master-sidecar-4.yaml

kind: Template
apiVersion: template.openshift.io/v1

parameters:
- name: JOB_NAME_SAFE
  required: true
- name: LOCAL_IMAGE_SRC
  required: true
- name: IMAGE_CLI
  required: true
- name: IMAGE_HYPERSHIFT
  required: true
- name: IMAGE_HYPERKUBE
  required: true
- name: IMAGE_ETCD
  required: true
- name: COMMAND
  required: true
- name: NAMESPACE
  required: true

objects:

# We want the cluster to be able to access these images
- kind: RoleBinding
  apiVersion: authorization.openshift.io/v1
  metadata:
    name: ${JOB_NAME_SAFE}-image-puller
    namespace: ${NAMESPACE}
  roleRef:
    name: system:image-puller
  subjects:
  - kind: SystemGroup
    name: system:unauthenticated
  - kind: SystemGroup
    name: system:authenticated

# The pod spins up a simple openshift control plane as a sidecar and waits for the
# COMMAND specified to the template to be executed, before itself exiting. The test
# container is given access to the generated config and the admin.kubeconfig.
- kind: Pod
  apiVersion: v1
  metadata:
    name: ${JOB_NAME_SAFE}
    namespace: ${NAMESPACE}
    annotations:
      ci-operator.openshift.io/container-sub-tests: "setup,test"
      ci-operator.openshift.io/save-container-logs: "true"
      ci-operator.openshift.io/wait-for-container-artifacts: setup
  spec:
    # otherwise the control plane is attempting to load the wrong credentials
    automountServiceAccountToken: false
    restartPolicy: Never
    activeDeadlineSeconds: 7200
    terminationGracePeriodSeconds: 600
    volumes:
    - name: artifacts
      emptyDir: {}
    - name: shared-tmp
      emptyDir: {}
    - name: start
      configMap:
        name: master-start-4
        defaultMode: 0555

    initContainers:
    - name: bin-cli
      image: ${IMAGE_CLI}
      volumeMounts:
      - name: shared-tmp
        mountPath: /tmp/shared
      command:
      - /bin/sh
      - -c
      - |
        mkdir /tmp/shared/bin
        cp /usr/bin/oc /tmp/shared/bin/
    - name: bin-hyperkube
      image: ${IMAGE_HYPERKUBE}
      volumeMounts:
      - name: shared-tmp
        mountPath: /tmp/shared
      command:
      - cp
      - /usr/bin/hyperkube
      - /tmp/shared/bin/
    - name: bin-hypershift
      image: ${IMAGE_HYPERSHIFT}
      volumeMounts:
      - name: shared-tmp
        mountPath: /tmp/shared
      command:
      - cp
      - /usr/bin/hypershift
      - /tmp/shared/bin/
    - name: bin-etcd
      image: ${IMAGE_ETCD}
      volumeMounts:
      - name: shared-tmp
        mountPath: /tmp/shared
      command:
      - cp
      - /usr/bin/etcd
      - /tmp/shared/bin/

    containers:

    # Once admin.kubeconfig exists, executes shared tests
    - name: test
      image: ${LOCAL_IMAGE_SRC}
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - name: shared-tmp
        mountPath: /tmp/shared
      - name: artifacts
        mountPath: /tmp/artifacts
      command:
      - /bin/bash
      - -c
      - |
        #!/bin/bash
        set -euo pipefail

        trap 'touch /tmp/shared/exit' EXIT
        trap 'jobs -p | xargs kill || true; exit 0' TERM

        # wait until the master job creates admin.kubeconfig
        while true; do
          if [[ ! -f /tmp/shared/admin.kubeconfig ]]; then
            sleep 5 & wait
            continue
          fi
          break
        done
        echo "Found kubeconfig"
        export KUBECONFIG=/tmp/shared/admin.kubeconfig

        ${COMMAND}

    # Start a standalone master
    - name: setup
      image: ${LOCAL_IMAGE_SRC}
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - name: shared-tmp
        mountPath: /tmp/shared
      - name: artifacts
        mountPath: /tmp/artifacts
      - name: start
        mountPath: /tmp/start
      env:
      - name: API_HOST_IP
        valueFrom:
          fieldRef:
            fieldPath: status.podIP
      - name: API_HOST
        value: $(API_HOST_IP)
      - name: TYPE
        value: ${CLUSTER_TYPE}
      resources:
        requests:
          cpu: 1
          memory: 300Mi
        limits:
          memory: 1Gi
      command:
      - /bin/bash
      - -c
      - |
        #!/bin/bash
        set -euo pipefail
        function teardown() {
          set +e
          echo "Gathering artifacts ..."
          cp -R /tmp/shared/logs /tmp/artifacts/
        }
        trap 'teardown' EXIT
        trap 'jobs -p | xargs kill || true; wait; exit 0' TERM

        export HOME=/tmp/home
        export PATH=/tmp/shared/bin:$PATH
        mkdir /tmp/home
        mkdir /tmp/cluster

        (
          while true; do
            if [[ -f /tmp/shared/exit ]]; then
              echo "Shutting down"
              kill 1
              exit 0
            fi
            sleep 5
          done
        ) &

        /tmp/start/start.sh /tmp/shared &
        wait $!

# Generated by running `oc create cm master-start-4 --from-file=hack/local-master --dry-run -o yaml` in origin
#
# ---
- apiVersion: v1
  data:
    apiservice-00_role_binding_restriction_crd.yaml: |
      apiVersion: apiextensions.k8s.io/v1beta1
      kind: CustomResourceDefinition
      metadata:
        name: rolebindingrestrictions.authorization.openshift.io
      spec:
        group: authorization.openshift.io
        names:
          kind: RoleBindingRestriction
          listKind: RoleBindingRestrictionList
          plural: rolebindingrestrictions
          singular: rolebindingrestriction
        subresources:
          status: {}
        scope: Namespaced
        versions:
        - name: v1
          served: true
          storage: true
        validation:
          openAPIV3Schema:
            properties:
              apiVersion:
                description: 'APIVersion defines the versioned schema of this representation
                  of an object. Servers should convert recognized schemas to the latest
                  internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
                type: string
              kind:
                description: 'Kind is a string value representing the REST resource this
                  object represents. Servers may infer this from the endpoint the client
                  submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
                type: string
              metadata:
                description: Standard object's metadata.
                type: object
              spec:
                description: Spec defines the matcher.
                properties:
                  grouprestriction:
                    description: GroupRestriction matches against group subjects.
                    nullable: true
                    properties:
                      groups:
                        description: Groups is a list of groups used to match against an
                          individual user's groups. If the user is a member of one of the
                          whitelisted groups, the user is allowed to be bound to a role.
                        items:
                          type: string
                        type: array
                        nullable: true
                      labels:
                        description: Selectors specifies a list of label selectors over
                          group labels.
                        items:
                          type: object
                        type: array
                        nullable: true
                    type: object
                  serviceaccountrestriction:
                    description: ServiceAccountRestriction matches against service-account
                      subjects.
                    nullable: true
                    properties:
                      namespaces:
                        description: Namespaces specifies a list of literal namespace names.
                        items:
                          type: string
                        type: array
                      serviceaccounts:
                        description: ServiceAccounts specifies a list of literal service-account
                          names.
                        items:
                          properties:
                            name:
                              description: Name is the name of the service account.
                              type: string
                            namespace:
                              description: Namespace is the namespace of the service account.  Service
                                accounts from inside the whitelisted namespaces are allowed
                                to be bound to roles.  If Namespace is empty, then the namespace
                                of the RoleBindingRestriction in which the ServiceAccountReference
                                is embedded is used.
                              type: string
                          type: object
                        type: array
                    type: object
                  userrestriction:
                    description: UserRestriction matches against user subjects.
                    nullable: true
                    properties:
                      groups:
                        description: Groups specifies a list of literal group names.
                        items:
                          type: string
                        type: array
                        nullable: true
                      labels:
                        description: Selectors specifies a list of label selectors over
                          user labels.
                        items:
                          type: object
                        type: array
                        nullable: true
                      users:
                        description: Users specifies a list of literal user names.
                        items:
                          type: string
                        type: array
                    type: object
                type: object
    apiservice-00_security_context_constraint_crd.yaml: |
      apiVersion: apiextensions.k8s.io/v1beta1
      kind: CustomResourceDefinition
      metadata:
        name: securitycontextconstraints.security.openshift.io
      spec:
        group: security.openshift.io
        names:
          kind: SecurityContextConstraints
          listKind: SecurityContextConstraintsList
          plural: securitycontextconstraints
          singular: securitycontextconstraints
        subresources:
          status: {}
        scope: Cluster
        versions:
        - name: v1
          served: true
          storage: true
        validation:
          openAPIV3Schema:
            properties:
              allowHostDirVolumePlugin:
                nullable: true
                description: AllowHostDirVolumePlugin determines if the policy allow containers
                  to use the HostDir volume plugin +k8s:conversion-gen=false
                type: boolean
              allowHostIPC:
                nullable: true
                description: AllowHostIPC determines if the policy allows host ipc in the
                  containers.
                type: boolean
              allowHostNetwork:
                nullable: true
                description: AllowHostNetwork determines if the policy allows the use of
                  HostNetwork in the pod spec.
                type: boolean
              allowHostPID:
                nullable: true
                description: AllowHostPID determines if the policy allows host pid in the
                  containers.
                type: boolean
              allowHostPorts:
                nullable: true
                description: AllowHostPorts determines if the policy allows host ports in
                  the containers.
                type: boolean
              allowPrivilegeEscalation:
                nullable: true
                description: AllowPrivilegeEscalation determines if a pod can request to
                  allow privilege escalation. If unspecified, defaults to true.
                type: boolean
              allowPrivilegedContainer:
                nullable: true
                description: AllowPrivilegedContainer determines if a container can request
                  to be run as privileged.
                type: boolean
              allowedCapabilities:
                nullable: true
                description: AllowedCapabilities is a list of capabilities that can be requested
                  to add to the container. Capabilities in this field maybe added at the
                  pod author's discretion. You must not list a capability in both AllowedCapabilities
                  and RequiredDropCapabilities. To allow all capabilities you may use '*'.
                items:
                  type: string
                type: array
              allowedFlexVolumes:
                nullable: true
                description: AllowedFlexVolumes is a whitelist of allowed Flexvolumes.  Empty
                  or nil indicates that all Flexvolumes may be used.  This parameter is
                  effective only when the usage of the Flexvolumes is allowed in the "Volumes"
                  field.
                items:
                  properties:
                    driver:
                      description: Driver is the name of the Flexvolume driver.
                      type: string
                  type: object
                type: array
              allowedUnsafeSysctls:
                nullable: true
                description: 'AllowedUnsafeSysctls is a list of explicitly allowed unsafe
                  sysctls, defaults to none. Each entry is either a plain sysctl name or
                  ends in "*" in which case it is considered as a prefix of allowed sysctls.
                  Single * means all unsafe sysctls are allowed. Kubelet has to whitelist
                  all allowed unsafe sysctls explicitly to avoid rejection.  Examples: e.g.
                  "foo/*" allows "foo/bar", "foo/baz", etc. e.g. "foo.*" allows "foo.bar",
                  "foo.baz", etc.'
                items:
                  type: string
                type: array
              apiVersion:
                nullable: true
                description: 'APIVersion defines the versioned schema of this representation
                  of an object. Servers should convert recognized schemas to the latest
                  internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
                type: string
              defaultAddCapabilities:
                nullable: true
                description: DefaultAddCapabilities is the default set of capabilities that
                  will be added to the container unless the pod spec specifically drops
                  the capability.  You may not list a capabiility in both DefaultAddCapabilities
                  and RequiredDropCapabilities.
                items:
                  type: string
                type: array
              defaultAllowPrivilegeEscalation:
                nullable: true
                description: DefaultAllowPrivilegeEscalation controls the default setting
                  for whether a process can gain more privileges than its parent process.
                type: boolean
              forbiddenSysctls:
                nullable: true
                description: 'ForbiddenSysctls is a list of explicitly forbidden sysctls,
                  defaults to none. Each entry is either a plain sysctl name or ends in
                  "*" in which case it is considered as a prefix of forbidden sysctls. Single
                  * means all sysctls are forbidden.  Examples: e.g. "foo/*" forbids "foo/bar",
                  "foo/baz", etc. e.g. "foo.*" forbids "foo.bar", "foo.baz", etc.'
                items:
                  type: string
                type: array
              fsGroup:
                nullable: true
                description: FSGroup is the strategy that will dictate what fs group is
                  used by the SecurityContext.
                properties:
                  ranges:
                    nullable: true
                    description: Ranges are the allowed ranges of fs groups.  If you would
                      like to force a single fs group then supply a single range with the
                      same start and end.
                    items:
                      properties:
                        max:
                          description: Max is the end of the range, inclusive.
                          format: int64
                          type: integer
                        min:
                          description: Min is the start of the range, inclusive.
                          format: int64
                          type: integer
                      type: object
                    type: array
                  type:
                    nullable: true
                    description: Type is the strategy that will dictate what FSGroup is
                      used in the SecurityContext.
                    type: string
                type: object
              groups:
                nullable: true
                description: The groups that have permission to use this security context
                  constraints
                items:
                  type: string
                type: array
              kind:
                nullable: true
                description: 'Kind is a string value representing the REST resource this
                  object represents. Servers may infer this from the endpoint the client
                  submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
                type: string
              metadata:
                description: 'Standard object''s metadata. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata'
                type: object
              priority:
                nullable: true
                description: Priority influences the sort order of SCCs when evaluating
                  which SCCs to try first for a given pod request based on access in the
                  Users and Groups fields.  The higher the int, the higher priority. An
                  unset value is considered a 0 priority. If scores for multiple SCCs are
                  equal they will be sorted from most restrictive to least restrictive.
                  If both priorities and restrictions are equal the SCCs will be sorted
                  by name.
                format: int32
                type: integer
              readOnlyRootFilesystem:
                nullable: true
                description: ReadOnlyRootFilesystem when set to true will force containers
                  to run with a read only root file system.  If the container specifically
                  requests to run with a non-read only root file system the SCC should deny
                  the pod. If set to false the container may run with a read only root file
                  system if it wishes but it will not be forced to.
                type: boolean
              requiredDropCapabilities:
                nullable: true
                description: RequiredDropCapabilities are the capabilities that will be
                  dropped from the container.  These are required to be dropped and cannot
                  be added.
                items:
                  type: string
                type: array
              runAsUser:
                nullable: true
                description: RunAsUser is the strategy that will dictate what RunAsUser
                  is used in the SecurityContext.
                properties:
                  type:
                    nullable: true
                    description: Type is the strategy that will dictate what RunAsUser is
                      used in the SecurityContext.
                    type: string
                  uid:
                    nullable: true
                    description: UID is the user id that containers must run as.  Required
                      for the MustRunAs strategy if not using namespace/service account
                      allocated uids.
                    format: int64
                    type: integer
                  uidRangeMax:
                    nullable: true
                    description: UIDRangeMax defines the max value for a strategy that allocates
                      by range.
                    format: int64
                    type: integer
                  uidRangeMin:
                    nullable: true
                    description: UIDRangeMin defines the min value for a strategy that allocates
                      by range.
                    format: int64
                    type: integer
                type: object
              seLinuxContext:
                nullable: true
                description: SELinuxContext is the strategy that will dictate what labels
                  will be set in the SecurityContext.
                properties:
                  seLinuxOptions:
                    nullable: true
                    description: seLinuxOptions required to run as; required for MustRunAs
                    type: object
                  type:
                    nullable: true
                    description: Type is the strategy that will dictate what SELinux context
                      is used in the SecurityContext.
                    type: string
                type: object
              seccompProfiles:
                nullable: true
                description: "SeccompProfiles lists the allowed profiles that may be set
                  for the pod or container's seccomp annotations.  An unset (nil) or empty
                  value means that no profiles may be specifid by the pod or container.\tThe
                  wildcard '*' may be used to allow all profiles.  When used to generate
                  a value for a pod the first non-wildcard profile will be used as the default."
                items:
                  type: string
                type: array
              supplementalGroups:
                nullable: true
                description: SupplementalGroups is the strategy that will dictate what supplemental
                  groups are used by the SecurityContext.
                properties:
                  ranges:
                    nullable: true
                    description: Ranges are the allowed ranges of supplemental groups.  If
                      you would like to force a single supplemental group then supply a
                      single range with the same start and end.
                    items:
                      properties:
                        max:
                          description: Max is the end of the range, inclusive.
                          format: int64
                          type: integer
                        min:
                          description: Min is the start of the range, inclusive.
                          format: int64
                          type: integer
                      type: object
                    type: array
                  type:
                    nullable: true
                    description: Type is the strategy that will dictate what supplemental
                      groups is used in the SecurityContext.
                    type: string
                type: object
              users:
                nullable: true
                description: The users who have permissions to use this security context
                  constraints
                items:
                  type: string
                type: array
              volumes:
                nullable: true
                description: Volumes is a white list of allowed volume plugins.  FSType
                  corresponds directly with the field names of a VolumeSource (azureFile,
                  configMap, emptyDir).  To allow all volumes you may use "*". To allow
                  no volumes, set to ["none"].
                items:
                  type: string
                type: array
    apiservice-01_service.yaml: |
      apiVersion: v1
      kind: Service
      metadata:
        namespace: default
        name: openshift
      spec:
        type: ClusterIP
        clusterIP: None
        ports:
        - port: 443
          targetPort: 8444
    apiservice-02_endpoints.yaml: |
      apiVersion: v1
      kind: Endpoints
      metadata:
        namespace: default
        name: openshift
      subsets:
      - addresses:
        - ip: NON_LOOPBACK_HOST
        ports:
        - port: 8444
    apiservice-03_apiservice.yaml: |
      apiVersion: v1
      kind: List
      items:
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.apps.openshift.io
        spec:
          group: apps.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.authorization.openshift.io
        spec:
          group: authorization.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.build.openshift.io
        spec:
          group: build.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.image.openshift.io
        spec:
          group: image.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.oauth.openshift.io
        spec:
          group: oauth.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.project.openshift.io
        spec:
          group: project.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.quota.openshift.io
        spec:
          group: quota.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.route.openshift.io
        spec:
          group: route.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.security.openshift.io
        spec:
          group: security.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.template.openshift.io
        spec:
          group: template.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiregistration.k8s.io/v1
        kind: APIService
        metadata:
          name: v1.user.openshift.io
        spec:
          group: user.openshift.io
          version: v1
          service:
            namespace: default
            name: openshift
          insecureSkipTLSVerify: true
          groupPriorityMinimum: 20000
          versionPriority: 15
      - apiVersion: apiextensions.k8s.io/v1beta1
        kind: CustomResourceDefinition
        metadata:
          name: clusterresourcequotas.quota.openshift.io
        spec:
          group: quota.openshift.io
          names:
            kind: ClusterResourceQuota
            listKind: ClusterResourceQuotaList
            plural: clusterresourcequotas
            singular: clusterresourcequota
          scope: Cluster
          subresources:
            status: {}
          versions:
          - name: v1
            served: true
            storage: true
          validation:
            openAPIV3Schema:
              properties:
                apiVersion:
                  description: 'APIVersion defines the versioned schema of this representation
                    of an object. Servers should convert recognized schemas to the latest
                    internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
                  type: string
                kind:
                  description: 'Kind is a string value representing the REST resource this
                    object represents. Servers may infer this from the endpoint the client
                    submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
                  type: string
                metadata:
                  description: Standard object's metadata.
                  type: object
                spec:
                  description: Spec defines the desired quota
                  properties:
                    quota:
                      description: Quota defines the desired quota
                      type: object
                    selector:
                      description: Selector is the selector used to match projects. It should
                        only select active projects on the scale of dozens (though it can
                        select many more less active projects).  These projects will contend
                        on object creation through this resource.
                      properties:
                        annotations:
                          description: AnnotationSelector is used to select projects by annotation.
                          nullable: true
                          type: object
                        labels:
                          description: LabelSelector is used to select projects by label.
                          nullable: true
                          type: object
                      type: object
                  type: object
                status:
                  description: Status defines the actual enforced quota and its current usage
                  properties:
                    namespaces:
                      description: Namespaces slices the usage by project.  This division
                        allows for quick resolution of deletion reconciliation inside of a
                        single project without requiring a recalculation across all projects.  This
                        can be used to pull the deltas for a given project.
                      items:
                        properties:
                          namespace:
                            description: Namespace the project this status applies to
                            type: string
                          status:
                            description: Status indicates how many resources have been consumed
                              by this project
                            type: object
                        type: object
                      nullable: true
                      type: array
                    total:
                      description: Total defines the actual enforced quota and its current
                        usage across all projects
                      type: object
                  type: object
    kube-apiserver.yaml: |
      apiVersion: kubecontrolplane.config.openshift.io/v1
      kind: KubeAPIServerConfig
      aggregatorConfig:
        proxyClientInfo:
          certFile: client-kube-aggregator.crt
          keyFile: client-kube-aggregator.key
      apiServerArguments:
        storage-backend:
        - etcd3
        storage-media-type:
        - application/vnd.kubernetes.protobuf
        enable-aggregator-routing:
        - "true"
      authConfig:
        requestHeader:
          clientCA: client-kube-aggregator.crt
          clientCommonNames:
          - kube-apiserver-proxy
          - system:openshift-aggregator
          - system:kube-aggregator
          extraHeaderPrefixes:
          - X-Remote-Extra-
          groupHeaders:
          - X-Remote-Group
          usernameHeaders:
          - X-Remote-User
        webhookTokenAuthenticators: null
      corsAllowedOrigins:
      - //127\.0\.0\.1(:|$)
      - //localhost(:|$)
      kubeletClientInfo:
        ca: server-ca.crt
        certFile: client-kubelet.crt
        keyFile: client-kubelet.key
        port: 10250
      oauthConfig:
        alwaysShowProviderSelection: false
        assetPublicURL: https://127.0.0.1:8443
        grantConfig:
          method: auto
          serviceAccountMethod: prompt
        masterCA: server-ca.crt
        masterPublicURL: https://127.0.0.1:8443
        masterURL: https://127.0.0.1:8443
        sessionConfig:
          sessionMaxAgeSeconds: 300
          sessionName: ssn
          sessionSecretsFile: ""
        templates: null
        tokenConfig:
          accessTokenMaxAgeSeconds: 86400
          authorizeTokenMaxAgeSeconds: 300
        identityProviders:
        - name: alwaysallow
          challenge: true
          login: true
          mappingMethod: claim
          provider:
            apiVersion: osin.config.openshift.io/v1
            kind: AllowAllPasswordIdentityProvider
      serviceAccountPublicKeyFiles:
      - service-account
      servicesNodePortRange: 30000-32767
      servicesSubnet: 172.30.0.0/16 # ServiceCIDR
      servingInfo:
        bindAddress: 0.0.0.0:8443
        bindNetwork: tcp4
        certFile: serving-kube-apiserver.crt
        clientCA: client-ca.crt
        keyFile: serving-kube-apiserver.key
        maxRequestsInFlight: 1200
        namedCertificates: null
        requestTimeoutSeconds: 3600
      storageConfig:
        ca: etcd-serving-ca.crt
        certFile: client-etcd-client.crt
        keyFile: client-etcd-client.key
        urls:
        - https://127.0.0.1:2379
    openshift-apiserver.yaml: |+
      apiVersion: openshiftcontrolplane.config.openshift.io/v1
      kind: OpenShiftAPIServerConfig
      kubeClientConfig:
        kubeConfig: openshift-apiserver.kubeconfig
      apiServerArguments:
        storage-backend:
        - etcd3
        storage-media-type:
        - application/vnd.kubernetes.protobuf
      corsAllowedOrigins:
      - //127\.0\.0\.1(:|$)
      - //localhost(:|$)
      servingInfo:
        bindAddress: 0.0.0.0:8444
        bindNetwork: tcp4
        certFile: serving-openshift-apiserver.crt
        clientCA: client-ca.crt
        keyFile: serving-openshift-apiserver.key
        maxRequestsInFlight: 1200
        namedCertificates: null
        requestTimeoutSeconds: 3600
      storageConfig:
        ca: etcd-serving-ca.crt
        certFile: client-etcd-client.crt
        keyFile: client-etcd-client.key
        urls:
        - https://127.0.0.1:2379

    openshift-controller-manager.yaml: |
      apiVersion: openshiftcontrolplane.config.openshift.io/v1
      kind: OpenShiftControllerManagerConfig
      kubeClientConfig:
        kubeConfig: openshift-controller-manager.kubeconfig
      corsAllowedOrigins:
      - //127\.0\.0\.1(:|$)
      - //localhost(:|$)
      servingInfo:
        bindAddress: 0.0.0.0:8445
        bindNetwork: tcp4
        certFile: serving-openshift-controller-manager.crt
        clientCA: client-ca.crt
        keyFile: serving-openshift-controller-manager.key
        maxRequestsInFlight: 1200
        namedCertificates: null
        requestTimeoutSeconds: 3600
    start.sh: "#!/usr/bin/env bash\n\nset -euo pipefail\n\nbase=$(dirname \"${BASH_SOURCE[0]}\")\n\n#
      Controls verbosity of the script output and logging.\nKUBE_VERBOSE=\"${KUBE_VERBOSE:-5}\"\n\n#
      A set of helpers for starting/running etcd for tests\n\nETCD_VERSION=${ETCD_VERSION:-3.2.16}\nETCD_HOST=${ETCD_HOST:-127.0.0.1}\nETCD_PORT=${ETCD_PORT:-2379}\nexport
      KUBE_INTEGRATION_ETCD_URL=\"https://${ETCD_HOST}:${ETCD_PORT}\"\n\nlocal::master::etcd::validate()
      {\n  # validate if in path\n  command -v etcd >/dev/null || {\n    local::master::log::usage
      \"etcd must be in your PATH\"\n    local::master::log::info \"You can use 'hack/install-etcd.sh'
      to install a copy in third_party/.\"\n    exit 1\n  }\n\n  # validate etcd port
      is free\n  local port_check_command\n  if command -v ss &> /dev/null && ss -Version
      | grep 'iproute2' &> /dev/null; then\n    port_check_command=\"ss\"\n  elif command
      -v netstat &>/dev/null; then\n    port_check_command=\"netstat\"\n  else\n    local::master::log::usage
      \"unable to identify if etcd is bound to port ${ETCD_PORT}. unable to find ss
      or netstat utilities.\"\n    exit 1\n  fi\n  if ${port_check_command} -nat | grep
      \"LISTEN\" | grep \"[\\.:]${ETCD_PORT:?}\" >/dev/null 2>&1; then\n    local::master::log::usage
      \"unable to start etcd as port ${ETCD_PORT} is in use. please stop the process
      listening on this port and retry.\"\n    local::master::log::usage \"`netstat
      -nat | grep \"[\\.:]${ETCD_PORT:?} .*LISTEN\"`\"\n    exit 1\n  fi\n\n  # validate
      installed version is at least equal to minimum\n  version=$(etcd --version | tail
      -n +1 | head -n 1 | cut -d \" \" -f 3)\n  if [[ $(local::master::etcd::version
      $ETCD_VERSION) -gt $(local::master::etcd::version $version) ]]; then\n   hash
      etcd\n   echo $PATH\n   version=$(etcd --version | head -n 1 | cut -d \" \" -f
      3)\n   if [[ $(local::master::etcd::version $ETCD_VERSION) -gt $(local::master::etcd::version
      $version) ]]; then\n    local::master::log::usage \"etcd version ${ETCD_VERSION}
      or greater required.\"\n    exit 1\n   fi\n  fi\n}\n\nlocal::master::etcd::version()
      {\n  printf '%s\\n' \"${@}\" | awk -F . '{ printf(\"%d%03d%03d\\n\", $1, $2, $3)
      }'\n}\n\nlocal::master::etcd::start() {\n  # validate before running\n  local::master::etcd::validate\n\n
      \ # Start etcd\n  ETCD_DIR=${ETCD_DIR:-$(mktemp -d 2>/dev/null || mktemp -d -t
      test-etcd.XXXXXX)}\n  if [[ -d \"${ARTIFACTS_DIR:-}\" ]]; then\n    ETCD_LOGFILE=\"${ARTIFACTS_DIR}/etcd.$(uname
      -n).$(id -un).log.DEBUG.$(date +%Y%m%d-%H%M%S).$$\"\n  else\n    ETCD_LOGFILE=${ETCD_LOGFILE:-\"/dev/null\"}\n
      \ fi\n  local::master::log::info \"etcd --advertise-client-urls ${KUBE_INTEGRATION_ETCD_URL}
      --data-dir ${ETCD_DIR}/data --listen-client-urls http://${ETCD_HOST}:${ETCD_PORT}
      --debug > \\\"${ETCD_LOGFILE}\\\" 2>/dev/null\"\n  etcd --advertise-client-urls
      ${KUBE_INTEGRATION_ETCD_URL} --cert-file=${ETCD_DIR}/serving-etcd-server.crt --key-file=${ETCD_DIR}/serving-etcd-server.key
      --data-dir ${ETCD_DIR}/data --listen-client-urls ${KUBE_INTEGRATION_ETCD_URL}
      --debug 2> \"${ETCD_LOGFILE}\" >/dev/null &\n  ETCD_PID=$!\n\n  echo \"Waiting
      for etcd to come up.\"\n  local::master::util::wait_for_url \"${KUBE_INTEGRATION_ETCD_URL}/version\"
      \"etcdserver\" 0.25 80\n}\n\nlocal::master::etcd::stop() {\n  if [[ -n \"${ETCD_PID-}\"
      ]]; then\n    kill \"${ETCD_PID}\" &>/dev/null || :\n    wait \"${ETCD_PID}\"
      &>/dev/null || :\n  fi\n}\n\nlocal::master::etcd::clean_etcd_dir() {\n  if [[
      -n \"${ETCD_DIR-}\" ]]; then\n    rm -rf \"${ETCD_DIR}/data\"\n  fi\n}\n\nlocal::master::etcd::cleanup()
      {\n  local::master::etcd::stop\n  local::master::etcd::clean_etcd_dir\n}\n\nlocal::master::util::sortable_date()
      {\n  date \"+%Y%m%d-%H%M%S\"\n}\n\n# arguments: target, item1, item2, item3, ...\n#
      returns 0 if target is in the given items, 1 otherwise.\nlocal::master::util::array_contains()
      {\n  local search=\"$1\"\n  local element\n  shift\n  for element; do\n    if
      [[ \"${element}\" == \"${search}\" ]]; then\n      return 0\n     fi\n  done\n
      \ return 1\n}\n\nlocal::master::util::wait_for_url() {\n  local url=$1\n  local
      prefix=${2:-}\n  local wait=${3:-1}\n  local times=${4:-30}\n  local maxtime=${5:-1}\n\n
      \ which curl >/dev/null || {\n    local::master::log::usage \"curl must be installed\"\n
      \   exit 1\n  }\n\n  local i\n  for i in $(seq 1 \"$times\"); do\n    local out\n
      \   if out=$(curl --max-time \"$maxtime\" -gkfs \"$url\" 2>/dev/null); then\n
      \     local::master::log::status \"On try ${i}, ${prefix}: ${out}\"\n      return
      0\n    fi\n    sleep \"${wait}\"\n  done\n  local::master::log::error \"Timed
      out waiting for ${prefix} to answer at ${url}; tried ${times} waiting ${wait}
      between each\"\n  return 1\n}\n\n# Example:  local::master::util::trap_add 'echo
      \"in trap DEBUG\"' DEBUG\n# See: http://stackoverflow.com/questions/3338030/multiple-bash-traps-for-the-same-signal\nlocal::master::util::trap_add()
      {\n  local trap_add_cmd\n  trap_add_cmd=$1\n  shift\n\n  for trap_add_name in
      \"$@\"; do\n    local existing_cmd\n    local new_cmd\n\n    # Grab the currently
      defined trap commands for this trap\n    existing_cmd=`trap -p \"${trap_add_name}\"
      |  awk -F\"'\" '{print $2}'`\n\n    if [[ -z \"${existing_cmd}\" ]]; then\n      new_cmd=\"${trap_add_cmd}\"\n
      \   else\n      new_cmd=\"${trap_add_cmd};${existing_cmd}\"\n    fi\n\n    # Assign
      the test\n    trap \"${new_cmd}\" \"${trap_add_name}\"\n  done\n}\n\n# Opposite
      of local::master::util::ensure-temp-dir()\nlocal::master::util::cleanup-temp-dir()
      {\n  if [[ -n \"${KUBE_TEMP-}\" ]]; then\n    rm -rf \"${KUBE_TEMP}\"\n  fi\n}\n\n#
      Create a temp dir that'll be deleted at the end of this bash session.\n#\n# Vars
      set:\n#   KUBE_TEMP\nlocal::master::util::ensure-temp-dir() {\n  if [[ -z ${KUBE_TEMP-}
      ]]; then\n    KUBE_TEMP=$(mktemp -d 2>/dev/null || mktemp -d -t kubernetes.XXXXXX)\n
      \ fi\n}\n\n# This figures out the host platform without relying on golang.  We
      need this as\n# we don't want a golang install to be a prerequisite to building
      yet we need\n# this info to figure out where the final binaries are placed.\nlocal::master::util::host_platform()
      {\n  local host_os\n  local host_arch\n  case \"$(uname -s)\" in\n    Darwin)\n
      \     host_os=darwin\n      ;;\n    Linux)\n      host_os=linux\n      ;;\n    *)\n
      \     local::master::log::error \"Unsupported host OS.  Must be Linux or Mac OS
      X.\"\n      exit 1\n      ;;\n  esac\n\n  case \"$(uname -m)\" in\n    x86_64*)\n
      \     host_arch=amd64\n      ;;\n    i?86_64*)\n      host_arch=amd64\n      ;;\n
      \   amd64*)\n      host_arch=amd64\n      ;;\n    aarch64*)\n      host_arch=arm64\n
      \     ;;\n    arm64*)\n      host_arch=arm64\n      ;;\n    arm*)\n      host_arch=arm\n
      \     ;;\n    i?86*)\n      host_arch=x86\n      ;;\n    s390x*)\n      host_arch=s390x\n
      \     ;;\n    ppc64le*)\n      host_arch=ppc64le\n      ;;\n    *)\n      local::master::log::error
      \"Unsupported host arch. Must be x86_64, 386, arm, arm64, s390x or ppc64le.\"\n
      \     exit 1\n      ;;\n  esac\n  echo \"${host_os}/${host_arch}\"\n}\n\n# Test
      whether openssl is installed.\n# Sets:\n#  OPENSSL_BIN: The path to the openssl
      binary to use\nfunction local::master::util::test_openssl_installed {\n    openssl
      version >& /dev/null\n    if [ \"$?\" != \"0\" ]; then\n      echo \"Failed to
      run openssl. Please ensure openssl is installed\"\n      exit 1\n    fi\n\n    OPENSSL_BIN=$(command
      -v openssl)\n}\n\n# creates a client CA, args are sudo, dest-dir, ca-id, purpose\n#
      purpose is dropped in after \"key encipherment\", you usually want\n# '\"client
      auth\"'\n# '\"server auth\"'\n# '\"client auth\",\"server auth\"'\nfunction local::master::util::create_signing_certkey
      {\n    local sudo=$1\n    local dest_dir=$2\n    local id=$3\n    local purpose=$4\n
      \   # Create client ca\n    /usr/bin/env bash -e <<EOF\n    rm -f \"${dest_dir}/${id}-ca.crt\"
      \"${dest_dir}/${id}-ca.key\"\n    ${OPENSSL_BIN} req -x509 -sha256 -new -nodes
      -days 365 -newkey rsa:2048 -keyout \"${dest_dir}/${id}-ca.key\" -out \"${dest_dir}/${id}-ca.crt\"
      -subj \"/C=xx/ST=x/L=x/O=x/OU=x/CN=ca/emailAddress=x/\"\n    echo '{\"signing\":{\"default\":{\"expiry\":\"43800h\",\"usages\":[\"signing\",\"key
      encipherment\",${purpose}]}}}' > \"${dest_dir}/${id}-ca-config.json\"\nEOF\n}\n\n#
      signs a client certificate: args are sudo, dest-dir, CA, filename (roughly), username,
      groups...\nfunction local::master::util::create_client_certkey {\n    local sudo=$1\n
      \   local dest_dir=$2\n    local ca=$3\n    local id=$4\n    local cn=${5:-$4}\n
      \   local groups=\"\"\n    local SEP=\"\"\n    shift 5\n    while [ -n \"${1:-}\"
      ]; do\n        groups+=\"${SEP}{\\\"O\\\":\\\"$1\\\"}\"\n        SEP=\",\"\n        shift
      1\n    done\n    /usr/bin/env bash -e <<EOF\n    cd ${dest_dir}\n    echo '{\"CN\":\"${cn}\",\"names\":[${groups}],\"hosts\":[\"\"],\"key\":{\"algo\":\"rsa\",\"size\":2048}}'
      | ${CFSSL_BIN} gencert -ca=${ca}.crt -ca-key=${ca}.key -config=${ca}-config.json
      - | ${CFSSLJSON_BIN} -bare client-${id}\n    mv \"client-${id}-key.pem\" \"client-${id}.key\"\n
      \   mv \"client-${id}.pem\" \"client-${id}.crt\"\n    rm -f \"client-${id}.csr\"\nEOF\n}\n\n#
      signs a serving certificate: args are sudo, dest-dir, ca, filename (roughly),
      subject, hosts...\nfunction local::master::util::create_serving_certkey {\n    local
      sudo=$1\n    local dest_dir=$2\n    local ca=$3\n    local id=$4\n    local cn=${5:-$4}\n
      \   local hosts=\"\"\n    local SEP=\"\"\n    shift 5\n    while [ -n \"${1:-}\"
      ]; do\n        hosts+=\"${SEP}\\\"$1\\\"\"\n        SEP=\",\"\n        shift 1\n
      \   done\n    /usr/bin/env bash -e <<EOF\n    cd ${dest_dir}\n    echo '{\"CN\":\"${cn}\",\"hosts\":[${hosts}],\"key\":{\"algo\":\"rsa\",\"size\":2048}}'
      | ${CFSSL_BIN} gencert -ca=${ca}.crt -ca-key=${ca}.key -config=${ca}-config.json
      - | ${CFSSLJSON_BIN} -bare serving-${id}\n    mv \"serving-${id}-key.pem\" \"serving-${id}.key\"\n
      \   mv \"serving-${id}.pem\" \"serving-${id}.crt\"\n    rm -f \"serving-${id}.csr\"\nEOF\n}\n\n#
      creates a self-contained kubeconfig: args are sudo, dest-dir, ca file, host, port,
      client id, token(optional)\nfunction local::master::util::write_client_kubeconfig
      {\n    local sudo=$1\n    local dest_dir=$2\n    local ca_file=$3\n    local api_host=$4\n
      \   local api_port=$5\n    local client_id=$6\n    local token=${7:-}\n    cat
      <<EOF | tee \"${dest_dir}\"/${client_id}.kubeconfig > /dev/null\napiVersion: v1\nkind:
      Config\nclusters:\n  - cluster:\n      certificate-authority: ${ca_file}\n      server:
      https://${api_host}:${api_port}\n    name: localhost:8443\nusers:\n  - user:\n
      \     token: ${token}\n      client-certificate: ${dest_dir}/client-${client_id}.crt\n
      \     client-key: ${dest_dir}/client-${client_id}.key\n    name: system:admin/localhost:8443\ncontexts:\n
      \ - context:\n      cluster: localhost:8443\n      user: system:admin/localhost:8443\n
      \   name: /localhost:8443/system:admin\ncurrent-context: /localhost:8443/system:admin\nEOF\n\n
      \   # flatten the kubeconfig files to make them self contained\n    username=$(id
      -u)\n    /usr/bin/env bash -e <<EOF\n    oc --config=\"${dest_dir}/${client_id}.kubeconfig\"
      config view --minify --flatten > \"/tmp/${client_id}.kubeconfig\"\n    mv -f \"/tmp/${client_id}.kubeconfig\"
      \"${dest_dir}/${client_id}.kubeconfig\"\n    chown ${username} \"${dest_dir}/${client_id}.kubeconfig\"\nEOF\n}\n\n#
      Wait for background jobs to finish. Return with\n# an error status if any of the
      jobs failed.\nlocal::master::util::wait-for-jobs() {\n  local fail=0\n  local
      job\n  for job in $(jobs -p); do\n    wait \"${job}\" || fail=$((fail + 1))\n
      \ done\n  return ${fail}\n}\n\n# local::master::util::join <delim> <list...>\n#
      Concatenates the list elements with the delimiter passed as first parameter\n#\n#
      Ex: local::master::util::join , a b c\n#  -> a,b,c\nfunction local::master::util::join
      {\n  local IFS=\"$1\"\n  shift\n  echo \"$*\"\n}\n\n# Downloads cfssl/cfssljson
      into $1 directory if they do not already exist in PATH\n#\n# Assumed vars:\n#
      \  $1 (cfssl directory) (optional)\n#\n# Sets:\n#  CFSSL_BIN: The path of the
      installed cfssl binary\n#  CFSSLJSON_BIN: The path of the installed cfssljson
      binary\n#\nfunction local::master::util::ensure-cfssl {\n  if command -v cfssl
      &>/dev/null && command -v cfssljson &>/dev/null; then\n    CFSSL_BIN=$(command
      -v cfssl)\n    CFSSLJSON_BIN=$(command -v cfssljson)\n    return 0\n  fi\n\n  #
      Create a temp dir for cfssl if no directory was given\n  local cfssldir=${1:-}\n
      \ if [[ -z \"${cfssldir}\" ]]; then\n    local::master::util::ensure-temp-dir\n
      \   cfssldir=\"${KUBE_TEMP}/cfssl\"\n  fi\n\n  mkdir -p \"${cfssldir}\"\n  pushd
      \"${cfssldir}\" > /dev/null\n\n    echo \"Unable to successfully run 'cfssl' from
      $PATH; downloading instead...\"\n    kernel=$(uname -s)\n    case \"${kernel}\"
      in\n      Linux)\n        curl --retry 10 -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64\n
      \       curl --retry 10 -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64\n
      \       ;;\n      Darwin)\n        curl --retry 10 -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_darwin-amd64\n
      \       curl --retry 10 -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_darwin-amd64\n
      \       ;;\n      *)\n        echo \"Unknown, unsupported platform: ${kernel}.\"
      >&2\n        echo \"Supported platforms: Linux, Darwin.\" >&2\n        exit 2\n
      \   esac\n\n    chmod +x cfssl || true\n    chmod +x cfssljson || true\n\n    CFSSL_BIN=\"${cfssldir}/cfssl\"\n
      \   CFSSLJSON_BIN=\"${cfssldir}/cfssljson\"\n    if [[ ! -x ${CFSSL_BIN} || !
      -x ${CFSSLJSON_BIN} ]]; then\n      echo \"Failed to download 'cfssl'. Please
      install cfssl and cfssljson and verify they are in \\$PATH.\"\n      echo \"Hint:
      export PATH=\\$PATH:\\$GOPATH/bin; go get -u github.com/cloudflare/cfssl/cmd/...\"\n
      \     exit 1\n    fi\n  popd > /dev/null\n}\n\n# local::master::util::ensure_dockerized\n#
      Confirms that the script is being run inside a kube-build image\n#\nfunction local::master::util::ensure_dockerized
      {\n  if [[ -f /kube-build-image ]]; then\n    return 0\n  else\n    echo \"ERROR:
      This script is designed to be run inside a kube-build container\"\n    exit 1\n
      \ fi\n}\n\n# local::master::util::ensure-gnu-sed\n# Determines which sed binary
      is gnu-sed on linux/darwin\n#\n# Sets:\n#  SED: The name of the gnu-sed binary\n#\nfunction
      local::master::util::ensure-gnu-sed {\n  if LANG=C sed --help 2>&1 | grep -q GNU;
      then\n    SED=\"sed\"\n  elif which gsed &>/dev/null; then\n    SED=\"gsed\"\n
      \ else\n    local::master::log::error \"Failed to find GNU sed as sed or gsed.
      If you are on Mac: brew install gnu-sed.\" >&2\n    return 1\n  fi\n}\n\n# Some
      useful colors.\nif [[ -z \"${color_start-}\" ]]; then\n  declare -r color_start=\"\\033[\"\n
      \ declare -r color_red=\"${color_start}0;31m\"\n  declare -r color_yellow=\"${color_start}0;33m\"\n
      \ declare -r color_green=\"${color_start}0;32m\"\n  declare -r color_blue=\"${color_start}1;34m\"\n
      \ declare -r color_cyan=\"${color_start}1;36m\"\n  declare -r color_norm=\"${color_start}0m\"\nfi\n\n#
      Handler for when we exit automatically on an error.\n# Borrowed from https://gist.github.com/ahendrix/7030300\nlocal::master::log::errexit()
      {\n  local err=\"${PIPESTATUS[@]}\"\n\n  # If the shell we are in doesn't have
      errexit set (common in subshells) then\n  # don't dump stacks.\n  set +o | grep
      -qe \"-o errexit\" || return\n\n  set +o xtrace\n  local code=\"${1:-1}\"\n  #
      Print out the stack trace described by $function_stack  \n  if [ ${#FUNCNAME[@]}
      -gt 2 ]\n  then\n    local::master::log::error \"Call tree:\"\n    for ((i=1;i<${#FUNCNAME[@]}-1;i++))\n
      \   do\n      local::master::log::error \" $i: ${BASH_SOURCE[$i+1]}:${BASH_LINENO[$i]}
      ${FUNCNAME[$i]}(...)\"\n    done\n  fi  \n  local::master::log::error_exit \"Error
      in ${BASH_SOURCE[1]}:${BASH_LINENO[0]}. '${BASH_COMMAND}' exited with status $err\"
      \"${1:-1}\" 1\n}\n\n# Print out the stack trace\n#\n# Args:\n#   $1 The number
      of stack frames to skip when printing.\nlocal::master::log::stack() {\n  local
      stack_skip=${1:-0}\n  stack_skip=$((stack_skip + 1))\n  if [[ ${#FUNCNAME[@]}
      -gt $stack_skip ]]; then\n    echo \"Call stack:\" >&2\n    local i\n    for ((i=1
      ; i <= ${#FUNCNAME[@]} - $stack_skip ; i++))\n    do\n      local frame_no=$((i
      - 1 + stack_skip))\n      local source_file=${BASH_SOURCE[$frame_no]}\n      local
      source_lineno=${BASH_LINENO[$((frame_no - 1))]}\n      local funcname=${FUNCNAME[$frame_no]}\n
      \     echo \"  $i: ${source_file}:${source_lineno} ${funcname}(...)\" >&2\n    done\n
      \ fi\n}\n\n# Log an error and exit.\n# Args:\n#   $1 Message to log with the error\n#
      \  $2 The error code to return\n#   $3 The number of stack frames to skip when
      printing.\nlocal::master::log::error_exit() {\n  local message=\"${1:-}\"\n  local
      code=\"${2:-1}\"\n  local stack_skip=\"${3:-0}\"\n  stack_skip=$((stack_skip +
      1))\n\n  if [[ ${KUBE_VERBOSE} -ge 4 ]]; then\n    local source_file=${BASH_SOURCE[$stack_skip]}\n
      \   local source_line=${BASH_LINENO[$((stack_skip - 1))]}\n    echo \"!!! Error
      in ${source_file}:${source_line}\" >&2\n    [[ -z ${1-} ]] || {\n      echo \"
      \ ${1}\" >&2\n    }\n\n    local::master::log::stack $stack_skip\n\n    echo \"Exiting
      with status ${code}\" >&2\n  fi\n\n  exit \"${code}\"\n}\n\n# Log an error but
      keep going.  Don't dump the stack or exit.\nlocal::master::log::error() {\n  timestamp=$(date
      +\"[%m%d %H:%M:%S]\")\n  echo \"!!! $timestamp ${1-}\" >&2\n  shift\n  for message;
      do\n    echo \"    $message\" >&2\n  done\n}\n\n# Print an usage message to stderr.
      \ The arguments are printed directly.\nlocal::master::log::usage() {\n  echo >&2\n
      \ local message\n  for message; do\n    echo \"$message\" >&2\n  done\n  echo
      >&2\n}\n\nlocal::master::log::usage_from_stdin() {\n  local messages=()\n  while
      read -r line; do\n    messages+=(\"$line\")\n  done\n\n  local::master::log::usage
      \"${messages[@]}\"\n}\n\n# Print out some info that isn't a top level status line\nlocal::master::log::info()
      {\n  local V=\"${V:-0}\"\n  if [[ $KUBE_VERBOSE < $V ]]; then\n    return\n  fi\n\n
      \ for message; do\n    echo \"$message\"\n  done\n}\n\n# Just like local::master::log::info,
      but no \\n, so you can make a progress bar\nlocal::master::log::progress() {\n
      \ for message; do\n    echo -e -n \"$message\"\n  done\n}\n\nlocal::master::log::info_from_stdin()
      {\n  local messages=()\n  while read -r line; do\n    messages+=(\"$line\")\n
      \ done\n\n  local::master::log::info \"${messages[@]}\"\n}\n\n# Print a status
      line.  Formatted to show up in a stream of output.\nlocal::master::log::status()
      {\n  local V=\"${V:-0}\"\n  if [[ $KUBE_VERBOSE < $V ]]; then\n    return\n  fi\n\n
      \ timestamp=$(date +\"[%m%d %H:%M:%S]\")\n  echo \"+++ $timestamp $1\"\n  shift\n
      \ for message; do\n    echo \"    $message\"\n  done\n}\n\n# preserve etcd data.
      you also need to set ETCD_DIR.\nPRESERVE_ETCD=\"${PRESERVE_ETCD:-false}\"\nAPI_PORT=${API_PORT:-8443}\nAPI_SECURE_PORT=${API_SECURE_PORT:-8443}\n\n#
      WARNING: For DNS to work on most setups you should export API_HOST as the docker0
      ip address,\nAPI_HOST=${API_HOST:-localhost}\nAPI_HOST_IP=${API_HOST_IP:-\"127.0.0.1\"}\nADVERTISE_ADDRESS=${ADVERTISE_ADDRESS:-\"\"}\nFIRST_SERVICE_CLUSTER_IP=${FIRST_SERVICE_CLUSTER_IP:-10.0.0.1}\nHOSTNAME_OVERRIDE=${HOSTNAME_OVERRIDE:-\"127.0.0.1\"}\nCONTROLPLANE_SUDO=\nLOG_LEVEL=${LOG_LEVEL:-3}\n#
      Use to increase verbosity on particular files, e.g. LOG_SPEC=token_controller*=5,other_controller*=4\nLOG_SPEC=${LOG_SPEC:-\"\"}\nWAIT_FOR_URL_API_SERVER=${WAIT_FOR_URL_API_SERVER:-60}\nMAX_TIME_FOR_URL_API_SERVER=${MAX_TIME_FOR_URL_API_SERVER:-1}\n\nfunction
      local::master::cleanup() {\n  local::master::log::info \"Cleaning up...\"\n\n
      \ set +e\n\n  # cleanup temp dirs\n  local::master::util::cleanup-temp-dir\n\n
      \ jobs -p | xargs -L1 kill 2>/dev/null\n  sleep 1\n  # etcd requires two sigterms,
      ensure we get at least a partial shutdown (bug in 3.3.9?)\n  jobs -p | xargs -L1
      kill 2>/dev/null\n  wait\n\n  local::master::ensure_free_port 10252\n  local::master::ensure_free_port
      2379\n\n  local::master::log::info \"Cleanup complete\"\n}\n\nfunction local::master::cleanup_config()
      {\n    rm -rf ${LOCALUP_CONFIG}\n}\n\nfunction local::master::ensure_free_port()
      {\n  # checking for free ports is a convenience to the user\n  if ! which nc &>/dev/null;
      then\n    return 0\n  fi\n  if nc 127.0.0.1 $1 </dev/null 2>/dev/null; then\n
      \   local::master::log::error \"port $1 already in use\"\n    return 1\n  fi\n}\n\n#
      Check if all processes are still running. Prints a warning once each time\n# a
      process dies unexpectedly.\nfunction local::master::healthcheck() {\n  if [[ -n
      \"${KUBE_APISERVER_PID-}\" ]] && ! kill -0 ${KUBE_APISERVER_PID} 2>/dev/null;
      then\n    local::master::log::error \"API server terminated unexpectedly, see
      ${KUBE_APISERVER_LOG}\"\n    KUBE_APISERVER_PID=\n  fi\n\n  if [[ -n \"${KUBE_CONTROLLER_MANAGER_PID-}\"
      ]] && ! kill -0 ${KUBE_CONTROLLER_MANAGER_PID} 2>/dev/null; then\n    local::master::log::error
      \"kube-controller-manager terminated unexpectedly, see ${KUBE_CONTROLLER_MANAGER_LOG}\"\n
      \   KUBE_CONTROLLER_MANAGER_PID=\n  fi\n\n  if [[ -n \"${OPENSHIFT_APISERVER_PID-}\"
      ]] && ! kill -0 ${OPENSHIFT_APISERVER_PID} 2>/dev/null; then\n    local::master::log::error
      \"API server terminated unexpectedly, see ${OPENSHIFT_APISERVER_LOG}\"\n    OPENSHIFT_APISERVER_PID=\n
      \ fi\n\n  if [[ -n \"${OPENSHIFT_CONTROLLER_MANAGER_PID-}\" ]] && ! kill -0 ${OPENSHIFT_CONTROLLER_MANAGER_PID}
      2>/dev/null; then\n    local::master::log::error \"kube-controller-manager terminated
      unexpectedly, see ${OPENSHIFT_CONTROLLER_MANAGER_LOG}\"\n    OPENSHIFT_CONTROLLER_MANAGER_PID=\n
      \ fi\n\n\n  if [[ -n \"${ETCD_PID-}\" ]] && ! kill -0 ${ETCD_PID} 2>/dev/null;
      then\n    local::master::log::error \"etcd terminated unexpectedly\"\n    ETCD_PID=\n
      \ fi\n}\n\nfunction local::master::generate_etcd_certs() {\n    # Create CA signers\n
      \   local::master::util::create_signing_certkey \"${CONTROLPLANE_SUDO}\" \"${ETCD_DIR}\"
      server '\"client auth\",\"server auth\"'\n    cp \"${ETCD_DIR}/server-ca.key\"
      \"${ETCD_DIR}/client-ca.key\"\n    cp \"${ETCD_DIR}/server-ca.crt\" \"${ETCD_DIR}/client-ca.crt\"\n
      \   cp \"${ETCD_DIR}/server-ca-config.json\" \"${ETCD_DIR}/client-ca-config.json\"\n\n
      \   # Create client certs signed with client-ca, given id, given CN and a number
      of groups\n    local::master::util::create_client_certkey \"${CONTROLPLANE_SUDO}\"
      \"${ETCD_DIR}\" 'client-ca' etcd-client etcd-clients\n\n    # Create matching
      certificates for kube-aggregator\n    local::master::util::create_serving_certkey
      \"${CONTROLPLANE_SUDO}\" \"${ETCD_DIR}\" \"server-ca\" etcd-server \"localhost\"
      \"127.0.0.1\" ${API_HOST_IP}\n}\n\nfunction local::master::generate_kubeapiserver_certs()
      {\n    openssl genrsa -out \"${CERT_DIR}/service-account\" 2048 2>/dev/null\n\n
      \   # Create CA signers\n    local::master::util::create_signing_certkey \"${CONTROLPLANE_SUDO}\"
      \"${CERT_DIR}\" server '\"client auth\",\"server auth\"'\n    cp \"${CERT_DIR}/server-ca.key\"
      \"${CERT_DIR}/client-ca.key\"\n    cp \"${CERT_DIR}/server-ca.crt\" \"${CERT_DIR}/client-ca.crt\"\n
      \   cp \"${CERT_DIR}/server-ca-config.json\" \"${CERT_DIR}/client-ca-config.json\"\n\n
      \   # Create auth proxy client ca\n    local::master::util::create_signing_certkey
      \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\" request-header '\"client auth\"'\n\n
      \   # serving cert for kube-apiserver\n    local::master::util::create_serving_certkey
      \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\" \"server-ca\" kube-apiserver kubernetes.default
      kubernetes.default.svc \"localhost\" ${API_HOST_IP} ${API_HOST} ${FIRST_SERVICE_CLUSTER_IP}\n\n
      \   # Create client certs signed with client-ca, given id, given CN and a number
      of groups\n    local::master::util::create_client_certkey \"${CONTROLPLANE_SUDO}\"
      \"${CERT_DIR}\" 'client-ca' kubelet system:node:${HOSTNAME_OVERRIDE} system:nodes\n
      \   local::master::util::create_client_certkey \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\"
      'client-ca' controller system:kube-controller-manager\n    local::master::util::create_client_certkey
      \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\" 'client-ca' admin system:admin system:masters\n
      \   local::master::util::create_client_certkey \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\"
      'client-ca' openshift-apiserver openshift-apiserver system:masters\n    local::master::util::create_client_certkey
      \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\" 'client-ca' openshift-controller-manager
      openshift-controller-manager system:masters\n\n    # Create matching certificates
      for kube-aggregator\n    local::master::util::create_serving_certkey \"${CONTROLPLANE_SUDO}\"
      \"${CERT_DIR}\" \"server-ca\" kube-aggregator api.kube-public.svc \"localhost\"
      ${API_HOST_IP}\n    local::master::util::create_client_certkey \"${CONTROLPLANE_SUDO}\"
      \"${CERT_DIR}\" request-header-ca auth-proxy system:auth-proxy\n    # TODO remove
      masters and add rolebinding\n    local::master::util::create_client_certkey \"${CONTROLPLANE_SUDO}\"
      \"${CERT_DIR}\" 'client-ca' kube-aggregator system:kube-aggregator system:masters\n
      \   local::master::util::write_client_kubeconfig \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\"
      \"${ROOT_CA_FILE}\" \"${API_HOST}\" \"${API_SECURE_PORT}\" kube-aggregator\n\n
      \   cp ${ETCD_DIR}/server-ca.crt ${CERT_DIR}/etcd-serving-ca.crt\n    cp ${ETCD_DIR}/client-etcd-client.crt
      ${CERT_DIR}/client-etcd-client.crt\n    cp ${ETCD_DIR}/client-etcd-client.key
      ${CERT_DIR}/client-etcd-client.key\n}\n\nfunction local::master::generate_kubecontrollermanager_certs()
      {\n    cp ${LOCALUP_CONFIG}/kube-apiserver/service-account ${LOCALUP_CONFIG}/kube-controller-manager/etcd-serving-ca.crt\n
      \   cp ${LOCALUP_CONFIG}/kube-apiserver/client-controller.crt ${LOCALUP_CONFIG}/kube-controller-manager/client-controller.crt\n
      \   cp ${LOCALUP_CONFIG}/kube-apiserver/client-controller.key ${LOCALUP_CONFIG}/kube-controller-manager/client-controller.key\n
      \   local::master::util::write_client_kubeconfig \"${CONTROLPLANE_SUDO}\" \"${LOCALUP_CONFIG}/kube-controller-manager\"
      \"${ROOT_CA_FILE}\" \"${API_HOST}\" \"${API_SECURE_PORT}\" controller\n}\n\nfunction
      local::master::generate_openshiftapiserver_certs() {\n    # Create CA signers\n
      \   local::master::util::create_signing_certkey \"${CONTROLPLANE_SUDO}\" \"${LOCALUP_CONFIG}/openshift-apiserver\"
      server '\"client auth\",\"server auth\"'\n\n    # serving cert for kube-apiserver\n
      \   local::master::util::create_serving_certkey \"${CONTROLPLANE_SUDO}\" \"${LOCALUP_CONFIG}/openshift-apiserver\"
      \"server-ca\" openshift-apiserver openshift.default openshift.default.svc \"localhost\"
      ${API_HOST_IP} ${API_HOST} ${FIRST_SERVICE_CLUSTER_IP}\n\n    cp ${LOCALUP_CONFIG}/kube-apiserver/client-openshift-apiserver.crt
      ${LOCALUP_CONFIG}/openshift-apiserver/client-openshift-apiserver.crt\n    cp ${LOCALUP_CONFIG}/kube-apiserver/client-openshift-apiserver.key
      ${LOCALUP_CONFIG}/openshift-apiserver/client-openshift-apiserver.key\n    local::master::util::write_client_kubeconfig
      \"${CONTROLPLANE_SUDO}\" \"${LOCALUP_CONFIG}/openshift-apiserver\" \"${ROOT_CA_FILE}\"
      \"${API_HOST}\" \"${API_SECURE_PORT}\" openshift-apiserver\n\n    cp ${ETCD_DIR}/server-ca.crt
      ${LOCALUP_CONFIG}/openshift-apiserver/etcd-serving-ca.crt\n    cp ${ETCD_DIR}/client-etcd-client.crt
      ${LOCALUP_CONFIG}/openshift-apiserver/client-etcd-client.crt\n    cp ${ETCD_DIR}/client-etcd-client.key
      ${LOCALUP_CONFIG}/openshift-apiserver/client-etcd-client.key\n}\n\nfunction local::master::generate_openshiftcontrollermanager_certs()
      {\n    # Create CA signers\n    local::master::util::create_signing_certkey \"${CONTROLPLANE_SUDO}\"
      \"${LOCALUP_CONFIG}/openshift-controller-manager\" server '\"client auth\",\"server
      auth\"'\n\n    # serving cert for kube-apiserver\n    local::master::util::create_serving_certkey
      \"${CONTROLPLANE_SUDO}\" \"${LOCALUP_CONFIG}/openshift-controller-manager\" \"server-ca\"
      openshift-controller-manager openshift.default openshift.default.svc \"localhost\"
      ${API_HOST_IP} ${API_HOST} ${FIRST_SERVICE_CLUSTER_IP}\n\n    cp ${LOCALUP_CONFIG}/kube-apiserver/client-ca.crt
      ${LOCALUP_CONFIG}/openshift-controller-manager/client-ca.crt\n    cp ${LOCALUP_CONFIG}/kube-apiserver/client-openshift-controller-manager.crt
      ${LOCALUP_CONFIG}/openshift-controller-manager/client-openshift-controller-manager.crt\n
      \   cp ${LOCALUP_CONFIG}/kube-apiserver/client-openshift-controller-manager.key
      ${LOCALUP_CONFIG}/openshift-controller-manager/client-openshift-controller-manager.key\n
      \   local::master::util::write_client_kubeconfig \"${CONTROLPLANE_SUDO}\" \"${LOCALUP_CONFIG}/openshift-controller-manager\"
      \"${ROOT_CA_FILE}\" \"${API_HOST}\" \"${API_SECURE_PORT}\" openshift-controller-manager\n}\n\nfunction
      local::master::start_etcd() {\n    if [ ! -d \"${LOCALUP_CONFIG}/etcd\" ]; then\n
      \       mkdir -p ${LOCALUP_CONFIG}/etcd\n        local::master::generate_etcd_certs\n
      \   fi\n    local::master::log::info \"Starting etcd\"\n    ETCD_LOGFILE=${LOG_DIR}/etcd.log\n
      \   local::master::etcd::start\n}\n\nfunction local::master::start_kubeapiserver()
      {\n    if [ ! -d \"${LOCALUP_CONFIG}/kube-apiserver\" ]; then\n        mkdir -p
      ${LOCALUP_CONFIG}/kube-apiserver\n        cp ${base}/kube-apiserver.yaml ${LOCALUP_CONFIG}/kube-apiserver\n
      \       local::master::generate_kubeapiserver_certs\n    fi\n\n    KUBE_APISERVER_LOG=${LOG_DIR}/kube-apiserver.log\n
      \   hypershift openshift-kube-apiserver \\\n      --v=${LOG_LEVEL} \\\n      --vmodule=\"${LOG_SPEC}\"
      \\\n      --config=${LOCALUP_CONFIG}/kube-apiserver/kube-apiserver.yaml >\"${KUBE_APISERVER_LOG}\"
      2>&1 &\n    KUBE_APISERVER_PID=$!\n\n    # Wait for kube-apiserver to come up
      before launching the rest of the components.\n    local::master::log::info \"Waiting
      for kube-apiserver to come up\"\n    local::master::util::wait_for_url \"https://${API_HOST_IP}:${API_SECURE_PORT}/healthz\"
      \"kube-apiserver: \" 1 ${WAIT_FOR_URL_API_SERVER} ${MAX_TIME_FOR_URL_API_SERVER}
      \\\n        || { local::master::log::error \"check kube-apiserver logs: ${KUBE_APISERVER_LOG}\"
      ; exit 1 ; }\n\n    # Create kubeconfigs for all components, using client certs\n
      \   local::master::util::write_client_kubeconfig \"${CONTROLPLANE_SUDO}\" \"${CERT_DIR}\"
      \"${ROOT_CA_FILE}\" \"${API_HOST}\" \"${API_SECURE_PORT}\" admin\n    chown \"${USER:-$(id
      -u)}\" \"${CERT_DIR}/client-admin.key\" # make readable for kubectl\n\n    # the
      apiservice requires an endpoint, which may not be a loopback address\n    public_address=${API_HOST_IP:-}\n
      \   if [[ -z \"${public_address}\" || \"${public_address}\" == \"127.0.0.1\" ]];
      then\n      public_address=$( ifconfig | sed -En 's/127.0.0.1//;s/.*inet (addr:)?(([0-9]*\\.){3}[0-9]*).*/\\2/p'
      | head -1 )\n    fi\n    for filename in ${base}/apiservice-*.yaml; do\n        sed
      \"s/NON_LOOPBACK_HOST/${public_address}/g\" ${filename} | oc --config=${LOCALUP_CONFIG}/kube-apiserver/admin.kubeconfig
      apply -f -\n    done\n}\n\nfunction local::master::start_kubecontrollermanager()
      {\n    if [ ! -d \"${LOCALUP_CONFIG}/kube-controller-manager\" ]; then\n        mkdir
      -p ${LOCALUP_CONFIG}/kube-controller-manager\n        local::master::generate_kubecontrollermanager_certs\n
      \   fi\n\n    KUBE_CONTROLLER_MANAGER_LOG=${LOG_DIR}/kube-controller-manager.log\n
      \   hyperkube controller-manager \\\n      --v=${LOG_LEVEL} \\\n      --vmodule=\"${LOG_SPEC}\"
      \\\n      --cert-dir=\"${CERT_DIR}\" \\\n      --service-account-private-key-file=\"${LOCALUP_CONFIG}/kube-controller-manager/etcd-serving-ca.crt\"
      \\\n      --root-ca-file=\"${ROOT_CA_FILE}\" \\\n      --kubeconfig  ${LOCALUP_CONFIG}/kube-controller-manager/controller.kubeconfig
      \\\n      --use-service-account-credentials \\\n      --leader-elect=false >\"${KUBE_CONTROLLER_MANAGER_LOG}\"
      2>&1 &\n    KUBE_CONTROLLER_MANAGER_PID=$!\n\n    local::master::log::info \"Waiting
      for kube-controller-manager to come up\"\n    local::master::util::wait_for_url
      \"http://localhost:10252/healthz\" \"kube-controller-manager: \" 1 ${WAIT_FOR_URL_API_SERVER}
      ${MAX_TIME_FOR_URL_API_SERVER} \\\n        || { local::master::log::error \"check
      kube-controller-manager logs: ${KUBE_CONTROLLER_MANAGER_LOG}\" ; exit 1 ; }\n\n
      \   # we need SCCs as they are part of the OpenShift apiserver bootstrap process\n
      \   echo \"Waiting for the SCCs to appear\"\n    tstamp=$(date +%s)\n    set +e\n
      \   while (( $(date +%s) - $tstamp < 160 )); do\n        oc get --config=\"${LOCALUP_CONFIG}/kube-apiserver/admin.kubeconfig\"
      --raw /apis/security.openshift.io/v1/securitycontextconstraints 2>/dev/null 1>&2
      && break\n        sleep 0.25\n    done\n    set -e\n    oc get --config=\"${LOCALUP_CONFIG}/kube-apiserver/admin.kubeconfig\"
      --raw /apis/security.openshift.io/v1/securitycontextconstraints 2>/dev/null 1>&2
      || bash\n}\n\nfunction local::master::start_openshiftapiserver() {\n    if [ !
      -d \"${LOCALUP_CONFIG}/openshift-apiserver\" ]; then\n        mkdir -p ${LOCALUP_CONFIG}/openshift-apiserver\n
      \       cp ${base}/openshift-apiserver.yaml ${LOCALUP_CONFIG}/openshift-apiserver\n
      \       local::master::generate_openshiftapiserver_certs\n    fi\n\n    OPENSHIFT_APISERVER_LOG=${LOG_DIR}/openshift-apiserver.log\n
      \   hypershift openshift-apiserver \\\n      --v=${LOG_LEVEL} \\\n      --vmodule=\"${LOG_SPEC}\"
      \\\n      --config=${LOCALUP_CONFIG}/openshift-apiserver/openshift-apiserver.yaml
      >\"${OPENSHIFT_APISERVER_LOG}\" 2>&1 &\n    OPENSHIFT_APISERVER_PID=$!\n\n    #
      Wait for openshift-apiserver to come up before launching the rest of the components.\n
      \   local::master::log::info \"Waiting for openshift-apiserver to come up\"\n
      \   local::master::util::wait_for_url \"https://${API_HOST_IP}:8444/healthz\"
      \"openshift-apiserver: \" 1 ${WAIT_FOR_URL_API_SERVER} ${MAX_TIME_FOR_URL_API_SERVER}
      \\\n        || { local::master::log::error \"check kube-apiserver logs: ${OPENSHIFT_APISERVER_LOG}\"
      ; exit 1 ; }\n}\n\nfunction local::master::start_openshiftcontrollermanager()
      {\n    mkdir -p ${LOCALUP_CONFIG}/openshift-controller-manager\n    cp ${base}/openshift-controller-manager.yaml
      ${LOCALUP_CONFIG}/openshift-controller-manager\n    local::master::generate_openshiftcontrollermanager_certs\n\n
      \   OPENSHIFT_CONTROLLER_MANAGER_LOG=${LOG_DIR}/openshift-controller-manager.log\n
      \   hypershift openshift-controller-manager \\\n      --v=${LOG_LEVEL} \\\n      --vmodule=\"${LOG_SPEC}\"
      \\\n      --config=${LOCALUP_CONFIG}/openshift-controller-manager/openshift-controller-manager.yaml
      >\"${OPENSHIFT_CONTROLLER_MANAGER_LOG}\" 2>&1 &\n    OPENSHIFT_CONTROLLER_MANAGER_PID=$!\n\n
      \   local::master::log::info \"Waiting for openshift-controller-manager to come
      up\"\n    local::master::util::wait_for_url \"https://localhost:8445/healthz\"
      \"openshift-controller-manager: \" 1 ${WAIT_FOR_URL_API_SERVER} ${MAX_TIME_FOR_URL_API_SERVER}
      \\\n        || { local::master::log::error \"check openshift-controller-manager
      logs: ${OPENSHIFT_CONTROLLER_MANAGER_LOG}\" ; exit 1 ; }\n}\n\nfunction local::master::init_master()
      {\n    ETCD_DIR=${LOCALUP_CONFIG}/etcd\n    CERT_DIR=${LOCALUP_CONFIG}/kube-apiserver\n
      \   ROOT_CA_FILE=${CERT_DIR}/server-ca.crt\n\n    # ensure necessary ports are
      free\n    local::master::ensure_free_port 2379\n    local::master::ensure_free_port
      8443\n    local::master::ensure_free_port 8444\n    local::master::ensure_free_port
      8445\n    local::master::ensure_free_port 10252\n\n    local::master::util::test_openssl_installed\n
      \   local::master::util::ensure-cfssl\n\n    local::master::start_etcd\n    local::master::start_kubeapiserver\n
      \   local::master::start_kubecontrollermanager\n    local::master::start_openshiftapiserver\n
      \   local::master::start_openshiftcontrollermanager\n\n    cp ${LOCALUP_CONFIG}/kube-apiserver/admin.kubeconfig
      ${LOCALUP_CONFIG}/admin.kubeconfig\n    local::master::log::info \"Created config
      directory in ${LOCALUP_CONFIG}\"\n}\n\ntrap 'exit 0' TERM\ntrap \"local::master::cleanup\"
      EXIT\n\nlocal::master::util::ensure-temp-dir\n\nroot=${KUBE_TEMP:-$(pwd)}\nexport
      LOCALUP_CONFIG=${1:-${root}}\nexport LOG_DIR=${LOCALUP_CONFIG}/logs\nmkdir -p
      ${LOG_DIR}\n\nif [[ -z \"${1-}\" ]]; then\n  echo \"Logging to ${LOG_DIR}\"\nfi\n\nlocal::master::init_master\n\necho\necho
      \"Cluster is available, use the following kubeconfig to interact with it\"\necho
      \"export KUBECONFIG=${LOCALUP_CONFIG}/admin.kubeconfig\"\necho \"Press ctrl+C
      to finish\"\n\nwhile true; do sleep 1; local::master::healthcheck; done\n"
  kind: ConfigMap
  metadata:
    creationTimestamp: null
    name: master-start-4
    namespace: ${NAMESPACE}