Kubernetes Enhancement Proposals

✓ test/integration/dryrun/dryrun_test.go
✓ pkg/registry/core/service/storage/rest_test.go
✓ staging/src/k8s.io/kubectl/pkg/util/openapi/dryrun_test.go
✓ staging/src/k8s.io/apiserver/pkg/registry/generic/registry/dryrun_test.go
✓ staging/src/k8s.io/apiserver/pkg/endpoints/apiserver_test.go

--server-dry-run
--dry-run=true
--dry-run=server

func ParseDryRun(dryRunFlag string) (DryRunEnum, error) {
	if dryRunFlag == "" {
		klog.Warning("The unset value for --dry-run is deprecated and a value will be required in a future version. Must be \"none\"")
		// this warning will eventually become a fatal error
	}
	b, err := strconv.ParseBool(dryRunFlag)
	if err != nil { // The flag is not a boolean
		switch dryRunFlag {
		case "client":
			return DryRunClient, nil
		case "server":
			return DryRunServer, nil
		case "none":
			return DryRunNone, nil
		default:
			return DryRunNone, fmt.Errorf("Invalid dry-run value (%v). Must be \"none\", \"server\", or \"client\"", dryRunFlag)
		}
	}
	if b { // flag was a boolean, true indicates client-side dry-run
		return DryRunClient, nil
	}
	return DryRunNone, nil
}

type TokenRequest struct {
    Spec   TokenRequestSpec
    Status TokenRequestStatus
}

type TokenRequestSpec struct {
    // Audiences are the intended audiences of the token. A token issued
    // for multiple audiences may be used to authenticate against any of
    // the audiences listed. This implies a high degree of trust between
    // the target audiences.
    Audiences []string

    // ValidityDuration is the requested duration of validity of the
    // token. The token issuer may return a token with a different validity duration
    // so a client needs to check the 'expiration' field in a response.
    ValidityDuration metav1.Duration

    // BoundObjectRef is a reference to an object that the token will be bound to.
    // The token will only be valid for as long as the bound object exists.
    BoundObjectRef *BoundObjectReference
}

type BoundObjectReference struct {
    // Kind of the referent. Valid kinds are 'Pod' and 'Secret'.
    // (Other fields omitted for brevity)
}

BoundServiceAccountVolume=true
TokenRequest=true
--service-account-issuer
--service-account-signing-key-file
--service-account-key-file
--api-audiences (default to --service-account-issuer)
TokenRequestProjection=true
Go: >= v0.15.7
Python: >= v12.0.0
Java: >= v9.0.0
Javascript: >= v0.10.3
Ruby: master branch
Haskell: v0.3.0.0