// StartAPI starts the components of the master that are considered part of the API - the Kubernetes
// API and core controllers, the Origin API, the group, policy, project, and authorization caches,
// etcd, the asset server (for the UI), the OAuth server endpoints, and the DNS server.
// TODO: allow to be more granularly targeted
func StartAPI(oc *origin.MasterConfig, kc *kubernetes.MasterConfig) error {
// start etcd
if oc.Options.EtcdConfig != nil {
etcdserver.RunEtcd(oc.Options.EtcdConfig)
}
// verify we can connect to etcd with the provided config
if etcdClient, err := etcd.GetAndTestEtcdClient(oc.Options.EtcdClientInfo); err != nil {
return err
} else {
etcdClient.Close()
}
// Must start policy caching immediately
oc.RunGroupCache()
oc.RunPolicyCache()
oc.RunProjectCache()
unprotectedInstallers := []origin.APIInstaller{}
if oc.Options.OAuthConfig != nil {
authConfig, err := origin.BuildAuthConfig(oc)
if err != nil {
return err
}
unprotectedInstallers = append(unprotectedInstallers, authConfig)
}
var standaloneAssetConfig *origin.AssetConfig
if oc.WebConsoleEnabled() {
var overrideConfig *overrideapi.ClusterResourceOverrideConfig = nil
if oc.Options.KubernetesMasterConfig != nil { // external kube gets you a nil pointer here
if overridePluginConfigFile, err := pluginconfig.GetPluginConfigFile(oc.Options.KubernetesMasterConfig.AdmissionConfig.PluginConfig, overrideapi.PluginName, ""); err != nil {
return err
} else if overridePluginConfigFile != "" {
configFile, err := os.Open(overridePluginConfigFile)
if err != nil {
return err
}
if overrideConfig, err = override.ReadConfig(configFile); err != nil {
return err
}
}
}
config, err := origin.NewAssetConfig(*oc.Options.AssetConfig, overrideConfig)
if err != nil {
return err
}
if oc.Options.AssetConfig.ServingInfo.BindAddress == oc.Options.ServingInfo.BindAddress {
unprotectedInstallers = append(unprotectedInstallers, config)
} else {
standaloneAssetConfig = config
}
}
if kc != nil {
oc.Run([]origin.APIInstaller{kc}, unprotectedInstallers)
} else {
_, kubeClientConfig, err := configapi.GetKubeClient(oc.Options.MasterClients.ExternalKubernetesKubeConfig)
if err != nil {
return err
}
proxy := &kubernetes.ProxyConfig{
ClientConfig: kubeClientConfig,
}
oc.Run([]origin.APIInstaller{proxy}, unprotectedInstallers)
}
oc.InitializeObjects()
if standaloneAssetConfig != nil {
standaloneAssetConfig.Run()
}
if oc.Options.DNSConfig != nil {
oc.RunDNSServer()
}
oc.RunProjectAuthorizationCache()
return nil
}
// startAPI starts the components of the master that are considered part of the API - the Kubernetes
// API and core controllers, the Origin API, the group, policy, project, and authorization caches,
// etcd, the asset server (for the UI), the OAuth server endpoints, and the DNS server.
// TODO: allow to be more granularly targeted
func startAPI(oc *origin.MasterConfig, kc *kubernetes.MasterConfig) error {
// start etcd
if oc.Options.EtcdConfig != nil {
etcd.RunEtcd(oc.Options.EtcdConfig)
}
// verify we can connect to etcd with the provided config
if err := etcd.TestEtcdClient(oc.EtcdClient); err != nil {
return err
}
// Must start policy caching immediately
oc.RunGroupCache()
oc.RunPolicyCache()
oc.RunProjectCache()
unprotectedInstallers := []origin.APIInstaller{}
if oc.Options.OAuthConfig != nil {
authConfig, err := origin.BuildAuthConfig(oc.Options)
if err != nil {
return err
}
unprotectedInstallers = append(unprotectedInstallers, authConfig)
}
var standaloneAssetConfig *origin.AssetConfig
if oc.WebConsoleEnabled() {
config, err := origin.BuildAssetConfig(*oc.Options.AssetConfig)
if err != nil {
return err
}
if oc.Options.AssetConfig.ServingInfo.BindAddress == oc.Options.ServingInfo.BindAddress {
unprotectedInstallers = append(unprotectedInstallers, config)
} else {
standaloneAssetConfig = config
}
}
if kc != nil {
oc.Run([]origin.APIInstaller{kc}, unprotectedInstallers)
} else {
_, kubeClientConfig, err := configapi.GetKubeClient(oc.Options.MasterClients.ExternalKubernetesKubeConfig)
if err != nil {
return err
}
proxy := &kubernetes.ProxyConfig{
ClientConfig: kubeClientConfig,
}
oc.Run([]origin.APIInstaller{proxy}, unprotectedInstallers)
}
oc.InitializeObjects()
if standaloneAssetConfig != nil {
standaloneAssetConfig.Run()
}
if oc.Options.DNSConfig != nil {
oc.RunDNSServer()
}
oc.RunProjectAuthorizationCache()
return nil
}
func StartMaster(openshiftMasterConfig *configapi.MasterConfig) error {
glog.Infof("Starting an OpenShift master, reachable at %s (etcd: %v)", openshiftMasterConfig.ServingInfo.BindAddress, openshiftMasterConfig.EtcdClientInfo.URLs)
glog.Infof("OpenShift master public address is %s", openshiftMasterConfig.AssetConfig.MasterPublicURL)
if openshiftMasterConfig.EtcdConfig != nil {
etcd.RunEtcd(openshiftMasterConfig.EtcdConfig)
}
// Allow privileged containers
// TODO: make this configurable and not the default https://github.com/openshift/origin/issues/662
capabilities.Initialize(capabilities.Capabilities{
AllowPrivileged: true,
HostNetworkSources: []string{kubelet.ApiserverSource, kubelet.FileSource},
})
openshiftConfig, err := origin.BuildMasterConfig(*openshiftMasterConfig)
if err != nil {
return err
}
go func() {
openshiftConfig.ControllerPlug.WaitForStop()
glog.Fatalf("Master shutdown requested")
}()
// Must start policy caching immediately
openshiftConfig.RunPolicyCache()
openshiftConfig.RunProjectCache()
unprotectedInstallers := []origin.APIInstaller{}
if openshiftMasterConfig.OAuthConfig != nil {
authConfig, err := origin.BuildAuthConfig(*openshiftMasterConfig)
if err != nil {
return err
}
unprotectedInstallers = append(unprotectedInstallers, authConfig)
}
var standaloneAssetConfig *origin.AssetConfig
if openshiftMasterConfig.AssetConfig != nil {
config, err := origin.BuildAssetConfig(*openshiftMasterConfig.AssetConfig)
if err != nil {
return err
}
if openshiftMasterConfig.AssetConfig.ServingInfo.BindAddress == openshiftMasterConfig.ServingInfo.BindAddress {
unprotectedInstallers = append(unprotectedInstallers, config)
} else {
standaloneAssetConfig = config
}
}
var kubeConfig *kubernetes.MasterConfig
if openshiftMasterConfig.KubernetesMasterConfig != nil {
kubeConfig, err = kubernetes.BuildKubernetesMasterConfig(*openshiftMasterConfig, openshiftConfig.RequestContextMapper, openshiftConfig.KubeClient())
if err != nil {
return err
}
openshiftConfig.Run([]origin.APIInstaller{kubeConfig}, unprotectedInstallers)
} else {
_, kubeConfig, err := configapi.GetKubeClient(openshiftMasterConfig.MasterClients.ExternalKubernetesKubeConfig)
if err != nil {
return err
}
proxy := &kubernetes.ProxyConfig{
ClientConfig: kubeConfig,
}
openshiftConfig.Run([]origin.APIInstaller{proxy}, unprotectedInstallers)
}
glog.Infof("Using images from %q", openshiftConfig.ImageFor("<component>"))
if standaloneAssetConfig != nil {
standaloneAssetConfig.Run()
}
if openshiftMasterConfig.DNSConfig != nil {
openshiftConfig.RunDNSServer()
}
openshiftConfig.RunProjectAuthorizationCache()
if openshiftMasterConfig.Controllers != configapi.ControllersDisabled {
go func() {
openshiftConfig.ControllerPlug.WaitForStart()
glog.Infof("Master controllers starting (%s)", openshiftMasterConfig.Controllers)
// Start these first, because they provide credentials for other controllers' clients
openshiftConfig.RunServiceAccountsController()
openshiftConfig.RunServiceAccountTokensController()
// used by admission controllers
openshiftConfig.RunServiceAccountPullSecretsControllers()
openshiftConfig.RunSecurityAllocationController()
if kubeConfig != nil {
_, rcClient, err := openshiftConfig.GetServiceAccountClients(openshiftConfig.ReplicationControllerServiceAccount)
if err != nil {
glog.Fatalf("Could not get client for replication controller: %v", err)
}
// called by admission control
kubeConfig.RunResourceQuotaManager()
// no special order
kubeConfig.RunNodeController()
kubeConfig.RunScheduler()
kubeConfig.RunReplicationController(rcClient)
kubeConfig.RunEndpointController()
kubeConfig.RunNamespaceController()
kubeConfig.RunPersistentVolumeClaimBinder()
kubeConfig.RunPersistentVolumeClaimRecycler(openshiftConfig.ImageFor("deployer"))
}
// no special order
openshiftConfig.RunBuildController()
openshiftConfig.RunBuildPodController()
openshiftConfig.RunBuildImageChangeTriggerController()
openshiftConfig.RunDeploymentController()
openshiftConfig.RunDeployerPodController()
openshiftConfig.RunDeploymentConfigController()
openshiftConfig.RunDeploymentConfigChangeController()
openshiftConfig.RunDeploymentImageChangeTriggerController()
openshiftConfig.RunImageImportController()
openshiftConfig.RunOriginNamespaceController()
openshiftConfig.RunSDNController()
}()
}
return nil
}
// StartAPI starts the components of the master that are considered part of the API - the Kubernetes
// API and core controllers, the Origin API, the group, policy, project, and authorization caches,
// etcd, the asset server (for the UI), the OAuth server endpoints, and the DNS server.
// TODO: allow to be more granularly targeted
func StartAPI(oc *origin.MasterConfig, kc *kubernetes.MasterConfig) error {
// start etcd
if oc.Options.EtcdConfig != nil {
etcdserver.RunEtcd(oc.Options.EtcdConfig)
}
// verify we can connect to etcd with the provided config
if _, err := etcd.GetAndTestEtcdClient(oc.Options.EtcdClientInfo); err != nil {
return err
}
// Must start policy caching immediately
oc.Informers.StartCore(utilwait.NeverStop)
oc.RunClusterQuotaMappingController()
oc.RunGroupCache()
oc.RunProjectCache()
unprotectedInstallers := []origin.APIInstaller{}
if oc.Options.OAuthConfig != nil {
authConfig, err := origin.BuildAuthConfig(oc)
if err != nil {
return err
}
unprotectedInstallers = append(unprotectedInstallers, authConfig)
}
var standaloneAssetConfig *origin.AssetConfig
if oc.WebConsoleEnabled() {
overrideConfig, err := getResourceOverrideConfig(oc)
if err != nil {
return err
}
config, err := origin.NewAssetConfig(*oc.Options.AssetConfig, overrideConfig)
if err != nil {
return err
}
if oc.Options.AssetConfig.ServingInfo.BindAddress == oc.Options.ServingInfo.BindAddress {
unprotectedInstallers = append(unprotectedInstallers, config)
} else {
standaloneAssetConfig = config
}
}
if kc != nil {
oc.Run([]origin.APIInstaller{kc}, unprotectedInstallers)
} else {
_, kubeClientConfig, err := configapi.GetKubeClient(oc.Options.MasterClients.ExternalKubernetesKubeConfig, oc.Options.MasterClients.ExternalKubernetesClientConnectionOverrides)
if err != nil {
return err
}
proxy := &kubernetes.ProxyConfig{
ClientConfig: kubeClientConfig,
}
oc.Run([]origin.APIInstaller{proxy}, unprotectedInstallers)
}
// start up the informers that we're trying to use in the API server
oc.Informers.Start(utilwait.NeverStop)
oc.InitializeObjects()
if standaloneAssetConfig != nil {
standaloneAssetConfig.Run()
}
if oc.Options.DNSConfig != nil {
oc.RunDNSServer()
}
oc.RunProjectAuthorizationCache()
return nil
}
func StartMaster(openshiftMasterConfig *configapi.MasterConfig) error {
glog.Infof("Starting master on %s (%s)", openshiftMasterConfig.ServingInfo.BindAddress, version.Get().String())
glog.Infof("Public master address is %s", openshiftMasterConfig.AssetConfig.MasterPublicURL)
if len(openshiftMasterConfig.DisabledFeatures) > 0 {
glog.V(4).Infof("Disabled features: %s", strings.Join(openshiftMasterConfig.DisabledFeatures, ", "))
}
if openshiftMasterConfig.EtcdConfig != nil {
etcd.RunEtcd(openshiftMasterConfig.EtcdConfig)
}
// Allow privileged containers
// TODO: make this configurable and not the default https://github.com/openshift/origin/issues/662
capabilities.Initialize(capabilities.Capabilities{
AllowPrivileged: true,
HostNetworkSources: []string{kubelet.ApiserverSource, kubelet.FileSource},
})
openshiftConfig, err := origin.BuildMasterConfig(*openshiftMasterConfig)
if err != nil {
return err
}
// verify we can connect to etcd with the provided config
if err := etcd.TestEtcdClient(openshiftConfig.EtcdClient); err != nil {
return err
}
// Must start policy caching immediately
openshiftConfig.RunGroupCache()
openshiftConfig.RunPolicyCache()
openshiftConfig.RunProjectCache()
unprotectedInstallers := []origin.APIInstaller{}
if openshiftMasterConfig.OAuthConfig != nil {
authConfig, err := origin.BuildAuthConfig(*openshiftMasterConfig)
if err != nil {
return err
}
unprotectedInstallers = append(unprotectedInstallers, authConfig)
}
var standaloneAssetConfig *origin.AssetConfig
if openshiftConfig.WebConsoleEnabled() {
config, err := origin.BuildAssetConfig(*openshiftMasterConfig.AssetConfig)
if err != nil {
return err
}
if openshiftMasterConfig.AssetConfig.ServingInfo.BindAddress == openshiftMasterConfig.ServingInfo.BindAddress {
unprotectedInstallers = append(unprotectedInstallers, config)
} else {
standaloneAssetConfig = config
}
}
startKubeMaster, kubeMasterConfig, err := buildKubernetesMasterConfig(openshiftConfig)
if err != nil {
return err
}
if startKubeMaster {
openshiftConfig.Run([]origin.APIInstaller{kubeMasterConfig}, unprotectedInstallers)
} else {
_, kubeMasterConfig, err := configapi.GetKubeClient(openshiftConfig.Options.MasterClients.ExternalKubernetesKubeConfig)
if err != nil {
return err
}
proxy := &kubernetes.ProxyConfig{
ClientConfig: kubeMasterConfig,
}
openshiftConfig.Run([]origin.APIInstaller{proxy}, unprotectedInstallers)
}
glog.Infof("Using images from %q", openshiftConfig.ImageFor("<component>"))
if standaloneAssetConfig != nil {
standaloneAssetConfig.Run()
}
if openshiftMasterConfig.DNSConfig != nil {
openshiftConfig.RunDNSServer()
}
openshiftConfig.RunProjectAuthorizationCache()
// controllers don't block startup
go func() {
if err := StartControllers(openshiftConfig, kubeMasterConfig); err != nil {
glog.Fatal(err)
}
}()
return nil
}