/usr/bin/cache-server

Starts a server that hosts data/resources that are required by shards. It serves as a cache helping to reduce the storage that would have to be copied onto every shard otherwise.

The actual group of shards that will use this server should be part of the topology. For example, it can be used only by shards that are in the same geographical region.

On a high level, the server exposes two HTTP paths. The first one is used by the shards for getting all resources. The second one is used by individual shards to push data they wish to be shared.

There are no limits on the types of data this server hosts. The rule of thumb is that they must be common for a larger group of shards. For example the root APIs.

Usage:
  cache-server [flags]

Flags:
      --authorization-always-allow-paths strings      A list of HTTP paths to skip during authorization, i.e. these are authorized without contacting the 'core' kubernetes server. (default [/healthz,/readyz,/livez])
      --bind-address ip                               The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank or an unspecified address (0.0.0.0 or ::), all interfaces and IP address families will be used. (default 0.0.0.0)
      --cert-dir string                               The directory where the TLS certs are located. If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default ".kcp-cache")
      --client-ca-file string                         Path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate signed by one of the authorities in the bundle is authenticated with an identity corresponding to the CommonName of the client certificate.
      --delete-collection-workers int                 Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup. (default 1)
      --disable-http2-serving                         If true, HTTP2 serving will be disabled [default=false]
      --embedded-etcd-client-port string              Port for embedded etcd client (default "2379")
      --embedded-etcd-directory string                Directory for embedded etcd (default ".kcp-cache/etcd-server")
      --embedded-etcd-force-new-cluster               Starts a new cluster from existing data restored from a different system
      --embedded-etcd-listen-metrics-urls strings     The list of protocol://host:port where embedded etcd server listens for Prometheus scrapes
      --embedded-etcd-peer-port string                Port for embedded etcd peer (default "2380")
      --embedded-etcd-quota-backend-bytes int         Alarm threshold for embedded etcd backend bytes
      --embedded-etcd-wal-size-bytes int              Size of embedded etcd WAL
      --enable-garbage-collector                      Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-controller-manager. (default true)
      --encryption-provider-config string             The file containing configuration for encryption providers to be used for storing secrets in etcd
      --encryption-provider-config-automatic-reload   Determines if the file set by --encryption-provider-config should be automatically reloaded if the disk contents change. Setting this to true disables the ability to uniquely identify distinct KMS plugins via the API server healthz endpoints.
      --etcd-cafile string                            SSL Certificate Authority file used to secure etcd communication.
      --etcd-certfile string                          SSL certification file used to secure etcd communication.
      --etcd-compaction-interval duration             The interval of compaction requests. If 0, the compaction request from apiserver is disabled. (default 5m0s)
      --etcd-count-metric-poll-period duration        Frequency of polling etcd for number of resources per type. 0 disables the metric collection. (default 1m0s)
      --etcd-db-metric-poll-interval duration         The interval of requests to poll etcd and update metric. 0 disables the metric collection (default 30s)
      --etcd-healthcheck-timeout duration             The timeout to use when checking etcd health. (default 2s)
      --etcd-keyfile string                           SSL key file used to secure etcd communication.
      --etcd-prefix string                            The prefix to prepend to all resource paths in etcd. (default "/registry")
      --etcd-readycheck-timeout duration              The timeout to use when checking etcd readiness (default 2s)
      --etcd-servers strings                          List of etcd servers to connect with (scheme://ip:port), comma separated. (default [embedded])
      --etcd-servers-overrides strings                Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are URLs, semicolon separated. Note that this applies only to resources compiled into this server binary. e.g. "/pods#http://etcd4:2379;http://etcd5:2379,/events#http://etcd6:2379"
  -h, --help                                          help for cache-server
      --http2-max-streams-per-connection int          The limit that the server gives to clients for the maximum number of streams in an HTTP/2 connection. Zero means to use golang's default.
      --lease-reuse-duration-seconds int              The time in seconds that each lease is reused. A lower value could avoid large number of objects reusing the same lease. Notice that a too small value may cause performance problems at storage layer. (default 60)
      --log-flush-frequency duration                  Maximum number of seconds between log flushes (default 5s)
      --log-json-info-buffer-size quantity            [Alpha] In JSON format with split output streams, the info messages can be buffered for a while to increase performance. The default value of zero bytes disables buffering. The size can be specified as number of bytes (512), multiples of 1000 (1K), multiples of 1024 (2Ki), or powers of those (3M, 4G, 5Mi, 6Gi). Enable the LoggingAlphaOptions feature gate to use this.
      --log-json-split-stream                         [Alpha] In JSON format, write error messages to stderr and info messages to stdout. The default is to write a single stream to stdout. Enable the LoggingAlphaOptions feature gate to use this.
      --log-text-info-buffer-size quantity            [Alpha] In text format with split output streams, the info messages can be buffered for a while to increase performance. The default value of zero bytes disables buffering. The size can be specified as number of bytes (512), multiples of 1000 (1K), multiples of 1024 (2Ki), or powers of those (3M, 4G, 5Mi, 6Gi). Enable the LoggingAlphaOptions feature gate to use this.
      --log-text-split-stream                         [Alpha] In text format, write error messages to stderr and info messages to stdout. The default is to write a single stream to stdout. Enable the LoggingAlphaOptions feature gate to use this.
      --logging-format string                         Sets the log format. Permitted formats: "json" (gated by LoggingBetaOptions), "text". (default "text")
      --permit-address-sharing                        If true, SO_REUSEADDR will be used when binding the port. This allows binding to wildcard IPs like 0.0.0.0 and specific IPs in parallel, and it avoids waiting for the kernel to release sockets in TIME_WAIT state. [default=false]
      --permit-port-sharing                           If true, SO_REUSEPORT will be used when binding the port, which allows more than one instance to bind on the same address and port. [default=false]
      --secure-port int                               The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. (default 6443)
      --storage-backend string                        The storage backend for persistence. Options: 'etcd3' (default).
      --storage-media-type string                     The media type to use to store objects in storage. Some resources or storage backends may only support a specific media type and will ignore this setting. Supported media types: [application/json, application/yaml, application/vnd.kubernetes.protobuf] (default "application/json")
      --synthetic-delay duration                      The duration of time the cache server will inject a delay for to all inbound requests. Useful for testing.
      --tls-cert-file string                          File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory specified by --cert-dir.
      --tls-cipher-suites strings                     Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
                                                      Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                                      Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-min-version string                        Minimum TLS version supported. Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
      --tls-private-key-file string                   File containing the default x509 private key matching --tls-cert-file.
      --tls-sni-cert-key namedCertKey                 A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. The domain patterns also allow IP addresses, but IPs should only be used if the apiserver has visibility to the IP address requested by a client. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.crt,example.key" or "foo.crt,foo.key:*.foo.com,foo.com". (default [])
  -v, --v Level                                       number for the log level verbosity
      --vmodule pattern=N,...                         comma-separated list of pattern=N settings for file-filtered logging (only works for text log format)
      --watch-cache                                   Enable watch caching in the apiserver
      --watch-cache-sizes strings                     Watch cache size settings for some resources (pods, nodes, etc.), comma separated. The individual setting format: resource[.group]#size, where resource is lowercase plural (no version), group is omitted for resources of apiVersion v1 (the legacy core API) and included for others, and size is a number. This option is only meaningful for resources built into the apiserver, not ones defined by CRDs or aggregated from external servers, and is only consulted if the watch-cache is enabled. The only meaningful size setting to supply here is zero, which means to disable watch caching for the associated resource; all non-zero values are equivalent and mean to not disable watch caching for that resource