server

type CrispServerOptions struct {
	RecommendedOptions *genericoptions.RecommendedOptions

	// ServerRun carries the serving limits the recommended set leaves out:
	// how many requests may be in flight, how long one may take, and — the one
	// that matters most for an aggregated server — how long to keep serving
	// after SIGTERM.
	//
	// Without it the server stops answering the instant it is told to shut
	// down, while the aggregation layer and the Service endpoints are still
	// routing to it, so every rolling update turns into a window of 503s on
	// each projected group.
	ServerRun *genericoptions.ServerRunOptions

	// ProjectionDir holds CustomResourceProjection manifests to serve.
	ProjectionDir string

	// ProjectionWebhook configures the admission webhook that checks a
	// projection before the cluster accepts it.
	ProjectionWebhook apiserver.ProjectionWebhookOptions

	// ProjectionWebhookCABundleFile holds the CA the kube-apiserver verifies
	// the webhook against.
	ProjectionWebhookCABundleFile string

	// LocalDSNFromEnv resolves data source credentials from environment
	// variables instead of Secrets, for running outside a cluster.
	LocalDSNFromEnv bool

	// WatchProjections enables watching CustomResourceProjection objects and
	// installing or removing API groups while the server runs.
	WatchProjections bool

	// APIServices controls whether the server registers the groups it serves
	// with the aggregation layer.
	APIServices projectioncontroller.APIServiceOptions

	// APIServiceCABundleFile holds the CA that verifies this server's serving
	// certificate, for the APIServices it creates.
	APIServiceCABundleFile string

	// RequireAllProjections gates readiness on every projection being served.
	RequireAllProjections bool

	// MaxOpenConnsPerDataSource is the ceiling a projection cannot raise, so
	// that many projections cannot together exhaust a database's connections.
	MaxOpenConnsPerDataSource int32

	// DataSourceNamespaces restricts where a projection's Secret may live.
	DataSourceNamespaces []string

	// RequireDataSourceOptIn demands the opt-in label on that Secret.
	RequireDataSourceOptIn bool

	// LeaderElection decides which replica polls watched projections at the
	// configured interval; the others fall back to a slower one.
	LeaderElection apiserver.LeaderElectionOptions

	// EnableAdmission runs the admission chain for projected writes, so
	// ValidatingAdmissionPolicy, admission webhooks, and namespace lifecycle
	// apply to them as they do to any other resource.
	EnableAdmission bool

	// CredentialTokenFileDirs are the directories the token-file credential
	// provider may read a credential out of.
	//
	// A projection names the path, and a projection is a cluster object, so
	// without this whoever may write one could have the server read any file
	// its process can — its own ServiceAccount token among them — and send it
	// to a database as a password. The operator says which directories hold
	// credentials; the default is one that exists for this and nothing else.
	CredentialTokenFileDirs []string

	StdOut io.Writer
	StdErr io.Writer
	// contains filtered or unexported fields
}