Show deprecated kube-apiserver flags

[hzxuzhonghu]

What this PR does / why we need it:

This PR unhides deprecated kube-apiserver flags, so that the deprecation notice is clearly visible in --help.

Fixes #62617

Release note:

NONE

[hzxuzhonghu]

/assign @liggitt @sttts

[hzxuzhonghu]

/retest

[CaoShuFeng]

diff of help message:

>       --address ip                                              DEPRECATED: see --insecure-bind-address instead. (default 127.0.0.1) (DEPRECATED: see --insecure-bind-address instead.)
>       --admission-control strings                               Admission is divided into two phases. In the first phase, only mutating admission plugins run. In the second phase, only validating admission plugins run. The names in the below list may represent a validating plugin, a mutating plugin, or both. The order of plugins in which they are passed to this flag does not matter. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, DefaultStorageClass, DefaultTolerationSeconds, DenyEscalatingExec, DenyExecOnPrivileged, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, InitialResources, Initializers, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodPreset, PodSecurityPolicy, PodTolerationRestriction, Priority, ResourceQuota, SecurityContextDeny, ServiceAccount, StorageObjectInUseProtection, ValidatingAdmissionWebhook. (DEPRECATED: Use --enable-admission-plugins or --disable-admission-plugins instead. Will be removed in a future version.)
30a33
>       --audit-webhook-batch-initial-backoff duration            The amount of time to wait before retrying the first failed request. (default 10s) (DEPRECATED: Deprecated, use --audit-webhook-initial-backoff instead.)
74a78
>       --etcd-quorum-read                                        If true, enable quorum read. It defaults to true and is strongly recommended not setting to false. (default true) (DEPRECATED: This flag is deprecated and the ability to switch off quorum read will be removed in a future release.)
129a134,135
>       --insecure-bind-address ip                                The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all IPv4 interfaces and :: for all IPv6 interfaces). (default 127.0.0.1) (DEPRECATED: This flag will be removed in a future version.)
>       --insecure-port int                                       The port on which to serve unsecured, unauthenticated access. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster and that port 443 on the cluster's public address is proxied to this port. This is performed by nginx in the default setup. Set to zero to disable. (default 8080) (DEPRECATED: This flag will be removed in a future version.)
141a148
>       --kubelet-port uint                                       DEPRECATED: kubelet port. (default 10250) (DEPRECATED: kubelet-port is deprecated and will be removed.)
163a171
>       --port int                                                DEPRECATED: see --insecure-port instead. (default 8080) (DEPRECATED: see --insecure-port instead.)
182a191,192
>       --ssh-keyfile string                                      If non-empty, use secure SSH proxy to the nodes, using this user keyfile (DEPRECATED: This flag will be removed in a future version.)
>       --ssh-user string                                         If non-empty, use secure SSH proxy to the nodes, using this user name (DEPRECATED: This flag will be removed in a future version.)

[sttts]

didn't know this is possible so easily 👍

[sttts]

There are many flags (also in other components) with "Deprecated" in its description. Can we call MarkDeprectated for all of them and then add code like in this PR to make them visible?

[CaoShuFeng]

There are many flags (also in other components) with "Deprecated" in its description. Can we call MarkDeprectated for all of them and then add code like in this PR to make them visible?

I am working on kubectl.

[sttts]

@CaoShuFeng for easier approval, you can open multiple PRs if that helps.

[CaoShuFeng]

Hi, will this take the hidden flag back?

What should I do if I do want to hide it?

[hzxuzhonghu]

Ref #62009 (comment)
This is intended.

[CaoShuFeng]

OK.
What should I do if I do want to hide it?

I do not want to hide it. 😆

[liggitt]

I don't think we need to make all of the apiserver flags visible like this. The reason we did that for the kubelet was that all flags that could be specified via config file were marked deprecated, which made most of the kubelet flags invisible, despite their function still being supported.

The only ones I would add back are --admission-control, --insecure-bind-address, and --insecure-port

[hzxuzhonghu]

The only ones I would add back are --admission-control, --insecure-bind-address, and --insecure-port

But how can we make it? like this

pflag.VisitAll(func(flag *pflag.Flag) {
	if flag.Name == "admission-control" {
		flag.Hidden = false
        }
})

[liggitt]

func (s *InsecureServingOptions) AddFlags(fs *pflag.FlagSet) {
	fs.IPVar(&s.BindAddress, "insecure-bind-address", s.BindAddress, ""+
		"The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all IPv4 interfaces and :: for all IPv6 interfaces).")
	fs.MarkDeprecated("insecure-bind-address", "This flag will be removed in a future version.")
+	fs.Lookup("insecure-bind-address").Hidden = false

	fs.IntVar(&s.BindPort, "insecure-port", s.BindPort, ""+
		"The port on which to serve unsecured, unauthenticated access. It is assumed "+
		"that firewall rules are set up such that this port is not reachable from outside of "+
		"the cluster and that port 443 on the cluster's public address is proxied to this "+
		"port. This is performed by nginx in the default setup. Set to zero to disable.")
	fs.MarkDeprecated("insecure-port", "This flag will be removed in a future version.")
+	fs.Lookup("insecure-port").Hidden = false
}

[liggitt]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hzxuzhonghu, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kube-apiserver/OWNERS [liggitt]
• pkg/kubeapiserver/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-github-robot]

Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions here.