-		clientv3.OpGet(compactRevKey),
-	).Commit()
-	if err != nil {
-		return t, rev, err
-	}
-
-	curRev := resp.Header.Revision
-
-	if !resp.Succeeded {
-		curTime := resp.Responses[0].GetResponseRange().Kvs[0].Version
-		return curTime, curRev, nil
-	}
-	curTime := t + 1
-
-	if rev == 0 {
-		// We don't compact on bootstrap.
-		return curTime, curRev, nil
-	}
-	if _, err = client.Compact(ctx, rev); err != nil {
-		return curTime, curRev, err
-	}
-	klog.V(4).Infof("etcd: compacted rev (%d), endpoints (%v)", rev, client.Endpoints())
-	return curTime, curRev, nil
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/errors.go

@@ -1,71 +0,0 @@
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"k8s.io/apimachinery/pkg/api/errors"
-
-	etcdrpc "go.etcd.io/etcd/etcdserver/api/v3rpc/rpctypes"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-)
-
-func interpretWatchError(err error) error {
-	switch {
-	case err == etcdrpc.ErrCompacted:
-		return errors.NewResourceExpired("The resourceVersion for the provided watch is too old.")
-	}
-	return err
-}
-
-const (
-	expired         string = "The resourceVersion for the provided list is too old."
-	continueExpired string = "The provided continue parameter is too old " +
-		"to display a consistent list result. You can start a new list without " +
-		"the continue parameter."
-	inconsistentContinue string = "The provided continue parameter is too old " +
-		"to display a consistent list result. You can start a new list without " +
-		"the continue parameter, or use the continue token in this response to " +
-		"retrieve the remainder of the results. Continuing with the provided " +
-		"token results in an inconsistent list - objects that were created, " +
-		"modified, or deleted between the time the first chunk was returned " +
-		"and now may show up in the list."
-)
-
-func interpretListError(err error, paging bool, continueKey, keyPrefix string) error {
-	switch {
-	case err == etcdrpc.ErrCompacted:
-		if paging {
-			return handleCompactedErrorForPaging(continueKey, keyPrefix)
-		}
-		return errors.NewResourceExpired(expired)
-	}
-	return err
-}
-
-func handleCompactedErrorForPaging(continueKey, keyPrefix string) error {
-	// continueToken.ResoureVersion=-1 means that the apiserver can
-	// continue the list at the latest resource version. We don't use rv=0
-	// for this purpose to distinguish from a bad token that has empty rv.
-	newToken, err := encodeContinue(continueKey, keyPrefix, -1)
-	if err != nil {
-		utilruntime.HandleError(err)
-		return errors.NewResourceExpired(continueExpired)
-	}
-	statusError := errors.NewResourceExpired(inconsistentContinue)
-	statusError.ErrStatus.ListMeta.Continue = newToken
-	return statusError
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/event.go

@@ -1,63 +0,0 @@
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"fmt"
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/mvcc/mvccpb"
-)
-
-type event struct {
-	key       string
-	value     []byte
-	prevValue []byte
-	rev       int64
-	isDeleted bool
-	isCreated bool
-}
-
-// parseKV converts a KeyValue retrieved from an initial sync() listing to a synthetic isCreated event.
-func parseKV(kv *mvccpb.KeyValue) *event {
-	return &event{
-		key:       string(kv.Key),
-		value:     kv.Value,
-		prevValue: nil,
-		rev:       kv.ModRevision,
-		isDeleted: false,
-		isCreated: true,
-	}
-}
-
-func parseEvent(e *clientv3.Event) (*event, error) {
-	if !e.IsCreate() && e.PrevKv == nil {
-		// If the previous value is nil, error. One example of how this is possible is if the previous value has been compacted already.
-		return nil, fmt.Errorf("etcd event received with PrevKv=nil (key=%q, modRevision=%d, type=%s)", string(e.Kv.Key), e.Kv.ModRevision, e.Type.String())
-
-	}
-	ret := &event{
-		key:       string(e.Kv.Key),
-		value:     e.Kv.Value,
-		rev:       e.Kv.ModRevision,
-		isDeleted: e.Type == clientv3.EventTypeDelete,
-		isCreated: e.IsCreate(),
-	}
-	if e.PrevKv != nil {
-		ret.prevValue = e.PrevKv.Value
-	}
-	return ret, nil
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/healthcheck.go

@@ -1,40 +0,0 @@
-/*
-Copyright 2015 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"encoding/json"
-	"fmt"
-)
-
-// etcdHealth encodes data returned from etcd /healthz handler.
-type etcdHealth struct {
-	// Note this has to be public so the json library can modify it.
-	Health string `json:"health"`
-}
-
-// EtcdHealthCheck decodes data returned from etcd /healthz handler.
-func EtcdHealthCheck(data []byte) error {
-	obj := etcdHealth{}
-	if err := json.Unmarshal(data, &obj); err != nil {
-		return err
-	}
-	if obj.Health != "true" {
-		return fmt.Errorf("Unhealthy status: %s", obj.Health)
-	}
-	return nil
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/lease_manager.go

@@ -1,102 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"context"
-	"sync"
-	"time"
-
-	"go.etcd.io/etcd/clientv3"
-)
-
-// leaseManager is used to manage leases requested from etcd. If a new write
-// needs a lease that has similar expiration time to the previous one, the old
-// lease will be reused to reduce the overhead of etcd, since lease operations
-// are expensive. In the implementation, we only store one previous lease,
-// since all the events have the same ttl.
-type leaseManager struct {
-	client                  *clientv3.Client // etcd client used to grant leases
-	leaseMu                 sync.Mutex
-	prevLeaseID             clientv3.LeaseID
-	prevLeaseExpirationTime time.Time
-	// The period of time in seconds and percent of TTL that each lease is
-	// reused. The minimum of them is used to avoid unreasonably large
-	// numbers. We use var instead of const for testing purposes.
-	leaseReuseDurationSeconds int64
-	leaseReuseDurationPercent float64
-}
-
-// newDefaultLeaseManager creates a new lease manager using default setting.
-func newDefaultLeaseManager(client *clientv3.Client) *leaseManager {
-	return newLeaseManager(client, 60, 0.05)
-}
-
-// newLeaseManager creates a new lease manager with the number of buffered
-// leases, lease reuse duration in seconds and percentage. The percentage
-// value x means x*100%.
-func newLeaseManager(client *clientv3.Client, leaseReuseDurationSeconds int64, leaseReuseDurationPercent float64) *leaseManager {
-	return &leaseManager{
-		client:                    client,
-		leaseReuseDurationSeconds: leaseReuseDurationSeconds,
-		leaseReuseDurationPercent: leaseReuseDurationPercent,
-	}
-}
-
-// setLeaseReuseDurationSeconds is used for testing purpose. It is used to
-// reduce the extra lease duration to avoid unnecessary timeout in testing.
-func (l *leaseManager) setLeaseReuseDurationSeconds(duration int64) {
-	l.leaseMu.Lock()
-	defer l.leaseMu.Unlock()
-	l.leaseReuseDurationSeconds = duration
-}
-
-// GetLease returns a lease based on requested ttl: if the cached previous
-// lease can be reused, reuse it; otherwise request a new one from etcd.
-func (l *leaseManager) GetLease(ctx context.Context, ttl int64) (clientv3.LeaseID, error) {
-	now := time.Now()
-	l.leaseMu.Lock()
-	defer l.leaseMu.Unlock()
-	// check if previous lease can be reused
-	reuseDurationSeconds := l.getReuseDurationSecondsLocked(ttl)
-	valid := now.Add(time.Duration(ttl) * time.Second).Before(l.prevLeaseExpirationTime)
-	sufficient := now.Add(time.Duration(ttl+reuseDurationSeconds) * time.Second).After(l.prevLeaseExpirationTime)
-	if valid && sufficient {
-		return l.prevLeaseID, nil
-	}
-	// request a lease with a little extra ttl from etcd
-	ttl += reuseDurationSeconds
-	lcr, err := l.client.Lease.Grant(ctx, ttl)
-	if err != nil {
-		return clientv3.LeaseID(0), err
-	}
-	// cache the new lease id
-	l.prevLeaseID = lcr.ID
-	l.prevLeaseExpirationTime = now.Add(time.Duration(ttl) * time.Second)
-	return lcr.ID, nil
-}
-
-// getReuseDurationSecondsLocked returns the reusable duration in seconds
-// based on the configuration. Lock has to be acquired before calling this
-// function.
-func (l *leaseManager) getReuseDurationSecondsLocked(ttl int64) int64 {
-	reuseDurationSeconds := int64(l.leaseReuseDurationPercent * float64(ttl))
-	if reuseDurationSeconds > l.leaseReuseDurationSeconds {
-		reuseDurationSeconds = l.leaseReuseDurationSeconds
-	}
-	return reuseDurationSeconds
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/logger.go

@@ -1,84 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"fmt"
-
-	"go.etcd.io/etcd/clientv3"
-	"k8s.io/klog"
-)
-
-func init() {
-	clientv3.SetLogger(klogWrapper{})
-}
-
-type klogWrapper struct{}
-
-const klogWrapperDepth = 4
-
-func (klogWrapper) Info(args ...interface{}) {
-	klog.InfoDepth(klogWrapperDepth, args...)
-}
-
-func (klogWrapper) Infoln(args ...interface{}) {
-	klog.InfoDepth(klogWrapperDepth, fmt.Sprintln(args...))
-}
-
-func (klogWrapper) Infof(format string, args ...interface{}) {
-	klog.InfoDepth(klogWrapperDepth, fmt.Sprintf(format, args...))
-}
-
-func (klogWrapper) Warning(args ...interface{}) {
-	klog.WarningDepth(klogWrapperDepth, args...)
-}
-
-func (klogWrapper) Warningln(args ...interface{}) {
-	klog.WarningDepth(klogWrapperDepth, fmt.Sprintln(args...))
-}
-
-func (klogWrapper) Warningf(format string, args ...interface{}) {
-	klog.WarningDepth(klogWrapperDepth, fmt.Sprintf(format, args...))
-}
-
-func (klogWrapper) Error(args ...interface{}) {
-	klog.ErrorDepth(klogWrapperDepth, args...)
-}
-
-func (klogWrapper) Errorln(args ...interface{}) {
-	klog.ErrorDepth(klogWrapperDepth, fmt.Sprintln(args...))
-}
-
-func (klogWrapper) Errorf(format string, args ...interface{}) {
-	klog.ErrorDepth(klogWrapperDepth, fmt.Sprintf(format, args...))
-}
-
-func (klogWrapper) Fatal(args ...interface{}) {
-	klog.FatalDepth(klogWrapperDepth, args...)
-}
-
-func (klogWrapper) Fatalln(args ...interface{}) {
-	klog.FatalDepth(klogWrapperDepth, fmt.Sprintln(args...))
-}
-
-func (klogWrapper) Fatalf(format string, args ...interface{}) {
-	klog.FatalDepth(klogWrapperDepth, fmt.Sprintf(format, args...))
-}
-
-func (klogWrapper) V(l int) bool {
-	return bool(klog.V(klog.Level(l)))
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/metrics/metrics.go

@@ -1,83 +0,0 @@
-/*
-Copyright 2015 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package metrics
-
-import (
-	"sync"
-	"time"
-
-	compbasemetrics "k8s.io/component-base/metrics"
-	"k8s.io/component-base/metrics/legacyregistry"
-)
-
-/*
- * By default, all the following metrics are defined as falling under
- * ALPHA stability level https://github.com/kubernetes/enhancements/blob/master/keps/sig-instrumentation/20190404-kubernetes-control-plane-metrics-stability.md#stability-classes)
- *
- * Promoting the stability level of the metric is a responsibility of the component owner, since it
- * involves explicitly acknowledging support for the metric across multiple releases, in accordance with
- * the metric stability policy.
- */
-var (
-	etcdRequestLatency = compbasemetrics.NewHistogramVec(
-		&compbasemetrics.HistogramOpts{
-			Name:           "etcd_request_duration_seconds",
-			Help:           "Etcd request latency in seconds for each operation and object type.",
-			StabilityLevel: compbasemetrics.ALPHA,
-		},
-		[]string{"operation", "type"},
-	)
-	objectCounts = compbasemetrics.NewGaugeVec(
-		&compbasemetrics.GaugeOpts{
-			Name:           "etcd_object_counts",
-			Help:           "Number of stored objects at the time of last check split by kind.",
-			StabilityLevel: compbasemetrics.ALPHA,
-		},
-		[]string{"resource"},
-	)
-)
-
-var registerMetrics sync.Once
-
-// Register all metrics.
-func Register() {
-	// Register the metrics.
-	registerMetrics.Do(func() {
-		legacyregistry.MustRegister(etcdRequestLatency)
-		legacyregistry.MustRegister(objectCounts)
-	})
-}
-
-// UpdateObjectCount sets the etcd_object_counts metric.
-func UpdateObjectCount(resourcePrefix string, count int64) {
-	objectCounts.WithLabelValues(resourcePrefix).Set(float64(count))
-}
-
-// RecordEtcdRequestLatency sets the etcd_request_duration_seconds metrics.
-func RecordEtcdRequestLatency(verb, resource string, startTime time.Time) {
-	etcdRequestLatency.WithLabelValues(verb, resource).Observe(sinceInSeconds(startTime))
-}
-
-// Reset resets the etcd_request_duration_seconds metric.
-func Reset() {
-	etcdRequestLatency.Reset()
-}
-
-// sinceInSeconds gets the time since the specified start in seconds.
-func sinceInSeconds(start time.Time) float64 {
-	return time.Since(start).Seconds()
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/store.go

@@ -1,879 +0,0 @@
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"path"
-	"reflect"
-	"strings"
-	"time"
-
-	"go.etcd.io/etcd/clientv3"
-
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/conversion"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	"k8s.io/apiserver/pkg/features"
-	"k8s.io/apiserver/pkg/storage"
-	"k8s.io/apiserver/pkg/storage/etcd3/metrics"
-	"k8s.io/apiserver/pkg/storage/value"
-	utilfeature "k8s.io/apiserver/pkg/util/feature"
-	"k8s.io/klog"
-	utiltrace "k8s.io/utils/trace"
-)
-
-// authenticatedDataString satisfies the value.Context interface. It uses the key to
-// authenticate the stored data. This does not defend against reuse of previously
-// encrypted values under the same key, but will prevent an attacker from using an
-// encrypted value from a different key. A stronger authenticated data segment would
-// include the etcd3 Version field (which is incremented on each write to a key and
-// reset when the key is deleted), but an attacker with write access to etcd can
-// force deletion and recreation of keys to weaken that angle.
-type authenticatedDataString string
-
-// AuthenticatedData implements the value.Context interface.
-func (d authenticatedDataString) AuthenticatedData() []byte {
-	return []byte(string(d))
-}
-
-var _ value.Context = authenticatedDataString("")
-
-type store struct {
-	client *clientv3.Client
-	// getOpts contains additional options that should be passed
-	// to all Get() calls.
-	getOps        []clientv3.OpOption
-	codec         runtime.Codec
-	versioner     storage.Versioner
-	transformer   value.Transformer
-	pathPrefix    string
-	watcher       *watcher
-	pagingEnabled bool
-	leaseManager  *leaseManager
-}
-
-type objState struct {
-	obj   runtime.Object
-	meta  *storage.ResponseMeta
-	rev   int64
-	data  []byte
-	stale bool
-}
-
-// New returns an etcd3 implementation of storage.Interface.
-func New(c *clientv3.Client, codec runtime.Codec, prefix string, transformer value.Transformer, pagingEnabled bool) storage.Interface {
-	return newStore(c, pagingEnabled, codec, prefix, transformer)
-}
-
-func newStore(c *clientv3.Client, pagingEnabled bool, codec runtime.Codec, prefix string, transformer value.Transformer) *store {
-	versioner := APIObjectVersioner{}
-	result := &store{
-		client:        c,
-		codec:         codec,
-		versioner:     versioner,
-		transformer:   transformer,
-		pagingEnabled: pagingEnabled,
-		// for compatibility with etcd2 impl.
-		// no-op for default prefix of '/registry'.
-		// keeps compatibility with etcd2 impl for custom prefixes that don't start with '/'
-		pathPrefix:   path.Join("/", prefix),
-		watcher:      newWatcher(c, codec, versioner, transformer),
-		leaseManager: newDefaultLeaseManager(c),
-	}
-	return result
-}
-
-// Versioner implements storage.Interface.Versioner.
-func (s *store) Versioner() storage.Versioner {
-	return s.versioner
-}
-
-// Get implements storage.Interface.Get.
-func (s *store) Get(ctx context.Context, key string, resourceVersion string, out runtime.Object, ignoreNotFound bool) error {
-	key = path.Join(s.pathPrefix, key)
-	startTime := time.Now()
-	getResp, err := s.client.KV.Get(ctx, key, s.getOps...)
-	metrics.RecordEtcdRequestLatency("get", getTypeName(out), startTime)
-	if err != nil {
-		return err
-	}
-	if err = s.ensureMinimumResourceVersion(resourceVersion, uint64(getResp.Header.Revision)); err != nil {
-		return err
-	}
-
-	if len(getResp.Kvs) == 0 {
-		if ignoreNotFound {
-			return runtime.SetZeroValue(out)
-		}
-		return storage.NewKeyNotFoundError(key, 0)
-	}
-	kv := getResp.Kvs[0]
-
-	data, _, err := s.transformer.TransformFromStorage(kv.Value, authenticatedDataString(key))
-	if err != nil {
-		return storage.NewInternalError(err.Error())
-	}
-
-	return decode(s.codec, s.versioner, data, out, kv.ModRevision)
-}
-
-// Create implements storage.Interface.Create.
-func (s *store) Create(ctx context.Context, key string, obj, out runtime.Object, ttl uint64) error {
-	if version, err := s.versioner.ObjectResourceVersion(obj); err == nil && version != 0 {
-		return errors.New("resourceVersion should not be set on objects to be created")
-	}
-	if err := s.versioner.PrepareObjectForStorage(obj); err != nil {
-		return fmt.Errorf("PrepareObjectForStorage failed: %v", err)
-	}
-	data, err := runtime.Encode(s.codec, obj)
-	if err != nil {
-		return err
-	}
-	key = path.Join(s.pathPrefix, key)
-
-	opts, err := s.ttlOpts(ctx, int64(ttl))
-	if err != nil {
-		return err
-	}
-
-	newData, err := s.transformer.TransformToStorage(data, authenticatedDataString(key))
-	if err != nil {
-		return storage.NewInternalError(err.Error())
-	}
-
-	startTime := time.Now()
-	txnResp, err := s.client.KV.Txn(ctx).If(
-		notFound(key),
-	).Then(
-		clientv3.OpPut(key, string(newData), opts...),
-	).Commit()
-	metrics.RecordEtcdRequestLatency("create", getTypeName(obj), startTime)
-	if err != nil {
-		return err
-	}
-	if !txnResp.Succeeded {
-		return storage.NewKeyExistsError(key, 0)
-	}
-
-	if out != nil {
-		putResp := txnResp.Responses[0].GetResponsePut()
-		return decode(s.codec, s.versioner, data, out, putResp.Header.Revision)
-	}
-	return nil
-}
-
-// Delete implements storage.Interface.Delete.
-func (s *store) Delete(ctx context.Context, key string, out runtime.Object, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc) error {
-	v, err := conversion.EnforcePtr(out)
-	if err != nil {
-		return fmt.Errorf("unable to convert output object to pointer: %v", err)
-	}
-	key = path.Join(s.pathPrefix, key)
-	return s.conditionalDelete(ctx, key, out, v, preconditions, validateDeletion)
-}
-
-func (s *store) conditionalDelete(ctx context.Context, key string, out runtime.Object, v reflect.Value, preconditions *storage.Preconditions, validateDeletion storage.ValidateObjectFunc) error {
-	startTime := time.Now()
-	getResp, err := s.client.KV.Get(ctx, key)
-	metrics.RecordEtcdRequestLatency("get", getTypeName(out), startTime)
-	if err != nil {
-		return err
-	}
-	for {
-		origState, err := s.getState(getResp, key, v, false)
-		if err != nil {
-			return err
-		}
-		if preconditions != nil {
-			if err := preconditions.Check(key, origState.obj); err != nil {
-				return err
-			}
-		}
-		if err := validateDeletion(ctx, origState.obj); err != nil {
-			return err
-		}
-		startTime := time.Now()
-		txnResp, err := s.client.KV.Txn(ctx).If(
-			clientv3.Compare(clientv3.ModRevision(key), "=", origState.rev),
-		).Then(
-			clientv3.OpDelete(key),
-		).Else(
-			clientv3.OpGet(key),
-		).Commit()
-		metrics.RecordEtcdRequestLatency("delete", getTypeName(out), startTime)
-		if err != nil {
-			return err
-		}
-		if !txnResp.Succeeded {
-			getResp = (*clientv3.GetResponse)(txnResp.Responses[0].GetResponseRange())
-			klog.V(4).Infof("deletion of %s failed because of a conflict, going to retry", key)
-			continue
-		}
-		return decode(s.codec, s.versioner, origState.data, out, origState.rev)
-	}
-}
-
-// GuaranteedUpdate implements storage.Interface.GuaranteedUpdate.
-func (s *store) GuaranteedUpdate(
-	ctx context.Context, key string, out runtime.Object, ignoreNotFound bool,
-	preconditions *storage.Preconditions, tryUpdate storage.UpdateFunc, suggestion ...runtime.Object) error {
-	trace := utiltrace.New("GuaranteedUpdate etcd3", utiltrace.Field{"type", getTypeName(out)})
-	defer trace.LogIfLong(500 * time.Millisecond)
-
-	v, err := conversion.EnforcePtr(out)
-	if err != nil {
-		return fmt.Errorf("unable to convert output object to pointer: %v", err)
-	}
-	key = path.Join(s.pathPrefix, key)
-
-	getCurrentState := func() (*objState, error) {
-		startTime := time.Now()
-		getResp, err := s.client.KV.Get(ctx, key, s.getOps...)
-		metrics.RecordEtcdRequestLatency("get", getTypeName(out), startTime)
-		if err != nil {
-			return nil, err
-		}
-		return s.getState(getResp, key, v, ignoreNotFound)
-	}
-
-	var origState *objState
-	var mustCheckData bool
-	if len(suggestion) == 1 && suggestion[0] != nil {
-		origState, err = s.getStateFromObject(suggestion[0])
-		if err != nil {
-			return err
-		}
-		mustCheckData = true
-	} else {
-		origState, err = getCurrentState()
-		if err != nil {
-			return err
-		}
-	}
-	trace.Step("initial value restored")
-
-	transformContext := authenticatedDataString(key)
-	for {
-		if err := preconditions.Check(key, origState.obj); err != nil {
-			// If our data is already up to date, return the error
-			if !mustCheckData {
-				return err
-			}
-
-			// It's possible we were working with stale data
-			// Actually fetch
-			origState, err = getCurrentState()
-			if err != nil {
-				return err
-			}
-			mustCheckData = false
-			// Retry
-			continue
-		}
-
-		ret, ttl, err := s.updateState(origState, tryUpdate)
-		if err != nil {
-			// If our data is already up to date, return the error
-			if !mustCheckData {
-				return err
-			}
-
-			// It's possible we were working with stale data
-			// Actually fetch
-			origState, err = getCurrentState()
-			if err != nil {
-				return err
-			}
-			mustCheckData = false
-			// Retry
-			continue
-		}
-
-		data, err := runtime.Encode(s.codec, ret)
-		if err != nil {
-			return err
-		}
-		if !origState.stale && bytes.Equal(data, origState.data) {
-			// if we skipped the original Get in this loop, we must refresh from
-			// etcd in order to be sure the data in the store is equivalent to
-			// our desired serialization
-			if mustCheckData {
-				origState, err = getCurrentState()
-				if err != nil {
-					return err
-				}
-				mustCheckData = false
-				if !bytes.Equal(data, origState.data) {
-					// original data changed, restart loop
-					continue
-				}
-			}
-			// recheck that the data from etcd is not stale before short-circuiting a write
-			if !origState.stale {
-				return decode(s.codec, s.versioner, origState.data, out, origState.rev)
-			}
-		}
-
-		newData, err := s.transformer.TransformToStorage(data, transformContext)
-		if err != nil {
-			return storage.NewInternalError(err.Error())
-		}
-
-		opts, err := s.ttlOpts(ctx, int64(ttl))
-		if err != nil {
-			return err
-		}
-		trace.Step("Transaction prepared")
-
-		startTime := time.Now()
-		txnResp, err := s.client.KV.Txn(ctx).If(
-			clientv3.Compare(clientv3.ModRevision(key), "=", origState.rev),
-		).Then(
-			clientv3.OpPut(key, string(newData), opts...),
-		).Else(
-			clientv3.OpGet(key),
-		).Commit()
-		metrics.RecordEtcdRequestLatency("update", getTypeName(out), startTime)
-		if err != nil {
-			return err
-		}
-		trace.Step("Transaction committed")
-		if !txnResp.Succeeded {
-			getResp := (*clientv3.GetResponse)(txnResp.Responses[0].GetResponseRange())
-			klog.V(4).Infof("GuaranteedUpdate of %s failed because of a conflict, going to retry", key)
-			origState, err = s.getState(getResp, key, v, ignoreNotFound)
-			if err != nil {
-				return err
-			}
-			trace.Step("Retry value restored")
-			mustCheckData = false
-			continue
-		}
-		putResp := txnResp.Responses[0].GetResponsePut()
-
-		return decode(s.codec, s.versioner, data, out, putResp.Header.Revision)
-	}
-}
-
-// GetToList implements storage.Interface.GetToList.
-func (s *store) GetToList(ctx context.Context, key string, resourceVersion string, pred storage.SelectionPredicate, listObj runtime.Object) error {
-	trace := utiltrace.New("GetToList etcd3",
-		utiltrace.Field{"key", key},
-		utiltrace.Field{"resourceVersion", resourceVersion},
-		utiltrace.Field{"limit", pred.Limit},
-		utiltrace.Field{"continue", pred.Continue})
-	defer trace.LogIfLong(500 * time.Millisecond)
-	listPtr, err := meta.GetItemsPtr(listObj)
-	if err != nil {
-		return err
-	}
-	v, err := conversion.EnforcePtr(listPtr)
-	if err != nil || v.Kind() != reflect.Slice {
-		return fmt.Errorf("need ptr to slice: %v", err)
-	}
-
-	newItemFunc := getNewItemFunc(listObj, v)
-
-	key = path.Join(s.pathPrefix, key)
-	startTime := time.Now()
-	getResp, err := s.client.KV.Get(ctx, key, s.getOps...)
-	metrics.RecordEtcdRequestLatency("get", getTypeName(listPtr), startTime)
-	if err != nil {
-		return err
-	}
-	if err = s.ensureMinimumResourceVersion(resourceVersion, uint64(getResp.Header.Revision)); err != nil {
-		return err
-	}
-
-	if len(getResp.Kvs) > 0 {
-		data, _, err := s.transformer.TransformFromStorage(getResp.Kvs[0].Value, authenticatedDataString(key))
-		if err != nil {
-			return storage.NewInternalError(err.Error())
-		}
-		if err := appendListItem(v, data, uint64(getResp.Kvs[0].ModRevision), pred, s.codec, s.versioner, newItemFunc); err != nil {
-			return err
-		}
-	}
-	// update version with cluster level revision
-	return s.versioner.UpdateList(listObj, uint64(getResp.Header.Revision), "", nil)
-}
-
-func getNewItemFunc(listObj runtime.Object, v reflect.Value) func() runtime.Object {
-	// For unstructured lists with a target group/version, preserve the group/version in the instantiated list items
-	if unstructuredList, isUnstructured := listObj.(*unstructured.UnstructuredList); isUnstructured {
-		if apiVersion := unstructuredList.GetAPIVersion(); len(apiVersion) > 0 {
-			return func() runtime.Object {
-				return &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": apiVersion}}
-			}
-		}
-	}
-
-	// Otherwise just instantiate an empty item
-	elem := v.Type().Elem()
-	return func() runtime.Object {
-		return reflect.New(elem).Interface().(runtime.Object)
-	}
-}
-
-func (s *store) Count(key string) (int64, error) {
-	key = path.Join(s.pathPrefix, key)
-	startTime := time.Now()
-	getResp, err := s.client.KV.Get(context.Background(), key, clientv3.WithRange(clientv3.GetPrefixRangeEnd(key)), clientv3.WithCountOnly())
-	metrics.RecordEtcdRequestLatency("listWithCount", key, startTime)
-	if err != nil {
-		return 0, err
-	}
-	return getResp.Count, nil
-}
-
-// continueToken is a simple structured object for encoding the state of a continue token.
-// TODO: if we change the version of the encoded from, we can't start encoding the new version
-// until all other servers are upgraded (i.e. we need to support rolling schema)
-// This is a public API struct and cannot change.
-type continueToken struct {
-	APIVersion      string `json:"v"`
-	ResourceVersion int64  `json:"rv"`
-	StartKey        string `json:"start"`
-}
-
-// parseFrom transforms an encoded predicate from into a versioned struct.
-// TODO: return a typed error that instructs clients that they must relist
-func decodeContinue(continueValue, keyPrefix string) (fromKey string, rv int64, err error) {
-	data, err := base64.RawURLEncoding.DecodeString(continueValue)
-	if err != nil {
-		return "", 0, fmt.Errorf("continue key is not valid: %v", err)
-	}
-	var c continueToken
-	if err := json.Unmarshal(data, &c); err != nil {
-		return "", 0, fmt.Errorf("continue key is not valid: %v", err)
-	}
-	switch c.APIVersion {
-	case "meta.k8s.io/v1":
-		if c.ResourceVersion == 0 {
-			return "", 0, fmt.Errorf("continue key is not valid: incorrect encoded start resourceVersion (version meta.k8s.io/v1)")
-		}
-		if len(c.StartKey) == 0 {
-			return "", 0, fmt.Errorf("continue key is not valid: encoded start key empty (version meta.k8s.io/v1)")
-		}
-		// defend against path traversal attacks by clients - path.Clean will ensure that startKey cannot
-		// be at a higher level of the hierarchy, and so when we append the key prefix we will end up with
-		// continue start key that is fully qualified and cannot range over anything less specific than
-		// keyPrefix.
-		key := c.StartKey
-		if !strings.HasPrefix(key, "/") {
-			key = "/" + key
-		}
-		cleaned := path.Clean(key)
-		if cleaned != key {
-			return "", 0, fmt.Errorf("continue key is not valid: %s", c.StartKey)
-		}
-		return keyPrefix + cleaned[1:], c.ResourceVersion, nil
-	default:
-		return "", 0, fmt.Errorf("continue key is not valid: server does not recognize this encoded version %q", c.APIVersion)
-	}
-}
-
-// encodeContinue returns a string representing the encoded continuation of the current query.
-func encodeContinue(key, keyPrefix string, resourceVersion int64) (string, error) {
-	nextKey := strings.TrimPrefix(key, keyPrefix)
-	if nextKey == key {
-		return "", fmt.Errorf("unable to encode next field: the key and key prefix do not match")
-	}
-	out, err := json.Marshal(&continueToken{APIVersion: "meta.k8s.io/v1", ResourceVersion: resourceVersion, StartKey: nextKey})
-	if err != nil {
-		return "", err
-	}
-	return base64.RawURLEncoding.EncodeToString(out), nil
-}
-
-// List implements storage.Interface.List.
-func (s *store) List(ctx context.Context, key, resourceVersion string, pred storage.SelectionPredicate, listObj runtime.Object) error {
-	trace := utiltrace.New("List etcd3",
-		utiltrace.Field{"key", key},
-		utiltrace.Field{"resourceVersion", resourceVersion},
-		utiltrace.Field{"limit", pred.Limit},
-		utiltrace.Field{"continue", pred.Continue})
-	defer trace.LogIfLong(500 * time.Millisecond)
-	listPtr, err := meta.GetItemsPtr(listObj)
-	if err != nil {
-		return err
-	}
-	v, err := conversion.EnforcePtr(listPtr)
-	if err != nil || v.Kind() != reflect.Slice {
-		return fmt.Errorf("need ptr to slice: %v", err)
-	}
-
-	if s.pathPrefix != "" {
-		key = path.Join(s.pathPrefix, key)
-	}
-	// We need to make sure the key ended with "/" so that we only get children "directories".
-	// e.g. if we have key "/a", "/a/b", "/ab", getting keys with prefix "/a" will return all three,
-	// while with prefix "/a/" will return only "/a/b" which is the correct answer.
-	if !strings.HasSuffix(key, "/") {
-		key += "/"
-	}
-	keyPrefix := key
-
-	// set the appropriate clientv3 options to filter the returned data set
-	var paging bool
-	options := make([]clientv3.OpOption, 0, 4)
-	if s.pagingEnabled && pred.Limit > 0 {
-		paging = true
-		options = append(options, clientv3.WithLimit(pred.Limit))
-	}
-
-	newItemFunc := getNewItemFunc(listObj, v)
-
-	var returnedRV, continueRV int64
-	var continueKey string
-	switch {
-	case s.pagingEnabled && len(pred.Continue) > 0:
-		continueKey, continueRV, err = decodeContinue(pred.Continue, keyPrefix)
-		if err != nil {
-			return apierrors.NewBadRequest(fmt.Sprintf("invalid continue token: %v", err))
-		}
-
-		if len(resourceVersion) > 0 && resourceVersion != "0" {
-			return apierrors.NewBadRequest("specifying resource version is not allowed when using continue")
-		}
-
-		rangeEnd := clientv3.GetPrefixRangeEnd(keyPrefix)
-		options = append(options, clientv3.WithRange(rangeEnd))
-		key = continueKey
-
-		// If continueRV > 0, the LIST request needs a specific resource version.
-		// continueRV==0 is invalid.
-		// If continueRV < 0, the request is for the latest resource version.
-		if continueRV > 0 {
-			options = append(options, clientv3.WithRev(continueRV))
-			returnedRV = continueRV
-		}
-	case s.pagingEnabled && pred.Limit > 0:
-		if len(resourceVersion) > 0 {
-			fromRV, err := s.versioner.ParseResourceVersion(resourceVersion)
-			if err != nil {
-				return apierrors.NewBadRequest(fmt.Sprintf("invalid resource version: %v", err))
-			}
-			if fromRV > 0 {
-				options = append(options, clientv3.WithRev(int64(fromRV)))
-			}
-			returnedRV = int64(fromRV)
-		}
-
-		rangeEnd := clientv3.GetPrefixRangeEnd(keyPrefix)
-		options = append(options, clientv3.WithRange(rangeEnd))
-
-	default:
-		options = append(options, clientv3.WithPrefix())
-	}
-
-	// loop until we have filled the requested limit from etcd or there are no more results
-	var lastKey []byte
-	var hasMore bool
-	var getResp *clientv3.GetResponse
-	for {
-		startTime := time.Now()
-		getResp, err = s.client.KV.Get(ctx, key, options...)
-		metrics.RecordEtcdRequestLatency("list", getTypeName(listPtr), startTime)
-		if err != nil {
-			return interpretListError(err, len(pred.Continue) > 0, continueKey, keyPrefix)
-		}
-		if err = s.ensureMinimumResourceVersion(resourceVersion, uint64(getResp.Header.Revision)); err != nil {
-			return err
-		}
-		hasMore = getResp.More
-
-		if len(getResp.Kvs) == 0 && getResp.More {
-			return fmt.Errorf("no results were found, but etcd indicated there were more values remaining")
-		}
-
-		// avoid small allocations for the result slice, since this can be called in many
-		// different contexts and we don't know how significantly the result will be filtered
-		if pred.Empty() {
-			growSlice(v, len(getResp.Kvs))
-		} else {
-			growSlice(v, 2048, len(getResp.Kvs))
-		}
-
-		// take items from the response until the bucket is full, filtering as we go
-		for _, kv := range getResp.Kvs {
-			if paging && int64(v.Len()) >= pred.Limit {
-				hasMore = true
-				break
-			}
-			lastKey = kv.Key
-
-			data, _, err := s.transformer.TransformFromStorage(kv.Value, authenticatedDataString(kv.Key))
-			if err != nil {
-				return storage.NewInternalErrorf("unable to transform key %q: %v", kv.Key, err)
-			}
-
-			if err := appendListItem(v, data, uint64(kv.ModRevision), pred, s.codec, s.versioner, newItemFunc); err != nil {
-				return err
-			}
-		}
-
-		// indicate to the client which resource version was returned
-		if returnedRV == 0 {
-			returnedRV = getResp.Header.Revision
-		}
-
-		// no more results remain or we didn't request paging
-		if !hasMore || !paging {
-			break
-		}
-		// we're paging but we have filled our bucket
-		if int64(v.Len()) >= pred.Limit {
-			break
-		}
-		key = string(lastKey) + "\x00"
-	}
-
-	// instruct the client to begin querying from immediately after the last key we returned
-	// we never return a key that the client wouldn't be allowed to see
-	if hasMore {
-		// we want to start immediately after the last key
-		next, err := encodeContinue(string(lastKey)+"\x00", keyPrefix, returnedRV)
-		if err != nil {
-			return err
-		}
-		var remainingItemCount *int64
-		// getResp.Count counts in objects that do not match the pred.
-		// Instead of returning inaccurate count for non-empty selectors, we return nil.
-		// Only set remainingItemCount if the predicate is empty.
-		if utilfeature.DefaultFeatureGate.Enabled(features.RemainingItemCount) {
-			if pred.Empty() {
-				c := int64(getResp.Count - pred.Limit)
-				remainingItemCount = &c
-			}
-		}
-		return s.versioner.UpdateList(listObj, uint64(returnedRV), next, remainingItemCount)
-	}
-
-	// no continuation
-	return s.versioner.UpdateList(listObj, uint64(returnedRV), "", nil)
-}
-
-// growSlice takes a slice value and grows its capacity up
-// to the maximum of the passed sizes or maxCapacity, whichever
-// is smaller. Above maxCapacity decisions about allocation are left
-// to the Go runtime on append. This allows a caller to make an
-// educated guess about the potential size of the total list while
-// still avoiding overly aggressive initial allocation. If sizes
-// is empty maxCapacity will be used as the size to grow.
-func growSlice(v reflect.Value, maxCapacity int, sizes ...int) {
-	cap := v.Cap()
-	max := cap
-	for _, size := range sizes {
-		if size > max {
-			max = size
-		}
-	}
-	if len(sizes) == 0 || max > maxCapacity {
-		max = maxCapacity
-	}
-	if max <= cap {
-		return
-	}
-	if v.Len() > 0 {
-		extra := reflect.MakeSlice(v.Type(), 0, max)
-		reflect.Copy(extra, v)
-		v.Set(extra)
-	} else {
-		extra := reflect.MakeSlice(v.Type(), 0, max)
-		v.Set(extra)
-	}
-}
-
-// Watch implements storage.Interface.Watch.
-func (s *store) Watch(ctx context.Context, key string, resourceVersion string, pred storage.SelectionPredicate) (watch.Interface, error) {
-	return s.watch(ctx, key, resourceVersion, pred, false)
-}
-
-// WatchList implements storage.Interface.WatchList.
-func (s *store) WatchList(ctx context.Context, key string, resourceVersion string, pred storage.SelectionPredicate) (watch.Interface, error) {
-	return s.watch(ctx, key, resourceVersion, pred, true)
-}
-
-func (s *store) watch(ctx context.Context, key string, rv string, pred storage.SelectionPredicate, recursive bool) (watch.Interface, error) {
-	rev, err := s.versioner.ParseResourceVersion(rv)
-	if err != nil {
-		return nil, err
-	}
-	key = path.Join(s.pathPrefix, key)
-	return s.watcher.Watch(ctx, key, int64(rev), recursive, pred)
-}
-
-func (s *store) getState(getResp *clientv3.GetResponse, key string, v reflect.Value, ignoreNotFound bool) (*objState, error) {
-	state := &objState{
-		meta: &storage.ResponseMeta{},
-	}
-
-	if u, ok := v.Addr().Interface().(runtime.Unstructured); ok {
-		state.obj = u.NewEmptyInstance()
-	} else {
-		state.obj = reflect.New(v.Type()).Interface().(runtime.Object)
-	}
-
-	if len(getResp.Kvs) == 0 {
-		if !ignoreNotFound {
-			return nil, storage.NewKeyNotFoundError(key, 0)
-		}
-		if err := runtime.SetZeroValue(state.obj); err != nil {
-			return nil, err
-		}
-	} else {
-		data, stale, err := s.transformer.TransformFromStorage(getResp.Kvs[0].Value, authenticatedDataString(key))
-		if err != nil {
-			return nil, storage.NewInternalError(err.Error())
-		}
-		state.rev = getResp.Kvs[0].ModRevision
-		state.meta.ResourceVersion = uint64(state.rev)
-		state.data = data
-		state.stale = stale
-		if err := decode(s.codec, s.versioner, state.data, state.obj, state.rev); err != nil {
-			return nil, err
-		}
-	}
-	return state, nil
-}
-
-func (s *store) getStateFromObject(obj runtime.Object) (*objState, error) {
-	state := &objState{
-		obj:  obj,
-		meta: &storage.ResponseMeta{},
-	}
-
-	rv, err := s.versioner.ObjectResourceVersion(obj)
-	if err != nil {
-		return nil, fmt.Errorf("couldn't get resource version: %v", err)
-	}
-	state.rev = int64(rv)
-	state.meta.ResourceVersion = uint64(state.rev)
-
-	// Compute the serialized form - for that we need to temporarily clean
-	// its resource version field (those are not stored in etcd).
-	if err := s.versioner.PrepareObjectForStorage(obj); err != nil {
-		return nil, fmt.Errorf("PrepareObjectForStorage failed: %v", err)
-	}
-	state.data, err = runtime.Encode(s.codec, obj)
-	if err != nil {
-		return nil, err
-	}
-	if err := s.versioner.UpdateObject(state.obj, uint64(rv)); err != nil {
-		klog.Errorf("failed to update object version: %v", err)
-	}
-	return state, nil
-}
-
-func (s *store) updateState(st *objState, userUpdate storage.UpdateFunc) (runtime.Object, uint64, error) {
-	ret, ttlPtr, err := userUpdate(st.obj, *st.meta)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	if err := s.versioner.PrepareObjectForStorage(ret); err != nil {
-		return nil, 0, fmt.Errorf("PrepareObjectForStorage failed: %v", err)
-	}
-	var ttl uint64
-	if ttlPtr != nil {
-		ttl = *ttlPtr
-	}
-	return ret, ttl, nil
-}
-
-// ttlOpts returns client options based on given ttl.
-// ttl: if ttl is non-zero, it will attach the key to a lease with ttl of roughly the same length
-func (s *store) ttlOpts(ctx context.Context, ttl int64) ([]clientv3.OpOption, error) {
-	if ttl == 0 {
-		return nil, nil
-	}
-	id, err := s.leaseManager.GetLease(ctx, ttl)
-	if err != nil {
-		return nil, err
-	}
-	return []clientv3.OpOption{clientv3.WithLease(id)}, nil
-}
-
-// ensureMinimumResourceVersion returns a 'too large resource' version error when the provided minimumResourceVersion is
-// greater than the most recent actualRevision available from storage.
-func (s *store) ensureMinimumResourceVersion(minimumResourceVersion string, actualRevision uint64) error {
-	if minimumResourceVersion == "" {
-		return nil
-	}
-	minimumRV, err := s.versioner.ParseResourceVersion(minimumResourceVersion)
-	if err != nil {
-		return apierrors.NewBadRequest(fmt.Sprintf("invalid resource version: %v", err))
-	}
-	// Enforce the storage.Interface guarantee that the resource version of the returned data
-	// "will be at least 'resourceVersion'".
-	if minimumRV > actualRevision {
-		return storage.NewTooLargeResourceVersionError(minimumRV, actualRevision, 0)
-	}
-	return nil
-}
-
-// decode decodes value of bytes into object. It will also set the object resource version to rev.
-// On success, objPtr would be set to the object.
-func decode(codec runtime.Codec, versioner storage.Versioner, value []byte, objPtr runtime.Object, rev int64) error {
-	if _, err := conversion.EnforcePtr(objPtr); err != nil {
-		return fmt.Errorf("unable to convert output object to pointer: %v", err)
-	}
-	_, _, err := codec.Decode(value, nil, objPtr)
-	if err != nil {
-		return err
-	}
-	// being unable to set the version does not prevent the object from being extracted
-	if err := versioner.UpdateObject(objPtr, uint64(rev)); err != nil {
-		klog.Errorf("failed to update object version: %v", err)
-	}
-	return nil
-}
-
-// appendListItem decodes and appends the object (if it passes filter) to v, which must be a slice.
-func appendListItem(v reflect.Value, data []byte, rev uint64, pred storage.SelectionPredicate, codec runtime.Codec, versioner storage.Versioner, newItemFunc func() runtime.Object) error {
-	obj, _, err := codec.Decode(data, nil, newItemFunc())
-	if err != nil {
-		return err
-	}
-	// being unable to set the version does not prevent the object from being extracted
-	if err := versioner.UpdateObject(obj, rev); err != nil {
-		klog.Errorf("failed to update object version: %v", err)
-	}
-	if matched, err := pred.Matches(obj); err == nil && matched {
-		v.Set(reflect.Append(v, reflect.ValueOf(obj).Elem()))
-	}
-	return nil
-}
-
-func notFound(key string) clientv3.Cmp {
-	return clientv3.Compare(clientv3.ModRevision(key), "=", 0)
-}
-
-// getTypeName returns type name of an object for reporting purposes.
-func getTypeName(obj interface{}) string {
-	return reflect.TypeOf(obj).String()
-}

vendor/k8s.io/apiserver/pkg/storage/etcd3/watcher.go

@@ -1,423 +0,0 @@
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package etcd3
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	"k8s.io/apiserver/pkg/storage"
-	"k8s.io/apiserver/pkg/storage/value"
-
-	"go.etcd.io/etcd/clientv3"
-	"k8s.io/klog"
-)
-
-const (
-	// We have set a buffer in order to reduce times of context switches.
-	incomingBufSize = 100
-	outgoingBufSize = 100
-)
-
-// fatalOnDecodeError is used during testing to panic the server if watcher encounters a decoding error
-var fatalOnDecodeError = false
-
-// errTestingDecode is the only error that testingDeferOnDecodeError catches during a panic
-var errTestingDecode = errors.New("sentinel error only used during testing to indicate watch decoding error")
-
-// testingDeferOnDecodeError is used during testing to recover from a panic caused by errTestingDecode, all other values continue to panic
-func testingDeferOnDecodeError() {
-	if r := recover(); r != nil && r != errTestingDecode {
-		panic(r)
-	}
-}
-
-func init() {
-	// check to see if we are running in a test environment
-	TestOnlySetFatalOnDecodeError(true)
-	fatalOnDecodeError, _ = strconv.ParseBool(os.Getenv("KUBE_PANIC_WATCH_DECODE_ERROR"))
-}
-
-// TestOnlySetFatalOnDecodeError should only be used for cases where decode errors are expected and need to be tested. e.g. conversion webhooks.
-func TestOnlySetFatalOnDecodeError(b bool) {
-	fatalOnDecodeError = b
-}
-
-type watcher struct {
-	client      *clientv3.Client
-	codec       runtime.Codec
-	versioner   storage.Versioner
-	transformer value.Transformer
-}
-
-// watchChan implements watch.Interface.
-type watchChan struct {
-	watcher           *watcher
-	key               string
-	initialRev        int64
-	recursive         bool
-	internalPred      storage.SelectionPredicate
-	ctx               context.Context
-	cancel            context.CancelFunc
-	incomingEventChan chan *event
-	resultChan        chan watch.Event
-	errChan           chan error
-}
-
-func newWatcher(client *clientv3.Client, codec runtime.Codec, versioner storage.Versioner, transformer value.Transformer) *watcher {
-	return &watcher{
-		client:      client,
-		codec:       codec,
-		versioner:   versioner,
-		transformer: transformer,
-	}
-}
-
-// Watch watches on a key and returns a watch.Interface that transfers relevant notifications.
-// If rev is zero, it will return the existing object(s) and then start watching from
-// the maximum revision+1 from returned objects.
-// If rev is non-zero, it will watch events happened after given revision.
-// If recursive is false, it watches on given key.
-// If recursive is true, it watches any children and directories under the key, excluding the root key itself.
-// pred must be non-nil. Only if pred matches the change, it will be returned.
-func (w *watcher) Watch(ctx context.Context, key string, rev int64, recursive bool, pred storage.SelectionPredicate) (watch.Interface, error) {
-	if recursive && !strings.HasSuffix(key, "/") {
-		key += "/"
-	}
-	wc := w.createWatchChan(ctx, key, rev, recursive, pred)
-	go wc.run()
-	return wc, nil
-}
-
-func (w *watcher) createWatchChan(ctx context.Context, key string, rev int64, recursive bool, pred storage.SelectionPredicate) *watchChan {
-	wc := &watchChan{
-		watcher:           w,
-		key:               key,
-		initialRev:        rev,
-		recursive:         recursive,
-		internalPred:      pred,
-		incomingEventChan: make(chan *event, incomingBufSize),
-		resultChan:        make(chan watch.Event, outgoingBufSize),
-		errChan:           make(chan error, 1),
-	}
-	if pred.Empty() {
-		// The filter doesn't filter out any object.
-		wc.internalPred = storage.Everything
-	}
-	wc.ctx, wc.cancel = context.WithCancel(ctx)
-	return wc
-}
-
-func (wc *watchChan) run() {
-	watchClosedCh := make(chan struct{})
-	go wc.startWatching(watchClosedCh)
-
-	var resultChanWG sync.WaitGroup
-	resultChanWG.Add(1)
-	go wc.processEvent(&resultChanWG)
-
-	select {
-	case err := <-wc.errChan:
-		if err == context.Canceled {
-			break
-		}
-		errResult := transformErrorToEvent(err)
-		if errResult != nil {
-			// error result is guaranteed to be received by user before closing ResultChan.
-			select {
-			case wc.resultChan <- *errResult:
-			case <-wc.ctx.Done(): // user has given up all results
-			}
-		}
-	case <-watchClosedCh:
-	case <-wc.ctx.Done(): // user cancel
-	}
-
-	// We use wc.ctx to reap all goroutines. Under whatever condition, we should stop them all.
-	// It's fine to double cancel.
-	wc.cancel()
-
-	// we need to wait until resultChan wouldn't be used anymore
-	resultChanWG.Wait()
-	close(wc.resultChan)
-}
-
-func (wc *watchChan) Stop() {
-	wc.cancel()
-}
-
-func (wc *watchChan) ResultChan() <-chan watch.Event {
-	return wc.resultChan
-}
-
-// sync tries to retrieve existing data and send them to process.
-// The revision to watch will be set to the revision in response.
-// All events sent will have isCreated=true
-func (wc *watchChan) sync() error {
-	opts := []clientv3.OpOption{}
-	if wc.recursive {
-		opts = append(opts, clientv3.WithPrefix())
-	}
-	getResp, err := wc.watcher.client.Get(wc.ctx, wc.key, opts...)
-	if err != nil {
-		return err
-	}
-	wc.initialRev = getResp.Header.Revision
-	for _, kv := range getResp.Kvs {
-		wc.sendEvent(parseKV(kv))
-	}
-	return nil
-}
-
-// logWatchChannelErr checks whether the error is about mvcc revision compaction which is regarded as warning
-func logWatchChannelErr(err error) {
-	if !strings.Contains(err.Error(), "mvcc: required revision has been compacted") {
-		klog.Errorf("watch chan error: %v", err)
-	} else {
-		klog.Warningf("watch chan error: %v", err)
-	}
-}
-
-// startWatching does:
-// - get current objects if initialRev=0; set initialRev to current rev
-// - watch on given key and send events to process.
-func (wc *watchChan) startWatching(watchClosedCh chan struct{}) {
-	if wc.initialRev == 0 {
-		if err := wc.sync(); err != nil {
-			klog.Errorf("failed to sync with latest state: %v", err)
-			wc.sendError(err)
-			return
-		}
-	}
-	opts := []clientv3.OpOption{clientv3.WithRev(wc.initialRev + 1), clientv3.WithPrevKV()}
-	if wc.recursive {
-		opts = append(opts, clientv3.WithPrefix())
-	}
-	wch := wc.watcher.client.Watch(wc.ctx, wc.key, opts...)
-	for wres := range wch {
-		if wres.Err() != nil {
-			err := wres.Err()
-			// If there is an error on server (e.g. compaction), the channel will return it before closed.
-			logWatchChannelErr(err)
-			wc.sendError(err)
-			return
-		}
-		for _, e := range wres.Events {
-			parsedEvent, err := parseEvent(e)
-			if err != nil {
-				logWatchChannelErr(err)
-				wc.sendError(err)
-				return
-			}
-			wc.sendEvent(parsedEvent)
-		}
-	}
-	// When we come to this point, it's only possible that client side ends the watch.
-	// e.g. cancel the context, close the client.
-	// If this watch chan is broken and context isn't cancelled, other goroutines will still hang.
-	// We should notify the main thread that this goroutine has exited.
-	close(watchClosedCh)
-}
-
-// processEvent processes events from etcd watcher and sends results to resultChan.
-func (wc *watchChan) processEvent(wg *sync.WaitGroup) {
-	defer wg.Done()
-
-	for {
-		select {
-		case e := <-wc.incomingEventChan:
-			res := wc.transform(e)
-			if res == nil {
-				continue
-			}
-			if len(wc.resultChan) == outgoingBufSize {
-				klog.V(3).Infof("Fast watcher, slow processing. Number of buffered events: %d."+
-					"Probably caused by slow dispatching events to watchers", outgoingBufSize)
-			}
-			// If user couldn't receive results fast enough, we also block incoming events from watcher.
-			// Because storing events in local will cause more memory usage.
-			// The worst case would be closing the fast watcher.
-			select {
-			case wc.resultChan <- *res:
-			case <-wc.ctx.Done():
-				return
-			}
-		case <-wc.ctx.Done():
-			return
-		}
-	}
-}
-
-func (wc *watchChan) filter(obj runtime.Object) bool {
-	if wc.internalPred.Empty() {
-		return true
-	}
-	matched, err := wc.internalPred.Matches(obj)
-	return err == nil && matched
-}
-
-func (wc *watchChan) acceptAll() bool {
-	return wc.internalPred.Empty()
-}
-
-// transform transforms an event into a result for user if not filtered.
-func (wc *watchChan) transform(e *event) (res *watch.Event) {
-	curObj, oldObj, err := wc.prepareObjs(e)
-	if err != nil {
-		klog.Errorf("failed to prepare current and previous objects: %v", err)
-		wc.sendError(err)
-		return nil
-	}
-
-	switch {
-	case e.isDeleted:
-		if !wc.filter(oldObj) {
-			return nil
-		}
-		res = &watch.Event{
-			Type:   watch.Deleted,
-			Object: oldObj,
-		}
-	case e.isCreated:
-		if !wc.filter(curObj) {
-			return nil
-		}
-		res = &watch.Event{
-			Type:   watch.Added,
-			Object: curObj,
-		}
-	default:
-		if wc.acceptAll() {
-			res = &watch.Event{
-				Type:   watch.Modified,
-				Object: curObj,
-			}
-			return res
-		}
-		curObjPasses := wc.filter(curObj)
-		oldObjPasses := wc.filter(oldObj)
-		switch {
-		case curObjPasses && oldObjPasses:
-			res = &watch.Event{
-				Type:   watch.Modified,
-				Object: curObj,
-			}
-		case curObjPasses && !oldObjPasses:
-			res = &watch.Event{
-				Type:   watch.Added,
-				Object: curObj,
-			}
-		case !curObjPasses && oldObjPasses:
-			res = &watch.Event{
-				Type:   watch.Deleted,
-				Object: oldObj,
-			}
-		}
-	}
-	return res
-}
-
-func transformErrorToEvent(err error) *watch.Event {
-	err = interpretWatchError(err)
-	if _, ok := err.(apierrors.APIStatus); !ok {
-		err = apierrors.NewInternalError(err)
-	}
-	status := err.(apierrors.APIStatus).Status()
-	return &watch.Event{
-		Type:   watch.Error,
-		Object: &status,
-	}
-}
-
-func (wc *watchChan) sendError(err error) {
-	select {
-	case wc.errChan <- err:
-	case <-wc.ctx.Done():
-	}
-}
-
-func (wc *watchChan) sendEvent(e *event) {
-	if len(wc.incomingEventChan) == incomingBufSize {
-		klog.V(3).Infof("Fast watcher, slow processing. Number of buffered events: %d."+
-			"Probably caused by slow decoding, user not receiving fast, or other processing logic",
-			incomingBufSize)
-	}
-	select {
-	case wc.incomingEventChan <- e:
-	case <-wc.ctx.Done():
-	}
-}
-
-func (wc *watchChan) prepareObjs(e *event) (curObj runtime.Object, oldObj runtime.Object, err error) {
-	if !e.isDeleted {
-		data, _, err := wc.watcher.transformer.TransformFromStorage(e.value, authenticatedDataString(e.key))
-		if err != nil {
-			return nil, nil, err
-		}
-		curObj, err = decodeObj(wc.watcher.codec, wc.watcher.versioner, data, e.rev)
-		if err != nil {
-			return nil, nil, err
-		}
-	}
-	// We need to decode prevValue, only if this is deletion event or
-	// the underlying filter doesn't accept all objects (otherwise we
-	// know that the filter for previous object will return true and
-	// we need the object only to compute whether it was filtered out
-	// before).
-	if len(e.prevValue) > 0 && (e.isDeleted || !wc.acceptAll()) {
-		data, _, err := wc.watcher.transformer.TransformFromStorage(e.prevValue, authenticatedDataString(e.key))
-		if err != nil {
-			return nil, nil, err
-		}
-		// Note that this sends the *old* object with the etcd revision for the time at
-		// which it gets deleted.
-		oldObj, err = decodeObj(wc.watcher.codec, wc.watcher.versioner, data, e.rev)
-		if err != nil {
-			return nil, nil, err
-		}
-	}
-	return curObj, oldObj, nil
-}
-
-func decodeObj(codec runtime.Codec, versioner storage.Versioner, data []byte, rev int64) (_ runtime.Object, err error) {
-	obj, err := runtime.Decode(codec, []byte(data))
-	if err != nil {
-		if fatalOnDecodeError {
-			// catch watch decode error iff we caused it on
-			// purpose during a unit test
-			defer testingDeferOnDecodeError()
-			// we are running in a test environment and thus an
-			// error here is due to a coder mistake if the defer
-			// does not catch it
-			panic(err)
-		}
-		return nil, err
-	}
-	// ensure resource version is set on the object we load from etcd
-	if err := versioner.UpdateObject(obj, uint64(rev)); err != nil {
-		return nil, fmt.Errorf("failure to version api object (%d) %#v: %v", rev, obj, err)
-	}
-	return obj, nil
-}

vendor/k8s.io/apiserver/pkg/storage/interfaces.go

@@ -1,245 +0,0 @@
-/*
-Copyright 2015 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package storage
-
-import (
-	"context"
-	"fmt"
-
-	"k8s.io/apimachinery/pkg/api/meta"
-	"k8s.io/apimachinery/pkg/fields"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-)
-
-// Versioner abstracts setting and retrieving metadata fields from database response
-// onto the object ot list. It is required to maintain storage invariants - updating an
-// object twice with the same data except for the ResourceVersion and SelfLink must be
-// a no-op. A resourceVersion of type uint64 is a 'raw' resourceVersion,
-// intended to be sent directly to or from the backend. A resourceVersion of
-// type string is a 'safe' resourceVersion, intended for consumption by users.
-type Versioner interface {
-	// UpdateObject sets storage metadata into an API object. Returns an error if the object
-	// cannot be updated correctly. May return nil if the requested object does not need metadata
-	// from database.
-	UpdateObject(obj runtime.Object, resourceVersion uint64) error
-	// UpdateList sets the resource version into an API list object. Returns an error if the object
-	// cannot be updated correctly. May return nil if the requested object does not need metadata from
-	// database. continueValue is optional and indicates that more results are available if the client
-	// passes that value to the server in a subsequent call. remainingItemCount indicates the number
-	// of remaining objects if the list is partial. The remainingItemCount field is omitted during
-	// serialization if it is set to nil.
-	UpdateList(obj runtime.Object, resourceVersion uint64, continueValue string, remainingItemCount *int64) error
-	// PrepareObjectForStorage should set SelfLink and ResourceVersion to the empty value. Should
-	// return an error if the specified object cannot be updated.
-	PrepareObjectForStorage(obj runtime.Object) error
-	// ObjectResourceVersion returns the resource version (for persistence) of the specified object.
-	// Should return an error if the specified object does not have a persistable version.
-	ObjectResourceVersion(obj runtime.Object) (uint64, error)
-
-	// ParseResourceVersion takes a resource version argument and
-	// converts it to the storage backend. For watch we should pass to helper.Watch().
-	// Because resourceVersion is an opaque value, the default watch
-	// behavior for non-zero watch is to watch the next value (if you pass
-	// "1", you will see updates from "2" onwards).
-	ParseResourceVersion(resourceVersion string) (uint64, error)
-}
-
-// ResponseMeta contains information about the database metadata that is associated with
-// an object. It abstracts the actual underlying objects to prevent coupling with concrete
-// database and to improve testability.
-type ResponseMeta struct {
-	// TTL is the time to live of the node that contained the returned object. It may be
-	// zero or negative in some cases (objects may be expired after the requested
-	// expiration time due to server lag).
-	TTL int64
-	// The resource version of the node that contained the returned object.
-	ResourceVersion uint64
-}
-
-// IndexerFunc is a function that for a given object computes
-// <value of an index> for a particular <index>.
-type IndexerFunc func(obj runtime.Object) string
-
-// IndexerFuncs is a mapping from <index name> to function that
-// for a given object computes <value for that index>.
-type IndexerFuncs map[string]IndexerFunc
-
-// Everything accepts all objects.
-var Everything = SelectionPredicate{
-	Label: labels.Everything(),
-	Field: fields.Everything(),
-}
-
-// MatchValue defines a pair (<index name>, <value for that index>).
-type MatchValue struct {
-	IndexName string
-	Value     string
-}
-
-// Pass an UpdateFunc to Interface.GuaranteedUpdate to make an update
-// that is guaranteed to succeed.
-// See the comment for GuaranteedUpdate for more details.
-type UpdateFunc func(input runtime.Object, res ResponseMeta) (output runtime.Object, ttl *uint64, err error)
-
-// ValidateObjectFunc is a function to act on a given object. An error may be returned
-// if the hook cannot be completed. The function may NOT transform the provided
-// object.
-type ValidateObjectFunc func(ctx context.Context, obj runtime.Object) error
-
-// ValidateAllObjectFunc is a "admit everything" instance of ValidateObjectFunc.
-func ValidateAllObjectFunc(ctx context.Context, obj runtime.Object) error {
-	return nil
-}
-
-// Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
-type Preconditions struct {
-	// Specifies the target UID.
-	// +optional
-	UID *types.UID `json:"uid,omitempty"`
-	// Specifies the target ResourceVersion
-	// +optional
-	ResourceVersion *string `json:"resourceVersion,omitempty"`
-}
-
-// NewUIDPreconditions returns a Preconditions with UID set.
-func NewUIDPreconditions(uid string) *Preconditions {
-	u := types.UID(uid)
-	return &Preconditions{UID: &u}
-}
-
-func (p *Preconditions) Check(key string, obj runtime.Object) error {
-	if p == nil {
-		return nil
-	}
-	objMeta, err := meta.Accessor(obj)
-	if err != nil {
-		return NewInternalErrorf(
-			"can't enforce preconditions %v on un-introspectable object %v, got error: %v",
-			*p,
-			obj,
-			err)
-	}
-	if p.UID != nil && *p.UID != objMeta.GetUID() {
-		err := fmt.Sprintf(
-			"Precondition failed: UID in precondition: %v, UID in object meta: %v",
-			*p.UID,
-			objMeta.GetUID())
-		return NewInvalidObjError(key, err)
-	}
-	if p.ResourceVersion != nil && *p.ResourceVersion != objMeta.GetResourceVersion() {
-		err := fmt.Sprintf(
-			"Precondition failed: ResourceVersion in precondition: %v, ResourceVersion in object meta: %v",
-			*p.ResourceVersion,
-			objMeta.GetResourceVersion())
-		return NewInvalidObjError(key, err)
-	}
-	return nil
-}
-
-// Interface offers a common interface for object marshaling/unmarshaling operations and
-// hides all the storage-related operations behind it.
-type Interface interface {
-	// Returns Versioner associated with this interface.
-	Versioner() Versioner
-
-	// Create adds a new object at a key unless it already exists. 'ttl' is time-to-live
-	// in seconds (0 means forever). If no error is returned and out is not nil, out will be
-	// set to the read value from database.
-	Create(ctx context.Context, key string, obj, out runtime.Object, ttl uint64) error
-
-	// Delete removes the specified key and returns the value that existed at that spot.
-	// If key didn't exist, it will return NotFound storage error.
-	Delete(ctx context.Context, key string, out runtime.Object, preconditions *Preconditions, validateDeletion ValidateObjectFunc) error
-
-	// Watch begins watching the specified key. Events are decoded into API objects,
-	// and any items selected by 'p' are sent down to returned watch.Interface.
-	// resourceVersion may be used to specify what version to begin watching,
-	// which should be the current resourceVersion, and no longer rv+1
-	// (e.g. reconnecting without missing any updates).
-	// If resource version is "0", this interface will get current object at given key
-	// and send it in an "ADDED" event, before watch starts.
-	Watch(ctx context.Context, key string, resourceVersion string, p SelectionPredicate) (watch.Interface, error)
-
-	// WatchList begins watching the specified key's items. Items are decoded into API
-	// objects and any item selected by 'p' are sent down to returned watch.Interface.
-	// resourceVersion may be used to specify what version to begin watching,
-	// which should be the current resourceVersion, and no longer rv+1
-	// (e.g. reconnecting without missing any updates).
-	// If resource version is "0", this interface will list current objects directory defined by key
-	// and send them in "ADDED" events, before watch starts.
-	WatchList(ctx context.Context, key string, resourceVersion string, p SelectionPredicate) (watch.Interface, error)
-
-	// Get unmarshals json found at key into objPtr. On a not found error, will either
-	// return a zero object of the requested type, or an error, depending on ignoreNotFound.
-	// Treats empty responses and nil response nodes exactly like a not found error.
-	// The returned contents may be delayed, but it is guaranteed that they will
-	// be have at least 'resourceVersion'.
-	Get(ctx context.Context, key string, resourceVersion string, objPtr runtime.Object, ignoreNotFound bool) error
-
-	// GetToList unmarshals json found at key and opaque it into *List api object
-	// (an object that satisfies the runtime.IsList definition).
-	// The returned contents may be delayed, but it is guaranteed that they will
-	// be have at least 'resourceVersion'.
-	GetToList(ctx context.Context, key string, resourceVersion string, p SelectionPredicate, listObj runtime.Object) error
-
-	// List unmarshalls jsons found at directory defined by key and opaque them
-	// into *List api object (an object that satisfies runtime.IsList definition).
-	// The returned contents may be delayed, but it is guaranteed that they will
-	// be have at least 'resourceVersion'.
-	List(ctx context.Context, key string, resourceVersion string, p SelectionPredicate, listObj runtime.Object) error
-
-	// GuaranteedUpdate keeps calling 'tryUpdate()' to update key 'key' (of type 'ptrToType')
-	// retrying the update until success if there is index conflict.
-	// Note that object passed to tryUpdate may change across invocations of tryUpdate() if
-	// other writers are simultaneously updating it, so tryUpdate() needs to take into account
-	// the current contents of the object when deciding how the update object should look.
-	// If the key doesn't exist, it will return NotFound storage error if ignoreNotFound=false
-	// or zero value in 'ptrToType' parameter otherwise.
-	// If the object to update has the same value as previous, it won't do any update
-	// but will return the object in 'ptrToType' parameter.
-	// If 'suggestion' can contain zero or one element - in such case this can be used as
-	// a suggestion about the current version of the object to avoid read operation from
-	// storage to get it.
-	//
-	// Example:
-	//
-	// s := /* implementation of Interface */
-	// err := s.GuaranteedUpdate(
-	//     "myKey", &MyType{}, true,
-	//     func(input runtime.Object, res ResponseMeta) (runtime.Object, *uint64, error) {
-	//       // Before each invocation of the user defined function, "input" is reset to
-	//       // current contents for "myKey" in database.
-	//       curr := input.(*MyType)  // Guaranteed to succeed.
-	//
-	//       // Make the modification
-	//       curr.Counter++
-	//
-	//       // Return the modified object - return an error to stop iterating. Return
-	//       // a uint64 to alter the TTL on the object, or nil to keep it the same value.
-	//       return cur, nil, nil
-	//    },
-	// )
-	GuaranteedUpdate(
-		ctx context.Context, key string, ptrToType runtime.Object, ignoreNotFound bool,
-		precondtions *Preconditions, tryUpdate UpdateFunc, suggestion ...runtime.Object) error
-
-	// Count returns number of different entries under the key (generally being path prefix).
-	Count(key string) (int64, error)
-}

vendor/k8s.io/apiserver/pkg/storage/selection_predicate.go

@@ -1,159 +0,0 @@
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package storage
-
-import (
-	"k8s.io/apimachinery/pkg/api/meta"
-	"k8s.io/apimachinery/pkg/fields"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// AttrFunc returns label and field sets and the uninitialized flag for List or Watch to match.
-// In any failure to parse given object, it returns error.
-type AttrFunc func(obj runtime.Object) (labels.Set, fields.Set, error)
-
-// FieldMutationFunc allows the mutation of the field selection fields.  It is mutating to
-// avoid the extra allocation on this common path
-type FieldMutationFunc func(obj runtime.Object, fieldSet fields.Set) error
-
-func DefaultClusterScopedAttr(obj runtime.Object) (labels.Set, fields.Set, error) {
-	metadata, err := meta.Accessor(obj)
-	if err != nil {
-		return nil, nil, err
-	}
-	fieldSet := fields.Set{
-		"metadata.name": metadata.GetName(),
-	}
-
-	return labels.Set(metadata.GetLabels()), fieldSet, nil
-}
-
-func DefaultNamespaceScopedAttr(obj runtime.Object) (labels.Set, fields.Set, error) {
-	metadata, err := meta.Accessor(obj)
-	if err != nil {
-		return nil, nil, err
-	}
-	fieldSet := fields.Set{
-		"metadata.name":      metadata.GetName(),
-		"metadata.namespace": metadata.GetNamespace(),
-	}
-
-	return labels.Set(metadata.GetLabels()), fieldSet, nil
-}
-
-func (f AttrFunc) WithFieldMutation(fieldMutator FieldMutationFunc) AttrFunc {
-	return func(obj runtime.Object) (labels.Set, fields.Set, error) {
-		labelSet, fieldSet, err := f(obj)
-		if err != nil {
-			return nil, nil, err
-		}
-		if err := fieldMutator(obj, fieldSet); err != nil {
-			return nil, nil, err
-		}
-		return labelSet, fieldSet, nil
-	}
-}
-
-// SelectionPredicate is used to represent the way to select objects from api storage.
-type SelectionPredicate struct {
-	Label               labels.Selector
-	Field               fields.Selector
-	GetAttrs            AttrFunc
-	IndexLabels         []string
-	IndexFields         []string
-	Limit               int64
-	Continue            string
-	AllowWatchBookmarks bool
-}
-
-// Matches returns true if the given object's labels and fields (as
-// returned by s.GetAttrs) match s.Label and s.Field. An error is
-// returned if s.GetAttrs fails.
-func (s *SelectionPredicate) Matches(obj runtime.Object) (bool, error) {
-	if s.Empty() {
-		return true, nil
-	}
-	labels, fields, err := s.GetAttrs(obj)
-	if err != nil {
-		return false, err
-	}
-	matched := s.Label.Matches(labels)
-	if matched && s.Field != nil {
-		matched = matched && s.Field.Matches(fields)
-	}
-	return matched, nil
-}
-
-// MatchesObjectAttributes returns true if the given labels and fields
-// match s.Label and s.Field.
-func (s *SelectionPredicate) MatchesObjectAttributes(l labels.Set, f fields.Set) bool {
-	if s.Label.Empty() && s.Field.Empty() {
-		return true
-	}
-	matched := s.Label.Matches(l)
-	if matched && s.Field != nil {
-		matched = (matched && s.Field.Matches(f))
-	}
-	return matched
-}
-
-// MatchesSingle will return (name, true) if and only if s.Field matches on the object's
-// name.
-func (s *SelectionPredicate) MatchesSingle() (string, bool) {
-	if len(s.Continue) > 0 {
-		return "", false
-	}
-	// TODO: should be namespace.name
-	if name, ok := s.Field.RequiresExactMatch("metadata.name"); ok {
-		return name, true
-	}
-	return "", false
-}
-
-// Empty returns true if the predicate performs no filtering.
-func (s *SelectionPredicate) Empty() bool {
-	return s.Label.Empty() && s.Field.Empty()
-}
-
-// For any index defined by IndexFields, if a matcher can match only (a subset)
-// of objects that return <value> for a given index, a pair (<index name>, <value>)
-// wil be returned.
-func (s *SelectionPredicate) MatcherIndex() []MatchValue {
-	var result []MatchValue
-	for _, field := range s.IndexFields {
-		if value, ok := s.Field.RequiresExactMatch(field); ok {
-			result = append(result, MatchValue{IndexName: FieldIndex(field), Value: value})
-		}
-	}
-	for _, label := range s.IndexLabels {
-		if value, ok := s.Label.RequiresExactMatch(label); ok {
-			result = append(result, MatchValue{IndexName: LabelIndex(label), Value: value})
-		}
-	}
-	return result
-}
-
-// LabelIndex add prefix for label index.
-func LabelIndex(label string) string {
-	return "l:" + label
-}
-
-// FiledIndex add prefix for field index.
-func FieldIndex(field string) string {
-	return "f:" + field
-}

vendor/k8s.io/apiserver/pkg/storage/util.go

@@ -1,81 +0,0 @@
-/*
-Copyright 2015 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package storage
-
-import (
-	"fmt"
-	"sync/atomic"
-
-	"k8s.io/apimachinery/pkg/api/meta"
-	"k8s.io/apimachinery/pkg/api/validation/path"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-type SimpleUpdateFunc func(runtime.Object) (runtime.Object, error)
-
-// SimpleUpdateFunc converts SimpleUpdateFunc into UpdateFunc
-func SimpleUpdate(fn SimpleUpdateFunc) UpdateFunc {
-	return func(input runtime.Object, _ ResponseMeta) (runtime.Object, *uint64, error) {
-		out, err := fn(input)
-		return out, nil, err
-	}
-}
-
-func EverythingFunc(runtime.Object) bool {
-	return true
-}
-
-func NamespaceKeyFunc(prefix string, obj runtime.Object) (string, error) {
-	meta, err := meta.Accessor(obj)
-	if err != nil {
-		return "", err
-	}
-	name := meta.GetName()
-	if msgs := path.IsValidPathSegmentName(name); len(msgs) != 0 {
-		return "", fmt.Errorf("invalid name: %v", msgs)
-	}
-	return prefix + "/" + meta.GetNamespace() + "/" + name, nil
-}
-
-func NoNamespaceKeyFunc(prefix string, obj runtime.Object) (string, error) {
-	meta, err := meta.Accessor(obj)
-	if err != nil {
-		return "", err
-	}
-	name := meta.GetName()
-	if msgs := path.IsValidPathSegmentName(name); len(msgs) != 0 {
-		return "", fmt.Errorf("invalid name: %v", msgs)
-	}
-	return prefix + "/" + name, nil
-}
-
-// HighWaterMark is a thread-safe object for tracking the maximum value seen
-// for some quantity.
-type HighWaterMark int64
-
-// Update returns true if and only if 'current' is the highest value ever seen.
-func (hwm *HighWaterMark) Update(current int64) bool {
-	for {
-		old := atomic.LoadInt64((*int64)(hwm))
-		if current <= old {
-			return false
-		}
-		if atomic.CompareAndSwapInt64((*int64)(hwm), old, current) {
-			return true
-		}
-	}
-}

vendor/k8s.io/apiserver/pkg/storage/value/metrics.go

@@ -1,141 +0,0 @@
-/*
-Copyright 2019 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package value
-
-import (
-	"sync"
-	"time"
-
-	"google.golang.org/grpc/status"
-
-	"k8s.io/component-base/metrics"
-	"k8s.io/component-base/metrics/legacyregistry"
-)
-
-const (
-	namespace = "apiserver"
-	subsystem = "storage"
-)
-
-/*
- * By default, all the following metrics are defined as falling under
- * ALPHA stability level https://github.com/kubernetes/enhancements/blob/master/keps/sig-instrumentation/20190404-kubernetes-control-plane-metrics-stability.md#stability-classes)
- *
- * Promoting the stability level of the metric is a responsibility of the component owner, since it
- * involves explicitly acknowledging support for the metric across multiple releases, in accordance with
- * the metric stability policy.
- */
-var (
-	transformerLatencies = metrics.NewHistogramVec(
-		&metrics.HistogramOpts{
-			Namespace: namespace,
-			Subsystem: subsystem,
-			Name:      "transformation_duration_seconds",
-			Help:      "Latencies in seconds of value transformation operations.",
-			// In-process transformations (ex. AES CBC) complete on the order of 20 microseconds. However, when
-			// external KMS is involved latencies may climb into milliseconds.
-			Buckets:        metrics.ExponentialBuckets(5e-6, 2, 14),
-			StabilityLevel: metrics.ALPHA,
-		},
-		[]string{"transformation_type"},
-	)
-
-	transformerOperationsTotal = metrics.NewCounterVec(
-		&metrics.CounterOpts{
-			Namespace:      namespace,
-			Subsystem:      subsystem,
-			Name:           "transformation_operations_total",
-			Help:           "Total number of transformations.",
-			StabilityLevel: metrics.ALPHA,
-		},
-		[]string{"transformation_type", "transformer_prefix", "status"},
-	)
-
-	envelopeTransformationCacheMissTotal = metrics.NewCounter(
-		&metrics.CounterOpts{
-			Namespace:      namespace,
-			Subsystem:      subsystem,
-			Name:           "envelope_transformation_cache_misses_total",
-			Help:           "Total number of cache misses while accessing key decryption key(KEK).",
-			StabilityLevel: metrics.ALPHA,
-		},
-	)
-
-	dataKeyGenerationLatencies = metrics.NewHistogram(
-		&metrics.HistogramOpts{
-			Namespace:      namespace,
-			Subsystem:      subsystem,
-			Name:           "data_key_generation_duration_seconds",
-			Help:           "Latencies in seconds of data encryption key(DEK) generation operations.",
-			Buckets:        metrics.ExponentialBuckets(5e-6, 2, 14),
-			StabilityLevel: metrics.ALPHA,
-		},
-	)
-
-	dataKeyGenerationFailuresTotal = metrics.NewCounter(
-		&metrics.CounterOpts{
-			Namespace:      namespace,
-			Subsystem:      subsystem,
-			Name:           "data_key_generation_failures_total",
-			Help:           "Total number of failed data encryption key(DEK) generation operations.",
-			StabilityLevel: metrics.ALPHA,
-		},
-	)
-)
-
-var registerMetrics sync.Once
-
-func RegisterMetrics() {
-	registerMetrics.Do(func() {
-		legacyregistry.MustRegister(transformerLatencies)
-		legacyregistry.MustRegister(transformerOperationsTotal)
-		legacyregistry.MustRegister(envelopeTransformationCacheMissTotal)
-		legacyregistry.MustRegister(dataKeyGenerationLatencies)
-		legacyregistry.MustRegister(dataKeyGenerationFailuresTotal)
-	})
-}
-
-// RecordTransformation records latencies and count of TransformFromStorage and TransformToStorage operations.
-// Note that transformation_failures_total metric is deprecated, use transformation_operations_total instead.
-func RecordTransformation(transformationType, transformerPrefix string, start time.Time, err error) {
-	transformerOperationsTotal.WithLabelValues(transformationType, transformerPrefix, status.Code(err).String()).Inc()
-
-	switch {
-	case err == nil:
-		transformerLatencies.WithLabelValues(transformationType).Observe(sinceInSeconds(start))
-	}
-}
-
-// RecordCacheMiss records a miss on Key Encryption Key(KEK) - call to KMS was required to decrypt KEK.
-func RecordCacheMiss() {
-	envelopeTransformationCacheMissTotal.Inc()
-}
-
-// RecordDataKeyGeneration records latencies and count of Data Encryption Key generation operations.
-func RecordDataKeyGeneration(start time.Time, err error) {
-	if err != nil {
-		dataKeyGenerationFailuresTotal.Inc()
-		return
-	}
-
-	dataKeyGenerationLatencies.Observe(sinceInSeconds(start))
-}
-
-// sinceInSeconds gets the time since the specified start in seconds.
-func sinceInSeconds(start time.Time) float64 {
-	return time.Since(start).Seconds()
-}

vendor/k8s.io/apiserver/pkg/storage/value/transformer.go

@@ -1,209 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package value contains methods for assisting with transformation of values in storage.
-package value
-
-import (
-	"bytes"
-	"fmt"
-	"sync"
-	"time"
-
-	"k8s.io/apimachinery/pkg/util/errors"
-)
-
-func init() {
-	RegisterMetrics()
-}
-
-// Context is additional information that a storage transformation may need to verify the data at rest.
-type Context interface {
-	// AuthenticatedData should return an array of bytes that describes the current value. If the value changes,
-	// the transformer may report the value as unreadable or tampered. This may be nil if no such description exists
-	// or is needed. For additional verification, set this to data that strongly identifies the value, such as
-	// the key and creation version of the stored data.
-	AuthenticatedData() []byte
-}
-
-// Transformer allows a value to be transformed before being read from or written to the underlying store. The methods
-// must be able to undo the transformation caused by the other.
-type Transformer interface {
-	// TransformFromStorage may transform the provided data from its underlying storage representation or return an error.
-	// Stale is true if the object on disk is stale and a write to etcd should be issued, even if the contents of the object
-	// have not changed.
-	TransformFromStorage(data []byte, context Context) (out []byte, stale bool, err error)
-	// TransformToStorage may transform the provided data into the appropriate form in storage or return an error.
-	TransformToStorage(data []byte, context Context) (out []byte, err error)
-}
-
-type identityTransformer struct{}
-
-// IdentityTransformer performs no transformation of the provided data.
-var IdentityTransformer Transformer = identityTransformer{}
-
-func (identityTransformer) TransformFromStorage(b []byte, ctx Context) ([]byte, bool, error) {
-	return b, false, nil
-}
-func (identityTransformer) TransformToStorage(b []byte, ctx Context) ([]byte, error) {
-	return b, nil
-}
-
-// DefaultContext is a simple implementation of Context for a slice of bytes.
-type DefaultContext []byte
-
-// AuthenticatedData returns itself.
-func (c DefaultContext) AuthenticatedData() []byte { return []byte(c) }
-
-// MutableTransformer allows a transformer to be changed safely at runtime.
-type MutableTransformer struct {
-	lock        sync.RWMutex
-	transformer Transformer
-}
-
-// NewMutableTransformer creates a transformer that can be updated at any time by calling Set()
-func NewMutableTransformer(transformer Transformer) *MutableTransformer {
-	return &MutableTransformer{transformer: transformer}
-}
-
-// Set updates the nested transformer.
-func (t *MutableTransformer) Set(transformer Transformer) {
-	t.lock.Lock()
-	t.transformer = transformer
-	t.lock.Unlock()
-}
-
-func (t *MutableTransformer) TransformFromStorage(data []byte, context Context) (out []byte, stale bool, err error) {
-	t.lock.RLock()
-	transformer := t.transformer
-	t.lock.RUnlock()
-	return transformer.TransformFromStorage(data, context)
-}
-func (t *MutableTransformer) TransformToStorage(data []byte, context Context) (out []byte, err error) {
-	t.lock.RLock()
-	transformer := t.transformer
-	t.lock.RUnlock()
-	return transformer.TransformToStorage(data, context)
-}
-
-// PrefixTransformer holds a transformer interface and the prefix that the transformation is located under.
-type PrefixTransformer struct {
-	Prefix      []byte
-	Transformer Transformer
-}
-
-type prefixTransformers struct {
-	transformers []PrefixTransformer
-	err          error
-}
-
-var _ Transformer = &prefixTransformers{}
-
-// NewPrefixTransformers supports the Transformer interface by checking the incoming data against the provided
-// prefixes in order. The first matching prefix will be used to transform the value (the prefix is stripped
-// before the Transformer interface is invoked). The first provided transformer will be used when writing to
-// the store.
-func NewPrefixTransformers(err error, transformers ...PrefixTransformer) Transformer {
-	if err == nil {
-		err = fmt.Errorf("the provided value does not match any of the supported transformers")
-	}
-	return &prefixTransformers{
-		transformers: transformers,
-		err:          err,
-	}
-}
-
-// TransformFromStorage finds the first transformer with a prefix matching the provided data and returns
-// the result of transforming the value. It will always mark any transformation as stale that is not using
-// the first transformer.
-func (t *prefixTransformers) TransformFromStorage(data []byte, context Context) ([]byte, bool, error) {
-	start := time.Now()
-	var errs []error
-	for i, transformer := range t.transformers {
-		if bytes.HasPrefix(data, transformer.Prefix) {
-			result, stale, err := transformer.Transformer.TransformFromStorage(data[len(transformer.Prefix):], context)
-			// To migrate away from encryption, user can specify an identity transformer higher up
-			// (in the config file) than the encryption transformer. In that scenario, the identity transformer needs to
-			// identify (during reads from disk) whether the data being read is encrypted or not. If the data is encrypted,
-			// it shall throw an error, but that error should not prevent the next subsequent transformer from being tried.
-			if len(transformer.Prefix) == 0 && err != nil {
-				continue
-			}
-			if len(transformer.Prefix) == 0 {
-				RecordTransformation("from_storage", "identity", start, err)
-			} else {
-				RecordTransformation("from_storage", string(transformer.Prefix), start, err)
-			}
-
-			// It is valid to have overlapping prefixes when the same encryption provider
-			// is specified multiple times but with different keys (the first provider is
-			// being rotated to and some later provider is being rotated away from).
-			//
-			// Example:
-			//
-			//  {
-			//    "aescbc": {
-			//      "keys": [
-			//        {
-			//          "name": "2",
-			//          "secret": "some key 2"
-			//        }
-			//      ]
-			//    }
-			//  },
-			//  {
-			//    "aescbc": {
-			//      "keys": [
-			//        {
-			//          "name": "1",
-			//          "secret": "some key 1"
-			//        }
-			//      ]
-			//    }
-			//  },
-			//
-			// The transformers for both aescbc configs share the prefix k8s:enc:aescbc:v1:
-			// but a failure in the first one should not prevent a later match from being attempted.
-			// Thus we never short-circuit on a prefix match that results in an error.
-			if err != nil {
-				errs = append(errs, err)
-				continue
-			}
-
-			return result, stale || i != 0, err
-		}
-	}
-	if err := errors.Reduce(errors.NewAggregate(errs)); err != nil {
-		return nil, false, err
-	}
-	RecordTransformation("from_storage", "unknown", start, t.err)
-	return nil, false, t.err
-}
-
-// TransformToStorage uses the first transformer and adds its prefix to the data.
-func (t *prefixTransformers) TransformToStorage(data []byte, context Context) ([]byte, error) {
-	start := time.Now()
-	transformer := t.transformers[0]
-	prefixedData := make([]byte, len(transformer.Prefix), len(data)+len(transformer.Prefix))
-	copy(prefixedData, transformer.Prefix)
-	result, err := transformer.Transformer.TransformToStorage(data, context)
-	RecordTransformation("to_storage", string(transformer.Prefix), start, err)
-	if err != nil {
-		return nil, err
-	}
-	prefixedData = append(prefixedData, result...)
-	return prefixedData, nil
-}

vendor/k8s.io/apiserver/pkg/util/webhook/authentication.go

@@ -55,7 +55,7 @@ func NewDefaultAuthenticationInfoResolverWrapper(
 				}
 
 				if egressSelector != nil {
-					networkContext := egressselector.Master.AsNetworkContext()
+					networkContext := egressselector.ControlPlane.AsNetworkContext()
 					var egressDialer utilnet.DialFunc
 					egressDialer, err = egressSelector.Lookup(networkContext)
 

vendor/k8s.io/apiserver/pkg/util/webhook/webhook.go

@@ -26,7 +26,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
-	"k8s.io/apimachinery/pkg/util/net"
 	utilnet "k8s.io/apimachinery/pkg/util/net"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/rest"
@@ -37,12 +36,23 @@ import (
 // timeout of the HTTP request, including reading the response body.
 const defaultRequestTimeout = 30 * time.Second
 
+// DefaultRetryBackoffWithInitialDelay returns the default backoff parameters for webhook retry from a given initial delay.
+// Handy for the client that provides a custom initial delay only.
+func DefaultRetryBackoffWithInitialDelay(initialBackoffDelay time.Duration) wait.Backoff {
+	return wait.Backoff{
+		Duration: initialBackoffDelay,
+		Factor:   1.5,
+		Jitter:   0.2,
+		Steps:    5,
+	}
+}
+
 // GenericWebhook defines a generic client for webhooks with commonly used capabilities,
 // such as retry requests.
 type GenericWebhook struct {
-	RestClient     *rest.RESTClient
-	InitialBackoff time.Duration
-	ShouldRetry    func(error) bool
+	RestClient   *rest.RESTClient
+	RetryBackoff wait.Backoff
+	ShouldRetry  func(error) bool
 }
 
 // DefaultShouldRetry is a default implementation for the GenericWebhook ShouldRetry function property.
@@ -51,7 +61,7 @@ type GenericWebhook struct {
 // Otherwise it returns false for an immediate fail.
 func DefaultShouldRetry(err error) bool {
 	// these errors indicate a transient error that should be retried.
-	if net.IsConnectionReset(err) || apierrors.IsInternalError(err) || apierrors.IsTimeout(err) || apierrors.IsTooManyRequests(err) {
+	if utilnet.IsConnectionReset(err) || apierrors.IsInternalError(err) || apierrors.IsTimeout(err) || apierrors.IsTooManyRequests(err) {
 		return true
 	}
 	// if the error sends the Retry-After header, we respect it as an explicit confirmation we should retry.
@@ -62,11 +72,11 @@ func DefaultShouldRetry(err error) bool {
 }
 
 // NewGenericWebhook creates a new GenericWebhook from the provided kubeconfig file.
-func NewGenericWebhook(scheme *runtime.Scheme, codecFactory serializer.CodecFactory, kubeConfigFile string, groupVersions []schema.GroupVersion, initialBackoff time.Duration, customDial utilnet.DialFunc) (*GenericWebhook, error) {
-	return newGenericWebhook(scheme, codecFactory, kubeConfigFile, groupVersions, initialBackoff, defaultRequestTimeout, customDial)
+func NewGenericWebhook(scheme *runtime.Scheme, codecFactory serializer.CodecFactory, kubeConfigFile string, groupVersions []schema.GroupVersion, retryBackoff wait.Backoff, customDial utilnet.DialFunc) (*GenericWebhook, error) {
+	return newGenericWebhook(scheme, codecFactory, kubeConfigFile, groupVersions, retryBackoff, defaultRequestTimeout, customDial)
 }
 
-func newGenericWebhook(scheme *runtime.Scheme, codecFactory serializer.CodecFactory, kubeConfigFile string, groupVersions []schema.GroupVersion, initialBackoff, requestTimeout time.Duration, customDial utilnet.DialFunc) (*GenericWebhook, error) {
+func newGenericWebhook(scheme *runtime.Scheme, codecFactory serializer.CodecFactory, kubeConfigFile string, groupVersions []schema.GroupVersion, retryBackoff wait.Backoff, requestTimeout time.Duration, customDial utilnet.DialFunc) (*GenericWebhook, error) {
 	for _, groupVersion := range groupVersions {
 		if !scheme.IsVersionRegistered(groupVersion) {
 			return nil, fmt.Errorf("webhook plugin requires enabling extension resource: %s", groupVersion)
@@ -103,19 +113,20 @@ func newGenericWebhook(scheme *runtime.Scheme, codecFactory serializer.CodecFact
 		return nil, err
 	}
 
-	return &GenericWebhook{restClient, initialBackoff, DefaultShouldRetry}, nil
+	return &GenericWebhook{restClient, retryBackoff, DefaultShouldRetry}, nil
 }
 
-// WithExponentialBackoff will retry webhookFn() up to 5 times with exponentially increasing backoff when
-// it returns an error for which this GenericWebhook's ShouldRetry function returns true, confirming it to
-// be retriable. If no ShouldRetry has been defined for the webhook, then the default one is used (DefaultShouldRetry).
+// WithExponentialBackoff will retry webhookFn() as specified by the given backoff parameters with exponentially
+// increasing backoff when it returns an error for which this GenericWebhook's ShouldRetry function returns true,
+// confirming it to be retriable. If no ShouldRetry has been defined for the webhook,
+// then the default one is used (DefaultShouldRetry).
 func (g *GenericWebhook) WithExponentialBackoff(ctx context.Context, webhookFn func() rest.Result) rest.Result {
 	var result rest.Result
 	shouldRetry := g.ShouldRetry
 	if shouldRetry == nil {
 		shouldRetry = DefaultShouldRetry
 	}
-	WithExponentialBackoff(ctx, g.InitialBackoff, func() error {
+	WithExponentialBackoff(ctx, g.RetryBackoff, func() error {
 		result = webhookFn()
 		return result.Error()
 	}, shouldRetry)
@@ -124,28 +135,28 @@ func (g *GenericWebhook) WithExponentialBackoff(ctx context.Context, webhookFn f
 
 // WithExponentialBackoff will retry webhookFn up to 5 times with exponentially increasing backoff when
 // it returns an error for which shouldRetry returns true, confirming it to be retriable.
-func WithExponentialBackoff(ctx context.Context, initialBackoff time.Duration, webhookFn func() error, shouldRetry func(error) bool) error {
-	backoff := wait.Backoff{
-		Duration: initialBackoff,
-		Factor:   1.5,
-		Jitter:   0.2,
-		Steps:    5,
-	}
-
-	var err error
-	wait.ExponentialBackoff(backoff, func() (bool, error) {
-		err = webhookFn()
-		if ctx.Err() != nil {
-			// we timed out or were cancelled, we should not retry
-			return true, err
-		}
-		if shouldRetry(err) {
+func WithExponentialBackoff(ctx context.Context, retryBackoff wait.Backoff, webhookFn func() error, shouldRetry func(error) bool) error {
+	// having a webhook error allows us to track the last actual webhook error for requests that
+	// are later cancelled or time out.
+	var webhookErr error
+	err := wait.ExponentialBackoffWithContext(ctx, retryBackoff, func() (bool, error) {
+		webhookErr = webhookFn()
+		if shouldRetry(webhookErr) {
 			return false, nil
 		}
-		if err != nil {
-			return false, err
+		if webhookErr != nil {
+			return false, webhookErr
 		}
 		return true, nil
 	})
-	return err
+
+	switch {
+	// we check for webhookErr first, if webhookErr is set it's the most important error to return.
+	case webhookErr != nil:
+		return webhookErr
+	case err != nil:
+		return fmt.Errorf("webhook call failed: %s", err.Error())
+	default:
+		return nil
+	}
 }

vendor/k8s.io/apiserver/pkg/warning/context.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package warning
+
+import (
+	"context"
+)
+
+// The key type is unexported to prevent collisions
+type key int
+
+const (
+	// auditAnnotationsKey is the context key for the audit annotations.
+	warningRecorderKey key = iota
+)
+
+// Recorder provides a method for recording warnings
+type Recorder interface {
+	// AddWarning adds the specified warning to the response.
+	// agent must be valid UTF-8, and must not contain spaces, quotes, backslashes, or control characters.
+	// text must be valid UTF-8, and must not contain control characters.
+	AddWarning(agent, text string)
+}
+
+// WithWarningRecorder returns a new context that wraps the provided context and contains the provided Recorder implementation.
+// The returned context can be passed to AddWarning().
+func WithWarningRecorder(ctx context.Context, recorder Recorder) context.Context {
+	return context.WithValue(ctx, warningRecorderKey, recorder)
+}
+func warningRecorderFrom(ctx context.Context) (Recorder, bool) {
+	recorder, ok := ctx.Value(warningRecorderKey).(Recorder)
+	return recorder, ok
+}
+
+// AddWarning records a warning for the specified agent and text to the Recorder added to the provided context using WithWarningRecorder().
+// If no Recorder exists in the provided context, this is a no-op.
+// agent must be valid UTF-8, and must not contain spaces, quotes, backslashes, or control characters.
+// text must be valid UTF-8, and must not contain control characters.
+func AddWarning(ctx context.Context, agent string, text string) {
+	recorder, ok := warningRecorderFrom(ctx)
+	if !ok {
+		return
+	}
+	recorder.AddWarning(agent, text)
+}