Add glide.yaml and vendor deps

vendor/k8s.io/kubernetes/cmd/OWNERS

@@ -0,0 +1,5 @@
+assignees:
+  - dchen1107
+  - lavalamp
+  - mikedanese
+  - thockin

vendor/k8s.io/kubernetes/cmd/clicheck/BUILD

@@ -0,0 +1,22 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "clicheck",
+    srcs = ["check_cli_conventions.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/kubectl/cmd:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/kubectl/cmd/util/sanity:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/clicheck/check_cli_conventions.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"k8s.io/kubernetes/pkg/kubectl/cmd"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	cmdsanity "k8s.io/kubernetes/pkg/kubectl/cmd/util/sanity"
+)
+
+var (
+	skip = []string{}
+)
+
+func main() {
+	errors := []error{}
+
+	kubectl := cmd.NewKubectlCommand(cmdutil.NewFactory(nil), os.Stdin, ioutil.Discard, ioutil.Discard)
+	result := cmdsanity.CheckCmdTree(kubectl, cmdsanity.AllCmdChecks, []string{})
+	errors = append(errors, result...)
+
+	if len(errors) > 0 {
+		for i, err := range errors {
+			fmt.Fprintf(os.Stderr, "%d. %s\n\n", i+1, err)
+		}
+		os.Exit(1)
+	}
+
+	fmt.Fprintln(os.Stdout, "Congrats, CLI looks good!")
+}

vendor/k8s.io/kubernetes/cmd/gendocs/BUILD

@@ -0,0 +1,23 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "gendocs",
+    srcs = ["gen_kubectl_docs.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/genutils:go_default_library",
+        "//pkg/kubectl/cmd:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//vendor:github.com/spf13/cobra/doc",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/gendocs/gen_kubectl_docs.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"github.com/spf13/cobra/doc"
+	"k8s.io/kubernetes/cmd/genutils"
+	"k8s.io/kubernetes/pkg/kubectl/cmd"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+)
+
+func main() {
+	// use os.Args instead of "flags" because "flags" will mess up the man pages!
+	path := "docs/"
+	if len(os.Args) == 2 {
+		path = os.Args[1]
+	} else if len(os.Args) > 2 {
+		fmt.Fprintf(os.Stderr, "usage: %s [output directory]\n", os.Args[0])
+		os.Exit(1)
+	}
+
+	outDir, err := genutils.OutDir(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to get output directory: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Set environment variables used by kubectl so the output is consistent,
+	// regardless of where we run.
+	os.Setenv("HOME", "/home/username")
+	// TODO os.Stdin should really be something like ioutil.Discard, but a Reader
+	kubectl := cmd.NewKubectlCommand(cmdutil.NewFactory(nil), os.Stdin, ioutil.Discard, ioutil.Discard)
+	doc.GenMarkdownTree(kubectl, outDir)
+}

vendor/k8s.io/kubernetes/cmd/genkubedocs/BUILD

@@ -0,0 +1,26 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "genkubedocs",
+    srcs = ["gen_kube_docs.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/genutils:go_default_library",
+        "//cmd/kube-apiserver/app:go_default_library",
+        "//cmd/kube-controller-manager/app:go_default_library",
+        "//cmd/kube-proxy/app:go_default_library",
+        "//cmd/kubelet/app:go_default_library",
+        "//plugin/cmd/kube-scheduler/app:go_default_library",
+        "//vendor:github.com/spf13/cobra/doc",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/genkubedocs/gen_kube_docs.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra/doc"
+	"k8s.io/kubernetes/cmd/genutils"
+	apiservapp "k8s.io/kubernetes/cmd/kube-apiserver/app"
+	cmapp "k8s.io/kubernetes/cmd/kube-controller-manager/app"
+	proxyapp "k8s.io/kubernetes/cmd/kube-proxy/app"
+	kubeletapp "k8s.io/kubernetes/cmd/kubelet/app"
+	schapp "k8s.io/kubernetes/plugin/cmd/kube-scheduler/app"
+)
+
+func main() {
+	// use os.Args instead of "flags" because "flags" will mess up the man pages!
+	path := ""
+	module := ""
+	if len(os.Args) == 3 {
+		path = os.Args[1]
+		module = os.Args[2]
+	} else {
+		fmt.Fprintf(os.Stderr, "usage: %s [output directory] [module] \n", os.Args[0])
+		os.Exit(1)
+	}
+
+	outDir, err := genutils.OutDir(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to get output directory: %v\n", err)
+		os.Exit(1)
+	}
+
+	switch module {
+	case "kube-apiserver":
+		// generate docs for kube-apiserver
+		apiserver := apiservapp.NewAPIServerCommand()
+		doc.GenMarkdownTree(apiserver, outDir)
+	case "kube-controller-manager":
+		// generate docs for kube-controller-manager
+		controllermanager := cmapp.NewControllerManagerCommand()
+		doc.GenMarkdownTree(controllermanager, outDir)
+	case "kube-proxy":
+		// generate docs for kube-proxy
+		proxy := proxyapp.NewProxyCommand()
+		doc.GenMarkdownTree(proxy, outDir)
+	case "kube-scheduler":
+		// generate docs for kube-scheduler
+		scheduler := schapp.NewSchedulerCommand()
+		doc.GenMarkdownTree(scheduler, outDir)
+	case "kubelet":
+		// generate docs for kubelet
+		kubelet := kubeletapp.NewKubeletCommand()
+		doc.GenMarkdownTree(kubelet, outDir)
+	default:
+		fmt.Fprintf(os.Stderr, "Module %s is not supported", module)
+		os.Exit(1)
+	}
+}

vendor/k8s.io/kubernetes/cmd/genman/BUILD

@@ -0,0 +1,30 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "genman",
+    srcs = ["gen_kube_man.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/genutils:go_default_library",
+        "//cmd/kube-apiserver/app:go_default_library",
+        "//cmd/kube-controller-manager/app:go_default_library",
+        "//cmd/kube-proxy/app:go_default_library",
+        "//cmd/kubelet/app:go_default_library",
+        "//pkg/kubectl/cmd:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//plugin/cmd/kube-scheduler/app:go_default_library",
+        "//vendor:github.com/cpuguy83/go-md2man/md2man",
+        "//vendor:github.com/spf13/cobra",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/genman/gen_kube_man.go

@@ -0,0 +1,215 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	mangen "github.com/cpuguy83/go-md2man/md2man"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"k8s.io/kubernetes/cmd/genutils"
+	apiservapp "k8s.io/kubernetes/cmd/kube-apiserver/app"
+	cmapp "k8s.io/kubernetes/cmd/kube-controller-manager/app"
+	proxyapp "k8s.io/kubernetes/cmd/kube-proxy/app"
+	kubeletapp "k8s.io/kubernetes/cmd/kubelet/app"
+	kubectlcmd "k8s.io/kubernetes/pkg/kubectl/cmd"
+	kubectlcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	schapp "k8s.io/kubernetes/plugin/cmd/kube-scheduler/app"
+)
+
+func main() {
+	// use os.Args instead of "flags" because "flags" will mess up the man pages!
+	path := "docs/man/man1"
+	module := ""
+	if len(os.Args) == 3 {
+		path = os.Args[1]
+		module = os.Args[2]
+	} else {
+		fmt.Fprintf(os.Stderr, "usage: %s [output directory] [module] \n", os.Args[0])
+		os.Exit(1)
+	}
+
+	outDir, err := genutils.OutDir(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to get output directory: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Set environment variables used by command so the output is consistent,
+	// regardless of where we run.
+	os.Setenv("HOME", "/home/username")
+
+	switch module {
+	case "kube-apiserver":
+		// generate manpage for kube-apiserver
+		apiserver := apiservapp.NewAPIServerCommand()
+		genMarkdown(apiserver, "", outDir)
+		for _, c := range apiserver.Commands() {
+			genMarkdown(c, "kube-apiserver", outDir)
+		}
+	case "kube-controller-manager":
+		// generate manpage for kube-controller-manager
+		controllermanager := cmapp.NewControllerManagerCommand()
+		genMarkdown(controllermanager, "", outDir)
+		for _, c := range controllermanager.Commands() {
+			genMarkdown(c, "kube-controller-manager", outDir)
+		}
+	case "kube-proxy":
+		// generate manpage for kube-proxy
+		proxy := proxyapp.NewProxyCommand()
+		genMarkdown(proxy, "", outDir)
+		for _, c := range proxy.Commands() {
+			genMarkdown(c, "kube-proxy", outDir)
+		}
+	case "kube-scheduler":
+		// generate manpage for kube-scheduler
+		scheduler := schapp.NewSchedulerCommand()
+		genMarkdown(scheduler, "", outDir)
+		for _, c := range scheduler.Commands() {
+			genMarkdown(c, "kube-scheduler", outDir)
+		}
+	case "kubelet":
+		// generate manpage for kubelet
+		kubelet := kubeletapp.NewKubeletCommand()
+		genMarkdown(kubelet, "", outDir)
+		for _, c := range kubelet.Commands() {
+			genMarkdown(c, "kubelet", outDir)
+		}
+	case "kubectl":
+		// generate manpage for kubectl
+		// TODO os.Stdin should really be something like ioutil.Discard, but a Reader
+		kubectl := kubectlcmd.NewKubectlCommand(kubectlcmdutil.NewFactory(nil), os.Stdin, ioutil.Discard, ioutil.Discard)
+		genMarkdown(kubectl, "", outDir)
+		for _, c := range kubectl.Commands() {
+			genMarkdown(c, "kubectl", outDir)
+		}
+	default:
+		fmt.Fprintf(os.Stderr, "Module %s is not supported", module)
+		os.Exit(1)
+	}
+}
+
+func preamble(out *bytes.Buffer, name, short, long string) {
+	out.WriteString(`% KUBERNETES(1) kubernetes User Manuals
+% Eric Paris
+% Jan 2015
+# NAME
+`)
+	fmt.Fprintf(out, "%s \\- %s\n\n", name, short)
+	fmt.Fprintf(out, "# SYNOPSIS\n")
+	fmt.Fprintf(out, "**%s** [OPTIONS]\n\n", name)
+	fmt.Fprintf(out, "# DESCRIPTION\n")
+	fmt.Fprintf(out, "%s\n\n", long)
+}
+
+func printFlags(out *bytes.Buffer, flags *pflag.FlagSet) {
+	flags.VisitAll(func(flag *pflag.Flag) {
+		format := "**--%s**=%s\n\t%s\n\n"
+		if flag.Value.Type() == "string" {
+			// put quotes on the value
+			format = "**--%s**=%q\n\t%s\n\n"
+		}
+
+		// Todo, when we mark a shorthand is deprecated, but specify an empty message.
+		// The flag.ShorthandDeprecated is empty as the shorthand is deprecated.
+		// Using len(flag.ShorthandDeprecated) > 0 can't handle this, others are ok.
+		if !(len(flag.ShorthandDeprecated) > 0) && len(flag.Shorthand) > 0 {
+			format = "**-%s**, " + format
+			fmt.Fprintf(out, format, flag.Shorthand, flag.Name, flag.DefValue, flag.Usage)
+		} else {
+			fmt.Fprintf(out, format, flag.Name, flag.DefValue, flag.Usage)
+		}
+	})
+}
+
+func printOptions(out *bytes.Buffer, command *cobra.Command) {
+	flags := command.NonInheritedFlags()
+	if flags.HasFlags() {
+		fmt.Fprintf(out, "# OPTIONS\n")
+		printFlags(out, flags)
+		fmt.Fprintf(out, "\n")
+	}
+	flags = command.InheritedFlags()
+	if flags.HasFlags() {
+		fmt.Fprintf(out, "# OPTIONS INHERITED FROM PARENT COMMANDS\n")
+		printFlags(out, flags)
+		fmt.Fprintf(out, "\n")
+	}
+}
+
+func genMarkdown(command *cobra.Command, parent, docsDir string) {
+	dparent := strings.Replace(parent, " ", "-", -1)
+	name := command.Name()
+	dname := name
+	if len(parent) > 0 {
+		dname = dparent + "-" + name
+		name = parent + " " + name
+	}
+
+	out := new(bytes.Buffer)
+	short := command.Short
+	long := command.Long
+	if len(long) == 0 {
+		long = short
+	}
+
+	preamble(out, name, short, long)
+	printOptions(out, command)
+
+	if len(command.Example) > 0 {
+		fmt.Fprintf(out, "# EXAMPLE\n")
+		fmt.Fprintf(out, "```\n%s\n```\n", command.Example)
+	}
+
+	if len(command.Commands()) > 0 || len(parent) > 0 {
+		fmt.Fprintf(out, "# SEE ALSO\n")
+		if len(parent) > 0 {
+			fmt.Fprintf(out, "**%s(1)**, ", dparent)
+		}
+		for _, c := range command.Commands() {
+			fmt.Fprintf(out, "**%s-%s(1)**, ", dname, c.Name())
+			genMarkdown(c, name, docsDir)
+		}
+		fmt.Fprintf(out, "\n")
+	}
+
+	out.WriteString(`
+# HISTORY
+January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since!
+`)
+
+	final := mangen.Render(out.Bytes())
+
+	filename := docsDir + dname + ".1"
+	outFile, err := os.Create(filename)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+	defer outFile.Close()
+	_, err = outFile.Write(final)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+}

vendor/k8s.io/kubernetes/cmd/genswaggertypedocs/BUILD

@@ -0,0 +1,22 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "genswaggertypedocs",
+    srcs = ["swagger_type_docs.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/runtime:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/genswaggertypedocs/swagger_type_docs.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+
+	kruntime "k8s.io/kubernetes/pkg/runtime"
+
+	"github.com/golang/glog"
+	flag "github.com/spf13/pflag"
+)
+
+var (
+	functionDest = flag.StringP("func-dest", "f", "-", "Output for swagger functions; '-' means stdout (default)")
+	typeSrc      = flag.StringP("type-src", "s", "", "From where we are going to read the types")
+	verify       = flag.BoolP("verify", "v", false, "Verifies if the given type-src file has documentation for every type")
+)
+
+func main() {
+	flag.Parse()
+
+	if *typeSrc == "" {
+		glog.Fatalf("Please define -s flag as it is the source file")
+	}
+
+	var funcOut io.Writer
+	if *functionDest == "-" {
+		funcOut = os.Stdout
+	} else {
+		file, err := os.Create(*functionDest)
+		if err != nil {
+			glog.Fatalf("Couldn't open %v: %v", *functionDest, err)
+		}
+		defer file.Close()
+		funcOut = file
+	}
+
+	docsForTypes := kruntime.ParseDocumentationFrom(*typeSrc)
+
+	if *verify == true {
+		rc, err := kruntime.VerifySwaggerDocsExist(docsForTypes, funcOut)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Error in verification process: %s\n", err)
+		}
+		os.Exit(rc)
+	}
+
+	if docsForTypes != nil && len(docsForTypes) > 0 {
+		if err := kruntime.WriteSwaggerDocFunc(docsForTypes, funcOut); err != nil {
+			fmt.Fprintf(os.Stderr, "Error when writing swagger documentation functions: %s\n", err)
+			os.Exit(-1)
+		}
+	}
+}

vendor/k8s.io/kubernetes/cmd/genutils/BUILD

@@ -0,0 +1,25 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["genutils.go"],
+    tags = ["automanaged"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["genutils_test.go"],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = [],
+)

vendor/k8s.io/kubernetes/cmd/genutils/genutils.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package genutils
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+func OutDir(path string) (string, error) {
+	outDir, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+
+	stat, err := os.Stat(outDir)
+	if err != nil {
+		return "", err
+	}
+
+	if !stat.IsDir() {
+		return "", fmt.Errorf("output directory %s is not a directory\n", outDir)
+	}
+	outDir = outDir + "/"
+	return outDir, nil
+}

vendor/k8s.io/kubernetes/cmd/genutils/genutils_test.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package genutils
+
+import (
+	"testing"
+)
+
+func TestValidDir(t *testing.T) {
+	_, err := OutDir("./")
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestInvalidDir(t *testing.T) {
+	_, err := OutDir("./nondir")
+	if err == nil {
+		t.Fatal(err)
+	}
+}
+
+func TestNotDir(t *testing.T) {
+	_, err := OutDir("./genutils_test.go")
+	if err == nil {
+		t.Fatal(err)
+	}
+}

vendor/k8s.io/kubernetes/cmd/genyaml/BUILD

@@ -0,0 +1,25 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "genyaml",
+    srcs = ["gen_kubectl_yaml.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/genutils:go_default_library",
+        "//pkg/kubectl/cmd:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//vendor:github.com/spf13/cobra",
+        "//vendor:github.com/spf13/pflag",
+        "//vendor:gopkg.in/yaml.v2",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/genyaml/gen_kubectl_yaml.go

@@ -0,0 +1,169 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"gopkg.in/yaml.v2"
+	"k8s.io/kubernetes/cmd/genutils"
+	"k8s.io/kubernetes/pkg/kubectl/cmd"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+)
+
+type cmdOption struct {
+	Name         string
+	Shorthand    string `yaml:",omitempty"`
+	DefaultValue string `yaml:"default_value,omitempty"`
+	Usage        string `yaml:",omitempty"`
+}
+
+type cmdDoc struct {
+	Name             string
+	Synopsis         string      `yaml:",omitempty"`
+	Description      string      `yaml:",omitempty"`
+	Options          []cmdOption `yaml:",omitempty"`
+	InheritedOptions []cmdOption `yaml:"inherited_options,omitempty"`
+	Example          string      `yaml:",omitempty"`
+	SeeAlso          []string    `yaml:"see_also,omitempty"`
+}
+
+func main() {
+	path := "docs/yaml/kubectl"
+	if len(os.Args) == 2 {
+		path = os.Args[1]
+	} else if len(os.Args) > 2 {
+		fmt.Fprintf(os.Stderr, "usage: %s [output directory]\n", os.Args[0])
+		os.Exit(1)
+	}
+
+	outDir, err := genutils.OutDir(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to get output directory: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Set environment variables used by kubectl so the output is consistent,
+	// regardless of where we run.
+	os.Setenv("HOME", "/home/username")
+	// TODO os.Stdin should really be something like ioutil.Discard, but a Reader
+	kubectl := cmd.NewKubectlCommand(cmdutil.NewFactory(nil), os.Stdin, ioutil.Discard, ioutil.Discard)
+	genYaml(kubectl, "", outDir)
+	for _, c := range kubectl.Commands() {
+		genYaml(c, "kubectl", outDir)
+	}
+}
+
+// Temporary workaround for yaml lib generating incorrect yaml with long strings
+// that do not contain \n.
+func forceMultiLine(s string) string {
+	if len(s) > 60 && !strings.Contains(s, "\n") {
+		s = s + "\n"
+	}
+	return s
+}
+
+func genFlagResult(flags *pflag.FlagSet) []cmdOption {
+	result := []cmdOption{}
+
+	flags.VisitAll(func(flag *pflag.Flag) {
+		// Todo, when we mark a shorthand is deprecated, but specify an empty message.
+		// The flag.ShorthandDeprecated is empty as the shorthand is deprecated.
+		// Using len(flag.ShorthandDeprecated) > 0 can't handle this, others are ok.
+		if !(len(flag.ShorthandDeprecated) > 0) && len(flag.Shorthand) > 0 {
+			opt := cmdOption{
+				flag.Name,
+				flag.Shorthand,
+				flag.DefValue,
+				forceMultiLine(flag.Usage),
+			}
+			result = append(result, opt)
+		} else {
+			opt := cmdOption{
+				Name:         flag.Name,
+				DefaultValue: forceMultiLine(flag.DefValue),
+				Usage:        forceMultiLine(flag.Usage),
+			}
+			result = append(result, opt)
+		}
+	})
+
+	return result
+}
+
+func genYaml(command *cobra.Command, parent, docsDir string) {
+	doc := cmdDoc{}
+
+	doc.Name = command.Name()
+	doc.Synopsis = forceMultiLine(command.Short)
+	doc.Description = forceMultiLine(command.Long)
+
+	flags := command.NonInheritedFlags()
+	if flags.HasFlags() {
+		doc.Options = genFlagResult(flags)
+	}
+	flags = command.InheritedFlags()
+	if flags.HasFlags() {
+		doc.InheritedOptions = genFlagResult(flags)
+	}
+
+	if len(command.Example) > 0 {
+		doc.Example = command.Example
+	}
+
+	if len(command.Commands()) > 0 || len(parent) > 0 {
+		result := []string{}
+		if len(parent) > 0 {
+			result = append(result, parent)
+		}
+		for _, c := range command.Commands() {
+			result = append(result, c.Name())
+		}
+		doc.SeeAlso = result
+	}
+
+	final, err := yaml.Marshal(&doc)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	var filename string
+
+	if parent == "" {
+		filename = docsDir + doc.Name + ".yaml"
+	} else {
+		filename = docsDir + parent + "_" + doc.Name + ".yaml"
+	}
+
+	outFile, err := os.Create(filename)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+	defer outFile.Close()
+	_, err = outFile.Write(final)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/BUILD

@@ -0,0 +1,55 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "hyperkube",
+    srcs = [
+        "federation-apiserver.go",
+        "federation-controller-manager.go",
+        "hyperkube.go",
+        "kube-apiserver.go",
+        "kube-controller-manager.go",
+        "kube-proxy.go",
+        "kube-scheduler.go",
+        "kubectl.go",
+        "kubelet.go",
+        "main.go",
+        "server.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-apiserver/app:go_default_library",
+        "//cmd/kube-apiserver/app/options:go_default_library",
+        "//cmd/kube-controller-manager/app:go_default_library",
+        "//cmd/kube-controller-manager/app/options:go_default_library",
+        "//cmd/kube-proxy/app:go_default_library",
+        "//cmd/kube-proxy/app/options:go_default_library",
+        "//cmd/kubelet/app:go_default_library",
+        "//cmd/kubelet/app/options:go_default_library",
+        "//federation/cmd/federation-apiserver/app:go_default_library",
+        "//federation/cmd/federation-apiserver/app/options:go_default_library",
+        "//federation/cmd/federation-controller-manager/app:go_default_library",
+        "//federation/cmd/federation-controller-manager/app/options:go_default_library",
+        "//pkg/client/metrics/prometheus:go_default_library",
+        "//pkg/healthz:go_default_library",
+        "//pkg/kubectl/cmd:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/util:go_default_library",
+        "//pkg/util/flag:go_default_library",
+        "//pkg/util/logs:go_default_library",
+        "//pkg/version/prometheus:go_default_library",
+        "//pkg/version/verflag:go_default_library",
+        "//plugin/cmd/kube-scheduler/app:go_default_library",
+        "//plugin/cmd/kube-scheduler/app/options:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/hyperkube/federation-apiserver.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"k8s.io/kubernetes/federation/cmd/federation-apiserver/app"
+	"k8s.io/kubernetes/federation/cmd/federation-apiserver/app/options"
+)
+
+// NewFederationAPIServer creates a new hyperkube Server object that includes the
+// description and flags.
+func NewFederationAPIServer() *Server {
+	s := options.NewServerRunOptions()
+
+	hks := Server{
+		SimpleUsage: "federation-apiserver",
+		Long:        "The API entrypoint for the federation control plane",
+		Run: func(_ *Server, args []string) error {
+			return app.Run(s)
+		},
+	}
+	s.AddFlags(hks.Flags())
+	return &hks
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/federation-controller-manager.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"k8s.io/kubernetes/federation/cmd/federation-controller-manager/app"
+	"k8s.io/kubernetes/federation/cmd/federation-controller-manager/app/options"
+)
+
+// NewFederationCMServer creates a new hyperkube Server object that includes the
+// description and flags.
+func NewFederationCMServer() *Server {
+	s := options.NewCMServer()
+
+	hks := Server{
+		SimpleUsage: "federation-controller-manager",
+		Long:        "Controller manager for federation control plane. Manages federation service endpoints and controllers",
+		Run: func(_ *Server, args []string) error {
+			return app.Run(s)
+		},
+	}
+	s.AddFlags(hks.Flags())
+	return &hks
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/hyperkube.go

@@ -0,0 +1,236 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path"
+
+	"k8s.io/kubernetes/pkg/util"
+	utilflag "k8s.io/kubernetes/pkg/util/flag"
+	"k8s.io/kubernetes/pkg/util/logs"
+	"k8s.io/kubernetes/pkg/version/verflag"
+
+	"github.com/spf13/pflag"
+)
+
+// HyperKube represents a single binary that can morph/manage into multiple
+// servers.
+type HyperKube struct {
+	Name string // The executable name, used for help and soft-link invocation
+	Long string // A long description of the binary.  It will be world wrapped before output.
+
+	servers             []Server
+	baseFlags           *pflag.FlagSet
+	out                 io.Writer
+	helpFlagVal         bool
+	makeSymlinksFlagVal bool
+}
+
+// AddServer adds a server to the HyperKube object.
+func (hk *HyperKube) AddServer(s *Server) {
+	hk.servers = append(hk.servers, *s)
+	hk.servers[len(hk.servers)-1].hk = hk
+}
+
+// FindServer will find a specific server named name.
+func (hk *HyperKube) FindServer(name string) (*Server, error) {
+	for _, s := range hk.servers {
+		if s.Name() == name {
+			return &s, nil
+		}
+	}
+	return nil, fmt.Errorf("Server not found: %s", name)
+}
+
+// Servers returns a list of all of the registered servers
+func (hk *HyperKube) Servers() []Server {
+	return hk.servers
+}
+
+// Flags returns a flagset for "global" flags.
+func (hk *HyperKube) Flags() *pflag.FlagSet {
+	if hk.baseFlags == nil {
+		hk.baseFlags = pflag.NewFlagSet(hk.Name, pflag.ContinueOnError)
+		hk.baseFlags.SetOutput(ioutil.Discard)
+		hk.baseFlags.SetNormalizeFunc(utilflag.WordSepNormalizeFunc)
+		hk.baseFlags.BoolVarP(&hk.helpFlagVal, "help", "h", false, "help for "+hk.Name)
+		hk.baseFlags.BoolVar(&hk.makeSymlinksFlagVal, "make-symlinks", false, "create a symlink for each server in current directory")
+		hk.baseFlags.MarkHidden("make-symlinks") // hide this flag from appearing in servers' usage output
+
+		// These will add all of the "global" flags (defined with both the
+		// flag and pflag packages) to the new flag set we have.
+		hk.baseFlags.AddGoFlagSet(flag.CommandLine)
+		hk.baseFlags.AddFlagSet(pflag.CommandLine)
+
+	}
+	return hk.baseFlags
+}
+
+// Out returns the io.Writer that is used for all usage/error information
+func (hk *HyperKube) Out() io.Writer {
+	if hk.out == nil {
+		hk.out = os.Stderr
+	}
+	return hk.out
+}
+
+// SetOut sets the output writer for all usage/error information
+func (hk *HyperKube) SetOut(w io.Writer) {
+	hk.out = w
+}
+
+// Print is a convenience method to Print to the defined output
+func (hk *HyperKube) Print(i ...interface{}) {
+	fmt.Fprint(hk.Out(), i...)
+}
+
+// Println is a convenience method to Println to the defined output
+func (hk *HyperKube) Println(i ...interface{}) {
+	fmt.Fprintln(hk.Out(), i...)
+}
+
+// Printf is a convenience method to Printf to the defined output
+func (hk *HyperKube) Printf(format string, i ...interface{}) {
+	fmt.Fprintf(hk.Out(), format, i...)
+}
+
+// Run the server.  This will pick the appropriate server and run it.
+func (hk *HyperKube) Run(args []string) error {
+	// If we are called directly, parse all flags up to the first real
+	// argument.  That should be the server to run.
+	command := args[0]
+	baseCommand := path.Base(command)
+	serverName := baseCommand
+	args = args[1:]
+	if serverName == hk.Name {
+
+		baseFlags := hk.Flags()
+		baseFlags.SetInterspersed(false) // Only parse flags up to the next real command
+		err := baseFlags.Parse(args)
+		if err != nil || hk.helpFlagVal {
+			if err != nil {
+				hk.Println("Error:", err)
+			}
+			hk.Usage()
+			return err
+		}
+
+		if hk.makeSymlinksFlagVal {
+			return hk.MakeSymlinks(command)
+		}
+
+		verflag.PrintAndExitIfRequested()
+
+		args = baseFlags.Args()
+		if len(args) > 0 && len(args[0]) > 0 {
+			serverName = args[0]
+			baseCommand = baseCommand + " " + serverName
+			args = args[1:]
+		} else {
+			err = errors.New("no server specified")
+			hk.Printf("Error: %v\n\n", err)
+			hk.Usage()
+			return err
+		}
+	}
+
+	s, err := hk.FindServer(serverName)
+	if err != nil {
+		hk.Printf("Error: %v\n\n", err)
+		hk.Usage()
+		return err
+	}
+
+	s.Flags().AddFlagSet(hk.Flags())
+	err = s.Flags().Parse(args)
+	if err != nil || hk.helpFlagVal {
+		if err != nil {
+			hk.Printf("Error: %v\n\n", err)
+		}
+		s.Usage()
+		return err
+	}
+
+	verflag.PrintAndExitIfRequested()
+
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	err = s.Run(s, s.Flags().Args())
+	if err != nil {
+		hk.Println("Error:", err)
+	}
+
+	return err
+}
+
+// RunToExit will run the hyperkube and then call os.Exit with an appropriate exit code.
+func (hk *HyperKube) RunToExit(args []string) {
+	err := hk.Run(args)
+	if err != nil {
+		fmt.Fprint(os.Stderr, err.Error())
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
+// Usage will write out a summary for all servers that this binary supports.
+func (hk *HyperKube) Usage() {
+	tt := `{{if .Long}}{{.Long | trim | wrap ""}}
+{{end}}Usage
+
+  {{.Name}} <server> [flags]
+
+Servers
+{{range .Servers}}
+  {{.Name}}
+{{.Long | trim | wrap "    "}}{{end}}
+Call '{{.Name}} --make-symlinks' to create symlinks for each server in the local directory.
+Call '{{.Name}} <server> --help' for help on a specific server.
+`
+	util.ExecuteTemplate(hk.Out(), tt, hk)
+}
+
+// MakeSymlinks will create a symlink for each registered hyperkube server in the local directory.
+func (hk *HyperKube) MakeSymlinks(command string) error {
+	wd, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+
+	var errs bool
+	for _, s := range hk.servers {
+		link := path.Join(wd, s.Name())
+
+		err := os.Symlink(command, link)
+		if err != nil {
+			errs = true
+			hk.Println(err)
+		}
+	}
+
+	if errs {
+		return errors.New("Error creating one or more symlinks.")
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/hyperkube_test.go

@@ -0,0 +1,223 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+)
+
+type result struct {
+	err    error
+	output string
+}
+
+func testServer(n string) *Server {
+	return &Server{
+		SimpleUsage: n,
+		Long:        fmt.Sprintf("A simple server named %s", n),
+		Run: func(s *Server, args []string) error {
+			s.hk.Printf("%s Run\n", s.Name())
+			return nil
+		},
+	}
+}
+func testServerError(n string) *Server {
+	return &Server{
+		SimpleUsage: n,
+		Long:        fmt.Sprintf("A simple server named %s that returns an error", n),
+		Run: func(s *Server, args []string) error {
+			s.hk.Printf("%s Run\n", s.Name())
+			return errors.New("server returning error")
+		},
+	}
+}
+
+const defaultCobraMessage = "default message from cobra command"
+const defaultCobraSubMessage = "default sub-message from cobra command"
+const cobraMessageDesc = "message to print"
+const cobraSubMessageDesc = "sub-message to print"
+
+func testCobraCommand(n string) *Server {
+
+	var cobraServer *Server
+	var msg string
+	cmd := &cobra.Command{
+		Use:   n,
+		Long:  n,
+		Short: n,
+		Run: func(cmd *cobra.Command, args []string) {
+			cobraServer.hk.Printf("msg: %s\n", msg)
+		},
+	}
+	cmd.PersistentFlags().StringVar(&msg, "msg", defaultCobraMessage, cobraMessageDesc)
+
+	var subMsg string
+	subCmdName := "subcommand"
+	subCmd := &cobra.Command{
+		Use:   subCmdName,
+		Long:  subCmdName,
+		Short: subCmdName,
+		Run: func(cmd *cobra.Command, args []string) {
+			cobraServer.hk.Printf("submsg: %s", subMsg)
+		},
+	}
+	subCmd.PersistentFlags().StringVar(&subMsg, "submsg", defaultCobraSubMessage, cobraSubMessageDesc)
+
+	cmd.AddCommand(subCmd)
+
+	localFlags := cmd.LocalFlags()
+	localFlags.SetInterspersed(false)
+	s := &Server{
+		SimpleUsage: n,
+		Long:        fmt.Sprintf("A server named %s which uses a cobra command", n),
+		Run: func(s *Server, args []string) error {
+			cobraServer = s
+			cmd.SetOutput(s.hk.Out())
+			cmd.SetArgs(args)
+			return cmd.Execute()
+		},
+		flags: localFlags,
+	}
+
+	return s
+}
+func runFull(t *testing.T, args string) *result {
+	buf := new(bytes.Buffer)
+	hk := HyperKube{
+		Name: "hyperkube",
+		Long: "hyperkube is an all-in-one server binary.",
+	}
+	hk.SetOut(buf)
+
+	hk.AddServer(testServer("test1"))
+	hk.AddServer(testServer("test2"))
+	hk.AddServer(testServer("test3"))
+	hk.AddServer(testServerError("test-error"))
+	hk.AddServer(testCobraCommand("test-cobra-command"))
+
+	a := strings.Split(args, " ")
+	t.Logf("Running full with args: %q", a)
+	err := hk.Run(a)
+
+	r := &result{err, buf.String()}
+	t.Logf("Result err: %v, output: %q", r.err, r.output)
+
+	return r
+}
+
+func TestRun(t *testing.T) {
+	x := runFull(t, "hyperkube test1")
+	assert.Contains(t, x.output, "test1 Run")
+	assert.NoError(t, x.err)
+}
+
+func TestLinkRun(t *testing.T) {
+	x := runFull(t, "test1")
+	assert.Contains(t, x.output, "test1 Run")
+	assert.NoError(t, x.err)
+}
+
+func TestTopNoArgs(t *testing.T) {
+	x := runFull(t, "hyperkube")
+	assert.EqualError(t, x.err, "no server specified")
+}
+
+func TestBadServer(t *testing.T) {
+	x := runFull(t, "hyperkube bad-server")
+	assert.EqualError(t, x.err, "Server not found: bad-server")
+	assert.Contains(t, x.output, "Usage")
+}
+
+func TestTopHelp(t *testing.T) {
+	x := runFull(t, "hyperkube --help")
+	assert.NoError(t, x.err)
+	assert.Contains(t, x.output, "all-in-one")
+	assert.Contains(t, x.output, "A simple server named test1")
+}
+
+func TestTopFlags(t *testing.T) {
+	x := runFull(t, "hyperkube --help test1")
+	assert.NoError(t, x.err)
+	assert.Contains(t, x.output, "all-in-one")
+	assert.Contains(t, x.output, "A simple server named test1")
+	assert.NotContains(t, x.output, "test1 Run")
+}
+
+func TestTopFlagsBad(t *testing.T) {
+	x := runFull(t, "hyperkube --bad-flag")
+	assert.EqualError(t, x.err, "unknown flag: --bad-flag")
+	assert.Contains(t, x.output, "all-in-one")
+	assert.Contains(t, x.output, "A simple server named test1")
+}
+
+func TestServerHelp(t *testing.T) {
+	x := runFull(t, "hyperkube test1 --help")
+	assert.NoError(t, x.err)
+	assert.Contains(t, x.output, "A simple server named test1")
+	assert.Contains(t, x.output, "-h, --help                                         help for hyperkube")
+	assert.NotContains(t, x.output, "test1 Run")
+}
+
+func TestServerFlagsBad(t *testing.T) {
+	x := runFull(t, "hyperkube test1 --bad-flag")
+	assert.EqualError(t, x.err, "unknown flag: --bad-flag")
+	assert.Contains(t, x.output, "A simple server named test1")
+	assert.Contains(t, x.output, "-h, --help                                         help for hyperkube")
+	assert.NotContains(t, x.output, "test1 Run")
+}
+
+func TestServerError(t *testing.T) {
+	x := runFull(t, "hyperkube test-error")
+	assert.Contains(t, x.output, "test-error Run")
+	assert.EqualError(t, x.err, "server returning error")
+}
+
+func TestCobraCommandHelp(t *testing.T) {
+	x := runFull(t, "hyperkube test-cobra-command --help")
+	assert.NoError(t, x.err)
+	assert.Contains(t, x.output, "A server named test-cobra-command which uses a cobra command")
+	assert.Contains(t, x.output, cobraMessageDesc)
+}
+func TestCobraCommandDefaultMessage(t *testing.T) {
+	x := runFull(t, "hyperkube test-cobra-command")
+	assert.Contains(t, x.output, fmt.Sprintf("msg: %s", defaultCobraMessage))
+}
+func TestCobraCommandMessage(t *testing.T) {
+	x := runFull(t, "hyperkube test-cobra-command --msg foobar")
+	assert.Contains(t, x.output, "msg: foobar")
+}
+
+func TestCobraSubCommandHelp(t *testing.T) {
+	x := runFull(t, "hyperkube test-cobra-command subcommand --help")
+	assert.NoError(t, x.err)
+	assert.Contains(t, x.output, cobraSubMessageDesc)
+}
+func TestCobraSubCommandDefaultMessage(t *testing.T) {
+	x := runFull(t, "hyperkube test-cobra-command subcommand")
+	assert.Contains(t, x.output, fmt.Sprintf("submsg: %s", defaultCobraSubMessage))
+}
+func TestCobraSubCommandMessage(t *testing.T) {
+	x := runFull(t, "hyperkube test-cobra-command subcommand --submsg foobar")
+	assert.Contains(t, x.output, "submsg: foobar")
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/kube-apiserver.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"k8s.io/kubernetes/cmd/kube-apiserver/app"
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+)
+
+// NewKubeAPIServer creates a new hyperkube Server object that includes the
+// description and flags.
+func NewKubeAPIServer() *Server {
+	s := options.NewServerRunOptions()
+
+	hks := Server{
+		SimpleUsage: "apiserver",
+		Long:        "The main API entrypoint and interface to the storage system.  The API server is also the focal point for all authorization decisions.",
+		Run: func(_ *Server, args []string) error {
+			return app.Run(s)
+		},
+	}
+	s.AddFlags(hks.Flags())
+	return &hks
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/kube-controller-manager.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"k8s.io/kubernetes/cmd/kube-controller-manager/app"
+	"k8s.io/kubernetes/cmd/kube-controller-manager/app/options"
+)
+
+// NewKubeControllerManager creates a new hyperkube Server object that includes the
+// description and flags.
+func NewKubeControllerManager() *Server {
+	s := options.NewCMServer()
+
+	hks := Server{
+		SimpleUsage: "controller-manager",
+		Long:        "A server that runs a set of active components. This includes replication controllers, service endpoints and nodes.",
+		Run: func(_ *Server, args []string) error {
+			return app.Run(s)
+		},
+	}
+	s.AddFlags(hks.Flags())
+	return &hks
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/kube-proxy.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"k8s.io/kubernetes/cmd/kube-proxy/app"
+	"k8s.io/kubernetes/cmd/kube-proxy/app/options"
+	"k8s.io/kubernetes/pkg/healthz"
+)
+
+func init() {
+	healthz.DefaultHealthz()
+}
+
+// NewKubeProxy creates a new hyperkube Server object that includes the
+// description and flags.
+func NewKubeProxy() *Server {
+	config := options.NewProxyConfig()
+
+	hks := Server{
+		SimpleUsage: "proxy",
+		Long: `The Kubernetes proxy server is responsible for taking traffic directed at
+		services and forwarding it to the appropriate pods. It generally runs on
+		nodes next to the Kubelet and proxies traffic from local pods to remote pods.
+		It is also used when handling incoming external traffic.`,
+	}
+
+	config.AddFlags(hks.Flags())
+
+	hks.Run = func(_ *Server, _ []string) error {
+		s, err := app.NewProxyServerDefault(config)
+		if err != nil {
+			return err
+		}
+
+		return s.Run()
+	}
+
+	return &hks
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/kube-scheduler.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"k8s.io/kubernetes/plugin/cmd/kube-scheduler/app"
+	"k8s.io/kubernetes/plugin/cmd/kube-scheduler/app/options"
+)
+
+// NewScheduler creates a new hyperkube Server object that includes the
+// description and flags.
+func NewScheduler() *Server {
+	s := options.NewSchedulerServer()
+
+	hks := Server{
+		SimpleUsage: "scheduler",
+		Long:        "Implements a Kubernetes scheduler.  This will assign pods to kubelets based on capacity and constraints.",
+		Run: func(_ *Server, _ []string) error {
+			return app.Run(s)
+		},
+	}
+	s.AddFlags(hks.Flags())
+	return &hks
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/kubectl.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"os"
+
+	"k8s.io/kubernetes/pkg/kubectl/cmd"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+)
+
+func NewKubectlServer() *Server {
+	cmd := cmd.NewKubectlCommand(cmdutil.NewFactory(nil), os.Stdin, os.Stdout, os.Stderr)
+	localFlags := cmd.LocalFlags()
+	localFlags.SetInterspersed(false)
+
+	return &Server{
+		name:        "kubectl",
+		SimpleUsage: "Kubernetes command line client",
+		Long:        "Kubernetes command line client",
+		Run: func(s *Server, args []string) error {
+			cmd.SetArgs(args)
+			return cmd.Execute()
+		},
+		flags: localFlags,
+	}
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/kubelet.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"k8s.io/kubernetes/cmd/kubelet/app"
+	"k8s.io/kubernetes/cmd/kubelet/app/options"
+)
+
+// NewKubelet creates a new hyperkube Server object that includes the
+// description and flags.
+func NewKubelet() *Server {
+	s := options.NewKubeletServer()
+	hks := Server{
+		SimpleUsage: "kubelet",
+		Long: `The kubelet binary is responsible for maintaining a set of containers on a
+		particular node. It syncs data from a variety of sources including a
+		Kubernetes API server, an etcd cluster, HTTP endpoint or local file. It then
+		queries Docker to see what is currently running.  It synchronizes the
+		configuration data, with the running set of containers by starting or stopping
+		Docker containers.`,
+		Run: func(_ *Server, _ []string) error {
+			return app.Run(s, nil)
+		},
+	}
+	s.AddFlags(hks.Flags())
+	return &hks
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/main.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// A binary that can morph into all of the other kubernetes binaries. You can
+// also soft-link to it busybox style.
+//
+package main
+
+import (
+	"os"
+
+	_ "k8s.io/kubernetes/pkg/client/metrics/prometheus" // for client metric registration
+	_ "k8s.io/kubernetes/pkg/version/prometheus"        // for version metric registration
+)
+
+func main() {
+	hk := HyperKube{
+		Name: "hyperkube",
+		Long: "This is an all-in-one binary that can run any of the various Kubernetes servers.",
+	}
+
+	hk.AddServer(NewKubectlServer())
+	hk.AddServer(NewKubeAPIServer())
+	hk.AddServer(NewKubeControllerManager())
+	hk.AddServer(NewScheduler())
+	hk.AddServer(NewKubelet())
+	hk.AddServer(NewKubeProxy())
+
+	//Federation servers
+	hk.AddServer(NewFederationAPIServer())
+	hk.AddServer(NewFederationCMServer())
+
+	hk.RunToExit(os.Args)
+}

vendor/k8s.io/kubernetes/cmd/hyperkube/server.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"io/ioutil"
+	"strings"
+
+	"k8s.io/kubernetes/pkg/util"
+	"k8s.io/kubernetes/pkg/util/flag"
+
+	"github.com/spf13/pflag"
+)
+
+type serverRunFunc func(s *Server, args []string) error
+
+// Server describes a server that this binary can morph into.
+type Server struct {
+	SimpleUsage string        // One line description of the server.
+	Long        string        // Longer free form description of the server
+	Run         serverRunFunc // Run the server.  This is not expected to return.
+
+	flags *pflag.FlagSet // Flags for the command (and all dependents)
+	name  string
+	hk    *HyperKube
+}
+
+// Usage returns the full usage string including all of the flags.
+func (s *Server) Usage() error {
+	tt := `{{if .Long}}{{.Long | trim | wrap ""}}
+{{end}}Usage:
+  {{.SimpleUsage}} [flags]
+
+Available Flags:
+{{.Flags.FlagUsages}}`
+
+	return util.ExecuteTemplate(s.hk.Out(), tt, s)
+}
+
+// Name returns the name of the command as derived from the usage line.
+func (s *Server) Name() string {
+	if s.name != "" {
+		return s.name
+	}
+	name := s.SimpleUsage
+	i := strings.Index(name, " ")
+	if i >= 0 {
+		name = name[:i]
+	}
+	return name
+}
+
+// Flags returns a flagset for this server
+func (s *Server) Flags() *pflag.FlagSet {
+	if s.flags == nil {
+		s.flags = pflag.NewFlagSet(s.Name(), pflag.ContinueOnError)
+		s.flags.SetOutput(ioutil.Discard)
+		s.flags.SetNormalizeFunc(flag.WordSepNormalizeFunc)
+	}
+	return s.flags
+}

vendor/k8s.io/kubernetes/cmd/kube-apiserver/BUILD

@@ -0,0 +1,27 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "kube-apiserver",
+    srcs = ["apiserver.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-apiserver/app:go_default_library",
+        "//cmd/kube-apiserver/app/options:go_default_library",
+        "//pkg/client/metrics/prometheus:go_default_library",
+        "//pkg/util/flag:go_default_library",
+        "//pkg/util/logs:go_default_library",
+        "//pkg/version/prometheus:go_default_library",
+        "//pkg/version/verflag:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-apiserver/OWNERS

@@ -0,0 +1,5 @@
+assignees:
+  - lavalamp
+  - smarterclayton
+  - nikhiljindal
+  - krousey

vendor/k8s.io/kubernetes/cmd/kube-apiserver/apiserver.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// apiserver is the main api server and master for the cluster.
+// it is responsible for serving the cluster management API.
+package main
+
+import (
+	"fmt"
+	"math/rand"
+	"os"
+	"time"
+
+	"k8s.io/kubernetes/cmd/kube-apiserver/app"
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+	_ "k8s.io/kubernetes/pkg/client/metrics/prometheus" // for client metric registration
+	"k8s.io/kubernetes/pkg/util/flag"
+	"k8s.io/kubernetes/pkg/util/logs"
+	_ "k8s.io/kubernetes/pkg/version/prometheus" // for version metric registration
+	"k8s.io/kubernetes/pkg/version/verflag"
+
+	"github.com/spf13/pflag"
+)
+
+func main() {
+	rand.Seed(time.Now().UTC().UnixNano())
+
+	s := options.NewServerRunOptions()
+	s.AddFlags(pflag.CommandLine)
+
+	flag.InitFlags()
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	verflag.PrintAndExitIfRequested()
+
+	if err := app.Run(s); err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		os.Exit(1)
+	}
+}

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/BUILD

@@ -0,0 +1,78 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "plugins.go",
+        "server.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-apiserver/app/options:go_default_library",
+        "//pkg/admission:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/apis/autoscaling:go_default_library",
+        "//pkg/apis/batch:go_default_library",
+        "//pkg/apis/extensions:go_default_library",
+        "//pkg/apiserver:go_default_library",
+        "//pkg/apiserver/authenticator:go_default_library",
+        "//pkg/capabilities:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/cloudprovider/providers:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/controller/serviceaccount:go_default_library",
+        "//pkg/generated/openapi:go_default_library",
+        "//pkg/genericapiserver:go_default_library",
+        "//pkg/genericapiserver/authorizer:go_default_library",
+        "//pkg/genericapiserver/options:go_default_library",
+        "//pkg/master:go_default_library",
+        "//pkg/registry/cachesize:go_default_library",
+        "//pkg/runtime/schema:go_default_library",
+        "//pkg/util/errors:go_default_library",
+        "//pkg/util/net:go_default_library",
+        "//pkg/util/wait:go_default_library",
+        "//pkg/version:go_default_library",
+        "//plugin/pkg/admission/admit:go_default_library",
+        "//plugin/pkg/admission/alwayspullimages:go_default_library",
+        "//plugin/pkg/admission/antiaffinity:go_default_library",
+        "//plugin/pkg/admission/deny:go_default_library",
+        "//plugin/pkg/admission/exec:go_default_library",
+        "//plugin/pkg/admission/gc:go_default_library",
+        "//plugin/pkg/admission/imagepolicy:go_default_library",
+        "//plugin/pkg/admission/initialresources:go_default_library",
+        "//plugin/pkg/admission/limitranger:go_default_library",
+        "//plugin/pkg/admission/namespace/autoprovision:go_default_library",
+        "//plugin/pkg/admission/namespace/exists:go_default_library",
+        "//plugin/pkg/admission/namespace/lifecycle:go_default_library",
+        "//plugin/pkg/admission/persistentvolume/label:go_default_library",
+        "//plugin/pkg/admission/podnodeselector:go_default_library",
+        "//plugin/pkg/admission/resourcequota:go_default_library",
+        "//plugin/pkg/admission/security/podsecuritypolicy:go_default_library",
+        "//plugin/pkg/admission/securitycontext/scdeny:go_default_library",
+        "//plugin/pkg/admission/serviceaccount:go_default_library",
+        "//plugin/pkg/admission/storageclass/default:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/pborman/uuid",
+        "//vendor:github.com/spf13/cobra",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["server_test.go"],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = ["//cmd/kube-apiserver/app/options:go_default_library"],
+)

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/options/BUILD

@@ -0,0 +1,33 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["options.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/validation:go_default_library",
+        "//pkg/genericapiserver/options:go_default_library",
+        "//pkg/kubelet/client:go_default_library",
+        "//pkg/master/ports:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["options_test.go"],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = ["//vendor:github.com/spf13/pflag"],
+)

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/options/options.go

@@ -0,0 +1,135 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package options contains flags and options for initializing an apiserver
+package options
+
+import (
+	"time"
+
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/validation"
+	genericoptions "k8s.io/kubernetes/pkg/genericapiserver/options"
+	kubeletclient "k8s.io/kubernetes/pkg/kubelet/client"
+	"k8s.io/kubernetes/pkg/master/ports"
+
+	"github.com/spf13/pflag"
+)
+
+// ServerRunOptions runs a kubernetes api server.
+type ServerRunOptions struct {
+	GenericServerRunOptions *genericoptions.ServerRunOptions
+	Etcd                    *genericoptions.EtcdOptions
+	SecureServing           *genericoptions.SecureServingOptions
+	InsecureServing         *genericoptions.ServingOptions
+	Authentication          *genericoptions.BuiltInAuthenticationOptions
+	Authorization           *genericoptions.BuiltInAuthorizationOptions
+
+	AllowPrivileged          bool
+	EventTTL                 time.Duration
+	KubeletConfig            kubeletclient.KubeletClientConfig
+	MaxConnectionBytesPerSec int64
+	SSHKeyfile               string
+	SSHUser                  string
+}
+
+// NewServerRunOptions creates a new ServerRunOptions object with default parameters
+func NewServerRunOptions() *ServerRunOptions {
+	s := ServerRunOptions{
+		GenericServerRunOptions: genericoptions.NewServerRunOptions(),
+		Etcd:            genericoptions.NewEtcdOptions(),
+		SecureServing:   genericoptions.NewSecureServingOptions(),
+		InsecureServing: genericoptions.NewInsecureServingOptions(),
+		Authentication:  genericoptions.NewBuiltInAuthenticationOptions().WithAll(),
+		Authorization:   genericoptions.NewBuiltInAuthorizationOptions(),
+
+		EventTTL: 1 * time.Hour,
+		KubeletConfig: kubeletclient.KubeletClientConfig{
+			Port: ports.KubeletPort,
+			PreferredAddressTypes: []string{
+				string(api.NodeHostName),
+				string(api.NodeInternalIP),
+				string(api.NodeExternalIP),
+				string(api.NodeLegacyHostIP),
+			},
+			EnableHttps: true,
+			HTTPTimeout: time.Duration(5) * time.Second,
+		},
+	}
+	return &s
+}
+
+// AddFlags adds flags for a specific APIServer to the specified FlagSet
+func (s *ServerRunOptions) AddFlags(fs *pflag.FlagSet) {
+	// Add the generic flags.
+	s.GenericServerRunOptions.AddUniversalFlags(fs)
+
+	s.Etcd.AddFlags(fs)
+	s.SecureServing.AddFlags(fs)
+	s.SecureServing.AddDeprecatedFlags(fs)
+	s.InsecureServing.AddFlags(fs)
+	s.InsecureServing.AddDeprecatedFlags(fs)
+	s.Authentication.AddFlags(fs)
+	s.Authorization.AddFlags(fs)
+
+	// Note: the weird ""+ in below lines seems to be the only way to get gofmt to
+	// arrange these text blocks sensibly. Grrr.
+
+	fs.DurationVar(&s.EventTTL, "event-ttl", s.EventTTL,
+		"Amount of time to retain events. Default is 1h.")
+
+	fs.BoolVar(&s.AllowPrivileged, "allow-privileged", s.AllowPrivileged,
+		"If true, allow privileged containers.")
+
+	fs.StringVar(&s.SSHUser, "ssh-user", s.SSHUser,
+		"If non-empty, use secure SSH proxy to the nodes, using this user name")
+
+	fs.StringVar(&s.SSHKeyfile, "ssh-keyfile", s.SSHKeyfile,
+		"If non-empty, use secure SSH proxy to the nodes, using this user keyfile")
+
+	fs.Int64Var(&s.MaxConnectionBytesPerSec, "max-connection-bytes-per-sec", s.MaxConnectionBytesPerSec, ""+
+		"If non-zero, throttle each user connection to this number of bytes/sec. "+
+		"Currently only applies to long-running requests.")
+
+	// Kubelet related flags:
+	fs.BoolVar(&s.KubeletConfig.EnableHttps, "kubelet-https", s.KubeletConfig.EnableHttps,
+		"Use https for kubelet connections.")
+
+	fs.StringSliceVar(&s.KubeletConfig.PreferredAddressTypes, "kubelet-preferred-address-types", s.KubeletConfig.PreferredAddressTypes,
+		"List of the preferred NodeAddressTypes to use for kubelet connections.")
+
+	fs.UintVar(&s.KubeletConfig.Port, "kubelet-port", s.KubeletConfig.Port,
+		"DEPRECATED: kubelet port.")
+	fs.MarkDeprecated("kubelet-port", "kubelet-port is deprecated and will be removed.")
+
+	fs.DurationVar(&s.KubeletConfig.HTTPTimeout, "kubelet-timeout", s.KubeletConfig.HTTPTimeout,
+		"Timeout for kubelet operations.")
+
+	fs.StringVar(&s.KubeletConfig.CertFile, "kubelet-client-certificate", s.KubeletConfig.CertFile,
+		"Path to a client cert file for TLS.")
+
+	fs.StringVar(&s.KubeletConfig.KeyFile, "kubelet-client-key", s.KubeletConfig.KeyFile,
+		"Path to a client key file for TLS.")
+
+	fs.StringVar(&s.KubeletConfig.CAFile, "kubelet-certificate-authority", s.KubeletConfig.CAFile,
+		"Path to a cert file for the certificate authority.")
+
+	// TODO: delete this flag as soon as we identify and fix all clients that send malformed updates, like #14126.
+	fs.BoolVar(&validation.RepairMalformedUpdates, "repair-malformed-updates", validation.RepairMalformedUpdates, ""+
+		"If true, server will do its best to fix the update request to pass the validation, "+
+		"e.g., setting empty UID in update request to its existing value. This flag can be turned off "+
+		"after we fix all the clients that send malformed updates.")
+}

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/options/options_test.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package options
+
+import (
+	"testing"
+
+	"github.com/spf13/pflag"
+)
+
+func TestAddFlagsFlag(t *testing.T) {
+	// TODO: This only tests the enable-swagger-ui flag for now.
+	// Expand the test to include other flags as well.
+	f := pflag.NewFlagSet("addflagstest", pflag.ContinueOnError)
+	s := NewServerRunOptions()
+	s.AddFlags(f)
+	if s.GenericServerRunOptions.EnableSwaggerUI {
+		t.Errorf("Expected s.EnableSwaggerUI to be false by default")
+	}
+
+	args := []string{
+		"--enable-swagger-ui=true",
+	}
+	f.Parse(args)
+	if !s.GenericServerRunOptions.EnableSwaggerUI {
+		t.Errorf("Expected s.EnableSwaggerUI to be true")
+	}
+}

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/plugins.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+// This file exists to force the desired plugin implementations to be linked.
+// This should probably be part of some configuration fed into the build for a
+// given binary target.
+import (
+	// Cloud providers
+	_ "k8s.io/kubernetes/pkg/cloudprovider/providers"
+
+	// Admission policies
+	_ "k8s.io/kubernetes/plugin/pkg/admission/admit"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/alwayspullimages"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/antiaffinity"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/deny"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/exec"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/gc"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/imagepolicy"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/initialresources"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/limitranger"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/namespace/autoprovision"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/namespace/exists"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/namespace/lifecycle"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/persistentvolume/label"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/podnodeselector"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/resourcequota"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/security/podsecuritypolicy"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/securitycontext/scdeny"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/serviceaccount"
+	_ "k8s.io/kubernetes/plugin/pkg/admission/storageclass/default"
+)

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/server.go

@@ -0,0 +1,315 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package app does all of the work necessary to create a Kubernetes
+// APIServer by binding together the API, master and APIServer infrastructure.
+// It can be configured and called directly or via the hyperkube framework.
+package app
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/golang/glog"
+	"github.com/pborman/uuid"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+	"k8s.io/kubernetes/pkg/admission"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/apis/autoscaling"
+	"k8s.io/kubernetes/pkg/apis/batch"
+	"k8s.io/kubernetes/pkg/apis/extensions"
+	"k8s.io/kubernetes/pkg/apiserver"
+	"k8s.io/kubernetes/pkg/apiserver/authenticator"
+	"k8s.io/kubernetes/pkg/capabilities"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	serviceaccountcontroller "k8s.io/kubernetes/pkg/controller/serviceaccount"
+	generatedopenapi "k8s.io/kubernetes/pkg/generated/openapi"
+	"k8s.io/kubernetes/pkg/genericapiserver"
+	"k8s.io/kubernetes/pkg/genericapiserver/authorizer"
+	genericoptions "k8s.io/kubernetes/pkg/genericapiserver/options"
+	"k8s.io/kubernetes/pkg/master"
+	"k8s.io/kubernetes/pkg/registry/cachesize"
+	"k8s.io/kubernetes/pkg/runtime/schema"
+	utilerrors "k8s.io/kubernetes/pkg/util/errors"
+	utilnet "k8s.io/kubernetes/pkg/util/net"
+	"k8s.io/kubernetes/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/version"
+)
+
+// NewAPIServerCommand creates a *cobra.Command object with default parameters
+func NewAPIServerCommand() *cobra.Command {
+	s := options.NewServerRunOptions()
+	s.AddFlags(pflag.CommandLine)
+	cmd := &cobra.Command{
+		Use: "kube-apiserver",
+		Long: `The Kubernetes API server validates and configures data
+for the api objects which include pods, services, replicationcontrollers, and
+others. The API Server services REST operations and provides the frontend to the
+cluster's shared state through which all other components interact.`,
+		Run: func(cmd *cobra.Command, args []string) {
+		},
+	}
+
+	return cmd
+}
+
+// Run runs the specified APIServer.  This should never exit.
+func Run(s *options.ServerRunOptions) error {
+	if errs := s.Etcd.Validate(); len(errs) > 0 {
+		return utilerrors.NewAggregate(errs)
+	}
+	if err := s.GenericServerRunOptions.DefaultExternalAddress(s.SecureServing, s.InsecureServing); err != nil {
+		return err
+	}
+
+	genericapiserver.DefaultAndValidateRunOptions(s.GenericServerRunOptions)
+	genericConfig := genericapiserver.NewConfig(). // create the new config
+							ApplyOptions(s.GenericServerRunOptions). // apply the options selected
+							ApplySecureServingOptions(s.SecureServing).
+							ApplyInsecureServingOptions(s.InsecureServing).
+							ApplyAuthenticationOptions(s.Authentication).
+							ApplyRBACSuperUser(s.Authorization.RBACSuperUser)
+
+	serviceIPRange, apiServerServiceIP, err := master.DefaultServiceIPRange(s.GenericServerRunOptions.ServiceClusterIPRange)
+	if err != nil {
+		glog.Fatalf("Error determining service IP ranges: %v", err)
+	}
+	if err := genericConfig.MaybeGenerateServingCerts(apiServerServiceIP); err != nil {
+		glog.Fatalf("Failed to generate service certificate: %v", err)
+	}
+
+	capabilities.Initialize(capabilities.Capabilities{
+		AllowPrivileged: s.AllowPrivileged,
+		// TODO(vmarmol): Implement support for HostNetworkSources.
+		PrivilegedSources: capabilities.PrivilegedSources{
+			HostNetworkSources: []string{},
+			HostPIDSources:     []string{},
+			HostIPCSources:     []string{},
+		},
+		PerConnectionBandwidthLimitBytesPerSec: s.MaxConnectionBytesPerSec,
+	})
+
+	// Setup tunneler if needed
+	var tunneler genericapiserver.Tunneler
+	var proxyDialerFn apiserver.ProxyDialerFunc
+	if len(s.SSHUser) > 0 {
+		// Get ssh key distribution func, if supported
+		var installSSH genericapiserver.InstallSSHKey
+		cloud, err := cloudprovider.InitCloudProvider(s.GenericServerRunOptions.CloudProvider, s.GenericServerRunOptions.CloudConfigFile)
+		if err != nil {
+			glog.Fatalf("Cloud provider could not be initialized: %v", err)
+		}
+		if cloud != nil {
+			if instances, supported := cloud.Instances(); supported {
+				installSSH = instances.AddSSHKeyToAllInstances
+			}
+		}
+		if s.KubeletConfig.Port == 0 {
+			glog.Fatalf("Must enable kubelet port if proxy ssh-tunneling is specified.")
+		}
+		// Set up the tunneler
+		// TODO(cjcullen): If we want this to handle per-kubelet ports or other
+		// kubelet listen-addresses, we need to plumb through options.
+		healthCheckPath := &url.URL{
+			Scheme: "https",
+			Host:   net.JoinHostPort("127.0.0.1", strconv.FormatUint(uint64(s.KubeletConfig.Port), 10)),
+			Path:   "healthz",
+		}
+		tunneler = genericapiserver.NewSSHTunneler(s.SSHUser, s.SSHKeyfile, healthCheckPath, installSSH)
+
+		// Use the tunneler's dialer to connect to the kubelet
+		s.KubeletConfig.Dial = tunneler.Dial
+		// Use the tunneler's dialer when proxying to pods, services, and nodes
+		proxyDialerFn = tunneler.Dial
+	}
+
+	// Proxying to pods and services is IP-based... don't expect to be able to verify the hostname
+	proxyTLSClientConfig := &tls.Config{InsecureSkipVerify: true}
+
+	if s.Etcd.StorageConfig.DeserializationCacheSize == 0 {
+		// When size of cache is not explicitly set, estimate its size based on
+		// target memory usage.
+		glog.V(2).Infof("Initalizing deserialization cache size based on %dMB limit", s.GenericServerRunOptions.TargetRAMMB)
+
+		// This is the heuristics that from memory capacity is trying to infer
+		// the maximum number of nodes in the cluster and set cache sizes based
+		// on that value.
+		// From our documentation, we officially recomment 120GB machines for
+		// 2000 nodes, and we scale from that point. Thus we assume ~60MB of
+		// capacity per node.
+		// TODO: We may consider deciding that some percentage of memory will
+		// be used for the deserialization cache and divide it by the max object
+		// size to compute its size. We may even go further and measure
+		// collective sizes of the objects in the cache.
+		clusterSize := s.GenericServerRunOptions.TargetRAMMB / 60
+		s.Etcd.StorageConfig.DeserializationCacheSize = 25 * clusterSize
+		if s.Etcd.StorageConfig.DeserializationCacheSize < 1000 {
+			s.Etcd.StorageConfig.DeserializationCacheSize = 1000
+		}
+	}
+
+	storageGroupsToEncodingVersion, err := s.GenericServerRunOptions.StorageGroupsToEncodingVersion()
+	if err != nil {
+		glog.Fatalf("error generating storage version map: %s", err)
+	}
+	storageFactory, err := genericapiserver.BuildDefaultStorageFactory(
+		s.Etcd.StorageConfig, s.GenericServerRunOptions.DefaultStorageMediaType, api.Codecs,
+		genericapiserver.NewDefaultResourceEncodingConfig(), storageGroupsToEncodingVersion,
+		// FIXME: this GroupVersionResource override should be configurable
+		[]schema.GroupVersionResource{batch.Resource("cronjobs").WithVersion("v2alpha1")},
+		master.DefaultAPIResourceConfigSource(), s.GenericServerRunOptions.RuntimeConfig)
+	if err != nil {
+		glog.Fatalf("error in initializing storage factory: %s", err)
+	}
+	storageFactory.AddCohabitatingResources(batch.Resource("jobs"), extensions.Resource("jobs"))
+	storageFactory.AddCohabitatingResources(autoscaling.Resource("horizontalpodautoscalers"), extensions.Resource("horizontalpodautoscalers"))
+	for _, override := range s.Etcd.EtcdServersOverrides {
+		tokens := strings.Split(override, "#")
+		if len(tokens) != 2 {
+			glog.Errorf("invalid value of etcd server overrides: %s", override)
+			continue
+		}
+
+		apiresource := strings.Split(tokens[0], "/")
+		if len(apiresource) != 2 {
+			glog.Errorf("invalid resource definition: %s", tokens[0])
+			continue
+		}
+		group := apiresource[0]
+		resource := apiresource[1]
+		groupResource := schema.GroupResource{Group: group, Resource: resource}
+
+		servers := strings.Split(tokens[1], ";")
+		storageFactory.SetEtcdLocation(groupResource, servers)
+	}
+
+	// Default to the private server key for service account token signing
+	if len(s.Authentication.ServiceAccounts.KeyFiles) == 0 && s.SecureServing.ServerCert.CertKey.KeyFile != "" {
+		if authenticator.IsValidServiceAccountKeyFile(s.SecureServing.ServerCert.CertKey.KeyFile) {
+			s.Authentication.ServiceAccounts.KeyFiles = []string{s.SecureServing.ServerCert.CertKey.KeyFile}
+		} else {
+			glog.Warning("No TLS key provided, service account token authentication disabled")
+		}
+	}
+
+	authenticatorConfig := s.Authentication.ToAuthenticationConfig(s.SecureServing.ClientCA)
+	if s.Authentication.ServiceAccounts.Lookup {
+		// If we need to look up service accounts and tokens,
+		// go directly to etcd to avoid recursive auth insanity
+		storageConfig, err := storageFactory.NewConfig(api.Resource("serviceaccounts"))
+		if err != nil {
+			glog.Fatalf("Unable to get serviceaccounts storage: %v", err)
+		}
+		authenticatorConfig.ServiceAccountTokenGetter = serviceaccountcontroller.NewGetterFromStorageInterface(storageConfig, storageFactory.ResourcePrefix(api.Resource("serviceaccounts")), storageFactory.ResourcePrefix(api.Resource("secrets")))
+	}
+
+	apiAuthenticator, securityDefinitions, err := authenticator.New(authenticatorConfig)
+	if err != nil {
+		glog.Fatalf("Invalid Authentication Config: %v", err)
+	}
+
+	privilegedLoopbackToken := uuid.NewRandom().String()
+	selfClientConfig, err := genericoptions.NewSelfClientConfig(s.SecureServing, s.InsecureServing, privilegedLoopbackToken)
+	if err != nil {
+		glog.Fatalf("Failed to create clientset: %v", err)
+	}
+	client, err := internalclientset.NewForConfig(selfClientConfig)
+	if err != nil {
+		glog.Errorf("Failed to create clientset: %v", err)
+	}
+	sharedInformers := informers.NewSharedInformerFactory(nil, client, 10*time.Minute)
+
+	authorizationConfig := s.Authorization.ToAuthorizationConfig(sharedInformers)
+	apiAuthorizer, err := authorizer.NewAuthorizerFromAuthorizationConfig(authorizationConfig)
+	if err != nil {
+		glog.Fatalf("Invalid Authorization Config: %v", err)
+	}
+
+	admissionControlPluginNames := strings.Split(s.GenericServerRunOptions.AdmissionControl, ",")
+	pluginInitializer := admission.NewPluginInitializer(sharedInformers, apiAuthorizer)
+	admissionController, err := admission.NewFromPlugins(client, admissionControlPluginNames, s.GenericServerRunOptions.AdmissionControlConfigFile, pluginInitializer)
+	if err != nil {
+		glog.Fatalf("Failed to initialize plugins: %v", err)
+	}
+
+	proxyTransport := utilnet.SetTransportDefaults(&http.Transport{
+		Dial:            proxyDialerFn,
+		TLSClientConfig: proxyTLSClientConfig,
+	})
+	kubeVersion := version.Get()
+
+	genericConfig.Version = &kubeVersion
+	genericConfig.LoopbackClientConfig = selfClientConfig
+	genericConfig.Authenticator = apiAuthenticator
+	genericConfig.Authorizer = apiAuthorizer
+	genericConfig.AdmissionControl = admissionController
+	genericConfig.APIResourceConfigSource = storageFactory.APIResourceConfigSource
+	genericConfig.OpenAPIConfig.Info.Title = "Kubernetes"
+	genericConfig.OpenAPIConfig.Definitions = generatedopenapi.OpenAPIDefinitions
+	genericConfig.EnableOpenAPISupport = true
+	genericConfig.EnableMetrics = true
+	genericConfig.OpenAPIConfig.SecurityDefinitions = securityDefinitions
+
+	config := &master.Config{
+		GenericConfig: genericConfig,
+
+		StorageFactory:          storageFactory,
+		EnableWatchCache:        s.GenericServerRunOptions.EnableWatchCache,
+		EnableCoreControllers:   true,
+		DeleteCollectionWorkers: s.GenericServerRunOptions.DeleteCollectionWorkers,
+		EventTTL:                s.EventTTL,
+		KubeletClientConfig:     s.KubeletConfig,
+		EnableUISupport:         true,
+		EnableLogsSupport:       true,
+		ProxyTransport:          proxyTransport,
+
+		Tunneler: tunneler,
+
+		ServiceIPRange:       serviceIPRange,
+		APIServerServiceIP:   apiServerServiceIP,
+		APIServerServicePort: 443,
+
+		ServiceNodePortRange:      s.GenericServerRunOptions.ServiceNodePortRange,
+		KubernetesServiceNodePort: s.GenericServerRunOptions.KubernetesServiceNodePort,
+
+		MasterCount: s.GenericServerRunOptions.MasterCount,
+	}
+
+	if s.GenericServerRunOptions.EnableWatchCache {
+		glog.V(2).Infof("Initalizing cache sizes based on %dMB limit", s.GenericServerRunOptions.TargetRAMMB)
+		cachesize.InitializeWatchCacheSizes(s.GenericServerRunOptions.TargetRAMMB)
+		cachesize.SetWatchCacheSizes(s.GenericServerRunOptions.WatchCacheSizes)
+	}
+
+	m, err := config.Complete().New()
+	if err != nil {
+		return err
+	}
+
+	sharedInformers.Start(wait.NeverStop)
+	m.GenericAPIServer.PrepareRun().Run(wait.NeverStop)
+	return nil
+}

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/server_test.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	"regexp"
+	"testing"
+
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+)
+
+func TestLongRunningRequestRegexp(t *testing.T) {
+	regexp := regexp.MustCompile(options.NewServerRunOptions().GenericServerRunOptions.LongRunningRequestRE)
+	dontMatch := []string{
+		"/api/v1/watch-namespace/",
+		"/api/v1/namespace-proxy/",
+		"/api/v1/namespace-watch",
+		"/api/v1/namespace-proxy",
+		"/api/v1/namespace-portforward/pods",
+		"/api/v1/portforward/pods",
+		". anything",
+		"/ that",
+	}
+	doMatch := []string{
+		"/api/v1/pods/watch",
+		"/api/v1/watch/stuff",
+		"/api/v1/default/service/proxy",
+		"/api/v1/pods/proxy/path/to/thing",
+		"/api/v1/namespaces/myns/pods/mypod/log",
+		"/api/v1/namespaces/myns/pods/mypod/logs",
+		"/api/v1/namespaces/myns/pods/mypod/portforward",
+		"/api/v1/namespaces/myns/pods/mypod/exec",
+		"/api/v1/namespaces/myns/pods/mypod/attach",
+		"/api/v1/namespaces/myns/pods/mypod/log/",
+		"/api/v1/namespaces/myns/pods/mypod/logs/",
+		"/api/v1/namespaces/myns/pods/mypod/portforward/",
+		"/api/v1/namespaces/myns/pods/mypod/exec/",
+		"/api/v1/namespaces/myns/pods/mypod/attach/",
+		"/api/v1/watch/namespaces/myns/pods",
+	}
+	for _, path := range dontMatch {
+		if regexp.MatchString(path) {
+			t.Errorf("path should not have match regexp but did: %s", path)
+		}
+	}
+	for _, path := range doMatch {
+		if !regexp.MatchString(path) {
+			t.Errorf("path should have match regexp did not: %s", path)
+		}
+	}
+}

vendor/k8s.io/kubernetes/cmd/kube-controller-manager/BUILD

@@ -0,0 +1,29 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "kube-controller-manager",
+    srcs = ["controller-manager.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-controller-manager/app:go_default_library",
+        "//cmd/kube-controller-manager/app/options:go_default_library",
+        "//pkg/client/metrics/prometheus:go_default_library",
+        "//pkg/healthz:go_default_library",
+        "//pkg/util/flag:go_default_library",
+        "//pkg/util/logs:go_default_library",
+        "//pkg/util/workqueue/prometheus:go_default_library",
+        "//pkg/version/prometheus:go_default_library",
+        "//pkg/version/verflag:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-controller-manager/OWNERS

@@ -0,0 +1,3 @@
+assignees:
+  - lavalamp
+  - mikedanese

vendor/k8s.io/kubernetes/cmd/kube-controller-manager/app/BUILD

@@ -0,0 +1,98 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "controllermanager.go",
+        "plugins.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-controller-manager/app/options:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apimachinery/registered:go_default_library",
+        "//pkg/apis/batch:go_default_library",
+        "//pkg/apis/componentconfig:go_default_library",
+        "//pkg/client/clientset_generated/release_1_5:go_default_library",
+        "//pkg/client/clientset_generated/release_1_5/typed/core/v1:go_default_library",
+        "//pkg/client/leaderelection:go_default_library",
+        "//pkg/client/leaderelection/resourcelock:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/client/typed/discovery:go_default_library",
+        "//pkg/client/typed/dynamic:go_default_library",
+        "//pkg/client/unversioned/clientcmd:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/cloudprovider/providers:go_default_library",
+        "//pkg/cloudprovider/providers/aws:go_default_library",
+        "//pkg/cloudprovider/providers/azure:go_default_library",
+        "//pkg/cloudprovider/providers/gce:go_default_library",
+        "//pkg/cloudprovider/providers/openstack:go_default_library",
+        "//pkg/cloudprovider/providers/photon:go_default_library",
+        "//pkg/cloudprovider/providers/vsphere:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/certificates:go_default_library",
+        "//pkg/controller/cronjob:go_default_library",
+        "//pkg/controller/daemon:go_default_library",
+        "//pkg/controller/deployment:go_default_library",
+        "//pkg/controller/disruption:go_default_library",
+        "//pkg/controller/endpoint:go_default_library",
+        "//pkg/controller/garbagecollector:go_default_library",
+        "//pkg/controller/garbagecollector/metaonly:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/controller/job:go_default_library",
+        "//pkg/controller/namespace:go_default_library",
+        "//pkg/controller/node:go_default_library",
+        "//pkg/controller/petset:go_default_library",
+        "//pkg/controller/podautoscaler:go_default_library",
+        "//pkg/controller/podautoscaler/metrics:go_default_library",
+        "//pkg/controller/podgc:go_default_library",
+        "//pkg/controller/replicaset:go_default_library",
+        "//pkg/controller/replication:go_default_library",
+        "//pkg/controller/resourcequota:go_default_library",
+        "//pkg/controller/route:go_default_library",
+        "//pkg/controller/service:go_default_library",
+        "//pkg/controller/serviceaccount:go_default_library",
+        "//pkg/controller/volume/attachdetach:go_default_library",
+        "//pkg/controller/volume/persistentvolume:go_default_library",
+        "//pkg/healthz:go_default_library",
+        "//pkg/quota/install:go_default_library",
+        "//pkg/runtime/schema:go_default_library",
+        "//pkg/runtime/serializer:go_default_library",
+        "//pkg/serviceaccount:go_default_library",
+        "//pkg/util/cert:go_default_library",
+        "//pkg/util/config:go_default_library",
+        "//pkg/util/configz:go_default_library",
+        "//pkg/util/io:go_default_library",
+        "//pkg/util/wait:go_default_library",
+        "//pkg/volume:go_default_library",
+        "//pkg/volume/aws_ebs:go_default_library",
+        "//pkg/volume/azure_dd:go_default_library",
+        "//pkg/volume/cinder:go_default_library",
+        "//pkg/volume/flexvolume:go_default_library",
+        "//pkg/volume/flocker:go_default_library",
+        "//pkg/volume/gce_pd:go_default_library",
+        "//pkg/volume/glusterfs:go_default_library",
+        "//pkg/volume/host_path:go_default_library",
+        "//pkg/volume/nfs:go_default_library",
+        "//pkg/volume/photon_pd:go_default_library",
+        "//pkg/volume/quobyte:go_default_library",
+        "//pkg/volume/rbd:go_default_library",
+        "//pkg/volume/vsphere_volume:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/prometheus/client_golang/prometheus",
+        "//vendor:github.com/spf13/cobra",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-controller-manager/app/options/BUILD

@@ -0,0 +1,25 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["options.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/apis/componentconfig:go_default_library",
+        "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/client/leaderelection:go_default_library",
+        "//pkg/master/ports:go_default_library",
+        "//pkg/util/config:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-controller-manager/app/options/options.go

@@ -0,0 +1,187 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package options provides the flags used for the controller manager.
+//
+package options
+
+import (
+	"time"
+
+	"k8s.io/kubernetes/pkg/apis/componentconfig"
+	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/client/leaderelection"
+	"k8s.io/kubernetes/pkg/master/ports"
+	"k8s.io/kubernetes/pkg/util/config"
+
+	"github.com/spf13/pflag"
+)
+
+// CMServer is the main context object for the controller manager.
+type CMServer struct {
+	componentconfig.KubeControllerManagerConfiguration
+
+	Master     string
+	Kubeconfig string
+}
+
+// NewCMServer creates a new CMServer with a default config.
+func NewCMServer() *CMServer {
+	s := CMServer{
+		KubeControllerManagerConfiguration: componentconfig.KubeControllerManagerConfiguration{
+			Port:                              ports.ControllerManagerPort,
+			Address:                           "0.0.0.0",
+			ConcurrentEndpointSyncs:           5,
+			ConcurrentServiceSyncs:            1,
+			ConcurrentRCSyncs:                 5,
+			ConcurrentRSSyncs:                 5,
+			ConcurrentDaemonSetSyncs:          2,
+			ConcurrentJobSyncs:                5,
+			ConcurrentResourceQuotaSyncs:      5,
+			ConcurrentDeploymentSyncs:         5,
+			ConcurrentNamespaceSyncs:          2,
+			ConcurrentSATokenSyncs:            5,
+			LookupCacheSizeForRC:              4096,
+			LookupCacheSizeForRS:              4096,
+			LookupCacheSizeForDaemonSet:       1024,
+			ServiceSyncPeriod:                 metav1.Duration{Duration: 5 * time.Minute},
+			RouteReconciliationPeriod:         metav1.Duration{Duration: 10 * time.Second},
+			ResourceQuotaSyncPeriod:           metav1.Duration{Duration: 5 * time.Minute},
+			NamespaceSyncPeriod:               metav1.Duration{Duration: 5 * time.Minute},
+			PVClaimBinderSyncPeriod:           metav1.Duration{Duration: 15 * time.Second},
+			HorizontalPodAutoscalerSyncPeriod: metav1.Duration{Duration: 30 * time.Second},
+			DeploymentControllerSyncPeriod:    metav1.Duration{Duration: 30 * time.Second},
+			MinResyncPeriod:                   metav1.Duration{Duration: 12 * time.Hour},
+			RegisterRetryCount:                10,
+			PodEvictionTimeout:                metav1.Duration{Duration: 5 * time.Minute},
+			NodeMonitorGracePeriod:            metav1.Duration{Duration: 40 * time.Second},
+			NodeStartupGracePeriod:            metav1.Duration{Duration: 60 * time.Second},
+			NodeMonitorPeriod:                 metav1.Duration{Duration: 5 * time.Second},
+			ClusterName:                       "kubernetes",
+			NodeCIDRMaskSize:                  24,
+			ConfigureCloudRoutes:              true,
+			TerminatedPodGCThreshold:          12500,
+			VolumeConfiguration: componentconfig.VolumeConfiguration{
+				EnableHostPathProvisioning: false,
+				EnableDynamicProvisioning:  true,
+				PersistentVolumeRecyclerConfiguration: componentconfig.PersistentVolumeRecyclerConfiguration{
+					MaximumRetry:             3,
+					MinimumTimeoutNFS:        300,
+					IncrementTimeoutNFS:      30,
+					MinimumTimeoutHostPath:   60,
+					IncrementTimeoutHostPath: 30,
+				},
+				FlexVolumePluginDir: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/",
+			},
+			ContentType:             "application/vnd.kubernetes.protobuf",
+			KubeAPIQPS:              20.0,
+			KubeAPIBurst:            30,
+			LeaderElection:          leaderelection.DefaultLeaderElectionConfiguration(),
+			ControllerStartInterval: metav1.Duration{Duration: 0 * time.Second},
+			EnableGarbageCollector:  true,
+			ConcurrentGCSyncs:       20,
+			ClusterSigningCertFile:  "/etc/kubernetes/ca/ca.pem",
+			ClusterSigningKeyFile:   "/etc/kubernetes/ca/ca.key",
+		},
+	}
+	s.LeaderElection.LeaderElect = true
+	return &s
+}
+
+// AddFlags adds flags for a specific CMServer to the specified FlagSet
+func (s *CMServer) AddFlags(fs *pflag.FlagSet) {
+	fs.Int32Var(&s.Port, "port", s.Port, "The port that the controller-manager's http service runs on")
+	fs.Var(componentconfig.IPVar{Val: &s.Address}, "address", "The IP address to serve on (set to 0.0.0.0 for all interfaces)")
+	fs.BoolVar(&s.UseServiceAccountCredentials, "use-service-account-credentials", s.UseServiceAccountCredentials, "If true, use individual service account credentials for each controller.")
+	fs.StringVar(&s.CloudProvider, "cloud-provider", s.CloudProvider, "The provider for cloud services.  Empty string for no provider.")
+	fs.StringVar(&s.CloudConfigFile, "cloud-config", s.CloudConfigFile, "The path to the cloud provider configuration file.  Empty string for no configuration file.")
+	fs.Int32Var(&s.ConcurrentEndpointSyncs, "concurrent-endpoint-syncs", s.ConcurrentEndpointSyncs, "The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load")
+	fs.Int32Var(&s.ConcurrentServiceSyncs, "concurrent-service-syncs", s.ConcurrentServiceSyncs, "The number of services that are allowed to sync concurrently. Larger number = more responsive service management, but more CPU (and network) load")
+	fs.Int32Var(&s.ConcurrentRCSyncs, "concurrent_rc_syncs", s.ConcurrentRCSyncs, "The number of replication controllers that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load")
+	fs.Int32Var(&s.ConcurrentRSSyncs, "concurrent-replicaset-syncs", s.ConcurrentRSSyncs, "The number of replica sets that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load")
+	fs.Int32Var(&s.ConcurrentResourceQuotaSyncs, "concurrent-resource-quota-syncs", s.ConcurrentResourceQuotaSyncs, "The number of resource quotas that are allowed to sync concurrently. Larger number = more responsive quota management, but more CPU (and network) load")
+	fs.Int32Var(&s.ConcurrentDeploymentSyncs, "concurrent-deployment-syncs", s.ConcurrentDeploymentSyncs, "The number of deployment objects that are allowed to sync concurrently. Larger number = more responsive deployments, but more CPU (and network) load")
+	fs.Int32Var(&s.ConcurrentNamespaceSyncs, "concurrent-namespace-syncs", s.ConcurrentNamespaceSyncs, "The number of namespace objects that are allowed to sync concurrently. Larger number = more responsive namespace termination, but more CPU (and network) load")
+	fs.Int32Var(&s.ConcurrentSATokenSyncs, "concurrent-serviceaccount-token-syncs", s.ConcurrentSATokenSyncs, "The number of service account token objects that are allowed to sync concurrently. Larger number = more responsive token generation, but more CPU (and network) load")
+	fs.Int32Var(&s.LookupCacheSizeForRC, "replication-controller-lookup-cache-size", s.LookupCacheSizeForRC, "The the size of lookup cache for replication controllers. Larger number = more responsive replica management, but more MEM load.")
+	fs.Int32Var(&s.LookupCacheSizeForRS, "replicaset-lookup-cache-size", s.LookupCacheSizeForRS, "The the size of lookup cache for replicatsets. Larger number = more responsive replica management, but more MEM load.")
+	fs.Int32Var(&s.LookupCacheSizeForDaemonSet, "daemonset-lookup-cache-size", s.LookupCacheSizeForDaemonSet, "The the size of lookup cache for daemonsets. Larger number = more responsive daemonsets, but more MEM load.")
+	fs.DurationVar(&s.ServiceSyncPeriod.Duration, "service-sync-period", s.ServiceSyncPeriod.Duration, "The period for syncing services with their external load balancers")
+	fs.DurationVar(&s.NodeSyncPeriod.Duration, "node-sync-period", 0, ""+
+		"This flag is deprecated and will be removed in future releases. See node-monitor-period for Node health checking or "+
+		"route-reconciliation-period for cloud provider's route configuration settings.")
+	fs.MarkDeprecated("node-sync-period", "This flag is currently no-op and will be deleted.")
+	fs.DurationVar(&s.RouteReconciliationPeriod.Duration, "route-reconciliation-period", s.RouteReconciliationPeriod.Duration, "The period for reconciling routes created for Nodes by cloud provider.")
+	fs.DurationVar(&s.ResourceQuotaSyncPeriod.Duration, "resource-quota-sync-period", s.ResourceQuotaSyncPeriod.Duration, "The period for syncing quota usage status in the system")
+	fs.DurationVar(&s.NamespaceSyncPeriod.Duration, "namespace-sync-period", s.NamespaceSyncPeriod.Duration, "The period for syncing namespace life-cycle updates")
+	fs.DurationVar(&s.PVClaimBinderSyncPeriod.Duration, "pvclaimbinder-sync-period", s.PVClaimBinderSyncPeriod.Duration, "The period for syncing persistent volumes and persistent volume claims")
+	fs.DurationVar(&s.MinResyncPeriod.Duration, "min-resync-period", s.MinResyncPeriod.Duration, "The resync period in reflectors will be random between MinResyncPeriod and 2*MinResyncPeriod")
+	fs.StringVar(&s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathNFS, "pv-recycler-pod-template-filepath-nfs", s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathNFS, "The file path to a pod definition used as a template for NFS persistent volume recycling")
+	fs.Int32Var(&s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.MinimumTimeoutNFS, "pv-recycler-minimum-timeout-nfs", s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.MinimumTimeoutNFS, "The minimum ActiveDeadlineSeconds to use for an NFS Recycler pod")
+	fs.Int32Var(&s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.IncrementTimeoutNFS, "pv-recycler-increment-timeout-nfs", s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.IncrementTimeoutNFS, "the increment of time added per Gi to ActiveDeadlineSeconds for an NFS scrubber pod")
+	fs.StringVar(&s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathHostPath, "pv-recycler-pod-template-filepath-hostpath", s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathHostPath, "The file path to a pod definition used as a template for HostPath persistent volume recycling. This is for development and testing only and will not work in a multi-node cluster.")
+	fs.Int32Var(&s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.MinimumTimeoutHostPath, "pv-recycler-minimum-timeout-hostpath", s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.MinimumTimeoutHostPath, "The minimum ActiveDeadlineSeconds to use for a HostPath Recycler pod.  This is for development and testing only and will not work in a multi-node cluster.")
+	fs.Int32Var(&s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.IncrementTimeoutHostPath, "pv-recycler-timeout-increment-hostpath", s.VolumeConfiguration.PersistentVolumeRecyclerConfiguration.IncrementTimeoutHostPath, "the increment of time added per Gi to ActiveDeadlineSeconds for a HostPath scrubber pod.  This is for development and testing only and will not work in a multi-node cluster.")
+	fs.BoolVar(&s.VolumeConfiguration.EnableHostPathProvisioning, "enable-hostpath-provisioner", s.VolumeConfiguration.EnableHostPathProvisioning, "Enable HostPath PV provisioning when running without a cloud provider. This allows testing and development of provisioning features.  HostPath provisioning is not supported in any way, won't work in a multi-node cluster, and should not be used for anything other than testing or development.")
+	fs.BoolVar(&s.VolumeConfiguration.EnableDynamicProvisioning, "enable-dynamic-provisioning", s.VolumeConfiguration.EnableDynamicProvisioning, "Enable dynamic provisioning for environments that support it.")
+	fs.StringVar(&s.VolumeConfiguration.FlexVolumePluginDir, "flex-volume-plugin-dir", s.VolumeConfiguration.FlexVolumePluginDir, "Full path of the directory in which the flex volume plugin should search for additional third party volume plugins.")
+	fs.Int32Var(&s.TerminatedPodGCThreshold, "terminated-pod-gc-threshold", s.TerminatedPodGCThreshold, "Number of terminated pods that can exist before the terminated pod garbage collector starts deleting terminated pods. If <= 0, the terminated pod garbage collector is disabled.")
+	fs.DurationVar(&s.HorizontalPodAutoscalerSyncPeriod.Duration, "horizontal-pod-autoscaler-sync-period", s.HorizontalPodAutoscalerSyncPeriod.Duration, "The period for syncing the number of pods in horizontal pod autoscaler.")
+	fs.DurationVar(&s.DeploymentControllerSyncPeriod.Duration, "deployment-controller-sync-period", s.DeploymentControllerSyncPeriod.Duration, "Period for syncing the deployments.")
+	fs.DurationVar(&s.PodEvictionTimeout.Duration, "pod-eviction-timeout", s.PodEvictionTimeout.Duration, "The grace period for deleting pods on failed nodes.")
+	fs.Float32Var(&s.DeletingPodsQps, "deleting-pods-qps", 0.1, "Number of nodes per second on which pods are deleted in case of node failure.")
+	fs.MarkDeprecated("deleting-pods-qps", "This flag is currently no-op and will be deleted.")
+	fs.Int32Var(&s.DeletingPodsBurst, "deleting-pods-burst", 0, "Number of nodes on which pods are bursty deleted in case of node failure. For more details look into RateLimiter.")
+	fs.MarkDeprecated("deleting-pods-burst", "This flag is currently no-op and will be deleted.")
+	fs.Int32Var(&s.RegisterRetryCount, "register-retry-count", s.RegisterRetryCount, ""+
+		"The number of retries for initial node registration.  Retry interval equals node-sync-period.")
+	fs.MarkDeprecated("register-retry-count", "This flag is currently no-op and will be deleted.")
+	fs.DurationVar(&s.NodeMonitorGracePeriod.Duration, "node-monitor-grace-period", s.NodeMonitorGracePeriod.Duration,
+		"Amount of time which we allow running Node to be unresponsive before marking it unhealthy. "+
+			"Must be N times more than kubelet's nodeStatusUpdateFrequency, "+
+			"where N means number of retries allowed for kubelet to post node status.")
+	fs.DurationVar(&s.NodeStartupGracePeriod.Duration, "node-startup-grace-period", s.NodeStartupGracePeriod.Duration,
+		"Amount of time which we allow starting Node to be unresponsive before marking it unhealthy.")
+	fs.DurationVar(&s.NodeMonitorPeriod.Duration, "node-monitor-period", s.NodeMonitorPeriod.Duration,
+		"The period for syncing NodeStatus in NodeController.")
+	fs.StringVar(&s.ServiceAccountKeyFile, "service-account-private-key-file", s.ServiceAccountKeyFile, "Filename containing a PEM-encoded private RSA or ECDSA key used to sign service account tokens.")
+	fs.StringVar(&s.ClusterSigningCertFile, "cluster-signing-cert-file", s.ClusterSigningCertFile, "Filename containing a PEM-encoded X509 CA certificate used to issue cluster-scoped certificates")
+	fs.StringVar(&s.ClusterSigningKeyFile, "cluster-signing-key-file", s.ClusterSigningKeyFile, "Filename containing a PEM-encoded RSA or ECDSA private key used to sign cluster-scoped certificates")
+	fs.StringVar(&s.ApproveAllKubeletCSRsForGroup, "insecure-experimental-approve-all-kubelet-csrs-for-group", s.ApproveAllKubeletCSRsForGroup, "The group for which the controller-manager will auto approve all CSRs for kubelet client certificates.")
+	fs.BoolVar(&s.EnableProfiling, "profiling", true, "Enable profiling via web interface host:port/debug/pprof/")
+	fs.StringVar(&s.ClusterName, "cluster-name", s.ClusterName, "The instance prefix for the cluster")
+	fs.StringVar(&s.ClusterCIDR, "cluster-cidr", s.ClusterCIDR, "CIDR Range for Pods in cluster.")
+	fs.StringVar(&s.ServiceCIDR, "service-cluster-ip-range", s.ServiceCIDR, "CIDR Range for Services in cluster.")
+	fs.Int32Var(&s.NodeCIDRMaskSize, "node-cidr-mask-size", s.NodeCIDRMaskSize, "Mask size for node cidr in cluster.")
+	fs.BoolVar(&s.AllocateNodeCIDRs, "allocate-node-cidrs", false, "Should CIDRs for Pods be allocated and set on the cloud provider.")
+	fs.BoolVar(&s.ConfigureCloudRoutes, "configure-cloud-routes", true, "Should CIDRs allocated by allocate-node-cidrs be configured on the cloud provider.")
+	fs.StringVar(&s.Master, "master", s.Master, "The address of the Kubernetes API server (overrides any value in kubeconfig)")
+	fs.StringVar(&s.Kubeconfig, "kubeconfig", s.Kubeconfig, "Path to kubeconfig file with authorization and master location information.")
+	fs.StringVar(&s.RootCAFile, "root-ca-file", s.RootCAFile, "If set, this root certificate authority will be included in service account's token secret. This must be a valid PEM-encoded CA bundle.")
+	fs.StringVar(&s.ContentType, "kube-api-content-type", s.ContentType, "Content type of requests sent to apiserver.")
+	fs.Float32Var(&s.KubeAPIQPS, "kube-api-qps", s.KubeAPIQPS, "QPS to use while talking with kubernetes apiserver")
+	fs.Int32Var(&s.KubeAPIBurst, "kube-api-burst", s.KubeAPIBurst, "Burst to use while talking with kubernetes apiserver")
+	fs.DurationVar(&s.ControllerStartInterval.Duration, "controller-start-interval", s.ControllerStartInterval.Duration, "Interval between starting controller managers.")
+	fs.BoolVar(&s.EnableGarbageCollector, "enable-garbage-collector", s.EnableGarbageCollector, "Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-apiserver.")
+	fs.Int32Var(&s.ConcurrentGCSyncs, "concurrent-gc-syncs", s.ConcurrentGCSyncs, "The number of garbage collector workers that are allowed to sync concurrently.")
+	fs.Float32Var(&s.NodeEvictionRate, "node-eviction-rate", 0.1, "Number of nodes per second on which pods are deleted in case of node failure when a zone is healthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters.")
+	fs.Float32Var(&s.SecondaryNodeEvictionRate, "secondary-node-eviction-rate", 0.01, "Number of nodes per second on which pods are deleted in case of node failure when a zone is unhealthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. This value is implicitly overridden to 0 if the cluster size is smaller than --large-cluster-size-threshold.")
+	fs.Int32Var(&s.LargeClusterSizeThreshold, "large-cluster-size-threshold", 50, "Number of nodes from which NodeController treats the cluster as large for the eviction logic purposes. --secondary-node-eviction-rate is implicitly overridden to 0 for clusters this size or smaller.")
+	fs.Float32Var(&s.UnhealthyZoneThreshold, "unhealthy-zone-threshold", 0.55, "Fraction of Nodes in a zone which needs to be not Ready (minimum 3) for zone to be treated as unhealthy. ")
+
+	leaderelection.BindFlags(&s.LeaderElection, fs)
+	config.DefaultFeatureGate.AddFlag(fs)
+}

vendor/k8s.io/kubernetes/cmd/kube-controller-manager/app/plugins.go

@@ -0,0 +1,189 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	// This file exists to force the desired plugin implementations to be linked.
+	// This should probably be part of some configuration fed into the build for a
+	// given binary target.
+
+	"fmt"
+
+	// Cloud providers
+	"k8s.io/kubernetes/pkg/apis/componentconfig"
+	_ "k8s.io/kubernetes/pkg/cloudprovider/providers"
+
+	// Volume plugins
+	"github.com/golang/glog"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/aws"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/azure"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/openstack"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/photon"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/vsphere"
+	utilconfig "k8s.io/kubernetes/pkg/util/config"
+	"k8s.io/kubernetes/pkg/util/io"
+	"k8s.io/kubernetes/pkg/volume"
+	"k8s.io/kubernetes/pkg/volume/aws_ebs"
+	"k8s.io/kubernetes/pkg/volume/azure_dd"
+	"k8s.io/kubernetes/pkg/volume/cinder"
+	"k8s.io/kubernetes/pkg/volume/flexvolume"
+	"k8s.io/kubernetes/pkg/volume/flocker"
+	"k8s.io/kubernetes/pkg/volume/gce_pd"
+	"k8s.io/kubernetes/pkg/volume/glusterfs"
+	"k8s.io/kubernetes/pkg/volume/host_path"
+	"k8s.io/kubernetes/pkg/volume/nfs"
+	"k8s.io/kubernetes/pkg/volume/photon_pd"
+	"k8s.io/kubernetes/pkg/volume/quobyte"
+	"k8s.io/kubernetes/pkg/volume/rbd"
+	"k8s.io/kubernetes/pkg/volume/vsphere_volume"
+)
+
+// ProbeAttachableVolumePlugins collects all volume plugins for the attach/
+// detach controller. VolumeConfiguration is used ot get FlexVolumePluginDir
+// which specifies the directory to search for additional third party volume
+// plugins.
+// The list of plugins is manually compiled. This code and the plugin
+// initialization code for kubelet really, really need a through refactor.
+func ProbeAttachableVolumePlugins(config componentconfig.VolumeConfiguration) []volume.VolumePlugin {
+	allPlugins := []volume.VolumePlugin{}
+
+	allPlugins = append(allPlugins, aws_ebs.ProbeVolumePlugins()...)
+	allPlugins = append(allPlugins, gce_pd.ProbeVolumePlugins()...)
+	allPlugins = append(allPlugins, cinder.ProbeVolumePlugins()...)
+	allPlugins = append(allPlugins, flexvolume.ProbeVolumePlugins(config.FlexVolumePluginDir)...)
+	allPlugins = append(allPlugins, vsphere_volume.ProbeVolumePlugins()...)
+	allPlugins = append(allPlugins, azure_dd.ProbeVolumePlugins()...)
+	allPlugins = append(allPlugins, photon_pd.ProbeVolumePlugins()...)
+	return allPlugins
+}
+
+// ProbeControllerVolumePlugins collects all persistent volume plugins into an
+// easy to use list. Only volume plugins that implement any of
+// provisioner/recycler/deleter interface should be returned.
+func ProbeControllerVolumePlugins(cloud cloudprovider.Interface, config componentconfig.VolumeConfiguration) []volume.VolumePlugin {
+	allPlugins := []volume.VolumePlugin{}
+
+	// The list of plugins to probe is decided by this binary, not
+	// by dynamic linking or other "magic".  Plugins will be analyzed and
+	// initialized later.
+
+	// Each plugin can make use of VolumeConfig.  The single arg to this func contains *all* enumerated
+	// options meant to configure volume plugins.  From that single config, create an instance of volume.VolumeConfig
+	// for a specific plugin and pass that instance to the plugin's ProbeVolumePlugins(config) func.
+
+	// HostPath recycling is for testing and development purposes only!
+	hostPathConfig := volume.VolumeConfig{
+		RecyclerMinimumTimeout:   int(config.PersistentVolumeRecyclerConfiguration.MinimumTimeoutHostPath),
+		RecyclerTimeoutIncrement: int(config.PersistentVolumeRecyclerConfiguration.IncrementTimeoutHostPath),
+		RecyclerPodTemplate:      volume.NewPersistentVolumeRecyclerPodTemplate(),
+		ProvisioningEnabled:      config.EnableHostPathProvisioning,
+	}
+	if err := AttemptToLoadRecycler(config.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathHostPath, &hostPathConfig); err != nil {
+		glog.Fatalf("Could not create hostpath recycler pod from file %s: %+v", config.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathHostPath, err)
+	}
+	allPlugins = append(allPlugins, host_path.ProbeVolumePlugins(hostPathConfig)...)
+
+	nfsConfig := volume.VolumeConfig{
+		RecyclerMinimumTimeout:   int(config.PersistentVolumeRecyclerConfiguration.MinimumTimeoutNFS),
+		RecyclerTimeoutIncrement: int(config.PersistentVolumeRecyclerConfiguration.IncrementTimeoutNFS),
+		RecyclerPodTemplate:      volume.NewPersistentVolumeRecyclerPodTemplate(),
+	}
+	if err := AttemptToLoadRecycler(config.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathNFS, &nfsConfig); err != nil {
+		glog.Fatalf("Could not create NFS recycler pod from file %s: %+v", config.PersistentVolumeRecyclerConfiguration.PodTemplateFilePathNFS, err)
+	}
+	allPlugins = append(allPlugins, nfs.ProbeVolumePlugins(nfsConfig)...)
+	allPlugins = append(allPlugins, glusterfs.ProbeVolumePlugins()...)
+	// add rbd provisioner
+	allPlugins = append(allPlugins, rbd.ProbeVolumePlugins()...)
+	allPlugins = append(allPlugins, quobyte.ProbeVolumePlugins()...)
+
+	allPlugins = append(allPlugins, flocker.ProbeVolumePlugins()...)
+
+	if cloud != nil {
+		switch {
+		case aws.ProviderName == cloud.ProviderName():
+			allPlugins = append(allPlugins, aws_ebs.ProbeVolumePlugins()...)
+		case gce.ProviderName == cloud.ProviderName():
+			allPlugins = append(allPlugins, gce_pd.ProbeVolumePlugins()...)
+		case openstack.ProviderName == cloud.ProviderName():
+			allPlugins = append(allPlugins, cinder.ProbeVolumePlugins()...)
+		case vsphere.ProviderName == cloud.ProviderName():
+			allPlugins = append(allPlugins, vsphere_volume.ProbeVolumePlugins()...)
+		case azure.CloudProviderName == cloud.ProviderName():
+			allPlugins = append(allPlugins, azure_dd.ProbeVolumePlugins()...)
+		case photon.ProviderName == cloud.ProviderName():
+			allPlugins = append(allPlugins, photon_pd.ProbeVolumePlugins()...)
+		}
+	}
+
+	return allPlugins
+}
+
+// NewAlphaVolumeProvisioner returns a volume provisioner to use when running in
+// a cloud or development environment. The alpha implementation of provisioning
+// allows 1 implied provisioner per cloud and is here only for compatibility
+// with Kubernetes 1.3
+// TODO: remove in Kubernetes 1.5
+func NewAlphaVolumeProvisioner(cloud cloudprovider.Interface, config componentconfig.VolumeConfiguration) (volume.ProvisionableVolumePlugin, error) {
+	switch {
+	case !utilconfig.DefaultFeatureGate.DynamicVolumeProvisioning():
+		return nil, nil
+	case cloud == nil && config.EnableHostPathProvisioning:
+		return getProvisionablePluginFromVolumePlugins(host_path.ProbeVolumePlugins(
+			volume.VolumeConfig{
+				ProvisioningEnabled: true,
+			}))
+	case cloud != nil && aws.ProviderName == cloud.ProviderName():
+		return getProvisionablePluginFromVolumePlugins(aws_ebs.ProbeVolumePlugins())
+	case cloud != nil && gce.ProviderName == cloud.ProviderName():
+		return getProvisionablePluginFromVolumePlugins(gce_pd.ProbeVolumePlugins())
+	case cloud != nil && openstack.ProviderName == cloud.ProviderName():
+		return getProvisionablePluginFromVolumePlugins(cinder.ProbeVolumePlugins())
+	case cloud != nil && vsphere.ProviderName == cloud.ProviderName():
+		return getProvisionablePluginFromVolumePlugins(vsphere_volume.ProbeVolumePlugins())
+	case cloud != nil && azure.CloudProviderName == cloud.ProviderName():
+		return getProvisionablePluginFromVolumePlugins(azure_dd.ProbeVolumePlugins())
+	case cloud != nil && photon.ProviderName == cloud.ProviderName():
+		return getProvisionablePluginFromVolumePlugins(photon_pd.ProbeVolumePlugins())
+	}
+	return nil, nil
+}
+
+func getProvisionablePluginFromVolumePlugins(plugins []volume.VolumePlugin) (volume.ProvisionableVolumePlugin, error) {
+	for _, plugin := range plugins {
+		if provisonablePlugin, ok := plugin.(volume.ProvisionableVolumePlugin); ok {
+			return provisonablePlugin, nil
+		}
+	}
+	return nil, fmt.Errorf("ProvisionablePlugin expected but not found in %#v: ", plugins)
+}
+
+// AttemptToLoadRecycler tries decoding a pod from a filepath for use as a recycler for a volume.
+// If successful, this method will set the recycler on the config.
+// If unsuccessful, an error is returned. Function is exported for reuse downstream.
+func AttemptToLoadRecycler(path string, config *volume.VolumeConfig) error {
+	if path != "" {
+		recyclerPod, err := io.LoadPodFromFile(path)
+		if err != nil {
+			return err
+		}
+		config.RecyclerPodTemplate = recyclerPod
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/cmd/kube-controller-manager/controller-manager.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// The controller manager is responsible for monitoring replication
+// controllers, and creating corresponding pods to achieve the desired
+// state.  It uses the API to listen for new controllers and to create/delete
+// pods.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"k8s.io/kubernetes/cmd/kube-controller-manager/app"
+	"k8s.io/kubernetes/cmd/kube-controller-manager/app/options"
+	_ "k8s.io/kubernetes/pkg/client/metrics/prometheus" // for client metric registration
+	"k8s.io/kubernetes/pkg/healthz"
+	"k8s.io/kubernetes/pkg/util/flag"
+	"k8s.io/kubernetes/pkg/util/logs"
+	_ "k8s.io/kubernetes/pkg/util/workqueue/prometheus" // for workqueue metric registration
+	_ "k8s.io/kubernetes/pkg/version/prometheus"        // for version metric registration
+	"k8s.io/kubernetes/pkg/version/verflag"
+
+	"github.com/spf13/pflag"
+)
+
+func init() {
+	healthz.DefaultHealthz()
+}
+
+func main() {
+	s := options.NewCMServer()
+	s.AddFlags(pflag.CommandLine)
+
+	flag.InitFlags()
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	verflag.PrintAndExitIfRequested()
+
+	if err := app.Run(s); err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		os.Exit(1)
+	}
+}

vendor/k8s.io/kubernetes/cmd/kube-discovery/BUILD

@@ -0,0 +1,18 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "kube-discovery",
+    srcs = ["kubediscovery.go"],
+    tags = ["automanaged"],
+    deps = ["//cmd/kube-discovery/app:go_default_library"],
+)

vendor/k8s.io/kubernetes/cmd/kube-discovery/app/BUILD

@@ -0,0 +1,33 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "handlers.go",
+        "model.go",
+        "routes.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//vendor:github.com/gorilla/mux",
+        "//vendor:github.com/square/go-jose",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["handlers_test.go"],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = ["//vendor:github.com/square/go-jose"],
+)

vendor/k8s.io/kubernetes/cmd/kube-discovery/app/handlers.go

@@ -0,0 +1,203 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package discovery
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"net/http"
+
+	"github.com/square/go-jose"
+)
+
+const secretPath = "/tmp/secret"
+
+// CAPath is the expected location of our cluster's CA to be distributed to
+// clients looking to connect. Because we expect to use kubernetes secrets
+// for the time being, this file is expected to be a base64 encoded version
+// of the normal cert PEM.
+const CAPath = secretPath + "/ca.pem"
+
+// caLoader is an interface for abstracting how we load the CA certificates
+// for the cluster.
+type caLoader interface {
+	LoadPEM() (string, error)
+}
+
+// fsCALoader is a caLoader for loading the PEM encoded CA from
+// /tmp/secret/ca.pem.
+type fsCALoader struct {
+	certData string
+}
+
+func (cl *fsCALoader) LoadPEM() (string, error) {
+	if cl.certData == "" {
+		data, err := ioutil.ReadFile(CAPath)
+		if err != nil {
+			return "", err
+		}
+
+		cl.certData = string(data)
+	}
+
+	return cl.certData, nil
+}
+
+const TokenMapPath = secretPath + "/token-map.json"
+const EndpointListPath = secretPath + "/endpoint-list.json"
+
+// tokenLoader is an interface for abstracting how we validate
+// token IDs and lookup their corresponding token.
+type tokenLoader interface {
+	// Lookup returns the token for a given token ID, or an error if the token ID
+	// does not exist. Both token and it's ID are expected be strings.
+	LoadAndLookup(tokenID string) (string, error)
+}
+
+type jsonFileTokenLoader struct {
+	tokenMap map[string]string
+}
+
+func (tl *jsonFileTokenLoader) LoadAndLookup(tokenID string) (string, error) {
+	if len(tl.tokenMap) == 0 {
+		data, err := ioutil.ReadFile(TokenMapPath)
+		if err != nil {
+			return "", err
+		}
+		if err := json.Unmarshal(data, &tl.tokenMap); err != nil {
+			return "", err
+		}
+	}
+	if val, ok := tl.tokenMap[tokenID]; ok {
+		return val, nil
+	}
+	return "", errors.New(fmt.Sprintf("invalid token: %s", tokenID))
+}
+
+type endpointsLoader interface {
+	LoadList() ([]string, error)
+}
+
+type jsonFileEndpointsLoader struct {
+	endpoints []string
+}
+
+func (el *jsonFileEndpointsLoader) LoadList() ([]string, error) {
+	if len(el.endpoints) == 0 {
+		data, err := ioutil.ReadFile(EndpointListPath)
+		if err != nil {
+			return nil, err
+		}
+		if err := json.Unmarshal(data, &el.endpoints); err != nil {
+			return nil, err
+		}
+	}
+	return el.endpoints, nil
+}
+
+// ClusterInfoHandler implements the http.ServeHTTP method and allows us to
+// mock out portions of the request handler in tests.
+type ClusterInfoHandler struct {
+	tokenLoader     tokenLoader
+	caLoader        caLoader
+	endpointsLoader endpointsLoader
+}
+
+func NewClusterInfoHandler() *ClusterInfoHandler {
+	return &ClusterInfoHandler{
+		tokenLoader:     &jsonFileTokenLoader{},
+		caLoader:        &fsCALoader{},
+		endpointsLoader: &jsonFileEndpointsLoader{},
+	}
+}
+
+func (cih *ClusterInfoHandler) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
+	tokenID := req.FormValue("token-id")
+	log.Printf("Got token ID: %s", tokenID)
+	token, err := cih.tokenLoader.LoadAndLookup(tokenID)
+	if err != nil {
+		log.Print(err)
+		http.Error(resp, "Forbidden", http.StatusForbidden)
+		return
+	}
+	log.Printf("Loaded token: %s", token)
+
+	// TODO probably should not leak server-side errors to the client
+	caPEM, err := cih.caLoader.LoadPEM()
+	log.Printf("Loaded CA: %s", caPEM)
+	if err != nil {
+		err = fmt.Errorf("Error loading root CA certificate data: %s", err)
+		log.Println(err)
+		http.Error(resp, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	endpoints, err := cih.endpointsLoader.LoadList()
+	if err != nil {
+		err = fmt.Errorf("Error loading list of API endpoints: %s", err)
+		log.Println(err)
+		http.Error(resp, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	clusterInfo := ClusterInfo{
+		CertificateAuthorities: []string{caPEM},
+		Endpoints:              endpoints,
+	}
+
+	// Instantiate an signer using HMAC-SHA256.
+	hmacKey := []byte(token)
+
+	log.Printf("Key is %d bytes long", len(hmacKey))
+	signer, err := jose.NewSigner(jose.HS256, hmacKey)
+	if err != nil {
+		err = fmt.Errorf("Error creating JWS signer: %s", err)
+		log.Println(err)
+		http.Error(resp, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	payload, err := json.Marshal(clusterInfo)
+	if err != nil {
+		err = fmt.Errorf("Error serializing clusterInfo to JSON: %s", err)
+		log.Println(err)
+		http.Error(resp, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	// Sign a sample payload. Calling the signer returns a protected JWS object,
+	// which can then be serialized for output afterwards. An error would
+	// indicate a problem in an underlying cryptographic primitive.
+	jws, err := signer.Sign(payload)
+	if err != nil {
+		err = fmt.Errorf("Error signing clusterInfo with JWS: %s", err)
+		log.Println(err)
+		http.Error(resp, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	// Serialize the encrypted object using the full serialization format.
+	// Alternatively you can also use the compact format here by calling
+	// object.CompactSerialize() instead.
+	serialized := jws.FullSerialize()
+
+	resp.Write([]byte(serialized))
+
+}

vendor/k8s.io/kubernetes/cmd/kube-discovery/app/handlers_test.go

@@ -0,0 +1,208 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package discovery
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/square/go-jose"
+)
+
+type mockTokenLoader struct {
+	tokenID string
+	token   string
+}
+
+func (tl *mockTokenLoader) LoadAndLookup(tokenID string) (string, error) {
+	if tokenID == tl.tokenID {
+		return tl.token, nil
+	}
+	return "", errors.New(fmt.Sprintf("invalid token: %s", tokenID))
+}
+
+const mockEndpoint1 = "https://192.168.1.5:8080"
+const mockEndpoint2 = "https://192.168.1.6:8080"
+
+type mockEndpointsLoader struct {
+}
+
+func (el *mockEndpointsLoader) LoadList() ([]string, error) {
+	return []string{mockEndpoint1, mockEndpoint2}, nil
+}
+
+const mockCA = "---BEGIN------END---DUMMYDATA"
+
+type mockCALoader struct {
+}
+
+func (cl *mockCALoader) LoadPEM() (string, error) {
+	return mockCA, nil
+}
+
+const mockTokenID = "AAAAAA"
+const mockToken = "9537434E638E4378"
+
+const mockTokenIDCustom = "SHAREDSECRET"
+const mockTokenCustom = "VERYSECRETTOKEN"
+
+func TestClusterInfoIndex(t *testing.T) {
+	longToken := strings.Repeat("a", 1000)
+	tests := map[string]struct {
+		tokenID          string // token ID the mock loader will use
+		token            string // token the mock loader will use
+		reqTokenID       string // token ID the will request with
+		reqToken         string // token the caller will validate response with
+		expStatus        int
+		expVerifyFailure bool
+	}{
+		"no token": {
+			tokenID:    mockTokenID,
+			token:      mockToken,
+			reqTokenID: "",
+			reqToken:   "",
+			expStatus:  http.StatusForbidden,
+		},
+		"valid token ID": {
+			tokenID:    mockTokenID,
+			token:      mockToken,
+			reqTokenID: mockTokenID,
+			reqToken:   mockToken,
+			expStatus:  http.StatusOK,
+		},
+		"valid arbitrary string token": {
+			tokenID:    mockTokenIDCustom,
+			token:      mockTokenCustom,
+			reqTokenID: mockTokenIDCustom,
+			reqToken:   mockTokenCustom,
+			expStatus:  http.StatusOK,
+		},
+		"valid arbitrary long string token": {
+			tokenID:    "LONGTOKENTEST",
+			token:      longToken,
+			reqTokenID: "LONGTOKENTEST",
+			reqToken:   longToken,
+			expStatus:  http.StatusOK,
+		},
+		"invalid token ID": {
+			tokenID:    mockTokenID,
+			token:      mockToken,
+			reqTokenID: "BADTOKENID",
+			reqToken:   mockToken,
+			expStatus:  http.StatusForbidden,
+		},
+		"invalid token": {
+			tokenID:          mockTokenID,
+			token:            mockToken,
+			reqTokenID:       mockTokenID,
+			reqToken:         "badtoken",
+			expStatus:        http.StatusOK,
+			expVerifyFailure: true,
+		},
+	}
+
+	for name, test := range tests {
+		t.Logf("Running test: %s", name)
+		tokenLoader := &mockTokenLoader{test.tokenID, test.token}
+		// Create a request to pass to our handler. We don't have any query parameters for now, so we'll
+		// pass 'nil' as the third parameter.
+		url := "/cluster-info/v1/"
+		if test.tokenID != "" {
+			url = fmt.Sprintf("%s?token-id=%s", url, test.reqTokenID)
+		}
+		req, err := http.NewRequest("GET", url, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		rr := httptest.NewRecorder()
+		handler := &ClusterInfoHandler{
+			tokenLoader:     tokenLoader,
+			caLoader:        &mockCALoader{},
+			endpointsLoader: &mockEndpointsLoader{},
+		}
+
+		handler.ServeHTTP(rr, req)
+
+		if status := rr.Code; status != test.expStatus {
+			t.Errorf("handler returned wrong status code: got %v want %v",
+				status, test.expStatus)
+			continue
+		}
+
+		// If we were expecting valid status validate the body:
+		if test.expStatus == http.StatusOK {
+			var ci ClusterInfo
+
+			body := string(rr.Body.Bytes())
+
+			// Parse the JSON web signature:
+			jws, err := jose.ParseSigned(body)
+			if err != nil {
+				t.Errorf("Error parsing JWS from request body: %s", err)
+				continue
+			}
+
+			// Now we can verify the signature on the payload. An error here would
+			// indicate the the message failed to verify, e.g. because the signature was
+			// broken or the message was tampered with.
+			var clusterInfoBytes []byte
+			hmacTestKey := []byte(test.reqToken)
+			clusterInfoBytes, err = jws.Verify(hmacTestKey)
+
+			if test.expVerifyFailure {
+				if err == nil {
+					t.Errorf("Signature verification did not fail as expected.")
+				}
+				// We are done the test here either way.
+				continue
+			}
+
+			if err != nil {
+				t.Errorf("Error verifing signature: %s", err)
+				continue
+			}
+
+			err = json.Unmarshal(clusterInfoBytes, &ci)
+			if err != nil {
+				t.Errorf("Unable to unmarshall payload to JSON: error=%s body=%s", err, rr.Body.String())
+				continue
+			}
+			if len(ci.Endpoints) != 2 {
+				t.Errorf("Expected 2 endpoints, got: %d", len(ci.Endpoints))
+			}
+			if mockEndpoint1 != ci.Endpoints[0] {
+				t.Errorf("Unexpected endpoint: %s", ci.Endpoints[0])
+			}
+			if mockEndpoint2 != ci.Endpoints[1] {
+				t.Errorf("Unexpected endpoint: %s", ci.Endpoints[1])
+			}
+
+			if len(ci.CertificateAuthorities) != 1 {
+				t.Errorf("Expected 1 root certificate, got: %d", len(ci.CertificateAuthorities))
+			}
+			if ci.CertificateAuthorities[0] != mockCA {
+				t.Errorf("Expected CA: %s, got: %s", mockCA, ci.CertificateAuthorities[0])
+			}
+		}
+	}
+}

vendor/k8s.io/kubernetes/cmd/kube-discovery/app/model.go

@@ -0,0 +1,24 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package discovery
+
+type ClusterInfo struct {
+	// TODO Kind, apiVersion
+	// TODO clusterId, fetchedTime, expiredTime
+	CertificateAuthorities []string `json:"certificateAuthorities,omitempty"`
+	Endpoints              []string `json:"endpoints,omitempty"`
+}

vendor/k8s.io/kubernetes/cmd/kube-discovery/app/routes.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package discovery
+
+import (
+	"net/http"
+
+	"github.com/gorilla/mux"
+)
+
+type Route struct {
+	Name    string
+	Method  string
+	Pattern string
+	Handler http.Handler
+}
+
+type Routes []Route
+
+var routes = Routes{
+	Route{
+		"ClusterInfoIndex",
+		"GET",
+		"/cluster-info/v1/",
+		NewClusterInfoHandler(),
+	},
+}
+
+func NewRouter() *mux.Router {
+
+	router := mux.NewRouter().StrictSlash(true)
+	for _, route := range routes {
+		router.
+			Methods(route.Method).
+			Path(route.Pattern).
+			Name(route.Name).
+			Handler(route.Handler)
+	}
+
+	return router
+}

vendor/k8s.io/kubernetes/cmd/kube-discovery/kubediscovery.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"log"
+	"net/http"
+	"os"
+
+	kd "k8s.io/kubernetes/cmd/kube-discovery/app"
+)
+
+func main() {
+	// Make sure we can load critical files, and be nice to the user by
+	// printing descriptive error message when we fail.
+	for desc, path := range map[string]string{
+		"root CA certificate":   kd.CAPath,
+		"token map file":        kd.TokenMapPath,
+		"list of API endpoints": kd.EndpointListPath,
+	} {
+		if _, err := os.Stat(path); os.IsNotExist(err) {
+			log.Fatalf("%s does not exist: %s", desc, path)
+		}
+		// Test read permissions
+		file, err := os.Open(path)
+		if err != nil {
+			log.Fatalf("Unable to open %s (%q [%s])", desc, path, err)
+		}
+		file.Close()
+	}
+
+	router := kd.NewRouter()
+	log.Printf("Listening for requests on port 9898.")
+	log.Fatal(http.ListenAndServe(":9898", router))
+}

vendor/k8s.io/kubernetes/cmd/kube-dns/BUILD

@@ -0,0 +1,29 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "kube-dns",
+    srcs = ["dns.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-dns/app:go_default_library",
+        "//cmd/kube-dns/app/options:go_default_library",
+        "//pkg/client/metrics/prometheus:go_default_library",
+        "//pkg/util/flag:go_default_library",
+        "//pkg/util/logs:go_default_library",
+        "//pkg/version:go_default_library",
+        "//pkg/version/prometheus:go_default_library",
+        "//pkg/version/verflag:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-dns/app/BUILD

@@ -0,0 +1,30 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["server.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-dns/app/options:go_default_library",
+        "//pkg/client/clientset_generated/release_1_5:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/client/unversioned/clientcmd:go_default_library",
+        "//pkg/dns:go_default_library",
+        "//pkg/dns/config:go_default_library",
+        "//pkg/runtime/schema:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/skynetservices/skydns/metrics",
+        "//vendor:github.com/skynetservices/skydns/server",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-dns/app/options/BUILD

@@ -0,0 +1,23 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["options.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/dns/federation:go_default_library",
+        "//pkg/util/validation:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-dns/app/options/options.go

@@ -0,0 +1,163 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package options contains flags for initializing a proxy.
+package options
+
+import (
+	"fmt"
+	_ "net/http/pprof"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/spf13/pflag"
+	"k8s.io/kubernetes/pkg/api"
+	fed "k8s.io/kubernetes/pkg/dns/federation"
+	"k8s.io/kubernetes/pkg/util/validation"
+)
+
+type KubeDNSConfig struct {
+	ClusterDomain  string
+	KubeConfigFile string
+	KubeMasterURL  string
+
+	HealthzPort    int
+	DNSBindAddress string
+	DNSPort        int
+
+	Federations map[string]string
+
+	ConfigMapNs string
+	ConfigMap   string
+}
+
+func NewKubeDNSConfig() *KubeDNSConfig {
+	return &KubeDNSConfig{
+		ClusterDomain:  "cluster.local.",
+		HealthzPort:    8081,
+		DNSBindAddress: "0.0.0.0",
+		DNSPort:        53,
+
+		Federations: make(map[string]string),
+
+		ConfigMapNs: api.NamespaceSystem,
+		ConfigMap:   "", // default to using command line flags
+	}
+}
+
+type clusterDomainVar struct {
+	val *string
+}
+
+func (m clusterDomainVar) Set(v string) error {
+	v = strings.TrimSuffix(v, ".")
+	segments := strings.Split(v, ".")
+	for _, segment := range segments {
+		if errs := validation.IsDNS1123Label(segment); len(errs) > 0 {
+			return fmt.Errorf("Not a valid DNS label. %v", errs)
+		}
+	}
+	if !strings.HasSuffix(v, ".") {
+		v = fmt.Sprintf("%s.", v)
+	}
+	*m.val = v
+	return nil
+}
+
+func (m clusterDomainVar) String() string {
+	return *m.val
+}
+
+func (m clusterDomainVar) Type() string {
+	return "string"
+}
+
+type kubeMasterURLVar struct {
+	val *string
+}
+
+func (m kubeMasterURLVar) Set(v string) error {
+	parsedURL, err := url.Parse(os.ExpandEnv(v))
+	if err != nil {
+		return fmt.Errorf("failed to parse kube-master-url")
+	}
+	if parsedURL.Scheme == "" || parsedURL.Host == "" || parsedURL.Host == ":" {
+		return fmt.Errorf("invalid kube-master-url specified")
+	}
+	*m.val = v
+	return nil
+}
+
+func (m kubeMasterURLVar) String() string {
+	return *m.val
+}
+
+func (m kubeMasterURLVar) Type() string {
+	return "string"
+}
+
+type federationsVar struct {
+	nameDomainMap map[string]string
+}
+
+func (fv federationsVar) Set(keyVal string) error {
+	return fed.ParseFederationsFlag(keyVal, fv.nameDomainMap)
+}
+
+func (fv federationsVar) String() string {
+	var splits []string
+	for name, domain := range fv.nameDomainMap {
+		splits = append(splits, fmt.Sprintf("%s=%s", name, domain))
+	}
+	return strings.Join(splits, ",")
+}
+
+func (fv federationsVar) Type() string {
+	return "[]string"
+}
+
+func (s *KubeDNSConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.Var(clusterDomainVar{&s.ClusterDomain}, "domain",
+		"domain under which to create names")
+
+	fs.StringVar(&s.KubeConfigFile, "kubecfg-file", s.KubeConfigFile,
+		"Location of kubecfg file for access to kubernetes master service;"+
+			" --kube-master-url overrides the URL part of this; if neither this nor"+
+			" --kube-master-url are provided, defaults to service account tokens")
+	fs.Var(kubeMasterURLVar{&s.KubeMasterURL}, "kube-master-url",
+		"URL to reach kubernetes master. Env variables in this flag will be expanded.")
+
+	fs.IntVar(&s.HealthzPort, "healthz-port", s.HealthzPort,
+		"port on which to serve a kube-dns HTTP readiness probe.")
+	fs.StringVar(&s.DNSBindAddress, "dns-bind-address", s.DNSBindAddress,
+		"address on which to serve DNS requests.")
+	fs.IntVar(&s.DNSPort, "dns-port", s.DNSPort, "port on which to serve DNS requests.")
+
+	fs.Var(federationsVar{s.Federations}, "federations",
+		"a comma separated list of the federation names and their corresponding"+
+			" domain names to which this cluster belongs. Example:"+
+			" \"myfederation1=example.com,myfederation2=example2.com,myfederation3=example.com\"."+
+			" It is an error to set both the federations and config-map flags.")
+	fs.MarkDeprecated("federations", "use config-map instead. Will be removed in future version")
+
+	fs.StringVar(&s.ConfigMapNs, "config-map-namespace", s.ConfigMapNs,
+		"namespace for the config-map")
+	fs.StringVar(&s.ConfigMap, "config-map", s.ConfigMap,
+		"config-map name. If empty, then the config-map will not used. Cannot be "+
+			" used in conjunction with federations flag. config-map contains "+
+			"dynamically adjustable configuration.")
+}

vendor/k8s.io/kubernetes/cmd/kube-dns/app/server.go

@@ -0,0 +1,171 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/golang/glog"
+	"github.com/skynetservices/skydns/metrics"
+	"github.com/skynetservices/skydns/server"
+	"github.com/spf13/pflag"
+
+	"k8s.io/kubernetes/cmd/kube-dns/app/options"
+	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	kclientcmd "k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
+	kdns "k8s.io/kubernetes/pkg/dns"
+	dnsconfig "k8s.io/kubernetes/pkg/dns/config"
+	"k8s.io/kubernetes/pkg/runtime/schema"
+)
+
+type KubeDNSServer struct {
+	// DNS domain name.
+	domain         string
+	healthzPort    int
+	dnsBindAddress string
+	dnsPort        int
+	kd             *kdns.KubeDNS
+}
+
+func NewKubeDNSServerDefault(config *options.KubeDNSConfig) *KubeDNSServer {
+	ks := KubeDNSServer{domain: config.ClusterDomain}
+
+	kubeClient, err := newKubeClient(config)
+	if err != nil {
+		glog.Fatalf("Failed to create a kubernetes client: %v", err)
+	}
+
+	ks.healthzPort = config.HealthzPort
+	ks.dnsBindAddress = config.DNSBindAddress
+	ks.dnsPort = config.DNSPort
+
+	var configSync dnsconfig.Sync
+	if config.ConfigMap == "" {
+		glog.V(0).Infof("ConfigMap not configured, using values from command line flags")
+		configSync = dnsconfig.NewNopSync(
+			&dnsconfig.Config{Federations: config.Federations})
+	} else {
+		glog.V(0).Infof("Using configuration read from ConfigMap: %v:%v",
+			config.ConfigMapNs, config.ConfigMap)
+		configSync = dnsconfig.NewSync(
+			kubeClient, config.ConfigMapNs, config.ConfigMap)
+	}
+
+	ks.kd = kdns.NewKubeDNS(kubeClient, config.ClusterDomain, configSync)
+
+	return &ks
+}
+
+// TODO: evaluate using pkg/client/clientcmd
+func newKubeClient(dnsConfig *options.KubeDNSConfig) (clientset.Interface, error) {
+	var (
+		config *restclient.Config
+		err    error
+	)
+
+	if dnsConfig.KubeMasterURL != "" && dnsConfig.KubeConfigFile == "" {
+		// Only --kube-master-url was provided.
+		config = &restclient.Config{
+			Host:          dnsConfig.KubeMasterURL,
+			ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: "v1"}},
+		}
+	} else {
+		// We either have:
+		//  1) --kube-master-url and --kubecfg-file
+		//  2) just --kubecfg-file
+		//  3) neither flag
+		// In any case, the logic is the same.  If (3), this will automatically
+		// fall back on the service account token.
+		overrides := &kclientcmd.ConfigOverrides{}
+		overrides.ClusterInfo.Server = dnsConfig.KubeMasterURL                                // might be "", but that is OK
+		rules := &kclientcmd.ClientConfigLoadingRules{ExplicitPath: dnsConfig.KubeConfigFile} // might be "", but that is OK
+		if config, err = kclientcmd.NewNonInteractiveDeferredLoadingClientConfig(rules, overrides).ClientConfig(); err != nil {
+			return nil, err
+		}
+	}
+
+	glog.V(0).Infof("Using %v for kubernetes master, kubernetes API: %v",
+		config.Host, config.GroupVersion)
+	return clientset.NewForConfig(config)
+}
+
+func (server *KubeDNSServer) Run() {
+	pflag.VisitAll(func(flag *pflag.Flag) {
+		glog.V(0).Infof("FLAG: --%s=%q", flag.Name, flag.Value)
+	})
+	setupSignalHandlers()
+	server.startSkyDNSServer()
+	server.kd.Start()
+	server.setupHandlers()
+
+	glog.V(0).Infof("Status HTTP port %v", server.healthzPort)
+	glog.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", server.healthzPort), nil))
+}
+
+// setupHealthzHandlers sets up a readiness and liveness endpoint for kube2sky.
+func (server *KubeDNSServer) setupHandlers() {
+	glog.V(0).Infof("Setting up Healthz Handler (/readiness)")
+	http.HandleFunc("/readiness", func(w http.ResponseWriter, req *http.Request) {
+		fmt.Fprintf(w, "ok\n")
+	})
+
+	glog.V(0).Infof("Setting up cache handler (/cache)")
+	http.HandleFunc("/cache", func(w http.ResponseWriter, req *http.Request) {
+		serializedJSON, err := server.kd.GetCacheAsJSON()
+		if err == nil {
+			fmt.Fprint(w, serializedJSON)
+		} else {
+			w.WriteHeader(http.StatusInternalServerError)
+			fmt.Fprint(w, err)
+		}
+	})
+}
+
+// setupSignalHandlers installs signal handler to ignore SIGINT and
+// SIGTERM. This daemon will be killed by SIGKILL after the grace
+// period to allow for some manner of graceful shutdown.
+func setupSignalHandlers() {
+	sigChan := make(chan os.Signal)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		glog.V(0).Infof("Ignoring signal %v (can only be terminated by SIGKILL)", <-sigChan)
+	}()
+}
+
+func (d *KubeDNSServer) startSkyDNSServer() {
+	glog.V(0).Infof("Starting SkyDNS server (%v:%v)", d.dnsBindAddress, d.dnsPort)
+	skydnsConfig := &server.Config{
+		Domain:  d.domain,
+		DnsAddr: fmt.Sprintf("%s:%d", d.dnsBindAddress, d.dnsPort),
+	}
+	server.SetDefaults(skydnsConfig)
+	s := server.New(d.kd, skydnsConfig)
+	if err := metrics.Metrics(); err != nil {
+		glog.Fatalf("Skydns metrics error: %s", err)
+	} else if metrics.Port != "" {
+		glog.V(0).Infof("Skydns metrics enabled (%v:%v)", metrics.Path, metrics.Port)
+	} else {
+		glog.V(0).Infof("Skydns metrics not enabled")
+	}
+
+	go s.Run()
+}

vendor/k8s.io/kubernetes/cmd/kube-dns/dns.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"github.com/golang/glog"
+	"github.com/spf13/pflag"
+	"k8s.io/kubernetes/cmd/kube-dns/app"
+	"k8s.io/kubernetes/cmd/kube-dns/app/options"
+	_ "k8s.io/kubernetes/pkg/client/metrics/prometheus" // for client metric registration
+	"k8s.io/kubernetes/pkg/util/flag"
+	"k8s.io/kubernetes/pkg/util/logs"
+	"k8s.io/kubernetes/pkg/version"
+	_ "k8s.io/kubernetes/pkg/version/prometheus" // for version metric registration
+	"k8s.io/kubernetes/pkg/version/verflag"
+)
+
+func main() {
+	config := options.NewKubeDNSConfig()
+	config.AddFlags(pflag.CommandLine)
+
+	flag.InitFlags()
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	verflag.PrintAndExitIfRequested()
+
+	glog.V(0).Infof("version: %+v", version.Get())
+
+	server := app.NewKubeDNSServerDefault(config)
+	server.Run()
+}

vendor/k8s.io/kubernetes/cmd/kube-proxy/BUILD

@@ -0,0 +1,28 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "kube-proxy",
+    srcs = ["proxy.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-proxy/app:go_default_library",
+        "//cmd/kube-proxy/app/options:go_default_library",
+        "//pkg/client/metrics/prometheus:go_default_library",
+        "//pkg/healthz:go_default_library",
+        "//pkg/util/flag:go_default_library",
+        "//pkg/util/logs:go_default_library",
+        "//pkg/version/prometheus:go_default_library",
+        "//pkg/version/verflag:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-proxy/app/BUILD

@@ -0,0 +1,65 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "conntrack.go",
+        "server.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-proxy/app/options:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset/typed/core/internalversion:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/client/unversioned/clientcmd:go_default_library",
+        "//pkg/client/unversioned/clientcmd/api:go_default_library",
+        "//pkg/proxy:go_default_library",
+        "//pkg/proxy/config:go_default_library",
+        "//pkg/proxy/iptables:go_default_library",
+        "//pkg/proxy/userspace:go_default_library",
+        "//pkg/proxy/winuserspace:go_default_library",
+        "//pkg/types:go_default_library",
+        "//pkg/util/configz:go_default_library",
+        "//pkg/util/dbus:go_default_library",
+        "//pkg/util/exec:go_default_library",
+        "//pkg/util/iptables:go_default_library",
+        "//pkg/util/mount:go_default_library",
+        "//pkg/util/net:go_default_library",
+        "//pkg/util/netsh:go_default_library",
+        "//pkg/util/node:go_default_library",
+        "//pkg/util/oom:go_default_library",
+        "//pkg/util/resourcecontainer:go_default_library",
+        "//pkg/util/sysctl:go_default_library",
+        "//pkg/util/wait:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/spf13/cobra",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["server_test.go"],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-proxy/app/options:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/apis/componentconfig:go_default_library",
+        "//pkg/util/iptables:go_default_library",
+        "//vendor:github.com/stretchr/testify/assert",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-proxy/app/conntrack.go

@@ -0,0 +1,119 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	"errors"
+	"io/ioutil"
+	"strconv"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/pkg/util/mount"
+	"k8s.io/kubernetes/pkg/util/sysctl"
+)
+
+// Conntracker is an interface to the global sysctl. Descriptions of the various
+// sysctl fields can be found here:
+//
+// https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt
+type Conntracker interface {
+	// SetMax adjusts nf_conntrack_max.
+	SetMax(max int) error
+	// SetTCPEstablishedTimeout adjusts nf_conntrack_tcp_timeout_established.
+	SetTCPEstablishedTimeout(seconds int) error
+	// SetTCPCloseWaitTimeout nf_conntrack_tcp_timeout_close_wait.
+	SetTCPCloseWaitTimeout(seconds int) error
+}
+
+type realConntracker struct{}
+
+var readOnlySysFSError = errors.New("readOnlySysFS")
+
+func (rct realConntracker) SetMax(max int) error {
+	if err := rct.setIntSysCtl("nf_conntrack_max", max); err != nil {
+		return err
+	}
+	// sysfs is expected to be mounted as 'rw'. However, it may be
+	// unexpectedly mounted as 'ro' by docker because of a known docker
+	// issue (https://github.com/docker/docker/issues/24000). Setting
+	// conntrack will fail when sysfs is readonly. When that happens, we
+	// don't set conntrack hashsize and return a special error
+	// readOnlySysFSError here. The caller should deal with
+	// readOnlySysFSError differently.
+	writable, err := isSysFSWritable()
+	if err != nil {
+		return err
+	}
+	if !writable {
+		return readOnlySysFSError
+	}
+	// TODO: generify this and sysctl to a new sysfs.WriteInt()
+	glog.Infof("Setting conntrack hashsize to %d", max/4)
+	return writeIntStringFile("/sys/module/nf_conntrack/parameters/hashsize", max/4)
+}
+
+func (rct realConntracker) SetTCPEstablishedTimeout(seconds int) error {
+	return rct.setIntSysCtl("nf_conntrack_tcp_timeout_established", seconds)
+}
+
+func (rct realConntracker) SetTCPCloseWaitTimeout(seconds int) error {
+	return rct.setIntSysCtl("nf_conntrack_tcp_timeout_close_wait", seconds)
+}
+
+func (realConntracker) setIntSysCtl(name string, value int) error {
+	entry := "net/netfilter/" + name
+
+	glog.Infof("Set sysctl '%v' to %v", entry, value)
+	if err := sysctl.New().SetSysctl(entry, value); err != nil {
+		return err
+	}
+	return nil
+}
+
+// isSysFSWritable checks /proc/mounts to see whether sysfs is 'rw' or not.
+func isSysFSWritable() (bool, error) {
+	const permWritable = "rw"
+	const sysfsDevice = "sysfs"
+	m := mount.New("" /* default mount path */)
+	mountPoints, err := m.List()
+	if err != nil {
+		glog.Errorf("failed to list mount points: %v", err)
+		return false, err
+	}
+
+	for _, mountPoint := range mountPoints {
+		const sysfsDevice = "sysfs"
+		if mountPoint.Type != sysfsDevice {
+			continue
+		}
+		// Check whether sysfs is 'rw'
+		const permWritable = "rw"
+		if len(mountPoint.Opts) > 0 && mountPoint.Opts[0] == permWritable {
+			return true, nil
+		}
+		glog.Errorf("sysfs is not writable: %+v (mount options are %v)",
+			mountPoint, mountPoint.Opts)
+		return false, readOnlySysFSError
+	}
+
+	return false, errors.New("No sysfs mounted")
+}
+
+func writeIntStringFile(filename string, value int) error {
+	return ioutil.WriteFile(filename, []byte(strconv.Itoa(value)), 0640)
+}

vendor/k8s.io/kubernetes/cmd/kube-proxy/app/options/BUILD

@@ -0,0 +1,26 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["options.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/apis/componentconfig:go_default_library",
+        "//pkg/apis/componentconfig/v1alpha1:go_default_library",
+        "//pkg/kubelet/qos:go_default_library",
+        "//pkg/util:go_default_library",
+        "//pkg/util/config:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kube-proxy/app/options/options.go

@@ -0,0 +1,104 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package options contains flags for initializing a proxy.
+package options
+
+import (
+	_ "net/http/pprof"
+	"time"
+
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/apis/componentconfig"
+	"k8s.io/kubernetes/pkg/apis/componentconfig/v1alpha1"
+	"k8s.io/kubernetes/pkg/kubelet/qos"
+	"k8s.io/kubernetes/pkg/util"
+	"k8s.io/kubernetes/pkg/util/config"
+
+	"github.com/spf13/pflag"
+)
+
+const (
+	ExperimentalProxyModeAnnotation = "net.experimental.kubernetes.io/proxy-mode"
+)
+
+// ProxyServerConfig configures and runs a Kubernetes proxy server
+type ProxyServerConfig struct {
+	componentconfig.KubeProxyConfiguration
+	ResourceContainer string
+	ContentType       string
+	KubeAPIQPS        float32
+	KubeAPIBurst      int32
+	ConfigSyncPeriod  time.Duration
+	CleanupAndExit    bool
+	NodeRef           *api.ObjectReference
+	Master            string
+	Kubeconfig        string
+}
+
+func NewProxyConfig() *ProxyServerConfig {
+	versioned := &v1alpha1.KubeProxyConfiguration{}
+	api.Scheme.Default(versioned)
+	cfg := componentconfig.KubeProxyConfiguration{}
+	api.Scheme.Convert(versioned, &cfg, nil)
+	return &ProxyServerConfig{
+		KubeProxyConfiguration: cfg,
+		ContentType:            "application/vnd.kubernetes.protobuf",
+		KubeAPIQPS:             5.0,
+		KubeAPIBurst:           10,
+		ConfigSyncPeriod:       15 * time.Minute,
+	}
+}
+
+// AddFlags adds flags for a specific ProxyServer to the specified FlagSet
+func (s *ProxyServerConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.Var(componentconfig.IPVar{Val: &s.BindAddress}, "bind-address", "The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces)")
+	fs.StringVar(&s.Master, "master", s.Master, "The address of the Kubernetes API server (overrides any value in kubeconfig)")
+	fs.Int32Var(&s.HealthzPort, "healthz-port", s.HealthzPort, "The port to bind the health check server. Use 0 to disable.")
+	fs.Var(componentconfig.IPVar{Val: &s.HealthzBindAddress}, "healthz-bind-address", "The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces)")
+	fs.Int32Var(s.OOMScoreAdj, "oom-score-adj", util.Int32PtrDerefOr(s.OOMScoreAdj, int32(qos.KubeProxyOOMScoreAdj)), "The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000]")
+	fs.StringVar(&s.ResourceContainer, "resource-container", s.ResourceContainer, "Absolute name of the resource-only container to create and run the Kube-proxy in (Default: /kube-proxy).")
+	fs.MarkDeprecated("resource-container", "This feature will be removed in a later release.")
+	fs.StringVar(&s.Kubeconfig, "kubeconfig", s.Kubeconfig, "Path to kubeconfig file with authorization information (the master location is set by the master flag).")
+	fs.Var(componentconfig.PortRangeVar{Val: &s.PortRange}, "proxy-port-range", "Range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.")
+	fs.StringVar(&s.HostnameOverride, "hostname-override", s.HostnameOverride, "If non-empty, will use this string as identification instead of the actual hostname.")
+	fs.Var(&s.Mode, "proxy-mode", "Which proxy mode to use: 'userspace' (older) or 'iptables' (faster). If blank, look at the Node object on the Kubernetes API and respect the '"+ExperimentalProxyModeAnnotation+"' annotation if provided.  Otherwise use the best-available proxy (currently iptables).  If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy.")
+	fs.Int32Var(s.IPTablesMasqueradeBit, "iptables-masquerade-bit", util.Int32PtrDerefOr(s.IPTablesMasqueradeBit, 14), "If using the pure iptables proxy, the bit of the fwmark space to mark packets requiring SNAT with.  Must be within the range [0, 31].")
+	fs.DurationVar(&s.IPTablesSyncPeriod.Duration, "iptables-sync-period", s.IPTablesSyncPeriod.Duration, "The maximum interval of how often iptables rules are refreshed (e.g. '5s', '1m', '2h22m').  Must be greater than 0.")
+	fs.DurationVar(&s.IPTablesMinSyncPeriod.Duration, "iptables-min-sync-period", s.IPTablesMinSyncPeriod.Duration, "The minimum interval of how often the iptables rules can be refreshed as endpoints and services change (e.g. '5s', '1m', '2h22m').")
+	fs.DurationVar(&s.ConfigSyncPeriod, "config-sync-period", s.ConfigSyncPeriod, "How often configuration from the apiserver is refreshed.  Must be greater than 0.")
+	fs.BoolVar(&s.MasqueradeAll, "masquerade-all", s.MasqueradeAll, "If using the pure iptables proxy, SNAT everything")
+	fs.StringVar(&s.ClusterCIDR, "cluster-cidr", s.ClusterCIDR, "The CIDR range of pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.")
+	fs.BoolVar(&s.CleanupAndExit, "cleanup-iptables", s.CleanupAndExit, "If true cleanup iptables rules and exit.")
+	fs.StringVar(&s.ContentType, "kube-api-content-type", s.ContentType, "Content type of requests sent to apiserver.")
+	fs.Float32Var(&s.KubeAPIQPS, "kube-api-qps", s.KubeAPIQPS, "QPS to use while talking with kubernetes apiserver")
+	fs.Int32Var(&s.KubeAPIBurst, "kube-api-burst", s.KubeAPIBurst, "Burst to use while talking with kubernetes apiserver")
+	fs.DurationVar(&s.UDPIdleTimeout.Duration, "udp-timeout", s.UDPIdleTimeout.Duration, "How long an idle UDP connection will be kept open (e.g. '250ms', '2s').  Must be greater than 0. Only applicable for proxy-mode=userspace")
+	fs.Int32Var(&s.ConntrackMax, "conntrack-max", s.ConntrackMax,
+		"Maximum number of NAT connections to track (0 to leave as-is). This overrides conntrack-max-per-core and conntrack-min.")
+	fs.MarkDeprecated("conntrack-max", "This feature will be removed in a later release.")
+	fs.Int32Var(&s.ConntrackMaxPerCore, "conntrack-max-per-core", s.ConntrackMaxPerCore,
+		"Maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore conntrack-min).")
+	fs.Int32Var(&s.ConntrackMin, "conntrack-min", s.ConntrackMin,
+		"Minimum number of conntrack entries to allocate, regardless of conntrack-max-per-core (set conntrack-max-per-core=0 to leave the limit as-is).")
+	fs.DurationVar(&s.ConntrackTCPEstablishedTimeout.Duration, "conntrack-tcp-timeout-established", s.ConntrackTCPEstablishedTimeout.Duration, "Idle timeout for established TCP connections (0 to leave as-is)")
+	fs.DurationVar(
+		&s.ConntrackTCPCloseWaitTimeout.Duration, "conntrack-tcp-timeout-close-wait",
+		s.ConntrackTCPCloseWaitTimeout.Duration,
+		"NAT timeout for TCP connections in the CLOSE_WAIT state")
+
+	config.DefaultFeatureGate.AddFlag(fs)
+}

vendor/k8s.io/kubernetes/cmd/kube-proxy/app/server.go

@@ -0,0 +1,478 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package app does all of the work necessary to configure and run a
+// Kubernetes app process.
+package app
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	_ "net/http/pprof"
+	"runtime"
+	"strconv"
+	"time"
+
+	"k8s.io/kubernetes/cmd/kube-proxy/app/options"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	unversionedcore "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
+	clientcmdapi "k8s.io/kubernetes/pkg/client/unversioned/clientcmd/api"
+	"k8s.io/kubernetes/pkg/proxy"
+	proxyconfig "k8s.io/kubernetes/pkg/proxy/config"
+	"k8s.io/kubernetes/pkg/proxy/iptables"
+	"k8s.io/kubernetes/pkg/proxy/userspace"
+	"k8s.io/kubernetes/pkg/proxy/winuserspace"
+	"k8s.io/kubernetes/pkg/types"
+	"k8s.io/kubernetes/pkg/util/configz"
+	utildbus "k8s.io/kubernetes/pkg/util/dbus"
+	"k8s.io/kubernetes/pkg/util/exec"
+	utiliptables "k8s.io/kubernetes/pkg/util/iptables"
+	utilnet "k8s.io/kubernetes/pkg/util/net"
+	utilnetsh "k8s.io/kubernetes/pkg/util/netsh"
+	nodeutil "k8s.io/kubernetes/pkg/util/node"
+	"k8s.io/kubernetes/pkg/util/oom"
+	"k8s.io/kubernetes/pkg/util/resourcecontainer"
+	utilsysctl "k8s.io/kubernetes/pkg/util/sysctl"
+	"k8s.io/kubernetes/pkg/util/wait"
+
+	"github.com/golang/glog"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+type ProxyServer struct {
+	Client       clientset.Interface
+	Config       *options.ProxyServerConfig
+	IptInterface utiliptables.Interface
+	Proxier      proxy.ProxyProvider
+	Broadcaster  record.EventBroadcaster
+	Recorder     record.EventRecorder
+	Conntracker  Conntracker // if nil, ignored
+	ProxyMode    string
+}
+
+const (
+	proxyModeUserspace              = "userspace"
+	proxyModeIPTables               = "iptables"
+	experimentalProxyModeAnnotation = options.ExperimentalProxyModeAnnotation
+	betaProxyModeAnnotation         = "net.beta.kubernetes.io/proxy-mode"
+)
+
+func checkKnownProxyMode(proxyMode string) bool {
+	switch proxyMode {
+	case "", proxyModeUserspace, proxyModeIPTables:
+		return true
+	}
+	return false
+}
+
+func NewProxyServer(
+	client clientset.Interface,
+	config *options.ProxyServerConfig,
+	iptInterface utiliptables.Interface,
+	proxier proxy.ProxyProvider,
+	broadcaster record.EventBroadcaster,
+	recorder record.EventRecorder,
+	conntracker Conntracker,
+	proxyMode string,
+) (*ProxyServer, error) {
+	return &ProxyServer{
+		Client:       client,
+		Config:       config,
+		IptInterface: iptInterface,
+		Proxier:      proxier,
+		Broadcaster:  broadcaster,
+		Recorder:     recorder,
+		Conntracker:  conntracker,
+		ProxyMode:    proxyMode,
+	}, nil
+}
+
+// NewProxyCommand creates a *cobra.Command object with default parameters
+func NewProxyCommand() *cobra.Command {
+	s := options.NewProxyConfig()
+	s.AddFlags(pflag.CommandLine)
+	cmd := &cobra.Command{
+		Use: "kube-proxy",
+		Long: `The Kubernetes network proxy runs on each node. This
+reflects services as defined in the Kubernetes API on each node and can do simple
+TCP,UDP stream forwarding or round robin TCP,UDP forwarding across a set of backends.
+Service cluster ips and ports are currently found through Docker-links-compatible
+environment variables specifying ports opened by the service proxy. There is an optional
+addon that provides cluster DNS for these cluster IPs. The user must create a service
+with the apiserver API to configure the proxy.`,
+		Run: func(cmd *cobra.Command, args []string) {
+		},
+	}
+
+	return cmd
+}
+
+// NewProxyServerDefault creates a new ProxyServer object with default parameters.
+func NewProxyServerDefault(config *options.ProxyServerConfig) (*ProxyServer, error) {
+	if c, err := configz.New("componentconfig"); err == nil {
+		c.Set(config.KubeProxyConfiguration)
+	} else {
+		glog.Errorf("unable to register configz: %s", err)
+	}
+	protocol := utiliptables.ProtocolIpv4
+	if net.ParseIP(config.BindAddress).To4() == nil {
+		protocol = utiliptables.ProtocolIpv6
+	}
+
+	var netshInterface utilnetsh.Interface
+	var iptInterface utiliptables.Interface
+	var dbus utildbus.Interface
+
+	// Create a iptables utils.
+	execer := exec.New()
+
+	if runtime.GOOS == "windows" {
+		netshInterface = utilnetsh.New(execer)
+	} else {
+		dbus = utildbus.New()
+		iptInterface = utiliptables.New(execer, dbus, protocol)
+	}
+
+	// We omit creation of pretty much everything if we run in cleanup mode
+	if config.CleanupAndExit {
+		return &ProxyServer{
+			Config:       config,
+			IptInterface: iptInterface,
+		}, nil
+	}
+
+	// TODO(vmarmol): Use container config for this.
+	var oomAdjuster *oom.OOMAdjuster
+	if config.OOMScoreAdj != nil {
+		oomAdjuster = oom.NewOOMAdjuster()
+		if err := oomAdjuster.ApplyOOMScoreAdj(0, int(*config.OOMScoreAdj)); err != nil {
+			glog.V(2).Info(err)
+		}
+	}
+
+	if config.ResourceContainer != "" {
+		// Run in its own container.
+		if err := resourcecontainer.RunInResourceContainer(config.ResourceContainer); err != nil {
+			glog.Warningf("Failed to start in resource-only container %q: %v", config.ResourceContainer, err)
+		} else {
+			glog.V(2).Infof("Running in resource-only container %q", config.ResourceContainer)
+		}
+	}
+
+	// Create a Kube Client
+	// define api config source
+	if config.Kubeconfig == "" && config.Master == "" {
+		glog.Warningf("Neither --kubeconfig nor --master was specified.  Using default API client.  This might not work.")
+	}
+	// This creates a client, first loading any specified kubeconfig
+	// file, and then overriding the Master flag, if non-empty.
+	kubeconfig, err := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
+		&clientcmd.ClientConfigLoadingRules{ExplicitPath: config.Kubeconfig},
+		&clientcmd.ConfigOverrides{ClusterInfo: clientcmdapi.Cluster{Server: config.Master}}).ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	kubeconfig.ContentType = config.ContentType
+	// Override kubeconfig qps/burst settings from flags
+	kubeconfig.QPS = config.KubeAPIQPS
+	kubeconfig.Burst = int(config.KubeAPIBurst)
+
+	client, err := clientset.NewForConfig(kubeconfig)
+	if err != nil {
+		glog.Fatalf("Invalid API configuration: %v", err)
+	}
+
+	// Create event recorder
+	hostname := nodeutil.GetHostname(config.HostnameOverride)
+	eventBroadcaster := record.NewBroadcaster()
+	recorder := eventBroadcaster.NewRecorder(v1.EventSource{Component: "kube-proxy", Host: hostname})
+
+	var proxier proxy.ProxyProvider
+	var endpointsHandler proxyconfig.EndpointsConfigHandler
+
+	proxyMode := getProxyMode(string(config.Mode), client.Core().Nodes(), hostname, iptInterface, iptables.LinuxKernelCompatTester{})
+	if proxyMode == proxyModeIPTables {
+		glog.V(0).Info("Using iptables Proxier.")
+		if config.IPTablesMasqueradeBit == nil {
+			// IPTablesMasqueradeBit must be specified or defaulted.
+			return nil, fmt.Errorf("Unable to read IPTablesMasqueradeBit from config")
+		}
+		proxierIPTables, err := iptables.NewProxier(iptInterface, utilsysctl.New(), execer, config.IPTablesSyncPeriod.Duration, config.IPTablesMinSyncPeriod.Duration, config.MasqueradeAll, int(*config.IPTablesMasqueradeBit), config.ClusterCIDR, hostname, getNodeIP(client, hostname))
+		if err != nil {
+			glog.Fatalf("Unable to create proxier: %v", err)
+		}
+		proxier = proxierIPTables
+		endpointsHandler = proxierIPTables
+		// No turning back. Remove artifacts that might still exist from the userspace Proxier.
+		glog.V(0).Info("Tearing down userspace rules.")
+		userspace.CleanupLeftovers(iptInterface)
+	} else {
+		glog.V(0).Info("Using userspace Proxier.")
+		// This is a proxy.LoadBalancer which NewProxier needs but has methods we don't need for
+		// our config.EndpointsConfigHandler.
+		loadBalancer := userspace.NewLoadBalancerRR()
+		// set EndpointsConfigHandler to our loadBalancer
+		endpointsHandler = loadBalancer
+
+		var proxierUserspace proxy.ProxyProvider
+
+		if runtime.GOOS == "windows" {
+			proxierUserspace, err = winuserspace.NewProxier(
+				loadBalancer,
+				net.ParseIP(config.BindAddress),
+				netshInterface,
+				*utilnet.ParsePortRangeOrDie(config.PortRange),
+				// TODO @pires replace below with default values, if applicable
+				config.IPTablesSyncPeriod.Duration,
+				config.UDPIdleTimeout.Duration,
+			)
+		} else {
+			proxierUserspace, err = userspace.NewProxier(
+				loadBalancer,
+				net.ParseIP(config.BindAddress),
+				iptInterface,
+				*utilnet.ParsePortRangeOrDie(config.PortRange),
+				config.IPTablesSyncPeriod.Duration,
+				config.IPTablesMinSyncPeriod.Duration,
+				config.UDPIdleTimeout.Duration,
+			)
+		}
+		if err != nil {
+			glog.Fatalf("Unable to create proxier: %v", err)
+		}
+		proxier = proxierUserspace
+		// Remove artifacts from the pure-iptables Proxier, if not on Windows.
+		if runtime.GOOS != "windows" {
+			glog.V(0).Info("Tearing down pure-iptables proxy rules.")
+			iptables.CleanupLeftovers(iptInterface)
+		}
+	}
+
+	// Add iptables reload function, if not on Windows.
+	if runtime.GOOS != "windows" {
+		iptInterface.AddReloadFunc(proxier.Sync)
+	}
+
+	// Create configs (i.e. Watches for Services and Endpoints)
+	// Note: RegisterHandler() calls need to happen before creation of Sources because sources
+	// only notify on changes, and the initial update (on process start) may be lost if no handlers
+	// are registered yet.
+	serviceConfig := proxyconfig.NewServiceConfig()
+	serviceConfig.RegisterHandler(proxier)
+
+	endpointsConfig := proxyconfig.NewEndpointsConfig()
+	endpointsConfig.RegisterHandler(endpointsHandler)
+
+	proxyconfig.NewSourceAPI(
+		client.Core().RESTClient(),
+		config.ConfigSyncPeriod,
+		serviceConfig.Channel("api"),
+		endpointsConfig.Channel("api"),
+	)
+
+	config.NodeRef = &api.ObjectReference{
+		Kind:      "Node",
+		Name:      hostname,
+		UID:       types.UID(hostname),
+		Namespace: "",
+	}
+
+	conntracker := realConntracker{}
+
+	return NewProxyServer(client, config, iptInterface, proxier, eventBroadcaster, recorder, conntracker, proxyMode)
+}
+
+// Run runs the specified ProxyServer.  This should never exit (unless CleanupAndExit is set).
+func (s *ProxyServer) Run() error {
+	// remove iptables rules and exit
+	if s.Config.CleanupAndExit {
+		encounteredError := userspace.CleanupLeftovers(s.IptInterface)
+		encounteredError = iptables.CleanupLeftovers(s.IptInterface) || encounteredError
+		if encounteredError {
+			return errors.New("Encountered an error while tearing down rules.")
+		}
+		return nil
+	}
+
+	s.Broadcaster.StartRecordingToSink(&unversionedcore.EventSinkImpl{Interface: s.Client.Core().Events("")})
+
+	// Start up a webserver if requested
+	if s.Config.HealthzPort > 0 {
+		http.HandleFunc("/proxyMode", func(w http.ResponseWriter, r *http.Request) {
+			fmt.Fprintf(w, "%s", s.ProxyMode)
+		})
+		configz.InstallHandler(http.DefaultServeMux)
+		go wait.Until(func() {
+			err := http.ListenAndServe(s.Config.HealthzBindAddress+":"+strconv.Itoa(int(s.Config.HealthzPort)), nil)
+			if err != nil {
+				glog.Errorf("Starting health server failed: %v", err)
+			}
+		}, 5*time.Second, wait.NeverStop)
+	}
+
+	// Tune conntrack, if requested
+	if s.Conntracker != nil && runtime.GOOS != "windows" {
+		max, err := getConntrackMax(s.Config)
+		if err != nil {
+			return err
+		}
+		if max > 0 {
+			err := s.Conntracker.SetMax(max)
+			if err != nil {
+				if err != readOnlySysFSError {
+					return err
+				}
+				// readOnlySysFSError is caused by a known docker issue (https://github.com/docker/docker/issues/24000),
+				// the only remediation we know is to restart the docker daemon.
+				// Here we'll send an node event with specific reason and message, the
+				// administrator should decide whether and how to handle this issue,
+				// whether to drain the node and restart docker.
+				// TODO(random-liu): Remove this when the docker bug is fixed.
+				const message = "DOCKER RESTART NEEDED (docker issue #24000): /sys is read-only: " +
+					"cannot modify conntrack limits, problems may arise later."
+				s.Recorder.Eventf(s.Config.NodeRef, api.EventTypeWarning, err.Error(), message)
+			}
+		}
+
+		if s.Config.ConntrackTCPEstablishedTimeout.Duration > 0 {
+			timeout := int(s.Config.ConntrackTCPEstablishedTimeout.Duration / time.Second)
+			if err := s.Conntracker.SetTCPEstablishedTimeout(timeout); err != nil {
+				return err
+			}
+		}
+
+		if s.Config.ConntrackTCPCloseWaitTimeout.Duration > 0 {
+			timeout := int(s.Config.ConntrackTCPCloseWaitTimeout.Duration / time.Second)
+			if err := s.Conntracker.SetTCPCloseWaitTimeout(timeout); err != nil {
+				return err
+			}
+		}
+	}
+
+	// Birth Cry after the birth is successful
+	s.birthCry()
+
+	// Just loop forever for now...
+	s.Proxier.SyncLoop()
+	return nil
+}
+
+func getConntrackMax(config *options.ProxyServerConfig) (int, error) {
+	if config.ConntrackMax > 0 {
+		if config.ConntrackMaxPerCore > 0 {
+			return -1, fmt.Errorf("invalid config: ConntrackMax and ConntrackMaxPerCore are mutually exclusive")
+		}
+		glog.V(3).Infof("getConntrackMax: using absolute conntrax-max (deprecated)")
+		return int(config.ConntrackMax), nil
+	}
+	if config.ConntrackMaxPerCore > 0 {
+		floor := int(config.ConntrackMin)
+		scaled := int(config.ConntrackMaxPerCore) * runtime.NumCPU()
+		if scaled > floor {
+			glog.V(3).Infof("getConntrackMax: using scaled conntrax-max-per-core")
+			return scaled, nil
+		}
+		glog.V(3).Infof("getConntrackMax: using conntrax-min")
+		return floor, nil
+	}
+	return 0, nil
+}
+
+type nodeGetter interface {
+	Get(hostname string) (*api.Node, error)
+}
+
+func getProxyMode(proxyMode string, client nodeGetter, hostname string, iptver iptables.IPTablesVersioner, kcompat iptables.KernelCompatTester) string {
+	if proxyMode == proxyModeUserspace {
+		return proxyModeUserspace
+	} else if proxyMode == proxyModeIPTables {
+		return tryIPTablesProxy(iptver, kcompat)
+	} else if proxyMode != "" {
+		glog.Warningf("Flag proxy-mode=%q unknown, assuming iptables proxy", proxyMode)
+		return tryIPTablesProxy(iptver, kcompat)
+	}
+	// proxyMode == "" - choose the best option.
+	if client == nil {
+		glog.Errorf("nodeGetter is nil: assuming iptables proxy")
+		return tryIPTablesProxy(iptver, kcompat)
+	}
+	node, err := client.Get(hostname)
+	if err != nil {
+		glog.Errorf("Can't get Node %q, assuming iptables proxy, err: %v", hostname, err)
+		return tryIPTablesProxy(iptver, kcompat)
+	}
+	if node == nil {
+		glog.Errorf("Got nil Node %q, assuming iptables proxy", hostname)
+		return tryIPTablesProxy(iptver, kcompat)
+	}
+	proxyMode, found := node.Annotations[betaProxyModeAnnotation]
+	if found {
+		glog.V(1).Infof("Found beta annotation %q = %q", betaProxyModeAnnotation, proxyMode)
+	} else {
+		// We already published some information about this annotation with the "experimental" name, so we will respect it.
+		proxyMode, found = node.Annotations[experimentalProxyModeAnnotation]
+		if found {
+			glog.V(1).Infof("Found experimental annotation %q = %q", experimentalProxyModeAnnotation, proxyMode)
+		}
+	}
+	if proxyMode == proxyModeUserspace {
+		glog.V(1).Infof("Annotation demands userspace proxy")
+		return proxyModeUserspace
+	}
+	return tryIPTablesProxy(iptver, kcompat)
+}
+
+func tryIPTablesProxy(iptver iptables.IPTablesVersioner, kcompat iptables.KernelCompatTester) string {
+	// guaranteed false on error, error only necessary for debugging
+	useIPTablesProxy, err := iptables.CanUseIPTablesProxier(iptver, kcompat)
+	if err != nil {
+		glog.Errorf("Can't determine whether to use iptables proxy, using userspace proxier: %v", err)
+		return proxyModeUserspace
+	}
+	if useIPTablesProxy {
+		return proxyModeIPTables
+	}
+	// Fallback.
+	glog.V(1).Infof("Can't use iptables proxy, using userspace proxier")
+	return proxyModeUserspace
+}
+
+func (s *ProxyServer) birthCry() {
+	s.Recorder.Eventf(s.Config.NodeRef, api.EventTypeNormal, "Starting", "Starting kube-proxy.")
+}
+
+func getNodeIP(client clientset.Interface, hostname string) net.IP {
+	var nodeIP net.IP
+	node, err := client.Core().Nodes().Get(hostname)
+	if err != nil {
+		glog.Warningf("Failed to retrieve node info: %v", err)
+		return nil
+	}
+	nodeIP, err = nodeutil.InternalGetNodeHostIP(node)
+	if err != nil {
+		glog.Warningf("Failed to retrieve node IP: %v", err)
+		return nil
+	}
+	return nodeIP
+}

vendor/k8s.io/kubernetes/cmd/kube-proxy/app/server_test.go

@@ -0,0 +1,350 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"k8s.io/kubernetes/cmd/kube-proxy/app/options"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/apis/componentconfig"
+	"k8s.io/kubernetes/pkg/util/iptables"
+)
+
+type fakeNodeInterface struct {
+	node api.Node
+}
+
+func (fake *fakeNodeInterface) Get(hostname string) (*api.Node, error) {
+	return &fake.node, nil
+}
+
+type fakeIPTablesVersioner struct {
+	version string // what to return
+	err     error  // what to return
+}
+
+func (fake *fakeIPTablesVersioner) GetVersion() (string, error) {
+	return fake.version, fake.err
+}
+
+type fakeKernelCompatTester struct {
+	ok bool
+}
+
+func (fake *fakeKernelCompatTester) IsCompatible() error {
+	if !fake.ok {
+		return fmt.Errorf("error")
+	}
+	return nil
+}
+
+func Test_getProxyMode(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		t.Skip("skipping on non-Linux")
+	}
+	var cases = []struct {
+		flag            string
+		annotationKey   string
+		annotationVal   string
+		iptablesVersion string
+		kernelCompat    bool
+		iptablesError   error
+		expected        string
+	}{
+		{ // flag says userspace
+			flag:     "userspace",
+			expected: proxyModeUserspace,
+		},
+		{ // flag says iptables, error detecting version
+			flag:          "iptables",
+			iptablesError: fmt.Errorf("oops!"),
+			expected:      proxyModeUserspace,
+		},
+		{ // flag says iptables, version too low
+			flag:            "iptables",
+			iptablesVersion: "0.0.0",
+			expected:        proxyModeUserspace,
+		},
+		{ // flag says iptables, version ok, kernel not compatible
+			flag:            "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    false,
+			expected:        proxyModeUserspace,
+		},
+		{ // flag says iptables, version ok, kernel is compatible
+			flag:            "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // detect, error
+			flag:          "",
+			iptablesError: fmt.Errorf("oops!"),
+			expected:      proxyModeUserspace,
+		},
+		{ // detect, version too low
+			flag:            "",
+			iptablesVersion: "0.0.0",
+			expected:        proxyModeUserspace,
+		},
+		{ // detect, version ok, kernel not compatible
+			flag:            "",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    false,
+			expected:        proxyModeUserspace,
+		},
+		{ // detect, version ok, kernel is compatible
+			flag:            "",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // annotation says userspace
+			flag:          "",
+			annotationKey: "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal: "userspace",
+			expected:      proxyModeUserspace,
+		},
+		{ // annotation says iptables, error detecting
+			flag:          "",
+			annotationKey: "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal: "iptables",
+			iptablesError: fmt.Errorf("oops!"),
+			expected:      proxyModeUserspace,
+		},
+		{ // annotation says iptables, version too low
+			flag:            "",
+			annotationKey:   "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: "0.0.0",
+			expected:        proxyModeUserspace,
+		},
+		{ // annotation says iptables, version ok, kernel not compatible
+			flag:            "",
+			annotationKey:   "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    false,
+			expected:        proxyModeUserspace,
+		},
+		{ // annotation says iptables, version ok, kernel is compatible
+			flag:            "",
+			annotationKey:   "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // annotation says something else, version ok
+			flag:            "",
+			annotationKey:   "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal:   "other",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // annotation says nothing, version ok
+			flag:            "",
+			annotationKey:   "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal:   "",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // annotation says userspace
+			flag:          "",
+			annotationKey: "net.beta.kubernetes.io/proxy-mode",
+			annotationVal: "userspace",
+			expected:      proxyModeUserspace,
+		},
+		{ // annotation says iptables, error detecting
+			flag:          "",
+			annotationKey: "net.beta.kubernetes.io/proxy-mode",
+			annotationVal: "iptables",
+			iptablesError: fmt.Errorf("oops!"),
+			expected:      proxyModeUserspace,
+		},
+		{ // annotation says iptables, version too low
+			flag:            "",
+			annotationKey:   "net.beta.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: "0.0.0",
+			expected:        proxyModeUserspace,
+		},
+		{ // annotation says iptables, version ok, kernel not compatible
+			flag:            "",
+			annotationKey:   "net.beta.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    false,
+			expected:        proxyModeUserspace,
+		},
+		{ // annotation says iptables, version ok, kernel is compatible
+			flag:            "",
+			annotationKey:   "net.beta.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // annotation says something else, version ok
+			flag:            "",
+			annotationKey:   "net.beta.kubernetes.io/proxy-mode",
+			annotationVal:   "other",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // annotation says nothing, version ok
+			flag:            "",
+			annotationKey:   "net.beta.kubernetes.io/proxy-mode",
+			annotationVal:   "",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // flag says userspace, annotation disagrees
+			flag:            "userspace",
+			annotationKey:   "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			expected:        proxyModeUserspace,
+		},
+		{ // flag says iptables, annotation disagrees
+			flag:            "iptables",
+			annotationKey:   "net.experimental.kubernetes.io/proxy-mode",
+			annotationVal:   "userspace",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+		{ // flag says userspace, annotation disagrees
+			flag:            "userspace",
+			annotationKey:   "net.beta.kubernetes.io/proxy-mode",
+			annotationVal:   "iptables",
+			iptablesVersion: iptables.MinCheckVersion,
+			expected:        proxyModeUserspace,
+		},
+		{ // flag says iptables, annotation disagrees
+			flag:            "iptables",
+			annotationKey:   "net.beta.kubernetes.io/proxy-mode",
+			annotationVal:   "userspace",
+			iptablesVersion: iptables.MinCheckVersion,
+			kernelCompat:    true,
+			expected:        proxyModeIPTables,
+		},
+	}
+	for i, c := range cases {
+		getter := &fakeNodeInterface{}
+		getter.node.Annotations = map[string]string{c.annotationKey: c.annotationVal}
+		versioner := &fakeIPTablesVersioner{c.iptablesVersion, c.iptablesError}
+		kcompater := &fakeKernelCompatTester{c.kernelCompat}
+		r := getProxyMode(c.flag, getter, "host", versioner, kcompater)
+		if r != c.expected {
+			t.Errorf("Case[%d] Expected %q, got %q", i, c.expected, r)
+		}
+	}
+}
+
+// This test verifies that Proxy Server does not crash that means
+// Config and iptinterface are not nil when CleanupAndExit is true.
+// To avoid proxy crash: https://github.com/kubernetes/kubernetes/pull/14736
+func TestProxyServerWithCleanupAndExit(t *testing.T) {
+	// creates default config
+	config := options.NewProxyConfig()
+
+	// sets CleanupAndExit manually
+	config.CleanupAndExit = true
+
+	// creates new proxy server
+	proxyserver, err := NewProxyServerDefault(config)
+
+	// verifies that nothing is nill except error
+	assert.Nil(t, err)
+	assert.NotNil(t, proxyserver)
+	assert.NotNil(t, proxyserver.Config)
+	assert.NotNil(t, proxyserver.IptInterface)
+}
+
+func TestGetConntrackMax(t *testing.T) {
+	ncores := runtime.NumCPU()
+	testCases := []struct {
+		config   componentconfig.KubeProxyConfiguration
+		expected int
+		err      string
+	}{
+		{
+			config:   componentconfig.KubeProxyConfiguration{},
+			expected: 0,
+		},
+		{
+			config: componentconfig.KubeProxyConfiguration{
+				ConntrackMax: 12345,
+			},
+			expected: 12345,
+		},
+		{
+			config: componentconfig.KubeProxyConfiguration{
+				ConntrackMax:        12345,
+				ConntrackMaxPerCore: 67890,
+			},
+			expected: -1,
+			err:      "mutually exclusive",
+		},
+		{
+			config: componentconfig.KubeProxyConfiguration{
+				ConntrackMaxPerCore: 67890, // use this if Max is 0
+				ConntrackMin:        1,     // avoid 0 default
+			},
+			expected: 67890 * ncores,
+		},
+		{
+			config: componentconfig.KubeProxyConfiguration{
+				ConntrackMaxPerCore: 1, // ensure that Min is considered
+				ConntrackMin:        123456,
+			},
+			expected: 123456,
+		},
+		{
+			config: componentconfig.KubeProxyConfiguration{
+				ConntrackMaxPerCore: 0, // leave system setting
+				ConntrackMin:        123456,
+			},
+			expected: 0,
+		},
+	}
+
+	for i, tc := range testCases {
+		cfg := options.ProxyServerConfig{KubeProxyConfiguration: tc.config}
+		x, e := getConntrackMax(&cfg)
+		if e != nil {
+			if tc.err == "" {
+				t.Errorf("[%d] unexpected error: %v", i, e)
+			} else if !strings.Contains(e.Error(), tc.err) {
+				t.Errorf("[%d] expected an error containing %q: %v", i, tc.err, e)
+			}
+		} else if x != tc.expected {
+			t.Errorf("[%d] expected %d, got %d", i, tc.expected, x)
+		}
+	}
+}

vendor/k8s.io/kubernetes/cmd/kube-proxy/proxy.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"k8s.io/kubernetes/cmd/kube-proxy/app"
+	"k8s.io/kubernetes/cmd/kube-proxy/app/options"
+	_ "k8s.io/kubernetes/pkg/client/metrics/prometheus" // for client metric registration
+	"k8s.io/kubernetes/pkg/healthz"
+	"k8s.io/kubernetes/pkg/util/flag"
+	"k8s.io/kubernetes/pkg/util/logs"
+	_ "k8s.io/kubernetes/pkg/version/prometheus" // for version metric registration
+	"k8s.io/kubernetes/pkg/version/verflag"
+
+	"github.com/spf13/pflag"
+)
+
+func init() {
+	healthz.DefaultHealthz()
+}
+
+func main() {
+	config := options.NewProxyConfig()
+	config.AddFlags(pflag.CommandLine)
+
+	flag.InitFlags()
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	verflag.PrintAndExitIfRequested()
+
+	s, err := app.NewProxyServerDefault(config)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		os.Exit(1)
+	}
+
+	if err = s.Run(); err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		os.Exit(1)
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/BUILD

@@ -0,0 +1,21 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_binary(
+    name = "kubeadm",
+    srcs = ["kubeadm.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app:go_default_library",
+        "//cmd/kubeadm/app/util:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/OWNERS

@@ -0,0 +1,5 @@
+assignees:
+  - mikedanese
+  - errordeveloper
+  - luxas
+  - jbeda

vendor/k8s.io/kubernetes/cmd/kubeadm/app/BUILD

@@ -0,0 +1,24 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["kubeadm.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app/apis/kubeadm/install:go_default_library",
+        "//cmd/kubeadm/app/cmd:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/util/logs:go_default_library",
+        "//vendor:github.com/spf13/pflag",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/BUILD

@@ -0,0 +1,28 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "env.go",
+        "register.go",
+        "types.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/runtime:go_default_library",
+        "//pkg/runtime/schema:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +groupName=kubeadm.k8s.io
+package kubeadm // import "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/env.go

@@ -0,0 +1,61 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubeadm
+
+import (
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+)
+
+var GlobalEnvParams = SetEnvParams()
+
+// TODO(phase2) use componentconfig
+// we need some params for testing etc, let's keep these hidden for now
+func SetEnvParams() *EnvParams {
+
+	envParams := map[string]string{
+		// TODO(phase1+): Mode prefix and host_pki_path to another place as constants, and use them everywhere
+		// Right now they're used here and there, but not consequently
+		"kubernetes_dir":     "/etc/kubernetes",
+		"host_pki_path":      "/etc/kubernetes/pki",
+		"host_etcd_path":     "/var/lib/etcd",
+		"hyperkube_image":    "",
+		"repo_prefix":        "gcr.io/google_containers",
+		"discovery_image":    fmt.Sprintf("gcr.io/google_containers/kube-discovery-%s:%s", runtime.GOARCH, "1.0"),
+		"etcd_image":         "",
+		"component_loglevel": "--v=2",
+	}
+
+	for k := range envParams {
+		if v := os.Getenv(fmt.Sprintf("KUBE_%s", strings.ToUpper(k))); v != "" {
+			envParams[k] = v
+		}
+	}
+
+	return &EnvParams{
+		KubernetesDir:     envParams["kubernetes_dir"],
+		HostPKIPath:       envParams["host_pki_path"],
+		HostEtcdPath:      envParams["host_etcd_path"],
+		HyperkubeImage:    envParams["hyperkube_image"],
+		RepositoryPrefix:  envParams["repo_prefix"],
+		DiscoveryImage:    envParams["discovery_image"],
+		EtcdImage:         envParams["etcd_image"],
+		ComponentLoglevel: envParams["component_loglevel"],
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/install/BUILD

@@ -0,0 +1,25 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "install.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
+        "//cmd/kubeadm/app/apis/kubeadm/v1alpha1:go_default_library",
+        "//pkg/apimachinery/announced:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/install/doc.go

@@ -0,0 +1,17 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package install // import "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/install"

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/install/install.go

@@ -0,0 +1,39 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package install
+
+import (
+	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1"
+	"k8s.io/kubernetes/pkg/apimachinery/announced"
+)
+
+func init() {
+	if err := announced.NewGroupMetaFactory(
+		&announced.GroupMetaFactoryArgs{
+			GroupName:                  kubeadm.GroupName,
+			VersionPreferenceOrder:     []string{v1alpha1.SchemeGroupVersion.Version},
+			ImportPrefix:               "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm",
+			AddInternalObjectsToScheme: kubeadm.AddToScheme,
+		},
+		announced.VersionToSchemeFunc{
+			v1alpha1.SchemeGroupVersion.Version: v1alpha1.AddToScheme,
+		},
+	).Announce().RegisterAndEnable(); err != nil {
+		panic(err)
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/register.go

@@ -0,0 +1,61 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubeadm
+
+import (
+	"k8s.io/kubernetes/pkg/api"
+	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/runtime"
+	"k8s.io/kubernetes/pkg/runtime/schema"
+)
+
+// GroupName is the group name use in this package
+const GroupName = "kubeadm.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&MasterConfiguration{},
+		&NodeConfiguration{},
+		&ClusterInfo{},
+		&api.ListOptions{},
+		&api.DeleteOptions{},
+		&metav1.ExportOptions{},
+	)
+	return nil
+}
+
+func (obj *MasterConfiguration) GetObjectKind() schema.ObjectKind { return &obj.TypeMeta }
+func (obj *NodeConfiguration) GetObjectKind() schema.ObjectKind   { return &obj.TypeMeta }
+func (obj *ClusterInfo) GetObjectKind() schema.ObjectKind         { return &obj.TypeMeta }

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/types.go

@@ -0,0 +1,91 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubeadm
+
+import (
+	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
+)
+
+type EnvParams struct {
+	KubernetesDir     string
+	HostPKIPath       string
+	HostEtcdPath      string
+	HyperkubeImage    string
+	RepositoryPrefix  string
+	DiscoveryImage    string
+	EtcdImage         string
+	ComponentLoglevel string
+}
+
+type MasterConfiguration struct {
+	metav1.TypeMeta
+
+	Secrets           Secrets
+	API               API
+	Discovery         Discovery
+	Etcd              Etcd
+	Networking        Networking
+	KubernetesVersion string
+	CloudProvider     string
+}
+
+type API struct {
+	AdvertiseAddresses []string
+	ExternalDNSNames   []string
+	BindPort           int32
+}
+
+type Discovery struct {
+	BindPort int32
+}
+
+type Networking struct {
+	ServiceSubnet string
+	PodSubnet     string
+	DNSDomain     string
+}
+
+type Etcd struct {
+	Endpoints []string
+	CAFile    string
+	CertFile  string
+	KeyFile   string
+}
+
+type Secrets struct {
+	GivenToken  string // dot-separated `<TokenID>.<Token>` set by the user
+	TokenID     string // optional on master side, will be generated if not specified
+	Token       []byte // optional on master side, will be generated if not specified
+	BearerToken string // set based on Token
+}
+
+type NodeConfiguration struct {
+	metav1.TypeMeta
+
+	MasterAddresses []string
+	Secrets         Secrets
+	APIPort         int32
+	DiscoveryPort   int32
+}
+
+// ClusterInfo TODO add description
+type ClusterInfo struct {
+	metav1.TypeMeta
+	// TODO(phase1+) this may become simply `api.Config`
+	CertificateAuthorities []string `json:"certificateAuthorities"`
+	Endpoints              []string `json:"endpoints"`
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1/BUILD

@@ -0,0 +1,29 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "defaults.go",
+        "doc.go",
+        "register.go",
+        "types.go",
+        "zz_generated.defaults.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/runtime:go_default_library",
+        "//pkg/runtime/schema:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1/defaults.go

@@ -0,0 +1,70 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"k8s.io/kubernetes/pkg/runtime"
+)
+
+const (
+	DefaultServiceDNSDomain          = "cluster.local"
+	DefaultServicesSubnet            = "10.96.0.0/12"
+	DefaultKubernetesVersion         = "stable"
+	DefaultKubernetesFallbackVersion = "v1.4.6"
+	DefaultAPIBindPort               = 6443
+	DefaultDiscoveryBindPort         = 9898
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	RegisterDefaults(scheme)
+	return scheme.AddDefaultingFuncs(
+		SetDefaults_MasterConfiguration,
+		SetDefaults_NodeConfiguration,
+	)
+}
+
+func SetDefaults_MasterConfiguration(obj *MasterConfiguration) {
+	if obj.KubernetesVersion == "" {
+		obj.KubernetesVersion = DefaultKubernetesVersion
+	}
+
+	if obj.API.BindPort == 0 {
+		obj.API.BindPort = DefaultAPIBindPort
+	}
+
+	if obj.Discovery.BindPort == 0 {
+		obj.Discovery.BindPort = DefaultDiscoveryBindPort
+	}
+
+	if obj.Networking.ServiceSubnet == "" {
+		obj.Networking.ServiceSubnet = DefaultServicesSubnet
+	}
+
+	if obj.Networking.DNSDomain == "" {
+		obj.Networking.DNSDomain = DefaultServiceDNSDomain
+	}
+}
+
+func SetDefaults_NodeConfiguration(obj *NodeConfiguration) {
+	if obj.APIPort == 0 {
+		obj.APIPort = DefaultAPIBindPort
+	}
+
+	if obj.DiscoveryPort == 0 {
+		obj.DiscoveryPort = DefaultDiscoveryBindPort
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=kubeadm.k8s.io
+package v1alpha1 // import "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1"

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1/register.go

@@ -0,0 +1,61 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"k8s.io/kubernetes/pkg/api/v1"
+	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/runtime"
+	"k8s.io/kubernetes/pkg/runtime/schema"
+)
+
+// GroupName is the group name use in this package
+const GroupName = "kubeadm.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes, addDefaultingFuncs)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&MasterConfiguration{},
+		&NodeConfiguration{},
+		&ClusterInfo{},
+		&v1.ListOptions{},
+		&v1.DeleteOptions{},
+		&metav1.ExportOptions{},
+	)
+	return nil
+}
+
+func (obj *MasterConfiguration) GetObjectKind() schema.ObjectKind { return &obj.TypeMeta }
+func (obj *NodeConfiguration) GetObjectKind() schema.ObjectKind   { return &obj.TypeMeta }
+func (obj *ClusterInfo) GetObjectKind() schema.ObjectKind         { return &obj.TypeMeta }

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1/types.go

@@ -0,0 +1,80 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
+)
+
+type MasterConfiguration struct {
+	metav1.TypeMeta `json:",inline"`
+
+	Secrets           Secrets    `json:"secrets"`
+	API               API        `json:"api"`
+	Etcd              Etcd       `json:"etcd"`
+	Discovery         Discovery  `json:"discovery"`
+	Networking        Networking `json:"networking"`
+	KubernetesVersion string     `json:"kubernetesVersion"`
+	CloudProvider     string     `json:"cloudProvider"`
+}
+
+type API struct {
+	AdvertiseAddresses []string `json:"advertiseAddresses"`
+	ExternalDNSNames   []string `json:"externalDNSNames"`
+	BindPort           int32    `json:"bindPort"`
+}
+
+type Discovery struct {
+	BindPort int32 `json:"bindPort"`
+}
+
+type Networking struct {
+	ServiceSubnet string `json:"serviceSubnet"`
+	PodSubnet     string `json:"podSubnet"`
+	DNSDomain     string `json:"dnsDomain"`
+}
+
+type Etcd struct {
+	Endpoints []string `json:"endpoints"`
+	CAFile    string   `json:"caFile"`
+	CertFile  string   `json:"certFile"`
+	KeyFile   string   `json:"keyFile"`
+}
+
+type Secrets struct {
+	GivenToken  string `json:"givenToken"`  // dot-separated `<TokenID>.<Token>` set by the user
+	TokenID     string `json:"tokenID"`     // optional on master side, will be generated if not specified
+	Token       []byte `json:"token"`       // optional on master side, will be generated if not specified
+	BearerToken string `json:"bearerToken"` // set based on Token
+}
+
+type NodeConfiguration struct {
+	metav1.TypeMeta `json:",inline"`
+
+	MasterAddresses []string `json:"masterAddresses"`
+	Secrets         Secrets  `json:"secrets"`
+	APIPort         int32    `json:"apiPort"`
+	DiscoveryPort   int32    `json:"discoveryPort"`
+}
+
+// ClusterInfo TODO add description
+type ClusterInfo struct {
+	metav1.TypeMeta `json:",inline"`
+	// TODO(phase1+) this may become simply `api.Config`
+	CertificateAuthorities []string `json:"certificateAuthorities"`
+	Endpoints              []string `json:"endpoints"`
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1/zz_generated.defaults.go

@@ -0,0 +1,42 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// This file was autogenerated by defaulter-gen. Do not edit it manually!
+
+package v1alpha1
+
+import (
+	runtime "k8s.io/kubernetes/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	scheme.AddTypeDefaultingFunc(&MasterConfiguration{}, func(obj interface{}) { SetObjectDefaults_MasterConfiguration(obj.(*MasterConfiguration)) })
+	scheme.AddTypeDefaultingFunc(&NodeConfiguration{}, func(obj interface{}) { SetObjectDefaults_NodeConfiguration(obj.(*NodeConfiguration)) })
+	return nil
+}
+
+func SetObjectDefaults_MasterConfiguration(in *MasterConfiguration) {
+	SetDefaults_MasterConfiguration(in)
+}
+
+func SetObjectDefaults_NodeConfiguration(in *NodeConfiguration) {
+	SetDefaults_NodeConfiguration(in)
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/BUILD

@@ -0,0 +1,54 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "cmd.go",
+        "init.go",
+        "join.go",
+        "reset.go",
+        "token.go",
+        "version.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
+        "//cmd/kubeadm/app/apis/kubeadm/v1alpha1:go_default_library",
+        "//cmd/kubeadm/app/master:go_default_library",
+        "//cmd/kubeadm/app/node:go_default_library",
+        "//cmd/kubeadm/app/preflight:go_default_library",
+        "//cmd/kubeadm/app/util:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/cloudprovider/providers:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/runtime:go_default_library",
+        "//pkg/util/flag:go_default_library",
+        "//pkg/util/initsystem:go_default_library",
+        "//pkg/util/net:go_default_library",
+        "//pkg/version:go_default_library",
+        "//vendor:github.com/renstrom/dedent",
+        "//vendor:github.com/spf13/cobra",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "reset_test.go",
+        "token_test.go",
+    ],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = ["//cmd/kubeadm/app/preflight:go_default_library"],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/cmd.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"io"
+
+	"github.com/renstrom/dedent"
+	"github.com/spf13/cobra"
+
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/util/flag"
+)
+
+func NewKubeadmCommand(f cmdutil.Factory, in io.Reader, out, err io.Writer) *cobra.Command {
+	cmds := &cobra.Command{
+		Use:   "kubeadm",
+		Short: "kubeadm: easily bootstrap a secure Kubernetes cluster",
+		Long: dedent.Dedent(`
+			kubeadm: easily bootstrap a secure Kubernetes cluster.
+
+			    ┌──────────────────────────────────────────────────────────┐
+			    │ KUBEADM IS ALPHA, DO NOT USE IT FOR PRODUCTION CLUSTERS! │
+			    │                                                          │
+			    │ But, please try it out! Give us feedback at:             │
+			    │ https://github.com/kubernetes/kubernetes/issues          │
+			    │ and at-mention @kubernetes/sig-cluster-lifecycle         │
+			    └──────────────────────────────────────────────────────────┘
+
+			Example usage:
+
+			    Create a two-machine cluster with one master (which controls the cluster),
+			    and one node (where workloads, like pods and replica sets run).
+
+			    ┌──────────────────────────────────────────────────────────┐
+			    │  On the first machine                                    │
+			    ├──────────────────────────────────────────────────────────┤
+			    │ master# kubeadm init                                     │
+			    └──────────────────────────────────────────────────────────┘
+
+			    ┌──────────────────────────────────────────────────────────┐
+			    │ On the second machine                                    │
+			    ├──────────────────────────────────────────────────────────┤
+			    │ node# kubeadm join --token=<token> <ip-of-master>        │
+			    └──────────────────────────────────────────────────────────┘
+
+			    You can then repeat the second step on as many other machines as you like.
+
+		`),
+	}
+	// TODO(phase2+) figure out how to avoid running as root
+	//
+	// TODO(phase2) detect interactive vs non-interactive use and adjust output accordingly
+	// i.e. make it automation friendly
+	//
+	// TODO(phase2) create an abstraction that defines files and the content that needs to
+	// be written to disc and write it all in one go at the end as we have a lot of
+	// crapy little files written from different parts of this code; this could also
+	// be useful for testing
+	// by having this model we can allow users to create some files before `kubeadm init` runs, e.g. PKI assets, we
+	// would then be able to look at files users has given an diff or validate if those are sane, we could also warn
+	// if any of the files had been deprecated
+
+	cmds.ResetFlags()
+	cmds.SetGlobalNormalizationFunc(flag.WarnWordSepNormalizeFunc)
+
+	cmds.AddCommand(NewCmdInit(out))
+	cmds.AddCommand(NewCmdJoin(out))
+	cmds.AddCommand(NewCmdReset(out))
+	cmds.AddCommand(NewCmdToken(out))
+	cmds.AddCommand(NewCmdVersion(out))
+
+	return cmds
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/init.go

@@ -0,0 +1,296 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"bytes"
+	"fmt"
+	"html/template"
+	"io"
+	"io/ioutil"
+
+	"github.com/renstrom/dedent"
+	"github.com/spf13/cobra"
+
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	kubeadmapiext "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1"
+	kubemaster "k8s.io/kubernetes/cmd/kubeadm/app/master"
+	"k8s.io/kubernetes/cmd/kubeadm/app/preflight"
+	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	_ "k8s.io/kubernetes/pkg/cloudprovider/providers"
+	"k8s.io/kubernetes/pkg/runtime"
+	netutil "k8s.io/kubernetes/pkg/util/net"
+)
+
+const (
+	joinArgsTemplateLiteral = `--token={{.Cfg.Secrets.GivenToken -}}
+		{{if ne .Cfg.API.BindPort .DefaultAPIBindPort -}}
+		{{" --api-port="}}{{.Cfg.API.BindPort -}}
+		{{end -}}
+		{{if ne .Cfg.Discovery.BindPort .DefaultDiscoveryBindPort -}}
+		{{" --discovery-port="}}{{.Cfg.Discovery.BindPort -}}
+		{{end -}}
+		{{" "}}{{index .Cfg.API.AdvertiseAddresses 0 -}}
+`
+)
+
+var (
+	initDoneMsgf = dedent.Dedent(`
+		Kubernetes master initialised successfully!
+
+		You can now join any number of machines by running the following on each node:
+
+		kubeadm join %s
+		`)
+)
+
+// NewCmdInit returns "kubeadm init" command.
+func NewCmdInit(out io.Writer) *cobra.Command {
+	versioned := &kubeadmapiext.MasterConfiguration{}
+	api.Scheme.Default(versioned)
+	cfg := kubeadmapi.MasterConfiguration{}
+	api.Scheme.Convert(versioned, &cfg, nil)
+
+	var cfgPath string
+	var skipPreFlight bool
+	cmd := &cobra.Command{
+		Use:   "init",
+		Short: "Run this in order to set up the Kubernetes master",
+		Run: func(cmd *cobra.Command, args []string) {
+			i, err := NewInit(cfgPath, &cfg, skipPreFlight)
+			kubeadmutil.CheckErr(err)
+			kubeadmutil.CheckErr(i.Run(out))
+		},
+	}
+
+	cmd.PersistentFlags().StringVar(
+		&cfg.Secrets.GivenToken, "token", cfg.Secrets.GivenToken,
+		"Shared secret used to secure cluster bootstrap; if none is provided, one will be generated for you",
+	)
+	cmd.PersistentFlags().StringSliceVar(
+		&cfg.API.AdvertiseAddresses, "api-advertise-addresses", cfg.API.AdvertiseAddresses,
+		"The IP addresses to advertise, in case autodetection fails",
+	)
+	cmd.PersistentFlags().StringSliceVar(
+		&cfg.API.ExternalDNSNames, "api-external-dns-names", cfg.API.ExternalDNSNames,
+		"The DNS names to advertise, in case you have configured them yourself",
+	)
+	cmd.PersistentFlags().StringVar(
+		&cfg.Networking.ServiceSubnet, "service-cidr", cfg.Networking.ServiceSubnet,
+		"Use alternative range of IP address for service VIPs",
+	)
+	cmd.PersistentFlags().StringVar(
+		&cfg.Networking.PodSubnet, "pod-network-cidr", cfg.Networking.PodSubnet,
+		"Specify range of IP addresses for the pod network; if set, the control plane will automatically allocate CIDRs for every node",
+	)
+	cmd.PersistentFlags().StringVar(
+		&cfg.Networking.DNSDomain, "service-dns-domain", cfg.Networking.DNSDomain,
+		`Use alternative domain for services, e.g. "myorg.internal"`,
+	)
+	cmd.PersistentFlags().StringVar(
+		&cfg.CloudProvider, "cloud-provider", cfg.CloudProvider,
+		`Enable cloud provider features (external load-balancers, storage, etc), e.g. "gce"`,
+	)
+
+	cmd.PersistentFlags().StringVar(
+		&cfg.KubernetesVersion, "use-kubernetes-version", cfg.KubernetesVersion,
+		`Choose a specific Kubernetes version for the control plane`,
+	)
+
+	cmd.PersistentFlags().StringVar(&cfgPath, "config", cfgPath, "Path to kubeadm config file")
+
+	// TODO (phase1+) @errordeveloper make the flags below not show up in --help but rather on --advanced-help
+	cmd.PersistentFlags().StringSliceVar(
+		&cfg.Etcd.Endpoints, "external-etcd-endpoints", cfg.Etcd.Endpoints,
+		"etcd endpoints to use, in case you have an external cluster",
+	)
+	cmd.PersistentFlags().MarkDeprecated("external-etcd-endpoints", "this flag will be removed when componentconfig exists")
+
+	cmd.PersistentFlags().StringVar(
+		&cfg.Etcd.CAFile, "external-etcd-cafile", cfg.Etcd.CAFile,
+		"etcd certificate authority certificate file. Note: The path must be in /etc/ssl/certs",
+	)
+	cmd.PersistentFlags().MarkDeprecated("external-etcd-cafile", "this flag will be removed when componentconfig exists")
+
+	cmd.PersistentFlags().StringVar(
+		&cfg.Etcd.CertFile, "external-etcd-certfile", cfg.Etcd.CertFile,
+		"etcd client certificate file. Note: The path must be in /etc/ssl/certs",
+	)
+	cmd.PersistentFlags().MarkDeprecated("external-etcd-certfile", "this flag will be removed when componentconfig exists")
+
+	cmd.PersistentFlags().StringVar(
+		&cfg.Etcd.KeyFile, "external-etcd-keyfile", cfg.Etcd.KeyFile,
+		"etcd client key file. Note: The path must be in /etc/ssl/certs",
+	)
+	cmd.PersistentFlags().MarkDeprecated("external-etcd-keyfile", "this flag will be removed when componentconfig exists")
+
+	cmd.PersistentFlags().BoolVar(
+		&skipPreFlight, "skip-preflight-checks", skipPreFlight,
+		"skip preflight checks normally run before modifying the system",
+	)
+
+	cmd.PersistentFlags().Int32Var(
+		&cfg.API.BindPort, "api-port", cfg.API.BindPort,
+		"Port for API to bind to",
+	)
+
+	cmd.PersistentFlags().Int32Var(
+		&cfg.Discovery.BindPort, "discovery-port", cfg.Discovery.BindPort,
+		"Port for JWS discovery service to bind to",
+	)
+
+	return cmd
+}
+
+type Init struct {
+	cfg *kubeadmapi.MasterConfiguration
+}
+
+func NewInit(cfgPath string, cfg *kubeadmapi.MasterConfiguration, skipPreFlight bool) (*Init, error) {
+	if cfgPath != "" {
+		b, err := ioutil.ReadFile(cfgPath)
+		if err != nil {
+			return nil, fmt.Errorf("unable to read config from %q [%v]", cfgPath, err)
+		}
+		if err := runtime.DecodeInto(api.Codecs.UniversalDecoder(), b, cfg); err != nil {
+			return nil, fmt.Errorf("unable to decode config from %q [%v]", cfgPath, err)
+		}
+	}
+
+	// Auto-detect the IP
+	if len(cfg.API.AdvertiseAddresses) == 0 {
+		// TODO(phase1+) perhaps we could actually grab eth0 and eth1
+		ip, err := netutil.ChooseHostInterface()
+		if err != nil {
+			return nil, err
+		}
+		cfg.API.AdvertiseAddresses = []string{ip.String()}
+	}
+
+	if !skipPreFlight {
+		fmt.Println("Running pre-flight checks")
+		err := preflight.RunInitMasterChecks(cfg)
+		if err != nil {
+			return nil, &preflight.PreFlightError{Msg: err.Error()}
+		}
+	} else {
+		fmt.Println("Skipping pre-flight checks")
+	}
+
+	// validate version argument
+	ver, err := kubeadmutil.KubernetesReleaseVersion(cfg.KubernetesVersion)
+	if err != nil {
+		if cfg.KubernetesVersion != kubeadmapiext.DefaultKubernetesVersion {
+			return nil, err
+		} else {
+			ver = kubeadmapiext.DefaultKubernetesFallbackVersion
+		}
+	}
+	cfg.KubernetesVersion = ver
+	fmt.Println("Using Kubernetes version:", ver)
+
+	// TODO(phase1+) create a custom flag
+	if cfg.CloudProvider != "" {
+		if cloudprovider.IsCloudProvider(cfg.CloudProvider) {
+			fmt.Printf("cloud provider %q initialized for the control plane. Remember to set the same cloud provider flag on the kubelet.\n", cfg.CloudProvider)
+		} else {
+			return nil, fmt.Errorf("cloud provider %q is not supported, you can use any of %v, or leave it unset.\n", cfg.CloudProvider, cloudprovider.CloudProviders())
+		}
+	}
+	return &Init{cfg: cfg}, nil
+}
+
+// joinArgsData denotes a data object which is needed by function generateJoinArgs to generate kubeadm join arguments.
+type joinArgsData struct {
+	Cfg                      *kubeadmapi.MasterConfiguration
+	DefaultAPIBindPort       int32
+	DefaultDiscoveryBindPort int32
+}
+
+// Run executes master node provisioning, including certificates, needed static pod manifests, etc.
+func (i *Init) Run(out io.Writer) error {
+	if err := kubemaster.CreateTokenAuthFile(&i.cfg.Secrets); err != nil {
+		return err
+	}
+
+	if err := kubemaster.WriteStaticPodManifests(i.cfg); err != nil {
+		return err
+	}
+
+	caKey, caCert, err := kubemaster.CreatePKIAssets(i.cfg)
+	if err != nil {
+		return err
+	}
+
+	kubeconfigs, err := kubemaster.CreateCertsAndConfigForClients(i.cfg.API, []string{"kubelet", "admin"}, caKey, caCert)
+	if err != nil {
+		return err
+	}
+
+	// kubeadm is responsible for writing the following kubeconfig file, which
+	// kubelet should be waiting for. Help user avoid foot-shooting by refusing to
+	// write a file that has already been written (the kubelet will be up and
+	// running in that case - they'd need to stop the kubelet, remove the file, and
+	// start it again in that case).
+	// TODO(phase1+) this is no longer the right place to guard agains foo-shooting,
+	// we need to decide how to handle existing files (it may be handy to support
+	// importing existing files, may be we could even make our command idempotant,
+	// or at least allow for external PKI and stuff)
+	for name, kubeconfig := range kubeconfigs {
+		if err := kubeadmutil.WriteKubeconfigIfNotExists(name, kubeconfig); err != nil {
+			return err
+		}
+	}
+
+	client, err := kubemaster.CreateClientAndWaitForAPI(kubeconfigs["admin"])
+	if err != nil {
+		return err
+	}
+
+	schedulePodsOnMaster := false
+	if err := kubemaster.UpdateMasterRoleLabelsAndTaints(client, schedulePodsOnMaster); err != nil {
+		return err
+	}
+
+	if err := kubemaster.CreateDiscoveryDeploymentAndSecret(i.cfg, client, caCert); err != nil {
+		return err
+	}
+
+	if err := kubemaster.CreateEssentialAddons(i.cfg, client); err != nil {
+		return err
+	}
+
+	data := joinArgsData{i.cfg, kubeadmapiext.DefaultAPIBindPort, kubeadmapiext.DefaultDiscoveryBindPort}
+	if joinArgs, err := generateJoinArgs(data); err != nil {
+		return err
+	} else {
+		fmt.Fprintf(out, initDoneMsgf, joinArgs)
+	}
+	return nil
+}
+
+// generateJoinArgs generates kubeadm join arguments
+func generateJoinArgs(data joinArgsData) (string, error) {
+	joinArgsTemplate := template.Must(template.New("joinArgsTemplate").Parse(joinArgsTemplateLiteral))
+	var b bytes.Buffer
+	if err := joinArgsTemplate.Execute(&b, data); err != nil {
+		return "", err
+	}
+	return b.String(), nil
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/join.go

@@ -0,0 +1,160 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+
+	"github.com/renstrom/dedent"
+	"github.com/spf13/cobra"
+
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	kubeadmapiext "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1"
+	kubenode "k8s.io/kubernetes/cmd/kubeadm/app/node"
+	"k8s.io/kubernetes/cmd/kubeadm/app/preflight"
+	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/runtime"
+)
+
+var (
+	joinDoneMsgf = dedent.Dedent(`
+		Node join complete:
+		* Certificate signing request sent to master and response
+		  received.
+		* Kubelet informed of new secure connection details.
+
+		Run 'kubectl get nodes' on the master to see this machine join.
+		`)
+)
+
+// NewCmdJoin returns "kubeadm join" command.
+func NewCmdJoin(out io.Writer) *cobra.Command {
+	versioned := &kubeadmapiext.NodeConfiguration{}
+	api.Scheme.Default(versioned)
+	cfg := kubeadmapi.NodeConfiguration{}
+	api.Scheme.Convert(versioned, &cfg, nil)
+
+	var skipPreFlight bool
+	var cfgPath string
+
+	cmd := &cobra.Command{
+		Use:   "join <master address>",
+		Short: "Run this on any machine you wish to join an existing cluster",
+		Run: func(cmd *cobra.Command, args []string) {
+			j, err := NewJoin(cfgPath, args, &cfg, skipPreFlight)
+			kubeadmutil.CheckErr(err)
+			kubeadmutil.CheckErr(j.Run(out))
+		},
+	}
+
+	cmd.PersistentFlags().StringVar(
+		&cfg.Secrets.GivenToken, "token", cfg.Secrets.GivenToken,
+		"(required) Shared secret used to secure bootstrap. Must match the output of 'kubeadm init'",
+	)
+
+	cmd.PersistentFlags().StringVar(&cfgPath, "config", cfgPath, "Path to kubeadm config file")
+
+	cmd.PersistentFlags().BoolVar(
+		&skipPreFlight, "skip-preflight-checks", false,
+		"skip preflight checks normally run before modifying the system",
+	)
+
+	cmd.PersistentFlags().Int32Var(
+		&cfg.APIPort, "api-port", cfg.APIPort,
+		"(optional) API server port on the master",
+	)
+
+	cmd.PersistentFlags().Int32Var(
+		&cfg.DiscoveryPort, "discovery-port", cfg.DiscoveryPort,
+		"(optional) Discovery port on the master",
+	)
+
+	return cmd
+}
+
+type Join struct {
+	cfg *kubeadmapi.NodeConfiguration
+}
+
+func NewJoin(cfgPath string, args []string, cfg *kubeadmapi.NodeConfiguration, skipPreFlight bool) (*Join, error) {
+	if cfgPath != "" {
+		b, err := ioutil.ReadFile(cfgPath)
+		if err != nil {
+			return nil, fmt.Errorf("unable to read config from %q [%v]", cfgPath, err)
+		}
+		if err := runtime.DecodeInto(api.Codecs.UniversalDecoder(), b, cfg); err != nil {
+			return nil, fmt.Errorf("unable to decode config from %q [%v]", cfgPath, err)
+		}
+	}
+
+	if len(args) == 0 && len(cfg.MasterAddresses) == 0 {
+		return nil, fmt.Errorf("must specify master address (see --help)")
+	}
+	cfg.MasterAddresses = append(cfg.MasterAddresses, args...)
+	if len(cfg.MasterAddresses) > 1 {
+		return nil, fmt.Errorf("Must not specify more than one master address  (see --help)")
+	}
+
+	if !skipPreFlight {
+		fmt.Println("Running pre-flight checks")
+		err := preflight.RunJoinNodeChecks(cfg)
+		if err != nil {
+			return nil, &preflight.PreFlightError{Msg: err.Error()}
+		}
+	} else {
+		fmt.Println("Skipping pre-flight checks")
+	}
+
+	ok, err := kubeadmutil.UseGivenTokenIfValid(&cfg.Secrets)
+	if !ok {
+		if err != nil {
+			return nil, fmt.Errorf("%v (see --help)\n", err)
+		}
+		return nil, fmt.Errorf("Must specify --token (see --help)\n")
+	}
+
+	return &Join{cfg: cfg}, nil
+}
+
+// Run executes worked node provisioning and tries to join an existing cluster.
+func (j *Join) Run(out io.Writer) error {
+	clusterInfo, err := kubenode.RetrieveTrustedClusterInfo(j.cfg)
+	if err != nil {
+		return err
+	}
+
+	connectionDetails, err := kubenode.EstablishMasterConnection(j.cfg, clusterInfo)
+	if err != nil {
+		return err
+	}
+
+	kubeconfig, err := kubenode.PerformTLSBootstrap(connectionDetails)
+	if err != nil {
+		return err
+	}
+
+	err = kubeadmutil.WriteKubeconfigIfNotExists("kubelet", kubeconfig)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(out, joinDoneMsgf)
+	return nil
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/reset.go

@@ -0,0 +1,165 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+
+	"k8s.io/kubernetes/cmd/kubeadm/app/preflight"
+	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
+	"k8s.io/kubernetes/pkg/util/initsystem"
+)
+
+// NewCmdReset returns "kubeadm reset" command.
+func NewCmdReset(out io.Writer) *cobra.Command {
+	var skipPreFlight bool
+	cmd := &cobra.Command{
+		Use:   "reset",
+		Short: "Run this to revert any changes made to this host by 'kubeadm init' or 'kubeadm join'.",
+		Run: func(cmd *cobra.Command, args []string) {
+			r, err := NewReset(skipPreFlight)
+			kubeadmutil.CheckErr(err)
+			kubeadmutil.CheckErr(r.Run(out))
+		},
+	}
+
+	cmd.PersistentFlags().BoolVar(
+		&skipPreFlight, "skip-preflight-checks", false,
+		"skip preflight checks normally run before modifying the system",
+	)
+
+	return cmd
+}
+
+type Reset struct{}
+
+func NewReset(skipPreFlight bool) (*Reset, error) {
+	if !skipPreFlight {
+		fmt.Println("Running pre-flight checks")
+		err := preflight.RunResetCheck()
+		if err != nil {
+			return nil, &preflight.PreFlightError{Msg: err.Error()}
+		}
+	} else {
+		fmt.Println("Skipping pre-flight checks")
+	}
+
+	return &Reset{}, nil
+}
+
+// cleanDir removes everything in a directory, but not the directory itself:
+func cleanDir(path string) {
+	// If the directory doesn't even exist there's nothing to do, and we do
+	// not consider this an error:
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		return
+	}
+
+	d, err := os.Open(path)
+	if err != nil {
+		fmt.Printf("failed to remove directory: [%v]\n", err)
+	}
+	defer d.Close()
+	names, err := d.Readdirnames(-1)
+	if err != nil {
+		fmt.Printf("failed to remove directory: [%v]\n", err)
+	}
+	for _, name := range names {
+		err = os.RemoveAll(filepath.Join(path, name))
+		if err != nil {
+			fmt.Printf("failed to remove directory: [%v]\n", err)
+		}
+	}
+}
+
+// resetConfigDir is used to cleanup the files kubeadm writes in /etc/kubernetes/.
+func resetConfigDir(configDirPath string) {
+	dirsToClean := []string{
+		filepath.Join(configDirPath, "manifests"),
+		filepath.Join(configDirPath, "pki"),
+	}
+	fmt.Printf("Deleting contents of config directories: %v\n", dirsToClean)
+	for _, dir := range dirsToClean {
+		cleanDir(dir)
+	}
+
+	filesToClean := []string{
+		filepath.Join(configDirPath, "admin.conf"),
+		filepath.Join(configDirPath, "kubelet.conf"),
+	}
+	fmt.Printf("Deleting files: %v\n", filesToClean)
+	for _, path := range filesToClean {
+		err := os.RemoveAll(path)
+		if err != nil {
+			fmt.Printf("failed to remove file: [%v]\n", err)
+		}
+	}
+}
+
+// Run reverts any changes made to this host by "kubeadm init" or "kubeadm join".
+func (r *Reset) Run(out io.Writer) error {
+	serviceToStop := "kubelet"
+	initSystem, err := initsystem.GetInitSystem()
+	if err != nil {
+		fmt.Printf("%v", err)
+	} else {
+		fmt.Printf("Stopping the %s service...\n", serviceToStop)
+		if err := initSystem.ServiceStop(serviceToStop); err != nil {
+			fmt.Printf("failed to stop the %s service", serviceToStop)
+		}
+	}
+
+	fmt.Printf("Unmounting directories in /var/lib/kubelet...\n")
+	umountDirsCmd := "cat /proc/mounts | awk '{print $2}' | grep '/var/lib/kubelet' | xargs -r umount"
+	umountOutputBytes, err := exec.Command("sh", "-c", umountDirsCmd).Output()
+	if err != nil {
+		fmt.Printf("failed to unmount directories in /var/lib/kubelet, %s", string(umountOutputBytes))
+	}
+
+	dirsToClean := []string{"/var/lib/kubelet"}
+
+	// Only clear etcd data when the etcd manifest is found. In case it is not found, we must assume that the user
+	// provided external etcd endpoints. In that case, it is his own responsibility to reset etcd
+	if _, err := os.Stat("/etc/kubernetes/manifests/etcd.json"); os.IsNotExist(err) {
+		dirsToClean = append(dirsToClean, "/var/lib/etcd")
+	}
+
+	resetConfigDir("/etc/kubernetes/")
+
+	fmt.Printf("Deleting contents of stateful directories: %v\n", dirsToClean)
+	for _, dir := range dirsToClean {
+		cleanDir(dir)
+	}
+
+	dockerCheck := preflight.ServiceCheck{Service: "docker"}
+	if warnings, errors := dockerCheck.Check(); len(warnings) == 0 && len(errors) == 0 {
+		fmt.Println("Stopping all running docker containers...")
+		if err := exec.Command("sh", "-c", "docker ps | grep 'k8s_' | awk '{print $1}' | xargs docker rm --force --volumes").Run(); err != nil {
+			fmt.Println("failed to stop the running containers")
+		}
+	} else {
+		fmt.Println("docker doesn't seem to be running, skipping the removal of kubernetes containers")
+	}
+
+	return nil
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/reset_test.go

@@ -0,0 +1,182 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"k8s.io/kubernetes/cmd/kubeadm/app/preflight"
+)
+
+func assertExists(t *testing.T, path string) {
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		t.Errorf("file/dir does not exist error: %s", err)
+		t.Errorf("file/dir does not exist: %s", path)
+	}
+}
+
+func assertNotExists(t *testing.T, path string) {
+	if _, err := os.Stat(path); err == nil {
+		t.Errorf("file/dir exists: %s", path)
+	}
+}
+
+// assertDirEmpty verifies a directory either does not exist, or is empty.
+func assertDirEmpty(t *testing.T, path string) {
+	dac := preflight.DirAvailableCheck{Path: path}
+	_, errors := dac.Check()
+	if len(errors) != 0 {
+		t.Errorf("directory not empty: [%v]", errors)
+	}
+}
+
+func TestConfigDirCleaner(t *testing.T) {
+	tests := map[string]struct {
+		setupDirs       []string
+		setupFiles      []string
+		verifyExists    []string
+		verifyNotExists []string
+	}{
+		"simple reset": {
+			setupDirs: []string{
+				"manifests",
+				"pki",
+			},
+			setupFiles: []string{
+				"manifests/etcd.json",
+				"manifests/kube-apiserver.json",
+				"pki/ca.pem",
+				"admin.conf",
+				"kubelet.conf",
+			},
+			verifyExists: []string{
+				"manifests",
+				"pki",
+			},
+		},
+		"partial reset": {
+			setupDirs: []string{
+				"pki",
+			},
+			setupFiles: []string{
+				"pki/ca.pem",
+				"kubelet.conf",
+			},
+			verifyExists: []string{
+				"pki",
+			},
+			verifyNotExists: []string{
+				"manifests",
+			},
+		},
+		"preserve cloud-config.json": {
+			setupDirs: []string{
+				"manifests",
+				"pki",
+			},
+			setupFiles: []string{
+				"manifests/etcd.json",
+				"manifests/kube-apiserver.json",
+				"pki/ca.pem",
+				"admin.conf",
+				"kubelet.conf",
+				"cloud-config.json",
+			},
+			verifyExists: []string{
+				"manifests",
+				"pki",
+				"cloud-config.json",
+			},
+		},
+		"preserve hidden files and directories": {
+			setupDirs: []string{
+				"manifests",
+				"pki",
+				".mydir",
+			},
+			setupFiles: []string{
+				"manifests/etcd.json",
+				"manifests/kube-apiserver.json",
+				"pki/ca.pem",
+				"admin.conf",
+				"kubelet.conf",
+				".cloud-config.json",
+				".mydir/.myfile",
+			},
+			verifyExists: []string{
+				"manifests",
+				"pki",
+				".cloud-config.json",
+				".mydir",
+				".mydir/.myfile",
+			},
+		},
+		"no-op reset": {
+			verifyNotExists: []string{
+				"pki",
+				"manifests",
+			},
+		},
+	}
+
+	for name, test := range tests {
+		t.Logf("Running test: %s", name)
+
+		// Create a temporary directory for our fake config dir:
+		tmpDir, err := ioutil.TempDir("", "kubeadm-reset-test")
+		if err != nil {
+			t.Errorf("Unable to create temp directory: %s", err)
+		}
+		defer os.RemoveAll(tmpDir)
+
+		for _, createDir := range test.setupDirs {
+			err := os.Mkdir(filepath.Join(tmpDir, createDir), 0700)
+			if err != nil {
+				t.Errorf("Unable to setup test config directory: %s", err)
+			}
+		}
+
+		for _, createFile := range test.setupFiles {
+			fullPath := filepath.Join(tmpDir, createFile)
+			f, err := os.Create(fullPath)
+			defer f.Close()
+			if err != nil {
+				t.Errorf("Unable to create test file: %s", err)
+			}
+		}
+
+		resetConfigDir(tmpDir)
+
+		// Verify the files we cleanup implicitly in every test:
+		assertExists(t, tmpDir)
+		assertNotExists(t, filepath.Join(tmpDir, "admin.conf"))
+		assertNotExists(t, filepath.Join(tmpDir, "kubelet.conf"))
+		assertDirEmpty(t, filepath.Join(tmpDir, "manifests"))
+		assertDirEmpty(t, filepath.Join(tmpDir, "pki"))
+
+		// Verify the files as requested by the test:
+		for _, path := range test.verifyExists {
+			assertExists(t, filepath.Join(tmpDir, path))
+		}
+		for _, path := range test.verifyNotExists {
+			assertNotExists(t, filepath.Join(tmpDir, path))
+		}
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/token.go

@@ -0,0 +1,86 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/renstrom/dedent"
+	"github.com/spf13/cobra"
+
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	"k8s.io/kubernetes/cmd/kubeadm/app/util"
+	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
+)
+
+func NewCmdToken(out io.Writer) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "token",
+		Short: "Manage tokens used by init/join",
+
+		// Without this callback, if a user runs just the "token"
+		// command without a subcommand, or with an invalid subcommand,
+		// cobra will print usage information, but still exit cleanly.
+		// We want to return an error code in these cases so that the
+		// user knows that their command was invalid.
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) < 1 {
+				return errors.New("missing subcommand; 'token' is not meant to be run on its own")
+			} else {
+				return fmt.Errorf("invalid subcommand: %s", args[0])
+			}
+		},
+	}
+
+	cmd.AddCommand(NewCmdTokenGenerate(out))
+	return cmd
+}
+
+func NewCmdTokenGenerate(out io.Writer) *cobra.Command {
+	return &cobra.Command{
+		Use:   "generate",
+		Short: "Generate and print a token suitable for use with init/join",
+		Long: dedent.Dedent(`
+			This command will print out a randomly-generated token that you can use with
+			the "init" and "join" commands.
+
+			You don't have to use this command in order to generate a token, you can do so
+			yourself as long as it's in the format "<6 characters>.<16 characters>". This
+			command is provided for convenience to generate tokens in that format.
+
+			You can also use "kubeadm init" without specifying a token, and it will
+			generate and print one for you.
+		`),
+		Run: func(cmd *cobra.Command, args []string) {
+			err := RunGenerateToken(out)
+			kubeadmutil.CheckErr(err)
+		},
+	}
+}
+
+func RunGenerateToken(out io.Writer) error {
+	s := &kubeadmapi.Secrets{}
+	err := util.GenerateToken(s)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintln(out, s.GivenToken)
+	return nil
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/token_test.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"bytes"
+	"regexp"
+	"testing"
+)
+
+const (
+	TokenExpectedRegex = "^\\S{6}\\.\\S{16}\n$"
+)
+
+func TestRunGenerateToken(t *testing.T) {
+	var buf bytes.Buffer
+
+	err := RunGenerateToken(&buf)
+	if err != nil {
+		t.Errorf("RunGenerateToken returned an error: %v", err)
+	}
+
+	output := buf.String()
+
+	matched, err := regexp.MatchString(TokenExpectedRegex, output)
+	if err != nil {
+		t.Fatalf("encountered an error while trying to match RunGenerateToken's output: %v", err)
+	}
+	if !matched {
+		t.Errorf("RunGenerateToken's output did not match expected regex; wanted: [%s], got: [%s]", TokenExpectedRegex, output)
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/cmd/version.go

@@ -0,0 +1,44 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/spf13/cobra"
+
+	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
+	"k8s.io/kubernetes/pkg/version"
+)
+
+func NewCmdVersion(out io.Writer) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "version",
+		Short: "Print the version of kubeadm",
+		Run: func(cmd *cobra.Command, args []string) {
+			err := RunVersion(out, cmd)
+			kubeadmutil.CheckErr(err)
+		},
+	}
+	return cmd
+}
+
+func RunVersion(out io.Writer, cmd *cobra.Command) error {
+	fmt.Fprintf(out, "kubeadm version: %#v\n", version.Get())
+	return nil
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/images/BUILD

@@ -0,0 +1,26 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["images.go"],
+    tags = ["automanaged"],
+    deps = ["//cmd/kubeadm/app/apis/kubeadm:go_default_library"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["images_test.go"],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = ["//cmd/kubeadm/app/apis/kubeadm:go_default_library"],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/images/images.go

@@ -0,0 +1,70 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package images
+
+import (
+	"fmt"
+	"runtime"
+
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+)
+
+const (
+	KubeEtcdImage = "etcd"
+
+	KubeAPIServerImage         = "apiserver"
+	KubeControllerManagerImage = "controller-manager"
+	KubeSchedulerImage         = "scheduler"
+	KubeProxyImage             = "proxy"
+
+	KubeDNSImage         = "kube-dns"
+	KubeDNSmasqImage     = "dnsmasq"
+	KubeExechealthzImage = "exechealthz"
+	Pause                = "pause"
+
+	gcrPrefix   = "gcr.io/google_containers"
+	etcdVersion = "3.0.14-kubeadm"
+
+	kubeDNSVersion     = "1.7"
+	dnsmasqVersion     = "1.3"
+	exechealthzVersion = "1.1"
+	pauseVersion       = "3.0"
+)
+
+func GetCoreImage(image string, cfg *kubeadmapi.MasterConfiguration, overrideImage string) string {
+	if overrideImage != "" {
+		return overrideImage
+	}
+	repoPrefix := kubeadmapi.GlobalEnvParams.RepositoryPrefix
+	return map[string]string{
+		KubeEtcdImage:              fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "etcd", runtime.GOARCH, etcdVersion),
+		KubeAPIServerImage:         fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "kube-apiserver", runtime.GOARCH, cfg.KubernetesVersion),
+		KubeControllerManagerImage: fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "kube-controller-manager", runtime.GOARCH, cfg.KubernetesVersion),
+		KubeSchedulerImage:         fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "kube-scheduler", runtime.GOARCH, cfg.KubernetesVersion),
+		KubeProxyImage:             fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "kube-proxy", runtime.GOARCH, cfg.KubernetesVersion),
+	}[image]
+}
+
+func GetAddonImage(image string) string {
+	repoPrefix := kubeadmapi.GlobalEnvParams.RepositoryPrefix
+	return map[string]string{
+		KubeDNSImage:         fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "kubedns", runtime.GOARCH, kubeDNSVersion),
+		KubeDNSmasqImage:     fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "kube-dnsmasq", runtime.GOARCH, dnsmasqVersion),
+		KubeExechealthzImage: fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "exechealthz", runtime.GOARCH, exechealthzVersion),
+		Pause:                fmt.Sprintf("%s/%s-%s:%s", repoPrefix, "pause", runtime.GOARCH, pauseVersion),
+	}[image]
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/images/images_test.go

@@ -0,0 +1,112 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package images
+
+import (
+	"fmt"
+	"runtime"
+	"testing"
+
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+)
+
+type getCoreImageTest struct {
+	i string
+	c *kubeadmapi.MasterConfiguration
+	o string
+}
+
+const testversion = "1"
+
+func TestGetCoreImage(t *testing.T) {
+	var tokenTest = []struct {
+		t        getCoreImageTest
+		expected string
+	}{
+		{getCoreImageTest{o: "override"}, "override"},
+		{getCoreImageTest{
+			i: KubeEtcdImage,
+			c: &kubeadmapi.MasterConfiguration{}},
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "etcd", runtime.GOARCH, etcdVersion),
+		},
+		{getCoreImageTest{
+			i: KubeAPIServerImage,
+			c: &kubeadmapi.MasterConfiguration{KubernetesVersion: testversion}},
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "kube-apiserver", runtime.GOARCH, testversion),
+		},
+		{getCoreImageTest{
+			i: KubeControllerManagerImage,
+			c: &kubeadmapi.MasterConfiguration{KubernetesVersion: testversion}},
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "kube-controller-manager", runtime.GOARCH, testversion),
+		},
+		{getCoreImageTest{
+			i: KubeSchedulerImage,
+			c: &kubeadmapi.MasterConfiguration{KubernetesVersion: testversion}},
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "kube-scheduler", runtime.GOARCH, testversion),
+		},
+		{getCoreImageTest{
+			i: KubeProxyImage,
+			c: &kubeadmapi.MasterConfiguration{KubernetesVersion: testversion}},
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "kube-proxy", runtime.GOARCH, testversion),
+		},
+	}
+	for _, rt := range tokenTest {
+		actual := GetCoreImage(rt.t.i, rt.t.c, rt.t.o)
+		if actual != rt.expected {
+			t.Errorf(
+				"failed GetCoreImage:\n\texpected: %s\n\t  actual: %s",
+				rt.expected,
+				actual,
+			)
+		}
+	}
+}
+
+func TestGetAddonImage(t *testing.T) {
+	var tokenTest = []struct {
+		t        string
+		expected string
+	}{
+		{"matches nothing", ""},
+		{
+			KubeDNSImage,
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "kubedns", runtime.GOARCH, kubeDNSVersion),
+		},
+		{
+			KubeDNSmasqImage,
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "kube-dnsmasq", runtime.GOARCH, dnsmasqVersion),
+		},
+		{
+			KubeExechealthzImage,
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "exechealthz", runtime.GOARCH, exechealthzVersion),
+		},
+		{
+			Pause,
+			fmt.Sprintf("%s/%s-%s:%s", gcrPrefix, "pause", runtime.GOARCH, pauseVersion),
+		},
+	}
+	for _, rt := range tokenTest {
+		actual := GetAddonImage(rt.t)
+		if actual != rt.expected {
+			t.Errorf(
+				"failed GetCoreImage:\n\texpected: %s\n\t  actual: %s",
+				rt.expected,
+				actual,
+			)
+		}
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/kubeadm.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	"os"
+
+	"github.com/spf13/pflag"
+
+	_ "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/install"
+	"k8s.io/kubernetes/cmd/kubeadm/app/cmd"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/util/logs"
+)
+
+func Run() error {
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	// We do not want these flags to show up in --help
+	pflag.CommandLine.MarkHidden("google-json-key")
+	pflag.CommandLine.MarkHidden("log-flush-frequency")
+
+	cmd := cmd.NewKubeadmCommand(cmdutil.NewFactory(nil), os.Stdin, os.Stdout, os.Stderr)
+	return cmd.Execute()
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/master/BUILD

@@ -0,0 +1,67 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+    "go_test",
+    "cgo_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "addons.go",
+        "apiclient.go",
+        "discovery.go",
+        "kubeconfig.go",
+        "manifests.go",
+        "pki.go",
+        "tokens.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
+        "//cmd/kubeadm/app/apis/kubeadm/v1alpha1:go_default_library",
+        "//cmd/kubeadm/app/images:go_default_library",
+        "//cmd/kubeadm/app/util:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/api/errors:go_default_library",
+        "//pkg/api/resource:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/client/clientset_generated/release_1_5:go_default_library",
+        "//pkg/client/unversioned/clientcmd:go_default_library",
+        "//pkg/client/unversioned/clientcmd/api:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/registry/core/service/ipallocator:go_default_library",
+        "//pkg/util/cert:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//pkg/util/uuid:go_default_library",
+        "//pkg/util/wait:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "addons_test.go",
+        "apiclient_test.go",
+        "discovery_test.go",
+        "kubeconfig_test.go",
+        "manifests_test.go",
+        "pki_test.go",
+        "tokens_test.go",
+    ],
+    library = "go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/util/cert:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/master/addons.go

@@ -0,0 +1,264 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package master
+
+import (
+	"fmt"
+	"net"
+	"path"
+
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	"k8s.io/kubernetes/cmd/kubeadm/app/images"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
+	ipallocator "k8s.io/kubernetes/pkg/registry/core/service/ipallocator"
+	"k8s.io/kubernetes/pkg/util/intstr"
+)
+
+func createKubeProxyPodSpec(cfg *kubeadmapi.MasterConfiguration) v1.PodSpec {
+	privilegedTrue := true
+	return v1.PodSpec{
+		HostNetwork:     true,
+		SecurityContext: &v1.PodSecurityContext{},
+		Containers: []v1.Container{{
+			Name:            kubeProxy,
+			Image:           images.GetCoreImage(images.KubeProxyImage, cfg, kubeadmapi.GlobalEnvParams.HyperkubeImage),
+			Command:         append(getProxyCommand(cfg), "--kubeconfig=/run/kubeconfig"),
+			SecurityContext: &v1.SecurityContext{Privileged: &privilegedTrue},
+			VolumeMounts: []v1.VolumeMount{
+				{
+					Name:      "dbus",
+					MountPath: "/var/run/dbus",
+					ReadOnly:  false,
+				},
+				{
+					// TODO there are handful of clever options to get around this, but it's
+					// easier to just mount kubelet's config here; we should probably just
+					// make sure that proxy reads the token and CA cert from /run/secrets
+					// and accepts `--master` at the same time
+					//
+					// clever options include:
+					//  - do CSR dance and create kubeconfig and mount it as a secret
+					//  - create a service account with a second secret encoding kubeconfig
+					//  - use init container to convert known information to kubeconfig
+					//  - ...whatever
+					Name:      "kubeconfig",
+					MountPath: "/run/kubeconfig",
+					ReadOnly:  false,
+				},
+			},
+		}},
+		Volumes: []v1.Volume{
+			{
+				Name: "kubeconfig",
+				VolumeSource: v1.VolumeSource{
+					HostPath: &v1.HostPathVolumeSource{Path: path.Join(kubeadmapi.GlobalEnvParams.KubernetesDir, "kubelet.conf")},
+				},
+			},
+			{
+				Name: "dbus",
+				VolumeSource: v1.VolumeSource{
+					HostPath: &v1.HostPathVolumeSource{Path: "/var/run/dbus"},
+				},
+			},
+		},
+	}
+}
+
+func createKubeDNSPodSpec(cfg *kubeadmapi.MasterConfiguration) v1.PodSpec {
+
+	dnsPodResources := v1.ResourceList{
+		v1.ResourceName(v1.ResourceCPU):    resource.MustParse("100m"),
+		v1.ResourceName(v1.ResourceMemory): resource.MustParse("170Mi"),
+	}
+
+	healthzPodResources := v1.ResourceList{
+		v1.ResourceName(v1.ResourceCPU):    resource.MustParse("10m"),
+		v1.ResourceName(v1.ResourceMemory): resource.MustParse("50Mi"),
+	}
+
+	kubeDNSPort := int32(10053)
+	dnsmasqPort := int32(53)
+
+	nslookup := fmt.Sprintf("nslookup kubernetes.default.svc.%s 127.0.0.1", cfg.Networking.DNSDomain)
+
+	nslookup = fmt.Sprintf("-cmd=%s:%d >/dev/null && %s:%d >/dev/null",
+		nslookup, dnsmasqPort,
+		nslookup, kubeDNSPort,
+	)
+
+	return v1.PodSpec{
+		Containers: []v1.Container{
+			// DNS server
+			{
+				Name:  "kube-dns",
+				Image: images.GetAddonImage(images.KubeDNSImage),
+				Resources: v1.ResourceRequirements{
+					Limits:   dnsPodResources,
+					Requests: dnsPodResources,
+				},
+				Args: []string{
+					fmt.Sprintf("--domain=%s", cfg.Networking.DNSDomain),
+					fmt.Sprintf("--dns-port=%d", kubeDNSPort),
+					// TODO __PILLAR__FEDERATIONS__DOMAIN__MAP__
+				},
+				LivenessProbe: &v1.Probe{
+					Handler: v1.Handler{
+						HTTPGet: &v1.HTTPGetAction{
+							Path:   "/healthz",
+							Port:   intstr.FromInt(8080),
+							Scheme: v1.URISchemeHTTP,
+						},
+					},
+					InitialDelaySeconds: 60,
+					TimeoutSeconds:      5,
+					SuccessThreshold:    1,
+					FailureThreshold:    1,
+				},
+				// # we poll on pod startup for the Kubernetes master service and
+				// # only setup the /readiness HTTP server once that's available.
+				ReadinessProbe: &v1.Probe{
+					Handler: v1.Handler{
+						HTTPGet: &v1.HTTPGetAction{
+							Path:   "/readiness",
+							Port:   intstr.FromInt(8081),
+							Scheme: v1.URISchemeHTTP,
+						},
+					},
+					InitialDelaySeconds: 30,
+					TimeoutSeconds:      5,
+				},
+				Ports: []v1.ContainerPort{
+					{
+						ContainerPort: kubeDNSPort,
+						Name:          "dns-local",
+						Protocol:      v1.ProtocolUDP,
+					},
+					{
+						ContainerPort: kubeDNSPort,
+						Name:          "dns-tcp-local",
+						Protocol:      v1.ProtocolTCP,
+					},
+				},
+			},
+			// dnsmasq
+			{
+				Name:  "dnsmasq",
+				Image: images.GetAddonImage(images.KubeDNSmasqImage),
+				Resources: v1.ResourceRequirements{
+					Limits:   dnsPodResources,
+					Requests: dnsPodResources,
+				},
+				Args: []string{
+					"--cache-size=1000",
+					"--no-resolv",
+					fmt.Sprintf("--server=127.0.0.1#%d", kubeDNSPort),
+				},
+				Ports: []v1.ContainerPort{
+					{
+						ContainerPort: dnsmasqPort,
+						Name:          "dns",
+						Protocol:      v1.ProtocolUDP,
+					},
+					{
+						ContainerPort: dnsmasqPort,
+						Name:          "dns-tcp",
+						Protocol:      v1.ProtocolTCP,
+					},
+				},
+			},
+			// healthz
+			{
+				Name:  "healthz",
+				Image: images.GetAddonImage(images.KubeExechealthzImage),
+				Resources: v1.ResourceRequirements{
+					Limits:   healthzPodResources,
+					Requests: healthzPodResources,
+				},
+				Args: []string{
+					nslookup,
+					"-port=8080",
+					"-quiet",
+				},
+				Ports: []v1.ContainerPort{{
+					ContainerPort: 8080,
+					Protocol:      v1.ProtocolTCP,
+				}},
+			},
+		},
+		DNSPolicy: v1.DNSDefault,
+	}
+
+}
+
+func createKubeDNSServiceSpec(cfg *kubeadmapi.MasterConfiguration) (*v1.ServiceSpec, error) {
+	_, n, err := net.ParseCIDR(cfg.Networking.ServiceSubnet)
+	if err != nil {
+		return nil, fmt.Errorf("could not parse %q: %v", cfg.Networking.ServiceSubnet, err)
+	}
+	ip, err := ipallocator.GetIndexedIP(n, 10)
+	if err != nil {
+		return nil, fmt.Errorf("unable to allocate IP address for kube-dns addon from the given CIDR (%q) [%v]", cfg.Networking.ServiceSubnet, err)
+	}
+
+	svc := &v1.ServiceSpec{
+		Selector: map[string]string{"name": "kube-dns"},
+		Ports: []v1.ServicePort{
+			{Name: "dns", Port: 53, Protocol: v1.ProtocolUDP},
+			{Name: "dns-tcp", Port: 53, Protocol: v1.ProtocolTCP},
+		},
+		ClusterIP: ip.String(),
+	}
+
+	return svc, nil
+}
+
+func CreateEssentialAddons(cfg *kubeadmapi.MasterConfiguration, client *clientset.Clientset) error {
+	kubeProxyDaemonSet := NewDaemonSet(kubeProxy, createKubeProxyPodSpec(cfg))
+	SetMasterTaintTolerations(&kubeProxyDaemonSet.Spec.Template.ObjectMeta)
+	SetNodeAffinity(&kubeProxyDaemonSet.Spec.Template.ObjectMeta, NativeArchitectureNodeAffinity())
+
+	if _, err := client.Extensions().DaemonSets(api.NamespaceSystem).Create(kubeProxyDaemonSet); err != nil {
+		return fmt.Errorf("<master/addons> failed creating essential kube-proxy addon [%v]", err)
+	}
+
+	fmt.Println("<master/addons> created essential addon: kube-proxy")
+
+	kubeDNSDeployment := NewDeployment("kube-dns", 1, createKubeDNSPodSpec(cfg))
+	SetMasterTaintTolerations(&kubeDNSDeployment.Spec.Template.ObjectMeta)
+	SetNodeAffinity(&kubeDNSDeployment.Spec.Template.ObjectMeta, NativeArchitectureNodeAffinity())
+
+	if _, err := client.Extensions().Deployments(api.NamespaceSystem).Create(kubeDNSDeployment); err != nil {
+		return fmt.Errorf("<master/addons> failed creating essential kube-dns addon [%v]", err)
+	}
+
+	kubeDNSServiceSpec, err := createKubeDNSServiceSpec(cfg)
+	if err != nil {
+		return fmt.Errorf("<master/addons> failed creating essential kube-dns addon - %v", err)
+	}
+
+	kubeDNSService := NewService("kube-dns", *kubeDNSServiceSpec)
+	if _, err := client.Services(api.NamespaceSystem).Create(kubeDNSService); err != nil {
+		return fmt.Errorf("<master/addons> failed creating essential kube-dns addon [%v]", err)
+	}
+
+	fmt.Println("<master/addons> created essential addon: kube-dns")
+
+	return nil
+}