Apiserver 源码阅读

app.Run()
	CreateServerChain()
		CreateNodeDialer()	//ssh 连接
		CreateKubeAPIServerConfig()	//
			defaultOptions()
				DefaultAdvertiseAddress()
				DefaultServiceIPRange()
				MaybeDefaultWithSelfSignedCerts()
				ApplyAuthorization()
				IsValidServiceAccountKeyFile()
			Validate() //validate options
			BuildGenericConfig()	//takes the master server options and produces the genericapiserver.Config associated with it
				genericConfig
				genericConfig.OpenAPIConfig //config swagger
				BuildStorageFactory()		//constructs the storage factory

					func NewStorageFactory(storageConfig storagebackend.Config, defaultMediaType string, serializer runtime.StorageSerializer,
						defaultResourceEncoding *serverstorage.DefaultResourceEncodingConfig, storageEncodingOverrides map[string]schema.GroupVersion, resourceEncodingOverrides []schema.GroupVersionResource,
						defaultAPIResourceConfig *serverstorage.ResourceConfig, resourceConfigOverrides utilflag.ConfigurationMap) (*serverstorage.DefaultStorageFactory, error)

						// storageConfig -> ETCD配置
						// defaultAPIResourceConfig ->
						func DefaultAPIResourceConfigSource() *serverstorage.ResourceConfig
							type ResourceConfig struct {
								GroupVersionResourceConfigs map[schema.GroupVersion]*GroupVersionResourceConfig
							}
							func (o *ResourceConfig) EnableVersions(versions ...schema.GroupVersion)		//Enable GroupVersion
							func (o *ResourceConfig) EnableResources(resources ...schema.GroupVersionResource)    //daemonsets,deployments,ingresses,networkpolicies,replicasets,podsecuritypolicies

							// Specifies the overrides for various API group versions.
							// This can be used to enable/disable entire group versions or specific resources.
							type GroupVersionResourceConfig struct {
								// Whether to enable or disable this entire group version.  This dominates any enablement check.
								// Enable=true means the group version is enabled, and EnabledResources/DisabledResources are considered.
								// Enable=false means the group version is disabled, and EnabledResources/DisabledResources are not considered.
								Enable bool

								// DisabledResources lists the resources that are specifically disabled for a group/version
								// DisabledResources trumps EnabledResources
								DisabledResources sets.String

								// EnabledResources lists the resources that should be enabled by default.  This is a little
								// unusual, but we need it for compatibility with old code for now.  An empty set means
								// enable all, a non-empty set means that all other resources are disabled.
								EnabledResources sets.String
							}
					EtcdServersOverrides //override etcd配置
				client, err := internalclientset.NewForConfig(genericConfig.LoopbackClientConfig) // new a loopback client
				sharedInformers := informers.NewSharedInformerFactory(client, 10*time.Minute)	
					// SharedInformerFactory provides shared informers for resources in all known API group versions.
					type SharedInformerFactory interface {
						internalinterfaces.SharedInformerFactory
						ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
						WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool

						Admissionregistration() admissionregistration.Interface
						Apps() apps.Interface
						Autoscaling() autoscaling.Interface
						Batch() batch.Interface
						Certificates() certificates.Interface
						Core() core.Interface
						Extensions() extensions.Interface
						Networking() networking.Interface
						Policy() policy.Interface
						Rbac() rbac.Interface
						Scheduling() scheduling.Interface
						Settings() settings.Interface
						Storage() storage.Interface
					}
				serviceResolver
					// A ServiceResolver knows how to get a URL given a service.
					type ServiceResolver interface {
						ResolveEndpoint(namespace, name string) (*url.URL, error)
					}

			DefaultServiceIPRange()
			BuildStorageFactory()
			readCAorNil()	//auth CA

			config := &master.Config{}
				type Config struct {
					GenericConfig *genericapiserver.Config
					ExtraConfig   ExtraConfig
				}
		createAPIExtensionsConfig()
		createAPIExtensionsServer() // apiextensions-apiserver\pkg\apiserver\apiserver.go New() is the function for CustomResourceDefinitions to register router handler on GenericAPIServer
		CreateKubeAPIServer() // creates and wires a workable kube-apiserver,
			// returns a new instance of Master from the given config
			func (c completedConfig) New(delegationTarget genericapiserver.DelegationTarget) (*Master, error){} // goproject\src\k8s.io\kubernetes\pkg\master\master.go
				c.GenericConfig.New("kube-apiserver", delegationTarget)	// creates a new server which logically combines the handling chain with the passed server   !! important
					apiServerHandler := NewAPIServerHandler(name, c.RequestContextMapper, c.Serializer, handlerChainBuilder, delegationTarget.UnprotectedHandler())
						// k8s.io\apiserver\pkg\server\handler.go construct gorestfulContainer and add default handler(NotFoundHandler, RecoverHandler, ServiceErrorHandler)
						func NewAPIServerHandler(name string, contextMapper request.RequestContextMapper, s runtime.NegotiatedSerializer, handlerChainBuilder HandlerChainBuilderFn, notFoundHandler http.Handler) *APIServerHandler {}
							director := director{...}
								type director struct {
									name               string
									goRestfulContainer *restful.Container
									nonGoRestfulMux    *mux.PathRecorderMux
								}
								func (d director) ServeHTTP(w http.ResponseWriter, req *http.Request) {}
					s := &GenericAPIServer{}	// k8s.io\apiserver\pkg\server\genericapiserver.go type GenericAPIServer
					add PostStartHooks & PreShutdownHooks
					AddPostStartHook(PostStartHookFunc)	//	{c.SharedInformerFactory.Start(context.StopCh)}
					add healthzChecks
					installAPI(s, c.Config)		// install utils routes like SwaggerUI, Profiling, Metrics
				if () routes.DefaultMetrics{}.Install(s.Handler.NonGoRestfulMux)
				if () routes.Logs{}.Install(s.Handler.GoRestfulContainer)
				m := &Master{ GenericAPIServer: s, }
				m.InstallLegacyAPI(&c, c.GenericConfig.RESTOptionsGetter, legacyRESTStorageProvider)	// k8s.io\kubernetes\pkg\master\master.go, install core api routes, !!!!important 
					NewLegacyRESTStorage() -> //定义如下 返回 LegacyRESTStorage和APIGroupInfo, Storage保存了具体资源对象的结构，如 PodStrorage
						// LegacyRESTStorage returns stateful information about particular instances of REST storage to master.go for wiring controllers
						func (c LegacyRESTStorageProvider) NewLegacyRESTStorage(restOptionsGetter generic.RESTOptionsGetter) (LegacyRESTStorage, genericapiserver.APIGroupInfo, error) {} // k8s.io\kubernetes\pkg\registry\core\rest\storage_core.go
							// Info about an API group.
							type APIGroupInfo struct {
								GroupMeta apimachinery.GroupMeta
								// Info about the resources in this group. Its a map from version to resource to the storage.
								VersionedResourcesStorageMap map[string]map[string]rest.Storage	// !!! important!!!!
								// OptionsExternalVersion controls the APIVersion used for common objects in the
								// schema like api.Status, api.DeleteOptions, and metav1.ListOptions. Other implementors may
								// define a version "v1beta1" but want to use the Kubernetes "v1" internal objects.
								// If nil, defaults to groupMeta.GroupVersion.
								// TODO: Remove this when https://github.com/kubernetes/kubernetes/issues/19018 is fixed.
								OptionsExternalVersion *schema.GroupVersion
								// MetaGroupVersion defaults to "meta.k8s.io/v1" and is the scheme group version used to decode
								// common API implementations like ListOptions. Future changes will allow this to vary by group
								// version (for when the inevitable meta/v2 group emerges).
								MetaGroupVersion *schema.GroupVersion

								// Scheme includes all of the types used by this group and how to convert between them (or
								// to convert objects from outside of this group that are accepted in this API).
								// TODO: replace with interfaces
								Scheme *runtime.Scheme
								// NegotiatedSerializer controls how this group encodes and decodes data
								NegotiatedSerializer runtime.NegotiatedSerializer
								// ParameterCodec performs conversions for query parameters passed to API calls
								ParameterCodec runtime.ParameterCodec
							}
							restStorage := LegacyRESTStorage{}
							// NewREST for basic resources
							podTemplateStorage := podtemplatestore.NewREST(restOptionsGetter)
							eventStorage := eventstore.NewREST(restOptionsGetter, uint64(c.EventTTL.Seconds()))
							limitRangeStorage := limitrangestore.NewREST(restOptionsGetter)
							resourceQuotaStorage, resourceQuotaStatusStorage := resourcequotastore.NewREST(restOptionsGetter)
							secretStorage := secretstore.NewREST(restOptionsGetter)
							serviceAccountStorage := serviceaccountstore.NewREST(restOptionsGetter)
							persistentVolumeStorage, persistentVolumeStatusStorage := pvstore.NewREST(restOptionsGetter)
							persistentVolumeClaimStorage, persistentVolumeClaimStatusStorage := pvcstore.NewREST(restOptionsGetter)
							configMapStorage := configmapstore.NewREST(restOptionsGetter)
							namespaceStorage, namespaceStatusStorage, namespaceFinalizeStorage := namespacestore.NewREST(restOptionsGetter)
		
							endpointsStorage := endpointsstore.NewREST(restOptionsGetter)
							endpointRegistry := endpoint.NewRegistry(endpointsStorage)
							podStorage := podstore.NewStorage()
							serviceRESTStorage, serviceStatusStorage := servicestore.NewREST(restOptionsGetter)
							serviceRegistry := service.NewRegistry(serviceRESTStorage)

							restStorageMap := map[string]rest.Storage{
								"pods":             podStorage.Pod,
								"pods/attach":      podStorage.Attach,
								// ...............
								"configMaps":                    configMapStorage,
								"componentStatuses": componentstatus.NewStorage(componentStatusStorage{c.StorageFactory}.serversToValidate),
							}
							apiGroupInfo.VersionedResourcesStorageMap["v1"] = restStorageMap // set APIGroupInfo.VersionedResourcesStorageMap to return, !!!!!
					
					// construct BootstrapController and add hook
					NewBootstrapController()	// a controller for watching the core capabilities of the master
					AddPostStartHookOrDie() 	// { controller.start() }
					AddPreShutdownHookOrDie()   // { controller.stop() }

					InstallLegacyAPIGroup()
						func (s *GenericAPIServer) InstallLegacyAPIGroup(apiPrefix string, apiGroupInfo *APIGroupInfo) error {}
							if legacyAPIGroupPrefixes.Has(apiPrefix)
							installAPIResources()	// a private method for installing the REST storage backing each api groupversionresource
								for apiGroupInfo.GroupMeta.GroupVersions {
									// get rest.Storage from apiGroupInfo.VersionedResourcesStorageMap[groupVersion.Version]
									apiGroupVersion := s.getAPIGroupVersion(apiGroupInfo, groupVersion, apiPrefix)
									// InstallREST registers the REST handlers (storage, watch, proxy and redirect) into a restful Container
									apiGroupVersion.InstallREST(s.Handler.GoRestfulContainer)
										installer := &APIInstaller{ group: g,...}
										installer.Install()
											// Install handlers for API resources. k8s.io\apiserver\pkg\endpoints\installer.go
											func (a *APIInstaller) Install() ([]metav1.APIResource, *restful.WebService, []error) {}
												paths := make([]string, len(a.group.Storage))
												for paths(storages) {
													apiResource, err := a.registerResourceHandlers(path, a.group.Storage[path], ws, proxyHandler)	
														// !!important(700+ lines...), function to actually add route to go-restful. k8s.io\apiserver\pkg\endpoints\installer.go
														// kubernetes把所有对资源对象的操作接口封装到一个action对象中，在 registerResourceHandlers 方法中，
														// 根据如 storage.(rest.Getter)的方法，获取 what verbs are supported by the storage, used to know what verbs we support per path，
														// 根据scope: RESTScopeNameRoot(Handle non-namespace scoped resources like nodes) 或 RESTScopeNameNamespace(Handler for standard REST verbs (GET, PUT, POST and DELETE))
														// 将 action append 到一个 actions 切片中(不同 scope ，path前缀不同)
														// 最后遍历actions，根据不同的action.Verb，注册到go-restful的 restful.WebService中，并将此对象支持的Verbs将入到apiResource.Verbs中并返回apiResource对象。
														func (a *APIInstaller) registerResourceHandlers(path string, storage rest.Storage, ws *restful.WebService, proxyHandler http.Handler) (*metav1.APIResource, error) {}
															// Struct capturing information about an action ("GET", "POST", "WATCH", "PROXY", etc).
															type action struct {
																Verb          string               // Verb identifying the action ("GET", "POST", "WATCH", "PROXY", etc).
																Path          string               // The path of the action
																Params        []*restful.Parameter // List of parameters associated with the action.
																Namer         handlers.ScopeNamer
																AllNamespaces bool // true iff the action is namespaced but works on aggregate result for all namespaces
															}
															// APIResource specifies the name of a resource and whether it is namespaced.
															type APIResource struct {
																// name is the plural name of the resource.
																Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
																// singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
																// The singularName is more correct for reporting status on a single item and both singular and plural are allowed
																// from the kubectl CLI interface.
																SingularName string `json:"singularName" protobuf:"bytes,6,opt,name=singularName"`
																// namespaced indicates if a resource is namespaced or not.
																Namespaced bool `json:"namespaced" protobuf:"varint,2,opt,name=namespaced"`
																// group is the preferred group of the resource.  Empty implies the group of the containing resource list.
																// For subresources, this may have a different value, for example: Scale".
																Group string `json:"group,omitempty" protobuf:"bytes,8,opt,name=group"`
																// version is the preferred version of the resource.  Empty implies the version of the containing resource list
																// For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
																Version string `json:"version,omitempty" protobuf:"bytes,9,opt,name=version"`
																// kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')
																Kind string `json:"kind" protobuf:"bytes,3,opt,name=kind"`
																// verbs is a list of supported kube verbs (this includes get, list, watch, create,
																// update, patch, delete, deletecollection, and proxy)
																Verbs Verbs `json:"verbs" protobuf:"bytes,4,opt,name=verbs"`
																// shortNames is a list of suggested short names of the resource.
																ShortNames []string `json:"shortNames,omitempty" protobuf:"bytes,5,rep,name=shortNames"`
																// categories is a list of the grouped resources this resource belongs to (e.g. 'all')
																Categories []string `json:"categories,omitempty" protobuf:"bytes,7,rep,name=categories"`
															}
													apiResources = append(apiResources, *apiResource)
												}
								}
				m.InstallAPIs(c.ExtraConfig.APIResourceConfigSource, c.GenericConfig.RESTOptionsGetter, restStorageProviders...)	// InstallAPIs will install the APIs for the restStorageProviders if they are enabled.
					for restStorageProviders {
						apiGroupsInfo = append(apiGroupsInfo, apiGroupInfo)
					}
					for i := range apiGroupsInfo {
						m.GenericAPIServer.InstallAPIGroup(&apiGroupsInfo[i])
							// installAPIResources is a private method for installing the REST storage backing each api groupversionresource, k8s.io\apiserver\pkg\server\genericapiserver.go
							func (s *GenericAPIServer) installAPIResources(apiPrefix string, apiGroupInfo *APIGroupInfo) error {}
								// ！！InstallREST registers the REST handlers (storage, watch, proxy and redirect) into a restful Container, k8s.io\apiserver\pkg\endpoints\groupversion.go
								apiGroupVersion.InstallREST(s.Handler.GoRestfulContainer
					}
				m.installTunneler(c.ExtraConfig.Tunneler, corev1client.NewForConfigOrDie(c.GenericConfig.LoopbackClientConfig).Nodes())
				m.GenericAPIServer.AddPostStartHookOrDie("ca-registration", c.ExtraConfig.ClientCARegistrationHook.PostStartHook)
			AddPostStartHook()		// addfunc {sharedInformers.Start(context.StopCh)}
		// openapi swagger
		// this wires up openapi
		kubeAPIServer.GenericAPIServer.PrepareRun()
		// This will wire up openapi for extension api server
		apiExtensionsServer.GenericAPIServer.PrepareRun()
		aggregatorConfig, err := createAggregatorConfig(*kubeAPIServerConfig.GenericConfig, runOptions, versionedInformers, serviceResolver, proxyTransport)
		aggregatorServer, err := createAggregatorServer(aggregatorConfig, kubeAPIServer.GenericAPIServer, apiExtensionsServer.Informers)
			aggregatorServer, err := aggregatorConfig.Complete().NewWithDelegate(delegateAPIServer)
				genericServer, err := c.GenericConfig.New("kube-aggregator", delegationTarget) // ----same function with called in CreateKubeAPIServer->New() (91)
				apiregistrationClient, err := internalclientset.NewForConfig(c.GenericConfig.LoopbackClientConfig)
					configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
					cs.apiregistration, err = apiregistrationinternalversion.NewForConfig(&configShallowCopy)
					cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
					informerFactory := informers.NewSharedInformerFactory(apiregistrationClient,5*time.Minute,)
					s := &APIAggregator{}	// APIAggregator contains state for a Kubernetes cluster master/api server.
					v1beta1storage := map[string]rest.Storage{}
					apiServiceREST := apiservicestorage.NewREST(Scheme, c.GenericConfig.RESTOptionsGetter)
					v1beta1storage["apiservices"] = apiServiceREST
					v1beta1storage["apiservices/status"] = apiservicestorage.NewStatusREST(Scheme, apiServiceREST)
					// rest implements a RESTStorage for API services against etcd
					type REST struct {
						*genericregistry.Store
					}
					apiGroupInfo.VersionedResourcesStorageMap["v1beta1"] = v1beta1storage
					s.GenericAPIServer.InstallAPIGroup(&apiGroupInfo)		// ----same function with called in CreateKubeAPIServer->New()->InstallAPIs() (237)
					s.GenericAPIServer.Handler.NonGoRestfulMux.Handle("/apis", apisHandler)
					s.GenericAPIServer.Handler.NonGoRestfulMux.UnlistedHandle("/apis/", apisHandler)
					apiserviceRegistrationController := NewAPIServiceRegistrationController(informerFactory.Apiregistration().InternalVersion().APIServices(), c.GenericConfig.SharedInformerFactory.Core().V1().Services(), s) // add event handler to informer
					s.GenericAPIServer.AddPostStartHook("start-kube-aggregator-informers")
					s.GenericAPIServer.AddPostStartHook("apiservice-registration-controller")
					s.GenericAPIServer.AddPostStartHook("apiservice-status-available-controller")
					// BuildAndRegisterAggregator registered OpenAPI aggregator handler. 
					openAPIAggregator, err := openapicontroller.BuildAndRegisterAggregator()
			// create controllers for auto-registration
			apiRegistrationClient, err := apiregistrationclient.NewForConfig(aggregatorConfig.GenericConfig.LoopbackClientConfig)
			// ......

// APIServerHandlers holds the different http.Handlers used by the API server.
// This includes the full handler chain, the director (which chooses between gorestful and nonGoRestful,
// the gorestful handler (used for the API) which falls through to the nonGoRestful handler on unregistered paths,
// and the nonGoRestful handler (which can contain a fallthrough of its own)
// FullHandlerChain -> Director -> {GoRestfulContainer,NonGoRestfulMux} based on inspection of registered web services
type APIServerHandler struct {
	// FullHandlerChain is the one that is eventually served with.  It should include the full filter
	// chain and then call the Director.
	FullHandlerChain http.Handler
	// The registered APIs.  InstallAPIs uses this.  Other servers probably shouldn't access this directly.
	GoRestfulContainer *restful.Container
	// NonGoRestfulMux is the final HTTP handler in the chain.
	// It comes after all filters and the API handling
	// This is where other servers can attach handler to various parts of the chain.
	NonGoRestfulMux *mux.PathRecorderMux
	// Other servers should only use this opaquely to delegate to an API server.
	Director http.Handler
}

// CreateServerChain creates the apiservers connected via delegation.
func CreateServerChain(runOptions *options.ServerRunOptions, stopCh <-chan struct{}) (*genericapiserver.GenericAPIServer, error) {}

kubeAPIServerConfig, sharedInformers, versionedInformers, insecureServingOptions, serviceResolver, err := CreateKubeAPIServerConfig(runOptions, nodeTunneler, proxyTransport)

// CreateKubeAPIServerConfig creates all the resources for running the API server, but runs none of them
func CreateKubeAPIServerConfig(s *options.ServerRunOptions, nodeTunneler tunneler.Tunneler, proxyTransport *http.Transport) (*master.Config, informers.SharedInformerFactory, clientgoinformers.SharedInformerFactory, *kubeserver.InsecureServingInfo, aggregatorapiserver.ServiceResolver, error) {}

serviceResolver = aggregatorapiserver.NewClusterIPServiceResolver(
			versionedInformers.Core().V1().Services().Lister(),
		)

// A ServiceResolver knows how to get a URL given a service.
type ServiceResolver interface {
	ResolveEndpoint(namespace, name string) (*url.URL, error)
}

// SharedInformerFactory provides shared informers for resources in all known
// API group versions.
type SharedInformerFactory interface {
	internalinterfaces.SharedInformerFactory
	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool

	Admissionregistration() admissionregistration.Interface
	Apps() apps.Interface
	Autoscaling() autoscaling.Interface
	Batch() batch.Interface
	Certificates() certificates.Interface
	Core() core.Interface
	Extensions() extensions.Interface
	Networking() networking.Interface
	Policy() policy.Interface
	Rbac() rbac.Interface
	Scheduling() scheduling.Interface
	Settings() settings.Interface
	Storage() storage.Interface
}

// SharedInformer has a shared data cache and is capable of distributing notifications for changes
// to the cache to multiple listeners who registered via AddEventHandler. If you use this, there is
// one behavior change compared to a standard Informer.  When you receive a notification, the cache
// will be AT LEAST as fresh as the notification, but it MAY be more fresh.  You should NOT depend
// on the contents of the cache exactly matching the notification you've received in handler
// functions.  If there was a create, followed by a delete, the cache may NOT have your item.  This
// has advantages over the broadcaster since it allows us to share a common cache across many
// controllers. Extending the broadcaster would have required us keep duplicate caches for each
// watch.
type SharedInformer interface {
	// AddEventHandler adds an event handler to the shared informer using the shared informer's resync
	// period.  Events to a single handler are delivered sequentially, but there is no coordination
	// between different handlers.
	AddEventHandler(handler ResourceEventHandler)
	// AddEventHandlerWithResyncPeriod adds an event handler to the shared informer using the
	// specified resync period.  Events to a single handler are delivered sequentially, but there is
	// no coordination between different handlers.
	AddEventHandlerWithResyncPeriod(handler ResourceEventHandler, resyncPeriod time.Duration)
	// GetStore returns the Store.
	GetStore() Store
	// GetController gives back a synthetic interface that "votes" to start the informer
	GetController() Controller
	// Run starts the shared informer, which will be stopped when stopCh is closed.
	Run(stopCh <-chan struct{})
	// HasSynced returns true if the shared informer's store has synced.
	HasSynced() bool
	// LastSyncResourceVersion is the resource version observed when last synced with the underlying
	// store. The value returned is not synchronized with access to the underlying store and is not
	// thread-safe.
	LastSyncResourceVersion() string
}

kubeAPIServer, err := CreateKubeAPIServer(kubeAPIServerConfig, apiExtensionsServer.GenericAPIServer, sharedInformers, versionedInformers)

// CreateKubeAPIServer creates and wires a workable kube-apiserver
func CreateKubeAPIServer(kubeAPIServerConfig *master.Config, delegateAPIServer genericapiserver.DelegationTarget, sharedInformers informers.SharedInformerFactory, versionedInformers clientgoinformers.SharedInformerFactory) (*master.Master, error) {}

// New creates a new server which logically combines the handling chain with the passed server.
// name is used to differentiate for logging.
func (c completedConfig) New(name string, delegationTarget DelegationTarget) (*GenericAPIServer, error) {}

// BuildHandlerChainFunc allows you to build custom handler chains by decorating the apiHandler.
BuildHandlerChainFunc func(apiHandler http.Handler, c *Config) (secure http.Handler)

// default BuildHandlerChainFunc
func DefaultBuildHandlerChain(apiHandler http.Handler, c *Config) http.Handler {
	handler := genericapifilters.WithAuthorization(apiHandler, c.RequestContextMapper, c.Authorizer, c.Serializer)
	handler = genericfilters.WithMaxInFlightLimit(handler, c.MaxRequestsInFlight, c.MaxMutatingRequestsInFlight, c.RequestContextMapper, c.LongRunningFunc)
	handler = genericapifilters.WithImpersonation(handler, c.RequestContextMapper, c.Authorizer, c.Serializer)
	if utilfeature.DefaultFeatureGate.Enabled(features.AdvancedAuditing) {
		handler = genericapifilters.WithAudit(handler, c.RequestContextMapper, c.AuditBackend, c.AuditPolicyChecker, c.LongRunningFunc)
	} else {
		handler = genericapifilters.WithLegacyAudit(handler, c.RequestContextMapper, c.LegacyAuditWriter)
	}
	failedHandler := genericapifilters.Unauthorized(c.RequestContextMapper, c.Serializer, c.SupportsBasicAuth)
	if utilfeature.DefaultFeatureGate.Enabled(features.AdvancedAuditing) {
		failedHandler = genericapifilters.WithFailedAuthenticationAudit(failedHandler, c.RequestContextMapper, c.AuditBackend, c.AuditPolicyChecker)
	}
	handler = genericapifilters.WithAuthentication(handler, c.RequestContextMapper, c.Authenticator, failedHandler)
	handler = genericfilters.WithCORS(handler, c.CorsAllowedOriginList, nil, nil, nil, "true")
	handler = genericfilters.WithTimeoutForNonLongRunningRequests(handler, c.RequestContextMapper, c.LongRunningFunc, c.RequestTimeout)
	handler = genericfilters.WithWaitGroup(handler, c.RequestContextMapper, c.LongRunningFunc, c.HandlerChainWaitGroup)
	handler = genericapifilters.WithRequestInfo(handler, c.RequestInfoResolver, c.RequestContextMapper)
	handler = apirequest.WithRequestContext(handler, c.RequestContextMapper)
	handler = genericfilters.WithPanicRecovery(handler)
	return handler
}

type director struct {
	name               string
	goRestfulContainer *restful.Container
	nonGoRestfulMux    *mux.PathRecorderMux
}

func (d director) ServeHTTP(w http.ResponseWriter, req *http.Request) {
	path := req.URL.Path

	// check to see if our webservices want to claim this path
	for _, ws := range d.goRestfulContainer.RegisteredWebServices() {
		switch {
		case ws.RootPath() == "/apis":
			// if we are exactly /apis or /apis/, then we need special handling in loop.
			// normally these are passed to the nonGoRestfulMux, but if discovery is enabled, it will go directly.
			// We can't rely on a prefix match since /apis matches everything (see the big comment on Director above)
			if path == "/apis" || path == "/apis/" {
				glog.V(5).Infof("%v: %v %q satisfied by gorestful with webservice %v", d.name, req.Method, path, ws.RootPath())
				// don't use servemux here because gorestful servemuxes get messed up when removing webservices
				// TODO fix gorestful, remove TPRs, or stop using gorestful
				d.goRestfulContainer.Dispatch(w, req)
				return
			}

		case strings.HasPrefix(path, ws.RootPath()):
			// ensure an exact match or a path boundary match
			if len(path) == len(ws.RootPath()) || path[len(ws.RootPath())] == '/' {
				glog.V(5).Infof("%v: %v %q satisfied by gorestful with webservice %v", d.name, req.Method, path, ws.RootPath())
				// don't use servemux here because gorestful servemuxes get messed up when removing webservices
				// TODO fix gorestful, remove TPRs, or stop using gorestful
				d.goRestfulContainer.Dispatch(w, req)
				return
			}
		}
	}

	// if we didn't find a match, then we just skip gorestful altogether
	glog.V(5).Infof("%v: %v %q satisfied by nonGoRestful", d.name, req.Method, path)
	d.nonGoRestfulMux.ServeHTTP(w, req)
}

// ListedPathProvider is an interface for providing paths that should be reported at /.
type ListedPathProvider interface {
	// ListedPaths is an alphabetically sorted list of paths to be reported at /.
	ListedPaths() []string
}

m.InstallLegacyAPI(&c, c.GenericConfig.RESTOptionsGetter, legacyRESTStorageProvider)

func (m *Master) InstallLegacyAPI(c *completedConfig, restOptionsGetter generic.RESTOptionsGetter, legacyRESTStorageProvider corerest.LegacyRESTStorageProvider) {}

legacyRESTStorage, apiGroupInfo, err := legacyRESTStorageProvider.NewLegacyRESTStorage(restOptionsGetter)

func (c LegacyRESTStorageProvider) NewLegacyRESTStorage(restOptionsGetter generic.RESTOptionsGetter) (LegacyRESTStorage, genericapiserver.APIGroupInfo, error) {}

// LegacyRESTStorage returns stateful information about particular instances of REST storage to
// master.go for wiring controllers.
// TODO remove this by running the controller as a poststarthook
type LegacyRESTStorage struct {
	ServiceClusterIPAllocator rangeallocation.RangeRegistry
	ServiceNodePortAllocator  rangeallocation.RangeRegistry
}

// Info about an API group.
type APIGroupInfo struct {
	GroupMeta apimachinery.GroupMeta
	// Info about the resources in this group. Its a map from version to resource to the storage.
	VersionedResourcesStorageMap map[string]map[string]rest.Storage
	// OptionsExternalVersion controls the APIVersion used for common objects in the
	// schema like api.Status, api.DeleteOptions, and metav1.ListOptions. Other implementors may
	// define a version "v1beta1" but want to use the Kubernetes "v1" internal objects.
	// If nil, defaults to groupMeta.GroupVersion.
	// TODO: Remove this when https://github.com/kubernetes/kubernetes/issues/19018 is fixed.
	OptionsExternalVersion *schema.GroupVersion
	// MetaGroupVersion defaults to "meta.k8s.io/v1" and is the scheme group version used to decode
	// common API implementations like ListOptions. Future changes will allow this to vary by group
	// version (for when the inevitable meta/v2 group emerges).
	MetaGroupVersion *schema.GroupVersion

	// Scheme includes all of the types used by this group and how to convert between them (or
	// to convert objects from outside of this group that are accepted in this API).
	// TODO: replace with interfaces
	Scheme *runtime.Scheme
	// NegotiatedSerializer controls how this group encodes and decodes data
	NegotiatedSerializer runtime.NegotiatedSerializer
	// ParameterCodec performs conversions for query parameters passed to API calls
	ParameterCodec runtime.ParameterCodec
}

// restStorageMap
restStorageMap := map[string]rest.Storage{
	"pods":             podStorage.Pod,
	"pods/attach":      podStorage.Attach,
	"pods/status":      podStorage.Status,
	"pods/log":         podStorage.Log,
	"pods/exec":        podStorage.Exec,
	"pods/portforward": podStorage.PortForward,
	"pods/proxy":       podStorage.Proxy,
	"pods/binding":     podStorage.Binding,
	"bindings":         podStorage.Binding,
	"podTemplates": podTemplateStorage,
	"replicationControllers":        controllerStorage.Controller,
	"replicationControllers/status": controllerStorage.Status,
	"services":        serviceRest.Service,
	"services/proxy":  serviceRest.Proxy,
	"services/status": serviceStatusStorage,
	"endpoints": endpointsStorage,
	"nodes":        nodeStorage.Node,
	"nodes/status": nodeStorage.Status,
	"nodes/proxy":  nodeStorage.Proxy,
	"events": eventStorage,
	"limitRanges":                   limitRangeStorage,
	"resourceQuotas":                resourceQuotaStorage,
	"resourceQuotas/status":         resourceQuotaStatusStorage,
	"namespaces":                    namespaceStorage,
	"namespaces/status":             namespaceStatusStorage,
	"namespaces/finalize":           namespaceFinalizeStorage,
	"secrets":                       secretStorage,
	"serviceAccounts":               serviceAccountStorage,
	"persistentVolumes":             persistentVolumeStorage,
	"persistentVolumes/status":      persistentVolumeStatusStorage,
	"persistentVolumeClaims":        persistentVolumeClaimStorage,
	"persistentVolumeClaims/status": persistentVolumeClaimStatusStorage,
	"configMaps":                    configMapStorage,
	"componentStatuses": componentstatus.NewStorage(componentStatusStorage{c.StorageFactory}.serversToValidate),
}

m.GenericAPIServer.InstallLegacyAPIGroup(genericapiserver.DefaultLegacyAPIPrefix, &apiGroupInfo)

func (s *GenericAPIServer) InstallLegacyAPIGroup(apiPrefix string, apiGroupInfo *APIGroupInfo) error {
	if !s.legacyAPIGroupPrefixes.Has(apiPrefix) {
		return fmt.Errorf("%q is not in the allowed legacy API prefixes: %v", apiPrefix, s.legacyAPIGroupPrefixes.List())
	}
	if err := s.installAPIResources(apiPrefix, apiGroupInfo); err != nil {
		return err
	}

	// setup discovery
	apiVersions := []string{}
	for _, groupVersion := range apiGroupInfo.GroupMeta.GroupVersions {
		apiVersions = append(apiVersions, groupVersion.Version)
	}
	// Install the version handler.
	// Add a handler at /<apiPrefix> to enumerate the supported api versions.
	s.Handler.GoRestfulContainer.Add(discovery.NewLegacyRootAPIHandler(s.discoveryAddresses, s.Serializer, apiPrefix, apiVersions, s.requestContextMapper).WebService())
	return nil
}

// InstallREST registers the REST handlers (storage, watch, proxy and redirect) into a restful Container.
// It is expected that the provided path root prefix will serve all operations. Root MUST NOT end
// in a slash.
func (g *APIGroupVersion) InstallREST(container *restful.Container) error {
	prefix := path.Join(g.Root, g.GroupVersion.Group, g.GroupVersion.Version)
	installer := &APIInstaller{
		group:                        g,
		prefix:                       prefix,
		minRequestTimeout:            g.MinRequestTimeout,
		enableAPIResponseCompression: g.EnableAPIResponseCompression,
	}

	apiResources, ws, registrationErrors := installer.Install()
	versionDiscoveryHandler := discovery.NewAPIVersionHandler(g.Serializer, g.GroupVersion, staticLister{apiResources}, g.Context)
	versionDiscoveryHandler.AddToWebService(ws)
	container.Add(ws)
	return utilerrors.NewAggregate(registrationErrors)
}

// Install handlers for API resources.
func (a *APIInstaller) Install() ([]metav1.APIResource, *restful.WebService, []error) {
	var apiResources []metav1.APIResource
	var errors []error
	ws := a.newWebService()

	proxyHandler := (&handlers.ProxyHandler{
		Prefix:     a.prefix + "/proxy/",
		Storage:    a.group.Storage,
		Serializer: a.group.Serializer,
		Mapper:     a.group.Context,
	})

	// Register the paths in a deterministic (sorted) order to get a deterministic swagger spec.
	paths := make([]string, len(a.group.Storage))
	var i int = 0
	for path := range a.group.Storage {
		paths[i] = path
		i++
	}
	sort.Strings(paths)
	for _, path := range paths {
		apiResource, err := a.registerResourceHandlers(path, a.group.Storage[path], ws, proxyHandler)
		if err != nil {
			errors = append(errors, fmt.Errorf("error in registering resource: %s, %v", path, err))
		}
		if apiResource != nil {
			apiResources = append(apiResources, *apiResource)
		}
	}
	return apiResources, ws, errors
}

m.InstallAPIs(c.ExtraConfig.APIResourceConfigSource, c.GenericConfig.RESTOptionsGetter, restStorageProviders...)

// InstallAPIs will install the APIs for the restStorageProviders if they are enabled.
func (m *Master) InstallAPIs(apiResourceConfigSource serverstorage.APIResourceConfigSource, restOptionsGetter generic.RESTOptionsGetter, restStorageProviders ...RESTStorageProvider) {}

// 代码片段 1
// RESTStorageProvider is a factory type for REST storage.
type RESTStorageProvider interface {
	GroupName() string
	NewRESTStorage(apiResourceConfigSource serverstorage.APIResourceConfigSource, restOptionsGetter generic.RESTOptionsGetter) (genericapiserver.APIGroupInfo, bool)
}

// The order here is preserved in discovery.
	// If resources with identical names exist in more than one of these groups (e.g. "deployments.apps"" and "deployments.extensions"),
	// the order of this list determines which group an unqualified resource name (e.g. "deployments") should prefer.
	// This priority order is used for local discovery, but it ends up aggregated in `k8s.io/kubernetes/cmd/kube-apiserver/app/aggregator.go
	// with specific priorities.
	// TODO: describe the priority all the way down in the RESTStorageProviders and plumb it back through the various discovery
	// handlers that we have.
	restStorageProviders := []RESTStorageProvider{
		authenticationrest.RESTStorageProvider{Authenticator: c.GenericConfig.Authenticator},
		authorizationrest.RESTStorageProvider{Authorizer: c.GenericConfig.Authorizer, RuleResolver: c.GenericConfig.RuleResolver},
		autoscalingrest.RESTStorageProvider{},
		batchrest.RESTStorageProvider{},
		certificatesrest.RESTStorageProvider{},
		extensionsrest.RESTStorageProvider{},
		networkingrest.RESTStorageProvider{},
		policyrest.RESTStorageProvider{},
		rbacrest.RESTStorageProvider{Authorizer: c.GenericConfig.Authorizer},
		schedulingrest.RESTStorageProvider{},
		settingsrest.RESTStorageProvider{},
		storagerest.RESTStorageProvider{},
		// keep apps after extensions so legacy clients resolve the extensions versions of shared resource names.
		// See https://github.com/kubernetes/kubernetes/issues/42392
		appsrest.RESTStorageProvider{},
		admissionregistrationrest.RESTStorageProvider{},
		eventsrest.RESTStorageProvider{TTL: c.ExtraConfig.EventTTL},
	}