Merge pull request #39442 from deads2k/generic-08-client-go-01

cmd/kubelet/app/BUILD

@@ -8,11 +8,28 @@ load(
     "go_test",
 )
 
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "bootstrap_test.go",
+        "server_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/kubelet:go_default_library",
+        "//pkg/util/config:go_default_library",
+        "//pkg/util/diff:go_default_library",
+    ],
+)
+
 go_library(
     name = "go_default_library",
     srcs = [
         "auth.go",
         "bootstrap.go",
+        "clientgo.go",
         "plugins.go",
         "server.go",
         "server_linux.go",
@@ -28,8 +45,6 @@ go_library(
         "//pkg/capabilities:go_default_library",
         "//pkg/client/chaosclient:go_default_library",
         "//pkg/client/clientset_generated/clientset:go_default_library",
-        "//pkg/client/clientset_generated/clientset/typed/authentication/v1beta1:go_default_library",
-        "//pkg/client/clientset_generated/clientset/typed/authorization/v1beta1:go_default_library",
         "//pkg/client/clientset_generated/clientset/typed/certificates/v1alpha1:go_default_library",
         "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
         "//pkg/client/record:go_default_library",
@@ -101,22 +116,13 @@ go_library(
         "//vendor:k8s.io/apiserver/pkg/authentication/authenticator",
         "//vendor:k8s.io/apiserver/pkg/authorization/authorizer",
         "//vendor:k8s.io/apiserver/pkg/healthz",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = [
-        "bootstrap_test.go",
-        "server_test.go",
-    ],
-    library = ":go_default_library",
-    tags = ["automanaged"],
-    deps = [
-        "//pkg/client/restclient:go_default_library",
-        "//pkg/kubelet:go_default_library",
-        "//pkg/util/config:go_default_library",
-        "//pkg/util/diff:go_default_library",
+        "//vendor:k8s.io/client-go/kubernetes",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authentication/v1beta1",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authorization/v1beta1",
+        "//vendor:k8s.io/client-go/rest",
+        "//vendor:k8s.io/client-go/tools/auth",
+        "//vendor:k8s.io/client-go/tools/clientcmd",
+        "//vendor:k8s.io/client-go/tools/clientcmd/api",
     ],
 )
 

cmd/kubelet/app/auth.go

@@ -23,10 +23,11 @@ import (
 
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
+	clientset "k8s.io/client-go/kubernetes"
+	authenticationclient "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+	authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+
 	"k8s.io/kubernetes/pkg/apis/componentconfig"
-	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
-	authenticationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authentication/v1beta1"
-	authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authorization/v1beta1"
 	apiserverauthenticator "k8s.io/kubernetes/pkg/genericapiserver/authenticator"
 	alwaysallowauthorizer "k8s.io/kubernetes/pkg/genericapiserver/authorizer"
 	apiserverauthorizer "k8s.io/kubernetes/pkg/genericapiserver/authorizer"

cmd/kubelet/app/clientgo.go

+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// this file contains parallel methods for getting a client-go clientconfig
+// The types are not reasonably compatibly between the client-go and kubernetes restclient.Interface,
+// restclient.Config, or typed clients, so this is the simplest solution during the transition
+package app
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/golang/glog"
+
+	"k8s.io/client-go/rest"
+	clientauth "k8s.io/client-go/tools/auth"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	"k8s.io/kubernetes/cmd/kubelet/app/options"
+	"k8s.io/kubernetes/pkg/client/chaosclient"
+)
+
+func kubeconfigClientGoConfig(s *options.KubeletServer) (*rest.Config, error) {
+	if s.RequireKubeConfig {
+		// Ignores the values of s.APIServerList
+		return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
+			&clientcmd.ClientConfigLoadingRules{ExplicitPath: s.KubeConfig.Value()},
+			&clientcmd.ConfigOverrides{},
+		).ClientConfig()
+	}
+	return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
+		&clientcmd.ClientConfigLoadingRules{ExplicitPath: s.KubeConfig.Value()},
+		&clientcmd.ConfigOverrides{ClusterInfo: clientcmdapi.Cluster{Server: s.APIServerList[0]}},
+	).ClientConfig()
+}
+
+// createClientConfig creates a client configuration from the command line
+// arguments. If --kubeconfig is explicitly set, it will be used. If it is
+// not set, we attempt to load the default kubeconfig file, and if we cannot,
+// we fall back to the default client with no auth - this fallback does not, in
+// and of itself, constitute an error.
+func createClientGoConfig(s *options.KubeletServer) (*rest.Config, error) {
+	if s.RequireKubeConfig {
+		return kubeconfigClientGoConfig(s)
+	}
+
+	// TODO: handle a new --standalone flag that bypasses kubeconfig loading and returns no error.
+	// DEPRECATED: all subsequent code is deprecated
+	if len(s.APIServerList) == 0 {
+		return nil, fmt.Errorf("no api servers specified")
+	}
+	// TODO: adapt Kube client to support LB over several servers
+	if len(s.APIServerList) > 1 {
+		glog.Infof("Multiple api servers specified.  Picking first one")
+	}
+
+	if s.KubeConfig.Provided() {
+		return kubeconfigClientGoConfig(s)
+	}
+	// If KubeConfig was not provided, try to load the default file, then fall back
+	// to a default auth config.
+	clientConfig, err := kubeconfigClientGoConfig(s)
+	if err != nil {
+		glog.Warningf("Could not load kubeconfig file %s: %v. Using default client config instead.", s.KubeConfig, err)
+
+		authInfo := &clientauth.Info{}
+		authConfig, err := authInfo.MergeWithConfig(rest.Config{})
+		if err != nil {
+			return nil, err
+		}
+		authConfig.Host = s.APIServerList[0]
+		clientConfig = &authConfig
+	}
+	return clientConfig, nil
+}
+
+// createAPIServerClientGoConfig generates a client.Config from command line flags,
+// including api-server-list, via createClientConfig and then injects chaos into
+// the configuration via addChaosToClientConfig. This func is exported to support
+// integration with third party kubelet extensions (e.g. kubernetes-mesos).
+func createAPIServerClientGoConfig(s *options.KubeletServer) (*rest.Config, error) {
+	clientConfig, err := createClientGoConfig(s)
+	if err != nil {
+		return nil, err
+	}
+
+	clientConfig.ContentType = s.ContentType
+	// Override kubeconfig qps/burst settings from flags
+	clientConfig.QPS = float32(s.KubeAPIQPS)
+	clientConfig.Burst = int(s.KubeAPIBurst)
+
+	addChaosToClientGoConfig(s, clientConfig)
+	return clientConfig, nil
+}
+
+// addChaosToClientConfig injects random errors into client connections if configured.
+func addChaosToClientGoConfig(s *options.KubeletServer, config *rest.Config) {
+	if s.ChaosChance != 0.0 {
+		config.WrapTransport = func(rt http.RoundTripper) http.RoundTripper {
+			seed := chaosclient.NewSeed(1)
+			// TODO: introduce a standard chaos package with more tunables - this is just a proof of concept
+			// TODO: introduce random latency and stalls
+			return chaosclient.NewChaosRoundTripper(rt, chaosclient.LogChaos, seed.P(s.ChaosChance, chaosclient.ErrSimulatedConnectionResetByPeer))
+		}
+	}
+}

cmd/kubelet/app/server.go

@@ -37,6 +37,8 @@ import (
 	"github.com/spf13/pflag"
 
 	"k8s.io/apiserver/pkg/healthz"
+	clientgoclientset "k8s.io/client-go/kubernetes"
+
 	"k8s.io/kubernetes/cmd/kubelet/app/options"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
@@ -137,19 +139,20 @@ func UnsecuredKubeletDeps(s *options.KubeletServer) (*kubelet.KubeletDeps, error
 	}
 
 	return &kubelet.KubeletDeps{
-		Auth:              nil, // default does not enforce auth[nz]
-		CAdvisorInterface: nil, // cadvisor.New launches background processes (bg http.ListenAndServe, and some bg cleaners), not set here
-		Cloud:             nil, // cloud provider might start background processes
-		ContainerManager:  nil,
-		DockerClient:      dockerClient,
-		KubeClient:        nil,
-		Mounter:           mounter,
-		NetworkPlugins:    ProbeNetworkPlugins(s.NetworkPluginDir, s.CNIConfDir, s.CNIBinDir),
-		OOMAdjuster:       oom.NewOOMAdjuster(),
-		OSInterface:       kubecontainer.RealOS{},
-		Writer:            writer,
-		VolumePlugins:     ProbeVolumePlugins(s.VolumePluginDir),
-		TLSOptions:        tlsOptions,
+		Auth:               nil, // default does not enforce auth[nz]
+		CAdvisorInterface:  nil, // cadvisor.New launches background processes (bg http.ListenAndServe, and some bg cleaners), not set here
+		Cloud:              nil, // cloud provider might start background processes
+		ContainerManager:   nil,
+		DockerClient:       dockerClient,
+		KubeClient:         nil,
+		ExternalKubeClient: nil,
+		Mounter:            mounter,
+		NetworkPlugins:     ProbeNetworkPlugins(s.NetworkPluginDir, s.CNIConfDir, s.CNIBinDir),
+		OOMAdjuster:        oom.NewOOMAdjuster(),
+		OSInterface:        kubecontainer.RealOS{},
+		Writer:             writer,
+		VolumePlugins:      ProbeVolumePlugins(s.VolumePluginDir),
+		TLSOptions:         tlsOptions,
 	}, nil
 }
 
@@ -359,6 +362,7 @@ func run(s *options.KubeletServer, kubeDeps *kubelet.KubeletDeps) (err error) {
 
 	if kubeDeps == nil {
 		var kubeClient, eventClient *clientset.Clientset
+		var externalKubeClient clientgoclientset.Interface
 		var cloud cloudprovider.Interface
 
 		if s.CloudProvider != componentconfigv1alpha1.AutoDetectCloudProvider {
@@ -406,6 +410,27 @@ func run(s *options.KubeletServer, kubeDeps *kubelet.KubeletDeps) (err error) {
 			}
 		}
 
+		// client-go and kuberenetes generated clients are incompatible because the runtime
+		// and runtime/serializer types have been duplicated in client-go.  This means that
+		// you can't reasonably convert from one to the other and its impossible for a single
+		// type to fulfill both interfaces.  Because of that, we have to build the clients
+		// up from scratch twice.
+		// TODO eventually the kubelet should only use the client-go library
+		clientGoConfig, err := createAPIServerClientGoConfig(s)
+		if err == nil {
+			externalKubeClient, err = clientgoclientset.NewForConfig(clientGoConfig)
+			if err != nil {
+				glog.Warningf("New kubeClient from clientConfig error: %v", err)
+			}
+		} else {
+			if s.RequireKubeConfig {
+				return fmt.Errorf("invalid kubeconfig: %v", err)
+			}
+			if standaloneMode {
+				glog.Warningf("No API client: %v", err)
+			}
+		}
+
 		kubeDeps, err = UnsecuredKubeletDeps(s)
 		if err != nil {
 			return err
@@ -413,6 +438,7 @@ func run(s *options.KubeletServer, kubeDeps *kubelet.KubeletDeps) (err error) {
 
 		kubeDeps.Cloud = cloud
 		kubeDeps.KubeClient = kubeClient
+		kubeDeps.ExternalKubeClient = externalKubeClient
 		kubeDeps.EventClient = eventClient
 	}
 
@@ -421,7 +447,8 @@ func run(s *options.KubeletServer, kubeDeps *kubelet.KubeletDeps) (err error) {
 		if err != nil {
 			return err
 		}
-		auth, err := buildAuth(nodeName, kubeDeps.KubeClient, s.KubeletConfiguration)
+
+		auth, err := buildAuth(nodeName, kubeDeps.ExternalKubeClient, s.KubeletConfiguration)
 		if err != nil {
 			return err
 		}

pkg/genericapiserver/authenticator/BUILD

@@ -18,7 +18,6 @@ go_library(
     deps = [
         "//pkg/auth/authenticator/bearertoken:go_default_library",
         "//pkg/auth/group:go_default_library",
-        "//pkg/client/clientset_generated/clientset/typed/authentication/v1beta1:go_default_library",
         "//pkg/util/cert:go_default_library",
         "//plugin/pkg/auth/authenticator/request/anonymous:go_default_library",
         "//plugin/pkg/auth/authenticator/request/headerrequest:go_default_library",
@@ -29,6 +28,7 @@ go_library(
         "//vendor:github.com/go-openapi/spec",
         "//vendor:k8s.io/apiserver/pkg/authentication/authenticator",
         "//vendor:k8s.io/apiserver/pkg/authentication/user",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authentication/v1beta1",
     ],
 )
 

pkg/genericapiserver/authenticator/delegating.go

@@ -25,9 +25,10 @@ import (
 
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
+	authenticationclient "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+
 	"k8s.io/kubernetes/pkg/auth/authenticator/bearertoken"
 	"k8s.io/kubernetes/pkg/auth/group"
-	authenticationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authentication/v1beta1"
 	"k8s.io/kubernetes/pkg/util/cert"
 	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/anonymous"
 	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/headerrequest"

pkg/genericapiserver/authorizer/BUILD

@@ -8,31 +8,28 @@ load(
     "go_test",
 )
 
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "builtin.go",
-        "delegating.go",
-    ],
+go_test(
+    name = "go_default_test",
+    srcs = ["authz_test.go"],
+    library = ":go_default_library",
     tags = ["automanaged"],
     deps = [
-        "//pkg/client/clientset_generated/clientset/typed/authorization/v1beta1:go_default_library",
-        "//plugin/pkg/auth/authorizer/webhook:go_default_library",
+        "//vendor:k8s.io/apiserver/pkg/authentication/user",
         "//vendor:k8s.io/apiserver/pkg/authorization/authorizer",
     ],
 )
 
-go_test(
-    name = "go_default_test",
-    srcs = ["authz_test.go"],
-    data = [
-        "//pkg/auth/authorizer/abac:example_policy",
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "builtin.go",
+        "delegating.go",
     ],
-    library = ":go_default_library",
     tags = ["automanaged"],
     deps = [
-        "//vendor:k8s.io/apiserver/pkg/authentication/user",
+        "//plugin/pkg/auth/authorizer/webhook:go_default_library",
         "//vendor:k8s.io/apiserver/pkg/authorization/authorizer",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authorization/v1beta1",
     ],
 )
 

pkg/genericapiserver/authorizer/delegating.go

@@ -20,7 +20,8 @@ import (
 	"time"
 
 	"k8s.io/apiserver/pkg/authorization/authorizer"
-	authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authorization/v1beta1"
+	authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+
 	webhooksar "k8s.io/kubernetes/plugin/pkg/auth/authorizer/webhook"
 )
 

pkg/genericapiserver/options/BUILD

@@ -22,10 +22,6 @@ go_library(
         "//pkg/admission:go_default_library",
         "//pkg/api:go_default_library",
         "//pkg/apimachinery/registered:go_default_library",
-        "//pkg/client/clientset_generated/clientset/typed/authentication/v1beta1:go_default_library",
-        "//pkg/client/clientset_generated/clientset/typed/authorization/v1beta1:go_default_library",
-        "//pkg/client/restclient:go_default_library",
-        "//pkg/client/unversioned/clientcmd:go_default_library",
         "//pkg/genericapiserver/authenticator:go_default_library",
         "//pkg/genericapiserver/authorizer:go_default_library",
         "//pkg/runtime/schema:go_default_library",
@@ -35,6 +31,10 @@ go_library(
         "//pkg/util/net:go_default_library",
         "//vendor:github.com/golang/glog",
         "//vendor:github.com/spf13/pflag",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authentication/v1beta1",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authorization/v1beta1",
+        "//vendor:k8s.io/client-go/rest",
+        "//vendor:k8s.io/client-go/tools/clientcmd",
     ],
 )
 

pkg/genericapiserver/options/authentication.go

@@ -21,9 +21,9 @@ import (
 
 	"github.com/spf13/pflag"
 
-	authenticationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authentication/v1beta1"
-	"k8s.io/kubernetes/pkg/client/restclient"
-	"k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
+	authenticationclient "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/kubernetes/pkg/genericapiserver/authenticator"
 )
 
@@ -145,7 +145,7 @@ func (s *DelegatingAuthenticationOptions) ToAuthenticationConfig() (authenticato
 }
 
 func (s *DelegatingAuthenticationOptions) newTokenAccessReview() (authenticationclient.TokenReviewInterface, error) {
-	var clientConfig *restclient.Config
+	var clientConfig *rest.Config
 	var err error
 	if len(s.RemoteKubeConfigFile) > 0 {
 		loadingRules := &clientcmd.ClientConfigLoadingRules{ExplicitPath: s.RemoteKubeConfigFile}
@@ -156,7 +156,7 @@ func (s *DelegatingAuthenticationOptions) newTokenAccessReview() (authentication
 	} else {
 		// without the remote kubeconfig file, try to use the in-cluster config.  Most addon API servers will
 		// use this path
-		clientConfig, err = restclient.InClusterConfig()
+		clientConfig, err = rest.InClusterConfig()
 	}
 	if err != nil {
 		return nil, err

pkg/genericapiserver/options/authorization.go

@@ -21,9 +21,9 @@ import (
 
 	"github.com/spf13/pflag"
 
-	authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authorization/v1beta1"
-	"k8s.io/kubernetes/pkg/client/restclient"
-	"k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
+	authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/kubernetes/pkg/genericapiserver/authorizer"
 )
 
@@ -84,7 +84,7 @@ func (s *DelegatingAuthorizationOptions) ToAuthorizationConfig() (authorizer.Del
 }
 
 func (s *DelegatingAuthorizationOptions) newSubjectAccessReview() (authorizationclient.SubjectAccessReviewInterface, error) {
-	var clientConfig *restclient.Config
+	var clientConfig *rest.Config
 	var err error
 	if len(s.RemoteKubeConfigFile) > 0 {
 		loadingRules := &clientcmd.ClientConfigLoadingRules{ExplicitPath: s.RemoteKubeConfigFile}
@@ -95,7 +95,7 @@ func (s *DelegatingAuthorizationOptions) newSubjectAccessReview() (authorization
 	} else {
 		// without the remote kubeconfig file, try to use the in-cluster config.  Most addon API servers will
 		// use this path
-		clientConfig, err = restclient.InClusterConfig()
+		clientConfig, err = rest.InClusterConfig()
 	}
 	if err != nil {
 		return nil, err

pkg/kubeapiserver/authenticator/BUILD

@@ -31,6 +31,8 @@ go_library(
         "//vendor:github.com/go-openapi/spec",
         "//vendor:k8s.io/apiserver/pkg/authentication/authenticator",
         "//vendor:k8s.io/apiserver/pkg/authentication/user",
+        "//vendor:k8s.io/client-go/plugin/pkg/client/auth/gcp",
+        "//vendor:k8s.io/client-go/plugin/pkg/client/auth/oidc",
     ],
 )
 

pkg/kubeapiserver/authenticator/config.go

@@ -39,6 +39,10 @@ import (
 	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/oidc"
 	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/tokenfile"
 	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/webhook"
+
+	// Initialize all known client auth plugins.
+	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
+	_ "k8s.io/client-go/plugin/pkg/client/auth/oidc"
 )
 
 type AuthenticatorConfig struct {

pkg/kubelet/BUILD

@@ -123,6 +123,7 @@ go_library(
         "//vendor:github.com/google/cadvisor/events",
         "//vendor:github.com/google/cadvisor/info/v1",
         "//vendor:github.com/google/cadvisor/info/v2",
+        "//vendor:k8s.io/client-go/kubernetes",
     ],
 )
 

pkg/kubelet/kubelet.go

@@ -30,6 +30,9 @@ import (
 	"time"
 
 	"github.com/golang/glog"
+
+	clientgoclientset "k8s.io/client-go/kubernetes"
+
 	cadvisorapi "github.com/google/cadvisor/info/v1"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/resource"
@@ -205,22 +208,23 @@ type KubeletDeps struct {
 	Options                 []Option
 
 	// Injected Dependencies
-	Auth              server.AuthInterface
-	CAdvisorInterface cadvisor.Interface
-	Cloud             cloudprovider.Interface
-	ContainerManager  cm.ContainerManager
-	DockerClient      dockertools.DockerInterface
-	EventClient       *clientset.Clientset
-	KubeClient        *clientset.Clientset
-	Mounter           mount.Interface
-	NetworkPlugins    []network.NetworkPlugin
-	OOMAdjuster       *oom.OOMAdjuster
-	OSInterface       kubecontainer.OSInterface
-	PodConfig         *config.PodConfig
-	Recorder          record.EventRecorder
-	Writer            kubeio.Writer
-	VolumePlugins     []volume.VolumePlugin
-	TLSOptions        *server.TLSOptions
+	Auth               server.AuthInterface
+	CAdvisorInterface  cadvisor.Interface
+	Cloud              cloudprovider.Interface
+	ContainerManager   cm.ContainerManager
+	DockerClient       dockertools.DockerInterface
+	EventClient        *clientset.Clientset
+	KubeClient         *clientset.Clientset
+	ExternalKubeClient clientgoclientset.Interface
+	Mounter            mount.Interface
+	NetworkPlugins     []network.NetworkPlugin
+	OOMAdjuster        *oom.OOMAdjuster
+	OSInterface        kubecontainer.OSInterface
+	PodConfig          *config.PodConfig
+	Recorder           record.EventRecorder
+	Writer             kubeio.Writer
+	VolumePlugins      []volume.VolumePlugin
+	TLSOptions         *server.TLSOptions
 }
 
 // makePodSourceConfig creates a config.PodConfig from the given

plugin/pkg/admission/imagepolicy/BUILD

@@ -19,14 +19,16 @@ go_library(
     deps = [
         "//pkg/admission:go_default_library",
         "//pkg/api:go_default_library",
-        "//pkg/api/errors:go_default_library",
-        "//pkg/apis/imagepolicy/v1alpha1:go_default_library",
-        "//pkg/client/restclient:go_default_library",
         "//pkg/runtime/schema:go_default_library",
         "//pkg/util/cache:go_default_library",
         "//pkg/util/yaml:go_default_library",
         "//plugin/pkg/webhook:go_default_library",
         "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/client-go/pkg/api/errors",
+        "//vendor:k8s.io/client-go/pkg/apis/imagepolicy/install",
+        "//vendor:k8s.io/client-go/pkg/apis/imagepolicy/v1alpha1",
+        "//vendor:k8s.io/client-go/pkg/runtime/schema",
+        "//vendor:k8s.io/client-go/rest",
     ],
 )
 

plugin/pkg/admission/imagepolicy/admission.go

@@ -28,17 +28,20 @@ import (
 
 	"github.com/golang/glog"
 
-	"k8s.io/kubernetes/pkg/api"
-	apierrors "k8s.io/kubernetes/pkg/api/errors"
-	"k8s.io/kubernetes/pkg/apis/imagepolicy/v1alpha1"
-	"k8s.io/kubernetes/pkg/runtime/schema"
-	"k8s.io/kubernetes/pkg/util/yaml"
+	apierrors "k8s.io/client-go/pkg/api/errors"
+	"k8s.io/client-go/pkg/apis/imagepolicy/v1alpha1"
+	"k8s.io/client-go/pkg/runtime/schema"
+	"k8s.io/client-go/rest"
 
-	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/admission"
+	"k8s.io/kubernetes/pkg/api"
+	kubeschema "k8s.io/kubernetes/pkg/runtime/schema"
 	"k8s.io/kubernetes/pkg/util/cache"
+	"k8s.io/kubernetes/pkg/util/yaml"
 	"k8s.io/kubernetes/plugin/pkg/webhook"
 
-	"k8s.io/kubernetes/pkg/admission"
+	// install the clientgo image policy API for use with api registry
+	_ "k8s.io/client-go/pkg/apis/imagepolicy/install"
 )
 
 var (
@@ -100,7 +103,7 @@ func (a *imagePolicyWebhook) webhookError(attributes admission.Attributes, err e
 
 func (a *imagePolicyWebhook) Admit(attributes admission.Attributes) (err error) {
 	// Ignore all calls to subresources or resources other than pods.
-	allowedResources := map[schema.GroupResource]bool{
+	allowedResources := map[kubeschema.GroupResource]bool{
 		api.Resource("pods"): true,
 	}
 
@@ -144,7 +147,7 @@ func (a *imagePolicyWebhook) admitPod(attributes admission.Attributes, review *v
 	if entry, ok := a.responseCache.Get(string(cacheKey)); ok {
 		review.Status = entry.(v1alpha1.ImageReviewStatus)
 	} else {
-		result := a.webhook.WithExponentialBackoff(func() restclient.Result {
+		result := a.webhook.WithExponentialBackoff(func() rest.Result {
 			return a.webhook.RestClient.Post().Body(review).Do()
 		})
 

plugin/pkg/auth/authenticator/token/webhook/BUILD

@@ -13,14 +13,14 @@ go_library(
     srcs = ["webhook.go"],
     tags = ["automanaged"],
     deps = [
-        "//pkg/apis/authentication/install:go_default_library",
-        "//pkg/apis/authentication/v1beta1:go_default_library",
-        "//pkg/client/clientset_generated/clientset/typed/authentication/v1beta1:go_default_library",
-        "//pkg/runtime/schema:go_default_library",
         "//pkg/util/cache:go_default_library",
         "//plugin/pkg/webhook:go_default_library",
         "//vendor:k8s.io/apiserver/pkg/authentication/authenticator",
         "//vendor:k8s.io/apiserver/pkg/authentication/user",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authentication/v1beta1",
+        "//vendor:k8s.io/client-go/pkg/apis/authentication/install",
+        "//vendor:k8s.io/client-go/pkg/apis/authentication/v1beta1",
+        "//vendor:k8s.io/client-go/pkg/runtime/schema",
     ],
 )
 

plugin/pkg/auth/authenticator/token/webhook/webhook.go

@@ -22,12 +22,14 @@ import (
 
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
-	_ "k8s.io/kubernetes/pkg/apis/authentication/install"
-	authentication "k8s.io/kubernetes/pkg/apis/authentication/v1beta1"
-	authenticationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authentication/v1beta1"
-	"k8s.io/kubernetes/pkg/runtime/schema"
+	authenticationclient "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+	authentication "k8s.io/client-go/pkg/apis/authentication/v1beta1"
+	"k8s.io/client-go/pkg/runtime/schema"
+
 	"k8s.io/kubernetes/pkg/util/cache"
 	"k8s.io/kubernetes/plugin/pkg/webhook"
+
+	_ "k8s.io/client-go/pkg/apis/authentication/install"
 )
 
 var (

plugin/pkg/auth/authorizer/webhook/BUILD

@@ -14,13 +14,13 @@ go_library(
     tags = ["automanaged"],
     deps = [
         "//pkg/apis/authorization/install:go_default_library",
-        "//pkg/apis/authorization/v1beta1:go_default_library",
-        "//pkg/client/clientset_generated/clientset/typed/authorization/v1beta1:go_default_library",
-        "//pkg/runtime/schema:go_default_library",
         "//pkg/util/cache:go_default_library",
         "//plugin/pkg/webhook:go_default_library",
         "//vendor:github.com/golang/glog",
         "//vendor:k8s.io/apiserver/pkg/authorization/authorizer",
+        "//vendor:k8s.io/client-go/kubernetes/typed/authorization/v1beta1",
+        "//vendor:k8s.io/client-go/pkg/apis/authorization/v1beta1",
+        "//vendor:k8s.io/client-go/pkg/runtime/schema",
     ],
 )
 

plugin/pkg/auth/authorizer/webhook/webhook.go

@@ -24,9 +24,10 @@ import (
 	"github.com/golang/glog"
 
 	"k8s.io/apiserver/pkg/authorization/authorizer"
-	authorization "k8s.io/kubernetes/pkg/apis/authorization/v1beta1"
-	authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authorization/v1beta1"
-	"k8s.io/kubernetes/pkg/runtime/schema"
+	authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+	authorization "k8s.io/client-go/pkg/apis/authorization/v1beta1"
+	"k8s.io/client-go/pkg/runtime/schema"
+
 	"k8s.io/kubernetes/pkg/util/cache"
 	"k8s.io/kubernetes/plugin/pkg/webhook"
 

plugin/pkg/webhook/BUILD

@@ -12,16 +12,16 @@ go_library(
     srcs = ["webhook.go"],
     tags = ["automanaged"],
     deps = [
-        "//pkg/api:go_default_library",
-        "//pkg/api/errors:go_default_library",
-        "//pkg/apimachinery/registered:go_default_library",
-        "//pkg/apis/authorization/install:go_default_library",
-        "//pkg/client/restclient:go_default_library",
-        "//pkg/client/unversioned/clientcmd:go_default_library",
-        "//pkg/runtime:go_default_library",
-        "//pkg/runtime/schema:go_default_library",
-        "//pkg/runtime/serializer:go_default_library",
-        "//pkg/util/wait:go_default_library",
+        "//vendor:k8s.io/client-go/pkg/api",
+        "//vendor:k8s.io/client-go/pkg/api/errors",
+        "//vendor:k8s.io/client-go/pkg/apimachinery/registered",
+        "//vendor:k8s.io/client-go/pkg/apis/authorization/install",
+        "//vendor:k8s.io/client-go/pkg/runtime",
+        "//vendor:k8s.io/client-go/pkg/runtime/schema",
+        "//vendor:k8s.io/client-go/pkg/runtime/serializer",
+        "//vendor:k8s.io/client-go/pkg/util/wait",
+        "//vendor:k8s.io/client-go/rest",
+        "//vendor:k8s.io/client-go/tools/clientcmd",
     ],
 )
 

plugin/pkg/webhook/webhook.go

@@ -21,21 +21,21 @@ import (
 	"fmt"
 	"time"
 
-	"k8s.io/kubernetes/pkg/api"
-	apierrors "k8s.io/kubernetes/pkg/api/errors"
-	"k8s.io/kubernetes/pkg/apimachinery/registered"
-	"k8s.io/kubernetes/pkg/client/restclient"
-	"k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
-	"k8s.io/kubernetes/pkg/runtime"
-	"k8s.io/kubernetes/pkg/runtime/schema"
-	runtimeserializer "k8s.io/kubernetes/pkg/runtime/serializer"
-	"k8s.io/kubernetes/pkg/util/wait"
-
-	_ "k8s.io/kubernetes/pkg/apis/authorization/install"
+	"k8s.io/client-go/pkg/api"
+	apierrors "k8s.io/client-go/pkg/api/errors"
+	"k8s.io/client-go/pkg/apimachinery/registered"
+	"k8s.io/client-go/pkg/runtime"
+	"k8s.io/client-go/pkg/runtime/schema"
+	runtimeserializer "k8s.io/client-go/pkg/runtime/serializer"
+	"k8s.io/client-go/pkg/util/wait"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+
+	_ "k8s.io/client-go/pkg/apis/authorization/install"
 )
 
 type GenericWebhook struct {
-	RestClient     *restclient.RESTClient
+	RestClient     *rest.RESTClient
 	initialBackoff time.Duration
 }
 
@@ -58,7 +58,7 @@ func NewGenericWebhook(kubeConfigFile string, groupVersions []schema.GroupVersio
 	codec := api.Codecs.LegacyCodec(groupVersions...)
 	clientConfig.ContentConfig.NegotiatedSerializer = runtimeserializer.NegotiatedSerializerWrapper(runtime.SerializerInfo{Serializer: codec})
 
-	restClient, err := restclient.UnversionedRESTClientFor(clientConfig)
+	restClient, err := rest.UnversionedRESTClientFor(clientConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -70,8 +70,8 @@ func NewGenericWebhook(kubeConfigFile string, groupVersions []schema.GroupVersio
 
 // WithExponentialBackoff will retry webhookFn() up to 5 times with exponentially increasing backoff when
 // it returns an error for which apierrors.SuggestsClientDelay() or apierrors.IsInternalError() returns true.
-func (g *GenericWebhook) WithExponentialBackoff(webhookFn func() restclient.Result) restclient.Result {
-	var result restclient.Result
+func (g *GenericWebhook) WithExponentialBackoff(webhookFn func() rest.Result) rest.Result {
+	var result rest.Result
 	WithExponentialBackoff(g.initialBackoff, func() error {
 		result = webhookFn()
 		return result.Error()