Bumping k8s dependencies to 1.13

vendor/k8s.io/kubernetes/pkg/kubeapiserver/BUILD

@@ -13,11 +13,24 @@ go_library(
     ],
     importpath = "k8s.io/kubernetes/pkg/kubeapiserver",
     deps = [
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/server/resourceconfig:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/server/storage:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/storage/storagebackend:go_default_library",
+        "//pkg/api/legacyscheme:go_default_library",
+        "//pkg/apis/admissionregistration:go_default_library",
+        "//pkg/apis/apps:go_default_library",
+        "//pkg/apis/batch:go_default_library",
+        "//pkg/apis/core:go_default_library",
+        "//pkg/apis/events:go_default_library",
+        "//pkg/apis/extensions:go_default_library",
+        "//pkg/apis/networking:go_default_library",
+        "//pkg/apis/policy:go_default_library",
+        "//pkg/apis/storage:go_default_library",
+        "//pkg/kubeapiserver/options:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server/options:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server/resourceconfig:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server/storage:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/storage/storagebackend:go_default_library",
     ],
 )
 

vendor/k8s.io/kubernetes/pkg/kubeapiserver/OWNERS

@@ -8,3 +8,6 @@ reviewers:
 - lavalamp
 - liggitt
 - sttts
+labels:
+- sig/api-machinery
+- area/apiserver

vendor/k8s.io/kubernetes/pkg/kubeapiserver/admission/BUILD

@@ -10,7 +10,7 @@ go_test(
     name = "go_default_test",
     srcs = ["initializer_test.go"],
     embed = [":go_default_library"],
-    deps = ["//vendor/k8s.io/apiserver/pkg/admission:go_default_library"],
+    deps = ["//staging/src/k8s.io/apiserver/pkg/admission:go_default_library"],
 )
 
 go_library(
@@ -21,11 +21,10 @@ go_library(
         "//pkg/client/clientset_generated/internalclientset:go_default_library",
         "//pkg/client/informers/informers_generated/internalversion:go_default_library",
         "//pkg/quota:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/admission:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/util/webhook:go_default_library",
     ],
 )
 

vendor/k8s.io/kubernetes/pkg/kubeapiserver/admission/initializer.go

@@ -19,9 +19,8 @@ package admission
 import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apiserver/pkg/admission"
-	webhookconfig "k8s.io/apiserver/pkg/admission/plugin/webhook/config"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
-	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/apiserver/pkg/util/webhook"
 	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
 	informers "k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion"
 	"k8s.io/kubernetes/pkg/quota"
@@ -60,14 +59,13 @@ type WantsQuotaConfiguration interface {
 // PluginInitializer is used for initialization of the Kubernetes specific admission plugins.
 type PluginInitializer struct {
 	internalClient                    internalclientset.Interface
-	externalClient                    clientset.Interface
 	informers                         informers.SharedInformerFactory
 	authorizer                        authorizer.Authorizer
 	cloudConfig                       []byte
 	restMapper                        meta.RESTMapper
 	quotaConfiguration                quota.Configuration
-	serviceResolver                   webhookconfig.ServiceResolver
-	authenticationInfoResolverWrapper webhookconfig.AuthenticationInfoResolverWrapper
+	serviceResolver                   webhook.ServiceResolver
+	authenticationInfoResolverWrapper webhook.AuthenticationInfoResolverWrapper
 }
 
 var _ admission.PluginInitializer = &PluginInitializer{}

vendor/k8s.io/kubernetes/pkg/kubeapiserver/admission/util/BUILD

@@ -10,9 +10,9 @@ go_library(
     srcs = ["initializer.go"],
     importpath = "k8s.io/kubernetes/pkg/kubeapiserver/admission/util",
     deps = [
-        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/initialization:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/initialization:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/admission:go_default_library",
     ],
 )
 

vendor/k8s.io/kubernetes/pkg/kubeapiserver/authenticator/BUILD

@@ -12,26 +12,26 @@ go_library(
     deps = [
         "//pkg/features:go_default_library",
         "//pkg/serviceaccount:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/authenticatorfactory:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/group:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/request/anonymous:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/request/bearertoken:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/request/headerrequest:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/request/union:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/request/websocket:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/request/x509:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/token/cache:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/token/tokenfile:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/token/union:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
+        "//staging/src/k8s.io/apiserver/plugin/pkg/authenticator/password/passwordfile:go_default_library",
+        "//staging/src/k8s.io/apiserver/plugin/pkg/authenticator/request/basicauth:go_default_library",
+        "//staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc:go_default_library",
+        "//staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/webhook:go_default_library",
+        "//staging/src/k8s.io/client-go/plugin/pkg/client/auth:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
         "//vendor/github.com/go-openapi/spec:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/authenticatorfactory:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/group:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/request/anonymous:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/request/bearertoken:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/request/headerrequest:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/request/union:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/request/websocket:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/request/x509:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/token/cache:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/token/tokenfile:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/token/union:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/util/feature:go_default_library",
-        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/password/passwordfile:go_default_library",
-        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/request/basicauth:go_default_library",
-        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc:go_default_library",
-        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/token/webhook:go_default_library",
-        "//vendor/k8s.io/client-go/plugin/pkg/client/auth:go_default_library",
-        "//vendor/k8s.io/client-go/util/cert:go_default_library",
     ],
 )
 

vendor/k8s.io/kubernetes/pkg/kubeapiserver/authorizer/BUILD

@@ -12,16 +12,15 @@ go_library(
     deps = [
         "//pkg/auth/authorizer/abac:go_default_library",
         "//pkg/auth/nodeidentifier:go_default_library",
-        "//pkg/client/informers/informers_generated/internalversion:go_default_library",
         "//pkg/kubeapiserver/authorizer/modes:go_default_library",
         "//plugin/pkg/auth/authorizer/node:go_default_library",
         "//plugin/pkg/auth/authorizer/rbac:go_default_library",
         "//plugin/pkg/auth/authorizer/rbac/bootstrappolicy:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/authorizerfactory:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/union:go_default_library",
-        "//vendor/k8s.io/apiserver/plugin/pkg/authorizer/webhook:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authorization/authorizerfactory:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authorization/union:go_default_library",
+        "//staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook:go_default_library",
+        "//staging/src/k8s.io/client-go/informers:go_default_library",
     ],
 )
 

vendor/k8s.io/kubernetes/pkg/kubeapiserver/authorizer/config.go

@@ -27,7 +27,6 @@ import (
 	versionedinformers "k8s.io/client-go/informers"
 	"k8s.io/kubernetes/pkg/auth/authorizer/abac"
 	"k8s.io/kubernetes/pkg/auth/nodeidentifier"
-	informers "k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion"
 	"k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
 	"k8s.io/kubernetes/plugin/pkg/auth/authorizer/node"
 	"k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac"
@@ -51,7 +50,6 @@ type AuthorizationConfig struct {
 	// TTL for caching of unauthorized responses from the webhook server.
 	WebhookCacheUnauthorizedTTL time.Duration
 
-	InformerFactory          informers.SharedInformerFactory
 	VersionedInformerFactory versionedinformers.SharedInformerFactory
 }
 
@@ -74,9 +72,9 @@ func (config AuthorizationConfig) New() (authorizer.Authorizer, authorizer.RuleR
 			graph := node.NewGraph()
 			node.AddGraphEventHandlers(
 				graph,
-				config.InformerFactory.Core().InternalVersion().Nodes(),
-				config.InformerFactory.Core().InternalVersion().Pods(),
-				config.InformerFactory.Core().InternalVersion().PersistentVolumes(),
+				config.VersionedInformerFactory.Core().V1().Nodes(),
+				config.VersionedInformerFactory.Core().V1().Pods(),
+				config.VersionedInformerFactory.Core().V1().PersistentVolumes(),
 				config.VersionedInformerFactory.Storage().V1beta1().VolumeAttachments(),
 			)
 			nodeAuthorizer := node.NewAuthorizer(graph, nodeidentifier.NewDefaultNodeIdentifier(), bootstrappolicy.NodeRules())

vendor/k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes/BUILD

@@ -16,7 +16,7 @@ go_library(
     name = "go_default_library",
     srcs = ["modes.go"],
     importpath = "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes",
-    deps = ["//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library"],
+    deps = ["//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library"],
 )
 
 filegroup(

vendor/k8s.io/kubernetes/pkg/kubeapiserver/default_storage_factory_builder.go

@@ -17,11 +17,27 @@ limitations under the License.
 package kubeapiserver
 
 import (
+	"strings"
+
+	"fmt"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	serveroptions "k8s.io/apiserver/pkg/server/options"
+	"k8s.io/apiserver/pkg/server/options/encryptionconfig"
 	"k8s.io/apiserver/pkg/server/resourceconfig"
 	serverstorage "k8s.io/apiserver/pkg/server/storage"
 	"k8s.io/apiserver/pkg/storage/storagebackend"
+	"k8s.io/kubernetes/pkg/api/legacyscheme"
+	"k8s.io/kubernetes/pkg/apis/admissionregistration"
+	"k8s.io/kubernetes/pkg/apis/apps"
+	"k8s.io/kubernetes/pkg/apis/batch"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/apis/events"
+	"k8s.io/kubernetes/pkg/apis/extensions"
+	"k8s.io/kubernetes/pkg/apis/networking"
+	"k8s.io/kubernetes/pkg/apis/policy"
+	apisstorage "k8s.io/kubernetes/pkg/apis/storage"
+	kubeapiserveroptions "k8s.io/kubernetes/pkg/kubeapiserver/options"
 )
 
 // SpecialDefaultResourcePrefixes are prefixes compiled into Kubernetes.
@@ -35,18 +51,84 @@ var SpecialDefaultResourcePrefixes = map[schema.GroupResource]string{
 	{Group: "policy", Resource: "podsecuritypolicies"}:     "podsecuritypolicy",
 }
 
-// NewStorageFactory builds the DefaultStorageFactory.
-// Merges defaultResourceEncoding with the user specified overrides.
-func NewStorageFactory(
-	storageConfig storagebackend.Config,
-	defaultMediaType string,
-	serializer runtime.StorageSerializer,
-	defaultResourceEncoding *serverstorage.DefaultResourceEncodingConfig,
-	storageEncodingOverrides map[string]schema.GroupVersion,
-	resourceEncodingOverrides []schema.GroupVersionResource,
-	apiResourceConfig *serverstorage.ResourceConfig,
-) (*serverstorage.DefaultStorageFactory, error) {
-	resourceEncodingConfig := resourceconfig.MergeGroupEncodingConfigs(defaultResourceEncoding, storageEncodingOverrides)
-	resourceEncodingConfig = resourceconfig.MergeResourceEncodingConfigs(resourceEncodingConfig, resourceEncodingOverrides)
-	return serverstorage.NewDefaultStorageFactory(storageConfig, defaultMediaType, serializer, resourceEncodingConfig, apiResourceConfig, SpecialDefaultResourcePrefixes), nil
+func NewStorageFactoryConfig() *StorageFactoryConfig {
+	return &StorageFactoryConfig{
+		Serializer:              legacyscheme.Codecs,
+		DefaultResourceEncoding: serverstorage.NewDefaultResourceEncodingConfig(legacyscheme.Scheme),
+		ResourceEncodingOverrides: []schema.GroupVersionResource{
+			batch.Resource("cronjobs").WithVersion("v1beta1"),
+			apisstorage.Resource("volumeattachments").WithVersion("v1beta1"),
+			admissionregistration.Resource("initializerconfigurations").WithVersion("v1alpha1"),
+		},
+	}
+}
+
+type StorageFactoryConfig struct {
+	StorageConfig                    storagebackend.Config
+	ApiResourceConfig                *serverstorage.ResourceConfig
+	DefaultResourceEncoding          *serverstorage.DefaultResourceEncodingConfig
+	DefaultStorageMediaType          string
+	Serializer                       runtime.StorageSerializer
+	StorageEncodingOverrides         map[string]schema.GroupVersion
+	ResourceEncodingOverrides        []schema.GroupVersionResource
+	EtcdServersOverrides             []string
+	EncryptionProviderConfigFilepath string
+}
+
+func (c *StorageFactoryConfig) Complete(etcdOptions *serveroptions.EtcdOptions, serializationOptions *kubeapiserveroptions.StorageSerializationOptions) (*completedStorageFactoryConfig, error) {
+	storageGroupsToEncodingVersion, err := serializationOptions.StorageGroupsToEncodingVersion()
+	if err != nil {
+		return nil, fmt.Errorf("error generating storage version map: %s", err)
+	}
+	c.StorageEncodingOverrides = storageGroupsToEncodingVersion
+	c.StorageConfig = etcdOptions.StorageConfig
+	c.DefaultStorageMediaType = etcdOptions.DefaultStorageMediaType
+	c.EtcdServersOverrides = etcdOptions.EtcdServersOverrides
+	c.EncryptionProviderConfigFilepath = etcdOptions.EncryptionProviderConfigFilepath
+	return &completedStorageFactoryConfig{c}, nil
+}
+
+type completedStorageFactoryConfig struct {
+	*StorageFactoryConfig
+}
+
+func (c *completedStorageFactoryConfig) New() (*serverstorage.DefaultStorageFactory, error) {
+	resourceEncodingConfig := resourceconfig.MergeGroupEncodingConfigs(c.DefaultResourceEncoding, c.StorageEncodingOverrides)
+	resourceEncodingConfig = resourceconfig.MergeResourceEncodingConfigs(resourceEncodingConfig, c.ResourceEncodingOverrides)
+	storageFactory := serverstorage.NewDefaultStorageFactory(
+		c.StorageConfig,
+		c.DefaultStorageMediaType,
+		c.Serializer,
+		resourceEncodingConfig,
+		c.ApiResourceConfig,
+		SpecialDefaultResourcePrefixes)
+
+	storageFactory.AddCohabitatingResources(networking.Resource("networkpolicies"), extensions.Resource("networkpolicies"))
+	storageFactory.AddCohabitatingResources(apps.Resource("deployments"), extensions.Resource("deployments"))
+	storageFactory.AddCohabitatingResources(apps.Resource("daemonsets"), extensions.Resource("daemonsets"))
+	storageFactory.AddCohabitatingResources(apps.Resource("replicasets"), extensions.Resource("replicasets"))
+	storageFactory.AddCohabitatingResources(api.Resource("events"), events.Resource("events"))
+	storageFactory.AddCohabitatingResources(policy.Resource("podsecuritypolicies"), extensions.Resource("podsecuritypolicies"))
+
+	for _, override := range c.EtcdServersOverrides {
+		tokens := strings.Split(override, "#")
+		apiresource := strings.Split(tokens[0], "/")
+
+		group := apiresource[0]
+		resource := apiresource[1]
+		groupResource := schema.GroupResource{Group: group, Resource: resource}
+
+		servers := strings.Split(tokens[1], ";")
+		storageFactory.SetEtcdLocation(groupResource, servers)
+	}
+	if len(c.EncryptionProviderConfigFilepath) != 0 {
+		transformerOverrides, err := encryptionconfig.GetTransformerOverrides(c.EncryptionProviderConfigFilepath)
+		if err != nil {
+			return nil, err
+		}
+		for groupResource, transformer := range transformerOverrides {
+			storageFactory.SetTransformer(groupResource, transformer)
+		}
+	}
+	return storageFactory, nil
 }

vendor/k8s.io/kubernetes/pkg/kubeapiserver/options/BUILD

@@ -21,12 +21,11 @@ go_library(
     importpath = "k8s.io/kubernetes/pkg/kubeapiserver/options",
     deps = [
         "//pkg/api/legacyscheme:go_default_library",
-        "//pkg/client/informers/informers_generated/internalversion:go_default_library",
         "//pkg/cloudprovider/providers:go_default_library",
+        "//pkg/features:go_default_library",
         "//pkg/kubeapiserver/authenticator:go_default_library",
         "//pkg/kubeapiserver/authorizer:go_default_library",
         "//pkg/kubeapiserver/authorizer/modes:go_default_library",
-        "//pkg/kubeapiserver/server:go_default_library",
         "//plugin/pkg/admission/admit:go_default_library",
         "//plugin/pkg/admission/alwayspullimages:go_default_library",
         "//plugin/pkg/admission/antiaffinity:go_default_library",
@@ -53,23 +52,23 @@ go_library(
         "//plugin/pkg/admission/storage/persistentvolume/resize:go_default_library",
         "//plugin/pkg/admission/storage/storageclass/setdefault:go_default_library",
         "//plugin/pkg/admission/storage/storageobjectinuseprotection:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/net:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/admission:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server/options:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/util/flag:go_default_library",
+        "//staging/src/k8s.io/client-go/informers:go_default_library",
+        "//staging/src/k8s.io/client-go/rest:go_default_library",
         "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/github.com/pborman/uuid:go_default_library",
         "//vendor/github.com/spf13/pflag:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/net:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/initialization:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/validating:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/server:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/server/options:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/util/flag:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
-        "//vendor/k8s.io/client-go/rest:go_default_library",
     ],
 )
 
@@ -90,12 +89,17 @@ go_test(
     name = "go_default_test",
     srcs = [
         "admission_test.go",
+        "authentication_test.go",
         "authorization_test.go",
         "storage_versions_test.go",
     ],
     embed = [":go_default_library"],
     deps = [
+        "//pkg/kubeapiserver/authenticator:go_default_library",
         "//pkg/kubeapiserver/authorizer/modes:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/errors:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/authenticatorfactory:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server/options:go_default_library",
     ],
 )

vendor/k8s.io/kubernetes/pkg/kubeapiserver/options/authentication.go

@@ -73,10 +73,11 @@ type PasswordFileAuthenticationOptions struct {
 }
 
 type ServiceAccountAuthenticationOptions struct {
-	KeyFiles     []string
-	Lookup       bool
-	Issuer       string
-	APIAudiences []string
+	KeyFiles      []string
+	Lookup        bool
+	Issuer        string
+	APIAudiences  []string
+	MaxExpiration time.Duration
 }
 
 type TokenFileAuthenticationOptions struct {
@@ -260,6 +261,10 @@ func (s *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) {
 		fs.StringSliceVar(&s.ServiceAccounts.APIAudiences, "service-account-api-audiences", s.ServiceAccounts.APIAudiences, ""+
 			"Identifiers of the API. The service account token authenticator will validate that "+
 			"tokens used against the API are bound to at least one of these audiences.")
+
+		fs.DurationVar(&s.ServiceAccounts.MaxExpiration, "service-account-max-token-expiration", s.ServiceAccounts.MaxExpiration, ""+
+			"The maximum validity duration of a token created by the service account token issuer. If an otherwise valid "+
+			"TokenRequest with a validity duration larger than this value is requested, a token will be issued with a validity duration of this value.")
 	}
 
 	if s.TokenFile != nil {

vendor/k8s.io/kubernetes/pkg/kubeapiserver/options/authentication_test.go

@@ -0,0 +1,172 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package options
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apiserver/pkg/authentication/authenticatorfactory"
+	apiserveroptions "k8s.io/apiserver/pkg/server/options"
+	"k8s.io/kubernetes/pkg/kubeapiserver/authenticator"
+)
+
+func TestAuthenticationValidate(t *testing.T) {
+	testCases := []struct {
+		name      string
+		testOIDC  *OIDCAuthenticationOptions
+		testSA    *ServiceAccountAuthenticationOptions
+		expectErr string
+	}{
+		{
+			name: "test when OIDC and ServiceAccounts are nil",
+		},
+		{
+			name: "test when OIDC and ServiceAccounts are valid",
+			testOIDC: &OIDCAuthenticationOptions{
+				UsernameClaim: "sub",
+				SigningAlgs:   []string{"RS256"},
+				IssuerURL:     "testIssuerURL",
+			},
+			testSA: &ServiceAccountAuthenticationOptions{
+				Issuer: "http://foo.bar.com",
+			},
+		},
+		{
+			name: "test when OIDC is invalid",
+			testOIDC: &OIDCAuthenticationOptions{
+				UsernameClaim: "sub",
+				SigningAlgs:   []string{"RS256"},
+				IssuerURL:     "testIssuerURL",
+			},
+			testSA: &ServiceAccountAuthenticationOptions{
+				Issuer: "http://foo.bar.com",
+			},
+			expectErr: "oidc-issuer-url and oidc-client-id should be specified together",
+		},
+		{
+			name: "test when ServiceAccount is invalid",
+			testOIDC: &OIDCAuthenticationOptions{
+				UsernameClaim: "sub",
+				SigningAlgs:   []string{"RS256"},
+				IssuerURL:     "testIssuerURL",
+				ClientID:      "testClientID",
+			},
+			testSA: &ServiceAccountAuthenticationOptions{
+				Issuer: "http://[::1]:namedport",
+			},
+			expectErr: "service-account-issuer contained a ':' but was not a valid URL",
+		},
+	}
+
+	for _, testcase := range testCases {
+		t.Run(testcase.name, func(t *testing.T) {
+			options := NewBuiltInAuthenticationOptions()
+			options.OIDC = testcase.testOIDC
+			options.ServiceAccounts = testcase.testSA
+
+			errs := options.Validate()
+			if len(errs) > 0 && !strings.Contains(utilerrors.NewAggregate(errs).Error(), testcase.expectErr) {
+				t.Errorf("Got err: %v, Expected err: %s", errs, testcase.expectErr)
+			}
+
+			if len(errs) == 0 && len(testcase.expectErr) != 0 {
+				t.Errorf("Got err nil, Expected err: %s", testcase.expectErr)
+			}
+		})
+	}
+}
+
+func TestToAuthenticationConfig(t *testing.T) {
+	testOptions := &BuiltInAuthenticationOptions{
+		Anonymous: &AnonymousAuthenticationOptions{
+			Allow: false,
+		},
+		ClientCert: &apiserveroptions.ClientCertAuthenticationOptions{
+			ClientCA: "/client-ca",
+		},
+		WebHook: &WebHookAuthenticationOptions{
+			CacheTTL:   180000000000,
+			ConfigFile: "/token-webhook-config",
+		},
+		BootstrapToken: &BootstrapTokenAuthenticationOptions{
+			Enable: false,
+		},
+		OIDC: &OIDCAuthenticationOptions{
+			CAFile:        "/testCAFile",
+			UsernameClaim: "sub",
+			SigningAlgs:   []string{"RS256"},
+			IssuerURL:     "testIssuerURL",
+			ClientID:      "testClientID",
+		},
+		PasswordFile: &PasswordFileAuthenticationOptions{
+			BasicAuthFile: "/testBasicAuthFile",
+		},
+		RequestHeader: &apiserveroptions.RequestHeaderAuthenticationOptions{
+			UsernameHeaders:     []string{"x-remote-user"},
+			GroupHeaders:        []string{"x-remote-group"},
+			ExtraHeaderPrefixes: []string{"x-remote-extra-"},
+			ClientCAFile:        "/testClientCAFile",
+			AllowedNames:        []string{"kube-aggregator"},
+		},
+		ServiceAccounts: &ServiceAccountAuthenticationOptions{
+			Lookup: true,
+			Issuer: "http://foo.bar.com",
+		},
+		TokenFile: &TokenFileAuthenticationOptions{
+			TokenFile: "/testTokenFile",
+		},
+		TokenSuccessCacheTTL: 10 * time.Second,
+		TokenFailureCacheTTL: 0,
+	}
+
+	expectConfig := authenticator.AuthenticatorConfig{
+		Anonymous:                   false,
+		BasicAuthFile:               "/testBasicAuthFile",
+		BootstrapToken:              false,
+		ClientCAFile:                "/client-ca",
+		TokenAuthFile:               "/testTokenFile",
+		OIDCIssuerURL:               "testIssuerURL",
+		OIDCClientID:                "testClientID",
+		OIDCCAFile:                  "/testCAFile",
+		OIDCUsernameClaim:           "sub",
+		OIDCSigningAlgs:             []string{"RS256"},
+		ServiceAccountLookup:        true,
+		ServiceAccountIssuer:        "http://foo.bar.com",
+		WebhookTokenAuthnConfigFile: "/token-webhook-config",
+		WebhookTokenAuthnCacheTTL:   180000000000,
+
+		TokenSuccessCacheTTL: 10 * time.Second,
+		TokenFailureCacheTTL: 0,
+
+		RequestHeaderConfig: &authenticatorfactory.RequestHeaderConfig{
+			UsernameHeaders:     []string{"x-remote-user"},
+			GroupHeaders:        []string{"x-remote-group"},
+			ExtraHeaderPrefixes: []string{"x-remote-extra-"},
+			ClientCA:            "/testClientCAFile",
+			AllowedClientNames:  []string{"kube-aggregator"},
+		},
+	}
+
+	resultConfig := testOptions.ToAuthenticationConfig()
+	if !reflect.DeepEqual(resultConfig, expectConfig) {
+		t.Errorf("Got AuthenticationConfig: %v, Expected AuthenticationConfig: %v", resultConfig, expectConfig)
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubeapiserver/options/authorization.go

@@ -25,7 +25,6 @@ import (
 
 	"k8s.io/apimachinery/pkg/util/sets"
 	versionedinformers "k8s.io/client-go/informers"
-	informers "k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion"
 	"k8s.io/kubernetes/pkg/kubeapiserver/authorizer"
 	authzmodes "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
 )
@@ -110,14 +109,13 @@ func (s *BuiltInAuthorizationOptions) AddFlags(fs *pflag.FlagSet) {
 		"The duration to cache 'unauthorized' responses from the webhook authorizer.")
 }
 
-func (s *BuiltInAuthorizationOptions) ToAuthorizationConfig(informerFactory informers.SharedInformerFactory, versionedInformerFactory versionedinformers.SharedInformerFactory) authorizer.AuthorizationConfig {
+func (s *BuiltInAuthorizationOptions) ToAuthorizationConfig(versionedInformerFactory versionedinformers.SharedInformerFactory) authorizer.AuthorizationConfig {
 	return authorizer.AuthorizationConfig{
 		AuthorizationModes:          s.Modes,
 		PolicyFile:                  s.PolicyFile,
 		WebhookConfigFile:           s.WebhookConfigFile,
 		WebhookCacheAuthorizedTTL:   s.WebhookCacheAuthorizedTTL,
 		WebhookCacheUnauthorizedTTL: s.WebhookCacheUnauthorizedTTL,
-		InformerFactory:             informerFactory,
 		VersionedInformerFactory:    versionedInformerFactory,
 	}
 }

vendor/k8s.io/kubernetes/pkg/kubeapiserver/options/plugins.go

@@ -57,6 +57,8 @@ import (
 	"k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle"
 	mutatingwebhook "k8s.io/apiserver/pkg/admission/plugin/webhook/mutating"
 	validatingwebhook "k8s.io/apiserver/pkg/admission/plugin/webhook/validating"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	"k8s.io/kubernetes/pkg/features"
 )
 
 // AllOrderedPlugins is the list of all the plugins in order.
@@ -139,5 +141,9 @@ func DefaultOffAdmissionPlugins() sets.String {
 		resourcequota.PluginName,            //ResourceQuota
 	)
 
+	if utilfeature.DefaultFeatureGate.Enabled(features.PodPriority) {
+		defaultOnPlugins.Insert(podpriority.PluginName) //PodPriority
+	}
+
 	return sets.NewString(AllOrderedPlugins...).Difference(defaultOnPlugins)
 }

vendor/k8s.io/kubernetes/pkg/kubeapiserver/options/serving.go

@@ -20,41 +20,47 @@ package options
 import (
 	"fmt"
 	"net"
-	"strconv"
-
-	"github.com/pborman/uuid"
-	"github.com/spf13/pflag"
 
 	utilnet "k8s.io/apimachinery/pkg/util/net"
-	"k8s.io/apiserver/pkg/server"
 	genericoptions "k8s.io/apiserver/pkg/server/options"
-	kubeserver "k8s.io/kubernetes/pkg/kubeapiserver/server"
 )
 
 // NewSecureServingOptions gives default values for the kube-apiserver which are not the options wanted by
 // "normal" API servers running on the platform
 func NewSecureServingOptions() *genericoptions.SecureServingOptionsWithLoopback {
-	return genericoptions.WithLoopback(&genericoptions.SecureServingOptions{
+	o := genericoptions.SecureServingOptions{
 		BindAddress: net.ParseIP("0.0.0.0"),
 		BindPort:    6443,
+		Required:    true,
 		ServerCert: genericoptions.GeneratableKeyCert{
 			PairName:      "apiserver",
 			CertDirectory: "/var/run/kubernetes",
 		},
-	})
+	}
+	return o.WithLoopback()
+}
+
+// NewInsecureServingOptions gives default values for the kube-apiserver.
+// TODO: switch insecure serving off by default
+func NewInsecureServingOptions() *genericoptions.DeprecatedInsecureServingOptionsWithLoopback {
+	o := genericoptions.DeprecatedInsecureServingOptions{
+		BindAddress: net.ParseIP("127.0.0.1"),
+		BindPort:    8080,
+	}
+	return o.WithLoopback()
 }
 
 // DefaultAdvertiseAddress sets the field AdvertiseAddress if
 // unset. The field will be set based on the SecureServingOptions. If
 // the SecureServingOptions is not present, DefaultExternalAddress
 // will fall back to the insecure ServingOptions.
-func DefaultAdvertiseAddress(s *genericoptions.ServerRunOptions, insecure *InsecureServingOptions) error {
+func DefaultAdvertiseAddress(s *genericoptions.ServerRunOptions, insecure *genericoptions.DeprecatedInsecureServingOptions) error {
 	if insecure == nil {
 		return nil
 	}
 
 	if s.AdvertiseAddress == nil || s.AdvertiseAddress.IsUnspecified() {
-		hostIP, err := insecure.DefaultExternalAddress()
+		hostIP, err := utilnet.ChooseBindAddress(insecure.BindAddress)
 		if err != nil {
 			return fmt.Errorf("unable to find suitable network address.error='%v'. "+
 				"Try to set the AdvertiseAddress directly or provide a valid BindAddress to fix this", err)
@@ -64,76 +70,3 @@ func DefaultAdvertiseAddress(s *genericoptions.ServerRunOptions, insecure *Insec
 
 	return nil
 }
-
-// InsecureServingOptions are for creating an unauthenticated, unauthorized, insecure port.
-// No one should be using these anymore.
-type InsecureServingOptions struct {
-	BindAddress net.IP
-	BindPort    int
-}
-
-// NewInsecureServingOptions is for creating an unauthenticated, unauthorized, insecure port.
-// No one should be using these anymore.
-func NewInsecureServingOptions() *InsecureServingOptions {
-	return &InsecureServingOptions{
-		BindAddress: net.ParseIP("127.0.0.1"),
-		BindPort:    8080,
-	}
-}
-
-func (s InsecureServingOptions) Validate() []error {
-	errors := []error{}
-
-	if s.BindPort < 0 || s.BindPort > 65535 {
-		errors = append(errors, fmt.Errorf("--insecure-port %v must be between 0 and 65535, inclusive. 0 for turning off insecure (HTTP) port", s.BindPort))
-	}
-
-	return errors
-}
-
-func (s *InsecureServingOptions) DefaultExternalAddress() (net.IP, error) {
-	return utilnet.ChooseBindAddress(s.BindAddress)
-}
-
-func (s *InsecureServingOptions) AddFlags(fs *pflag.FlagSet) {
-	fs.IPVar(&s.BindAddress, "insecure-bind-address", s.BindAddress, ""+
-		"The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all IPv4 interfaces and :: for all IPv6 interfaces).")
-	fs.MarkDeprecated("insecure-bind-address", "This flag will be removed in a future version.")
-	fs.Lookup("insecure-bind-address").Hidden = false
-
-	fs.IntVar(&s.BindPort, "insecure-port", s.BindPort, ""+
-		"The port on which to serve unsecured, unauthenticated access. It is assumed "+
-		"that firewall rules are set up such that this port is not reachable from outside of "+
-		"the cluster and that port 443 on the cluster's public address is proxied to this "+
-		"port. This is performed by nginx in the default setup. Set to zero to disable.")
-	fs.MarkDeprecated("insecure-port", "This flag will be removed in a future version.")
-	fs.Lookup("insecure-port").Hidden = false
-}
-
-// TODO: remove it until kops stop using `--address`
-func (s *InsecureServingOptions) AddDeprecatedFlags(fs *pflag.FlagSet) {
-	fs.IPVar(&s.BindAddress, "address", s.BindAddress,
-		"DEPRECATED: see --insecure-bind-address instead.")
-	fs.MarkDeprecated("address", "see --insecure-bind-address instead.")
-
-	fs.IntVar(&s.BindPort, "port", s.BindPort, "DEPRECATED: see --insecure-port instead.")
-	fs.MarkDeprecated("port", "see --insecure-port instead.")
-}
-
-func (s *InsecureServingOptions) ApplyTo(c *server.Config) (*kubeserver.InsecureServingInfo, error) {
-	if s.BindPort <= 0 {
-		return nil, nil
-	}
-
-	ret := &kubeserver.InsecureServingInfo{
-		BindAddress: net.JoinHostPort(s.BindAddress.String(), strconv.Itoa(s.BindPort)),
-	}
-
-	var err error
-	privilegedLoopbackToken := uuid.NewRandom().String()
-	if c.LoopbackClientConfig, err = ret.NewLoopbackClientConfig(privilegedLoopbackToken); err != nil {
-		return nil, err
-	}
-
-	return ret, nil
-}

vendor/k8s.io/kubernetes/pkg/kubeapiserver/options/storage_versions.go

@@ -17,14 +17,12 @@ limitations under the License.
 package options
 
 import (
+	"sort"
 	"strings"
 
+	"github.com/spf13/pflag"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/kubernetes/pkg/api/legacyscheme"
-
-	"sort"
-
-	"github.com/spf13/pflag"
 )
 
 const (
@@ -105,6 +103,11 @@ func (s *StorageSerializationOptions) AddFlags(fs *pflag.FlagSet) {
 		"You only need to pass the groups you wish to change from the defaults. "+
 		"It defaults to a list of preferred versions of all known groups.")
 
+	fs.MarkDeprecated("storage-versions", ""+
+		"Please omit this flag to ensure the default storage versions are used ."+
+		"Otherwise the cluster is not safe to upgrade to a version newer than 1.12. "+
+		"This flag will be removed in 1.13.")
+
 }
 
 // ToPreferredVersionString returns the preferred versions of all registered

vendor/k8s.io/kubernetes/pkg/kubeapiserver/server/BUILD

@@ -10,15 +10,9 @@ go_library(
     srcs = ["insecure_handler.go"],
     importpath = "k8s.io/kubernetes/pkg/kubeapiserver/server",
     deps = [
-        "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/endpoints/filters:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/features:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/server:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/server/filters:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/server/options:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/util/feature:go_default_library",
-        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/endpoints/filters:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/server/filters:go_default_library",
     ],
 )
 

vendor/k8s.io/kubernetes/pkg/kubeapiserver/server/insecure_handler.go

@@ -17,34 +17,21 @@ limitations under the License.
 package server
 
 import (
-	"net"
 	"net/http"
-	"time"
 
-	"github.com/golang/glog"
-
-	"k8s.io/apiserver/pkg/authentication/user"
 	genericapifilters "k8s.io/apiserver/pkg/endpoints/filters"
-	"k8s.io/apiserver/pkg/features"
 	"k8s.io/apiserver/pkg/server"
 	genericfilters "k8s.io/apiserver/pkg/server/filters"
-	"k8s.io/apiserver/pkg/server/options"
-	utilfeature "k8s.io/apiserver/pkg/util/feature"
-	"k8s.io/client-go/rest"
 )
 
-// InsecureServingInfo is required to serve http.  HTTP does NOT include authentication or authorization.
+// DeprecatedInsecureServingInfo is required to serve http.  HTTP does NOT include authentication or authorization.
 // You shouldn't be using this.  It makes sig-auth sad.
-// InsecureServingInfo *ServingInfo
+// DeprecatedInsecureServingInfo *ServingInfo
 
 func BuildInsecureHandlerChain(apiHandler http.Handler, c *server.Config) http.Handler {
 	handler := apiHandler
-	if utilfeature.DefaultFeatureGate.Enabled(features.AdvancedAuditing) {
-		handler = genericapifilters.WithAudit(handler, c.AuditBackend, c.AuditPolicyChecker, c.LongRunningFunc)
-	} else {
-		handler = genericapifilters.WithLegacyAudit(handler, c.LegacyAuditWriter)
-	}
-	handler = genericapifilters.WithAuthentication(handler, insecureSuperuser{}, nil)
+	handler = genericapifilters.WithAudit(handler, c.AuditBackend, c.AuditPolicyChecker, c.LongRunningFunc)
+	handler = genericapifilters.WithAuthentication(handler, server.InsecureSuperuser{}, nil)
 	handler = genericfilters.WithCORS(handler, c.CorsAllowedOriginList, nil, nil, nil, "true")
 	handler = genericfilters.WithTimeoutForNonLongRunningRequests(handler, c.LongRunningFunc, c.RequestTimeout)
 	handler = genericfilters.WithMaxInFlightLimit(handler, c.MaxRequestsInFlight, c.MaxMutatingRequestsInFlight, c.LongRunningFunc)
@@ -54,85 +41,3 @@ func BuildInsecureHandlerChain(apiHandler http.Handler, c *server.Config) http.H
 
 	return handler
 }
-
-type InsecureServingInfo struct {
-	// BindAddress is the ip:port to serve on
-	BindAddress string
-	// BindNetwork is the type of network to bind to - defaults to "tcp", accepts "tcp",
-	// "tcp4", and "tcp6".
-	BindNetwork string
-}
-
-func (s *InsecureServingInfo) NewLoopbackClientConfig(token string) (*rest.Config, error) {
-	if s == nil {
-		return nil, nil
-	}
-
-	host, port, err := server.LoopbackHostPort(s.BindAddress)
-	if err != nil {
-		return nil, err
-	}
-
-	return &rest.Config{
-		Host: "http://" + net.JoinHostPort(host, port),
-		// Increase QPS limits. The client is currently passed to all admission plugins,
-		// and those can be throttled in case of higher load on apiserver - see #22340 and #22422
-		// for more details. Once #22422 is fixed, we may want to remove it.
-		QPS:   50,
-		Burst: 100,
-	}, nil
-}
-
-// NonBlockingRun spawns the insecure http server. An error is
-// returned if the ports cannot be listened on.
-func NonBlockingRun(insecureServingInfo *InsecureServingInfo, insecureHandler http.Handler, shutDownTimeout time.Duration, stopCh <-chan struct{}) error {
-	// Use an internal stop channel to allow cleanup of the listeners on error.
-	internalStopCh := make(chan struct{})
-
-	if insecureServingInfo != nil && insecureHandler != nil {
-		if err := serveInsecurely(insecureServingInfo, insecureHandler, shutDownTimeout, internalStopCh); err != nil {
-			close(internalStopCh)
-			return err
-		}
-	}
-
-	// Now that the listener has bound successfully, it is the
-	// responsibility of the caller to close the provided channel to
-	// ensure cleanup.
-	go func() {
-		<-stopCh
-		close(internalStopCh)
-	}()
-
-	return nil
-}
-
-// serveInsecurely run the insecure http server. It fails only if the initial listen
-// call fails. The actual server loop (stoppable by closing stopCh) runs in a go
-// routine, i.e. serveInsecurely does not block.
-func serveInsecurely(insecureServingInfo *InsecureServingInfo, insecureHandler http.Handler, shutDownTimeout time.Duration, stopCh <-chan struct{}) error {
-	insecureServer := &http.Server{
-		Addr:           insecureServingInfo.BindAddress,
-		Handler:        insecureHandler,
-		MaxHeaderBytes: 1 << 20,
-	}
-	glog.Infof("Serving insecurely on %s", insecureServingInfo.BindAddress)
-	ln, _, err := options.CreateListener(insecureServingInfo.BindNetwork, insecureServingInfo.BindAddress)
-	if err != nil {
-		return err
-	}
-	err = server.RunServer(insecureServer, ln, shutDownTimeout, stopCh)
-	return err
-}
-
-// insecureSuperuser implements authenticator.Request to always return a superuser.
-// This is functionally equivalent to skipping authentication and authorization,
-// but allows apiserver code to stop special-casing a nil user to skip authorization checks.
-type insecureSuperuser struct{}
-
-func (insecureSuperuser) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {
-	return &user.DefaultInfo{
-		Name:   "system:unsecured",
-		Groups: []string{user.SystemPrivilegedGroup, user.AllAuthenticated},
-	}, true, nil
-}