// https://github.com/kubernetes/kubernetes/blob/v1.23.1/pkg/kubeapiserver/options/authentication.go#L48

// BuiltInAuthenticationOptions contains all build-in authentication options for API Server
type BuiltInAuthenticationOptions struct {
    Anonymous       *AnonymousAuthenticationOptions
    BootstrapToken  *BootstrapTokenAuthenticationOptions
    ClientCert      *genericoptions.ClientCertAuthenticationOptions
    OIDC            *OIDCAuthenticationOptions
    RequestHeader   *genericoptions.RequestHeaderAuthenticationOptions
    ServiceAccounts *ServiceAccountAuthenticationOptions
    TokenFile       *TokenFileAuthenticationOptions
    WebHook         *WebHookAuthenticationOptions
    ...
}

// WithAll set default value for every build-in authentication option
func (o *BuiltInAuthenticationOptions) WithAll() *BuiltInAuthenticationOptions {
    return o.
        WithAnonymous().
        WithBootstrapToken().
        WithClientCert().
        WithOIDC().
        WithRequestHeader().
        WithServiceAccounts().
        WithTokenFile().
        WithWebHook()
}

// 注册各种 AuthN 相关的命令行参数到 API Server
func (o *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) {
    BoolVar("anonymous-auth")
    BoolVar("enable-bootstrap-token-auth")

    // Client certificate flags
    ClientCert.AddFlags
      |-StringVar("client-ca-file")

    // OIDC flags

    // Request header flags
    RequestHeader.AddFlags
      |-StringSliceVar("requestheader-username-headers") // e.g. `X-Remote-User`
      |-StringSliceVar("requestheader-group-headers")    // e.g. `X-Remote-Group`
      |-StringSliceVar("requestheader-extra-headers-prefix") // e.g. `X-Remote-Extra-`
      |-StringVar("requestheader-client-ca-file")
      |-StringSliceVar("requestheader-allowed-names")

    // ServiceAccount flags
    StringVar("service-account-key-file") // e.g. --service-account-key-file=/etc/kubernetes/pki/sa.pub

    // Token file
    StringVar("token-auth-file")

    // Webhook
}

// https://github.com/kubernetes/kubernetes/blob/v1.23.0/staging/src/k8s.io/apiserver/pkg/server/config.go#L764

func DefaultBuildHandlerChain(apiHandler http.Handler, c *Config) http.Handler {
    handler = genericapifilters.WithAuthorization(handler, c.Authorization.Authorizer, c.Serializer)
    handler = genericapifilters.WithAudit(handler, c.AuditBackend, c.AuditPolicyRuleEvaluator, c.LongRunningFunc)
    handler = genericapifilters.WithAuthentication(handler, c.Authentication.Authenticator, failedHandler, c.Authentication.APIAudiences)
    ...
}

// cmd/kubelet/app/server.go

func run() {
        if s.CgroupsPerQOS && s.CgroupRoot == "" {
            s.CgroupRoot = "/" // if --cgroups-per-qos enabled but --cgroup-root not specified, default to /
        }
    ...
        kubeDeps.ContainerManager = cm.NewContainerManager(
            kubeDeps.Mounter,
            kubeDeps.CAdvisorInterface,
            cm.NodeConfig{
                RuntimeCgroupsName:    s.RuntimeCgroups,
                SystemCgroupsName:     s.SystemCgroups,
                KubeletCgroupsName:    s.KubeletCgroups,
                KubeletOOMScoreAdj:    s.OOMScoreAdj,
                CgroupsPerQOS:         s.CgroupsPerQOS,
                CgroupRoot:            s.CgroupRoot,
                CgroupDriver:          s.CgroupDriver,
                KubeletRootDir:        s.RootDirectory,
                ProtectKernelDefaults: s.ProtectKernelDefaults,
                NodeAllocatableConfig: cm.NodeAllocatableConfig{
                    KubeReservedCgroupName:   s.KubeReservedCgroup,
                    SystemReservedCgroupName: s.SystemReservedCgroup,
                    EnforceNodeAllocatable:   sets.NewString(s.EnforceNodeAllocatable...),
                    KubeReserved:             kubeReserved,
                    SystemReserved:           systemReserved,
                    ReservedSystemCPUs:       reservedSystemCPUs,
                    HardEvictionThresholds:   hardEvictionThresholds,
                },
                QOSReserved:                              *experimentalQOSReserved,
                CPUManagerPolicy:                         s.CPUManagerPolicy,
                CPUManagerPolicyOptions:                  cpuManagerPolicyOptions,
                CPUManagerReconcilePeriod:                s.CPUManagerReconcilePeriod.Duration,
                ExperimentalMemoryManagerPolicy:          s.MemoryManagerPolicy,
                ExperimentalMemoryManagerReservedMemory:  s.ReservedMemory,
                ExperimentalPodPidsLimit:                 s.PodPidsLimit,
                EnforceCPULimits:                         s.CPUCFSQuota,
                CPUCFSQuotaPeriod:                        s.CPUCFSQuotaPeriod.Duration,
                ExperimentalTopologyManagerPolicy:        s.TopologyManagerPolicy,
                ExperimentalTopologyManagerScope:         s.TopologyManagerScope,
                ExperimentalTopologyManagerPolicyOptions: topologyManagerPolicyOptions,
            },
            s.FailSwapOn,
            kubeDeps.Recorder,
            kubeDeps.KubeClient,
        )
}

// pkg/kubelet/cm/container_manager_linux.go

func NewContainerManager(mountUtil mount.Interface, cadvisorInterface cadvisor.Interface, nodeConfig NodeConfig, failSwapOn bool, recorder record.EventRecorder, kubeClient clientset.Interface) (ContainerManager, error) {
    subsystems := GetCgroupSubsystems()

    if failSwapOn { // Check whether swap is enabled. The Kubelet does not support running with swap enabled.
        swapFile := "/proc/swaps"
        swapData := os.ReadFile(swapFile)
        ...
    }

    machineInfo := cadvisorInterface.MachineInfo()
    capacity := cadvisor.CapacityFromMachineInfo(machineInfo)
    for k, v := range capacity {
        internalCapacity[k] = v
    }

    cgroupRoot    := ParseCgroupfsToCgroupName(nodeConfig.CgroupRoot)      // ""
    cgroupManager := NewCgroupManager(subsystems, nodeConfig.CgroupDriver) // "cgroupfs"

    if nodeConfig.CgroupsPerQOS { // true by default
        cgroupManager.Validate(cgroupRoot)
        cgroupRoot = NewCgroupName(cgroupRoot, defaultNodeAllocatableCgroupName) // -> "/kubepods"
    }
    Info("Creating Container Manager object based on Node Config", "nodeConfig", nodeConfig)

    qosContainerManager := NewQOSContainerManager(subsystems, cgroupRoot, nodeConfig, cgroupManager)

    cm := &containerManagerImpl{
        cadvisorInterface:   cadvisorInterface,
        mountUtil:           mountUtil,
        NodeConfig:          nodeConfig,
        subsystems:          subsystems,
        cgroupManager:       cgroupManager,
        capacity:            capacity,
        internalCapacity:    internalCapacity,
        cgroupRoot:          cgroupRoot,
        recorder:            recorder,
        qosContainerManager: qosContainerManager,
    }

    cm.topologyManager = topologymanager.NewManager()
    cm.deviceManager   = devicemanager.NewManagerImpl(machineInfo.Topology, cm.topologyManager)
    cm.draManager      = dra.NewManagerImpl(kubeClient) // initialize DRA manager
    cm.cpuManager      = cpumanager.NewManager() // Initialize CPU manager
    cm.memoryManager   = memorymanager.NewManager()

    return cm, nil
}