/usr/bin/cache-server

Starts a server that hosts data/resources that are required by shards. It serves as a cache helping to reduce the storage that would have to be copied onto every shard otherwise.

The actual group of shards that will use this server should be part of the topology. For example, it can be used only by shards that are in the same geographical region.

On a high level, the server exposes two HTTP paths. The first one is used by the shards for getting all resources. The second one is used by individual shards to push data they wish to be shared.

There are no limits on the types of data this server hosts. The rule of thumb is that they must be common for a larger group of shards. For example the root APIs.

Usage:
  cache-server [flags]

Flags:
      --authorization-always-allow-paths strings    A list of HTTP paths to skip during authorization, i.e. these are authorized without contacting the 'core' kubernetes server. (default [/healthz,/readyz,/livez])
      --bind-address ip                             The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank or an unspecified address (0.0.0.0 or ::), all interfaces and IP address families will be used. (default 0.0.0.0)
      --cert-dir string                             The directory where the TLS certs are located. If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default ".kcp-cache")
      --client-ca-file string                       Path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate signed by one of the authorities in the bundle is authenticated with an identity corresponding to the CommonName of the client certificate.
      --disable-http2-serving                       If true, HTTP2 serving will be disabled [default=false]
      --embedded-etcd-client-port string            Port for embedded etcd client (default "2379")
      --embedded-etcd-directory string              Directory for embedded etcd (default ".kcp-cache/etcd-server")
      --embedded-etcd-force-new-cluster             Starts a new cluster from existing data restored from a different system
      --embedded-etcd-listen-metrics-urls strings   The list of protocol://host:port where embedded etcd server listens for Prometheus scrapes
      --embedded-etcd-peer-port string              Port for embedded etcd peer (default "2380")
      --embedded-etcd-quota-backend-bytes int       Alarm threshold for embedded etcd backend bytes
      --embedded-etcd-wal-size-bytes int            Size of embedded etcd WAL
  -h, --help                                        help for cache-server
      --http2-max-streams-per-connection int        The limit that the server gives to clients for the maximum number of streams in an HTTP/2 connection. Zero means to use golang's default.
      --log-flush-frequency duration                Maximum number of seconds between log flushes (default 5s)
      --permit-address-sharing                      If true, SO_REUSEADDR will be used when binding the port. This allows binding to wildcard IPs like 0.0.0.0 and specific IPs in parallel, and it avoids waiting for the kernel to release sockets in TIME_WAIT state. [default=false]
      --permit-port-sharing                         If true, SO_REUSEPORT will be used when binding the port, which allows more than one instance to bind on the same address and port. [default=false]
      --secure-port int                             The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. (default 6443)
      --synthetic-delay duration                    The duration of time the cache server will inject a delay for to all inbound requests. Useful for testing.
      --tls-cert-file string                        File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory specified by --cert-dir.
      --tls-cipher-suites strings                   Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
                                                    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                                    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-min-version string                      Minimum TLS version supported. Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
      --tls-private-key-file string                 File containing the default x509 private key matching --tls-cert-file.
      --tls-sni-cert-key namedCertKey               A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. The domain patterns also allow IP addresses, but IPs should only be used if the apiserver has visibility to the IP address requested by a client. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.crt,example.key" or "foo.crt,foo.key:*.foo.com,foo.com". (default [])
  -v, --v Level                                     number for the log level verbosity
      --vmodule moduleSpec                          comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)