refactor project structure

.dockerignore

+tmp/

.env

+DATA_PATH=./tmp
+KUBESPHERE_LOG_LEVEL=debug

.gitattributes

+pkg/cmd/api/spec/api.swagger.json linguist-generated=true
+pkg/cmd/api/spec/static.go linguist-generated=true

.github/.stale.yaml

+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 30
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 14
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - lifecycle/frozen
+staleLabel: lifecycle/stale
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Any further update will
+  cause the issue/pull request to no longer be considered stale. Thank you for your contributions.
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: >
+  This issue is being automatically closed due to inactivity.

.github/ISSUE_TEMPLATE/bug_report.md

+---
+name: Bug report
+about: Create a report to help us improve
+---
+
+ 
+**General remarks**
+
+> Please delete this section including header before submitting
+> 也可以使用中文
+>
+> This form is to report bugs. For general usage questions refer to our Slack channel
+>        [KubeSphere-users](https://join.slack.com/t/kubesphere/shared_invite/enQtNTE3MDIxNzUxNzQ0LTdkNTc3OTdmNzdiODViZjViNTU5ZDY3M2I2MzY4MTI4OGZlOTJmMDg5ZTFiMDAwYzNlZDY5NjA0NzZlNDU5NmY)
+
+**Describe the bug(描述下问题)**
+A clear and concise description of what the bug is.
+
+For UI issues please also add a screenshot that shows the issue.
+
+**Versions used(KubeSphere/Kubernetes的版本)**
+KubeSphere:
+Kubernetes: (If KubeSphere installer used, you can skip this)
+
+
+**Environment(环境的硬件配置)**
+How many nodes and their hardware configuration: 
+
+For example:
+3 masters:  8cpu/8g
+3 nodes: 8cpu/16g
+
+(and other info are welcomed to help us debugging)
+
+**To Reproduce(复现步骤)**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior(预期行为)**
+A clear and concise description of what you expected to happen.

.gitmodules

+[submodule "vendor/github.com/knative/pkg"]
+	path = vendor/github.com/knative/pkg
+	url = https://github.com/knative/pkg.git

.travis.yml

+services:
+  - docker
+
+language: go
+
+git:
+  depth: false
+
+go:
+  - 1.12
+
+go_import_path: kubesphere.io/kubesphere
+
+before_install:
+  - go get -u github.com/golang/dep/cmd/dep
+
+before_script:
+  - dep ensure -v
+  - docker --version
+  - bash hack/install_kubebuilder.sh
+
+script:
+  - make all && make test && bash hack/docker_build.sh
+
+deploy:
+  skip_cleanup: true
+  provider: script
+  script: bash hack/docker_push.sh
+  on:
+    branch: master

Gopkg.toml

+required = [
+    "github.com/emicklei/go-restful",
+    "github.com/onsi/ginkgo", # for test framework
+    "github.com/onsi/gomega", # for test matchers
+    "k8s.io/gengo/examples/defaulter-gen/generators",
+    "k8s.io/gengo/examples/deepcopy-gen/generators",
+    "k8s.io/client-go/plugin/pkg/client/auth/gcp", # for development against gcp
+    "k8s.io/code-generator/cmd/client-gen",
+    "sigs.k8s.io/controller-tools/cmd/controller-gen", # for crd/rbac generation
+    "sigs.k8s.io/controller-runtime/pkg/client/config",
+    "sigs.k8s.io/controller-runtime/pkg/controller",
+    "sigs.k8s.io/controller-runtime/pkg/handler",
+    "sigs.k8s.io/controller-runtime/pkg/manager",
+    "sigs.k8s.io/controller-runtime/pkg/runtime/signals",
+    "sigs.k8s.io/controller-runtime/pkg/source",
+    "sigs.k8s.io/testing_frameworks/integration", # for integration testing
+    "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1",
+    "github.com/kubesphere/s2ioperator/pkg/client/clientset/versioned",
+    "github.com/kubesphere/s2ioperator/pkg/client/informers/externalversions",
+    "github.com/kubesphere/s2ioperator/pkg/apis/devops/v1alpha1"
+]
+
+[[constraint]]
+  name = "github.com/docker/docker"
+  version = "v17.05.0-ce"
+
+[[override]]
+  name = "k8s.io/api"
+  version = "kubernetes-1.13.1"
+
+[[override]]
+  name = "k8s.io/apimachinery"
+  version = "kubernetes-1.13.1"
+
+[[constraint]]
+  name = "k8s.io/code-generator"
+  version = "kubernetes-1.13.1"
+
+[[override]]
+  name = "k8s.io/client-go"
+  version = "kubernetes-1.13.1"
+
+[[constraint]]
+  name = "k8s.io/kubernetes"
+  version = "1.13.1"
+
+[[constraint]]
+  name="sigs.k8s.io/controller-runtime"
+  version="v0.1.7"
+
+[[constraint]]
+  name="sigs.k8s.io/controller-tools"
+  version="v0.1.7"
+
+[[constraint]]
+  name="github.com/kubesphere/s2ioperator"
+  version="v0.0.4"
+
+[[override]]
+  name="github.com/bifurcation/mint"
+  revision="824af65410658916142a7600349144e1289f2110"
+
+[prune]
+  go-tests = true
+  unused-packages = true
+  non-go = true
+
+[[prune.project]]
+  name = "k8s.io/code-generator"
+  unused-packages = false
+  non-go = false
+
+
+# To use reference package:
+#   vendor/github.com/docker/docker/client/container_commit.go:17: undefined: reference.ParseNormalizedNamed
+#   vendor/github.com/docker/docker/client/container_commit.go:25: undefined: reference.TagNameOnly
+#   vendor/github.com/docker/docker/client/container_commit.go:30: undefined: reference.FamiliarNam
+[[override]]
+  name = "github.com/docker/distribution"
+  branch = "master"
+
+# To use reference package:
+#   vendor/github.com/docker/docker/registry/registry.go:30: cannot call non-function tlsconfig.ServerDefault (type tls.Config)
+#   vendor/github.com/docker/docker/registry/registry.go:66: undefined: tlsconfig.SystemCertPool
+#   vendor/github.com/docker/docker/registry/registry.go:168: cannot call non-function tlsconfig.ServerDefault (type tls.Config)
+#   vendor/github.com/docker/docker/registry/service_v2.go:11: cannot call non-function tlsconfig.ServerDefault (type tls.Config)
+[[override]]
+  name = "github.com/docker/go-connections"
+  branch = "master"
+
+# For dependency below: Refer to issue https://github.com/golang/dep/issues/1799
+[[override]]
+  name = "gopkg.in/fsnotify.v1"
+  source = "https://github.com/fsnotify/fsnotify.git"
+  version = "v1.4.7"
+
+[[override]]
+  name = "github.com/russross/blackfriday"
+  version = "v1.5.2"
+
+[[constraint]]
+  branch = "master"
+  name = "sigs.k8s.io/application"
+
+[[constraint]]
+  name = "github.com/kiali/kiali"
+  version = "0.15.0"
+
+[[constraint]]
+  name = "github.com/gorilla/mux"
+  version = "1.7.0"

LICENSE

+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

Makefile

+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+
+# The binary to build 
+BIN ?= ks-apiserver
+
+IMG ?= kubespheredev/ks-apiserver
+OUTPUT_DIR=bin
+
+define ALL_HELP_INFO
+# Build code.
+#
+# Args:
+#   WHAT: Directory names to build.  If any of these directories has a 'main'
+#     package, the build will produce executable files under $(OUT_DIR).
+#     If not specified, "everything" will be built.
+#   GOFLAGS: Extra flags to pass to 'go' when building.
+#   GOLDFLAGS: Extra linking flags passed to 'go' when building.
+#   GOGCFLAGS: Additional go compile flags passed to 'go' when building.
+#
+# Example:
+#   make
+#   make all
+#   make all WHAT=cmd/ks-apiserver
+#     Note: Use the -N -l options to disable compiler optimizations an inlining.
+#           Using these build options allows you to subsequently use source
+#           debugging tools like delve.
+endef
+.PHONY: all
+all: test ks-apiserver ks-apigateway ks-iam
+
+# Build ks-apiserver binary
+ks-apiserver: test
+	hack/gobuild.sh cmd/ks-apiserver
+
+# Build ks-apigateway binary
+ks-apigateway: test
+	hack/gobuild.sh cmd/ks-apigateway
+
+# Build ks-iam binary
+ks-iam: test
+	hack/gobuild.sh cmd/ks-iam
+
+# Run go fmt against code 
+fmt:
+	go fmt ./pkg/... ./cmd/...
+
+# Run go vet against code
+vet:
+	go vet ./pkg/... ./cmd/...
+
+# Generate manifests e.g. CRD, RBAC etc.
+manifests:
+	go run vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go all
+
+deploy: manifests
+	kubectl apply -f config/crds
+	kustomize build config/default | kubectl apply -f -
+
+# Generate DeepCopy to implement runtime.Object
+deepcopy:
+	./vendor/k8s.io/code-generator/generate-groups.sh deepcopy kubesphere.io/kubesphere/pkg/client kubesphere.io/kubesphere/pkg/apis "servicemesh:v1alpha2"
+
+# Generate code
+generate:
+ifndef GOPATH
+	$(error GOPATH not defined, please define GOPATH. Run "go help gopath" to learn more about GOPATH)
+endif
+	go generate ./pkg/... ./cmd/...
+
+# Build the docker image
+docker-build: all
+	docker build . -t ${IMG}
+
+# Run tests
+test: generate fmt vet
+	go test ./pkg/... ./cmd/... -coverprofile cover.out
+
+.PHONY: clean
+clean:
+	-make -C ./pkg/version clean
+	@echo "ok"

PROJECT

+version: "1"
+domain: kubesphere.io
+repo: kubesphere.io/kubesphere

README.md

+# KubeSphere
+[![License](http://img.shields.io/badge/license-apache%20v2-blue.svg)](https://github.com/KubeSphere/KubeSphere/blob/master/LICENSE)
+[![Build Status](https://travis-ci.org/kubesphere/kubesphere.svg?branch=master)](https://travis-ci.org/kubesphere/kubesphere)
+
+----
+***KubeSphere*** is a distribution of [Kubernetes](https://kubernetes.io), aimed to provide quick setup, friendly and easily use, and powerful management features for Kubernetes clusters, which could help both personal and enterprise users, reduce their learning curve of Kubernetes, accelerate their transform process from other container platforms to Kubernetes.   
+
+**Features:**
+ - Multiple IaaS platform support, including baremetal/KVM/QingCloud, and more will be supported in future release.  
+ - Easy setup of Kubernetes standalone(only one master node) and cluster environment(including High Availability support).  
+ - Powerful management console to help business users to manage and monitor the Kubernetes.  
+ - Integrate with [OpenPitrix](https://github.com/openpitrix) to provide full life cycle of application management and be compatible of helm package.  
+ - Support popular open source network solutions, including calico and flannel, also could use [qingcloud hostnic solution](https://github.com/yunify/hostnic-cni) if the Kubernetes is deployed on QingCloud platform.  
+ - Support popular open source storage solutions, including Glusterfs and Cephfs, also could use [qingcloud storage solution](https://github.com/yunify/qingcloud-csi) or [qingstor storage solution](https://github.com/yunify/qingstor-csi) if the Kubernetes is deployed on QingCloud platform or QingStor NeonSAN.  
+ - CI/CD support.  
+ - Service Mesh support.  
+ - Multiple image registries support.  
+ - Integrate with QingCloud IAM.  
+----
+
+## Motivation
+
+The project originates from the requirement and pains we heard from our customers on public and private QingCloud platform, who have strong will to deploy Kubernetes in their IT system but struggle on completed setup process and long learning curve. With help of KubeSphere, their IT operators could setup Kubernetes environment quickly and use an easy management UI interface to mange their applications, also KubeSphere provides more features to help customers to handle daily business more easily, including CI/CD, micro services management...etc.
+
+Getting Started
+---------------
+**TBD**
+
+## Design
+
+## Contributing to the project
+
+All members of the KubeSphere community must abide by [Code of Conduct](docs/code-of-conduct.md). Only by respecting each other can we develop a productive, collaborative community.
+
+You can then find out more detail [here](docs/welcome-toKubeSphere-new-developer-guide.md).
+
+

build/controller-manager/Dockerfile

+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+
+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+FROM golang:1.10.3 as controller-manager-builder
+
+COPY / /go/src/kubesphere.io/kubesphere
+WORKDIR /go/src/kubesphere.io/kubesphere
+
+RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build --ldflags "-extldflags -static" -o controller-manager ./cmd/controller-manager/
+
+FROM alpine:3.7
+RUN apk add --update ca-certificates && update-ca-certificates
+COPY --from=controller-manager-builder /go/src/kubesphere.io/kubesphere/controller-manager /usr/local/bin/
+CMD controller-manager

build/ks-apigateway/Dockerfile

+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+
+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+
+FROM golang:1.12 as ks-apigateway-builder
+
+COPY / /go/src/kubesphere.io/kubesphere
+WORKDIR /go/src/kubesphere.io/kubesphere
+RUN CGO_ENABLED=0 GO111MODULE=off GOOS=linux GOARCH=amd64 go build -i -ldflags '-w -s' -o ks-apigateway cmd/ks-apigateway/apiserver.go && \
+    go run tools/cmd/doc-gen/main.go --output=install/swagger-ui/api.json
+
+FROM alpine:3.9
+RUN apk add --update ca-certificates && update-ca-certificates
+COPY --from=ks-apigateway-builder /go/src/kubesphere.io/kubesphere/ks-apigateway /usr/local/bin/
+COPY --from=ks-apigateway-builder /go/src/kubesphere.io/kubesphere/install/swagger-ui /var/static/swagger-ui
+CMD ["sh"]
\ No newline at end of file

build/ks-apiserver/Dockerfile

+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+
+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+FROM golang:1.12 as ks-apiserver-builder
+
+COPY / /go/src/kubesphere.io/kubesphere
+
+WORKDIR /go/src/kubesphere.io/kubesphere
+RUN CGO_ENABLED=0 GO111MODULE=off GOOS=linux GOARCH=amd64 go build -i -ldflags '-w -s' -o ks-apiserver cmd/ks-apiserver/apiserver.go
+
+FROM alpine:3.9
+RUN apk add --update ca-certificates && update-ca-certificates
+COPY --from=ks-apiserver-builder /go/src/kubesphere.io/kubesphere/ks-apiserver /usr/local/bin/
+CMD ["sh"]

build/ks-iam/Dockerfile

+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+
+# Copyright 2018 The KubeSphere Authors. All rights reserved.
+# Use of this source code is governed by a Apache license
+# that can be found in the LICENSE file.
+FROM golang:1.12 as ks-iam-builder
+
+COPY / /go/src/kubesphere.io/kubesphere
+
+WORKDIR /go/src/kubesphere.io/kubesphere
+RUN CGO_ENABLED=0 GO111MODULE=off GOOS=linux GOARCH=amd64 go build -i -ldflags '-w -s' -o ks-iam cmd/ks-iam/apiserver.go
+
+FROM alpine:3.9
+RUN apk add --update ca-certificates && update-ca-certificates
+COPY --from=ks-iam-builder /go/src/kubesphere.io/kubesphere/ks-iam /usr/local/bin/
+CMD ["sh"]

cmd/controller-manager/controller-manager.go

+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package main
+
+import (
+	"flag"
+
+	"os"
+	"sigs.k8s.io/application/pkg/apis/app/v1beta1"
+
+	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
+	"kubesphere.io/kubesphere/pkg/informers"
+	"kubesphere.io/kubesphere/pkg/simple/client/k8s"
+	"kubesphere.io/kubesphere/pkg/simple/controller/namespace"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
+	"sigs.k8s.io/controller-runtime/pkg/runtime/signals"
+
+	"kubesphere.io/kubesphere/pkg/apis"
+	"kubesphere.io/kubesphere/pkg/controller"
+	"kubesphere.io/kubesphere/pkg/webhook"
+)
+
+func main() {
+	var metricsAddr string
+	flag.StringVar(&metricsAddr, "metrics-addr", ":8080", "The address the metric endpoint binds to.")
+	flag.Parse()
+	logf.SetLogger(logf.ZapLogger(false))
+	log := logf.Log.WithName("entrypoint")
+
+	// Get a config to talk to the apiserver
+	log.Info("setting up client for manager")
+	cfg, err := k8s.Config()
+	if err != nil {
+		log.Error(err, "unable to set up client config")
+		os.Exit(1)
+	}
+
+	// Create a new Cmd to provide shared dependencies and start components
+	log.Info("setting up manager")
+	mgr, err := manager.New(cfg, manager.Options{})
+	if err != nil {
+		log.Error(err, "unable to set up overall controller manager")
+		os.Exit(1)
+	}
+
+	log.Info("Registering Components.")
+
+	// Setup Scheme for all resources
+	log.Info("setting up scheme")
+	if err := apis.AddToScheme(mgr.GetScheme()); err != nil {
+		log.Error(err, "unable add APIs to scheme")
+		os.Exit(1)
+	}
+
+	log.Info("Print all known types")
+	for k, v := range mgr.GetScheme().AllKnownTypes() {
+		if k.Group == v1beta1.SchemeGroupVersion.Group {
+			log.Info(k.String() + " / " + v.String())
+		}
+	}
+
+	// Setup all Controllers
+	log.Info("Setting up controller")
+	if err := controller.AddToManager(mgr); err != nil {
+		log.Error(err, "unable to register controllers to the manager")
+		os.Exit(1)
+	}
+
+	log.Info("setting up webhooks")
+	if err := webhook.AddToManager(mgr); err != nil {
+		log.Error(err, "unable to register webhooks to the manager")
+		os.Exit(1)
+	}
+
+	err = mgr.Add(manager.RunnableFunc(func(s <-chan struct{}) error {
+		informerFactory := informers.SharedInformerFactory()
+		informerFactory.Start(s)
+		namespace.NewNamespaceController(k8s.Client(),
+			informerFactory.Core().V1().Namespaces(),
+			informerFactory.Rbac().V1().Roles()).Start(s)
+		return nil
+	}))
+
+	if err != nil {
+		log.Error(err, "error Adding controllers to the Manager")
+		os.Exit(1)
+	}
+
+	// Start the Cmd
+	log.Info("Starting the Cmd.")
+	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
+		log.Error(err, "unable to run the manager")
+		os.Exit(1)
+	}
+}

cmd/ks-apigateway/apiserver.go

+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+package main
+
+import (
+	"github.com/mholt/caddy/caddy/caddymain"
+	"github.com/mholt/caddy/caddyhttp/httpserver"
+
+	// Install apis
+	_ "kubesphere.io/kubesphere/pkg/apigateway/caddy-plugin/authenticate"
+	_ "kubesphere.io/kubesphere/pkg/apigateway/caddy-plugin/authentication"
+	_ "kubesphere.io/kubesphere/pkg/apigateway/caddy-plugin/swagger"
+)
+
+func main() {
+	httpserver.RegisterDevDirective("authenticate", "jwt")
+	httpserver.RegisterDevDirective("authentication", "jwt")
+	httpserver.RegisterDevDirective("swagger", "jwt")
+	caddymain.Run()
+}

cmd/ks-apiserver/apiserver.go

+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+package main
+
+import (
+	"kubesphere.io/kubesphere/cmd/ks-apiserver/app"
+	"log"
+	// Install apis
+	_ "kubesphere.io/kubesphere/pkg/apis/logging/install"
+	_ "kubesphere.io/kubesphere/pkg/apis/metrics/install"
+	_ "kubesphere.io/kubesphere/pkg/apis/monitoring/install"
+	_ "kubesphere.io/kubesphere/pkg/apis/operations/install"
+	_ "kubesphere.io/kubesphere/pkg/apis/resources/install"
+	_ "kubesphere.io/kubesphere/pkg/apis/servicemesh/metrics/install"
+)
+
+func main() {
+
+	cmd := app.NewAPIServerCommand()
+
+	if err := cmd.Execute(); err != nil {
+		log.Fatalln(err)
+	}
+}

cmd/ks-apiserver/app/options/options.go

+package options
+
+import (
+	"github.com/spf13/pflag"
+	genericoptions "kubesphere.io/kubesphere/pkg/options"
+)
+
+type ServerRunOptions struct {
+	GenericServerRunOptions *genericoptions.ServerRunOptions
+
+	// istio pilot discovery service url
+	IstioPilotServiceURL string
+}
+
+func NewServerRunOptions() *ServerRunOptions {
+
+	s := ServerRunOptions{
+		GenericServerRunOptions: genericoptions.NewServerRunOptions(),
+		IstioPilotServiceURL:    "http://istio-pilot.istio-system.svc:8080/version",
+	}
+
+	return &s
+}
+
+func (s *ServerRunOptions) AddFlags(fs *pflag.FlagSet) {
+
+	s.GenericServerRunOptions.AddFlags(fs)
+
+	fs.StringVar(&s.IstioPilotServiceURL, "istio-pilot-service-url", "http://istio-pilot.istio-system.svc:8080/version", "istio pilot discovery service url")
+}

cmd/ks-apiserver/app/server.go

+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+package app
+
+import (
+	goflag "flag"
+	"fmt"
+	"github.com/golang/glog"
+	"github.com/json-iterator/go"
+	kconfig "github.com/kiali/kiali/config"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"kubesphere.io/kubesphere/cmd/ks-apiserver/app/options"
+	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
+	"kubesphere.io/kubesphere/pkg/filter"
+	"kubesphere.io/kubesphere/pkg/informers"
+	logging "kubesphere.io/kubesphere/pkg/models/log"
+	"kubesphere.io/kubesphere/pkg/signals"
+	es "kubesphere.io/kubesphere/pkg/simple/client/elasticsearch"
+	fb "kubesphere.io/kubesphere/pkg/simple/client/fluentbit"
+	"kubesphere.io/kubesphere/pkg/simple/client/mysql"
+	"log"
+	"net/http"
+)
+
+var jsonIter = jsoniter.ConfigCompatibleWithStandardLibrary
+
+func NewAPIServerCommand() *cobra.Command {
+	s := options.NewServerRunOptions()
+
+	cmd := &cobra.Command{
+		Use: "ks-apiserver",
+		Long: `The KubeSphere API server validates and configures data
+for the api objects. The API Server services REST operations and provides the frontend to the
+cluster's shared state through which all other components interact.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return Run(s)
+		},
+	}
+
+	s.AddFlags(cmd.Flags())
+	cmd.Flags().AddGoFlagSet(goflag.CommandLine)
+	glog.CopyStandardLogTo("INFO")
+
+	return cmd
+}
+
+func Run(s *options.ServerRunOptions) error {
+
+	pflag.VisitAll(func(flag *pflag.Flag) {
+		log.Printf("FLAG: --%s=%q", flag.Name, flag.Value)
+	})
+
+	var err error
+
+	waitForResourceSync()
+
+	container := runtime.Container
+	container.Filter(filter.Logging)
+
+	log.Printf("Server listening on %d.", s.GenericServerRunOptions.InsecurePort)
+
+	for _, webservice := range container.RegisteredWebServices() {
+		for _, route := range webservice.Routes() {
+			log.Printf(route.Path)
+		}
+	}
+
+	initializeESClientConfig()
+	initializeKialiConfig(s)
+
+	if s.GenericServerRunOptions.InsecurePort != 0 {
+		err = http.ListenAndServe(fmt.Sprintf("%s:%d", s.GenericServerRunOptions.BindAddress, s.GenericServerRunOptions.InsecurePort), container)
+	}
+
+	if s.GenericServerRunOptions.SecurePort != 0 && len(s.GenericServerRunOptions.TlsCertFile) > 0 && len(s.GenericServerRunOptions.TlsPrivateKey) > 0 {
+		err = http.ListenAndServeTLS(fmt.Sprintf("%s:%d", s.GenericServerRunOptions.BindAddress, s.GenericServerRunOptions.SecurePort), s.GenericServerRunOptions.TlsCertFile, s.GenericServerRunOptions.TlsPrivateKey, container)
+	}
+
+	return err
+}
+
+func initializeKialiConfig(s *options.ServerRunOptions) {
+	// Initialize kiali config
+	config := kconfig.NewConfig()
+
+	// Exclude system namespaces
+	config.API.Namespaces.Exclude = []string{"istio-system", "kubesphere*", "kube*"}
+	config.InCluster = true
+
+	// Set default prometheus service url
+	// TODO: use kubesphere builtin p8s instead of istio p8s
+	config.ExternalServices.PrometheusServiceURL = "http://prometheus.istio-system.svc.cluster.local:9090"
+	config.ExternalServices.PrometheusCustomMetricsURL = config.ExternalServices.PrometheusServiceURL
+
+	// Set istio pilot discovery service url
+	config.ExternalServices.Istio.UrlServiceVersion = s.IstioPilotServiceURL
+
+	kconfig.Set(config)
+}
+
+func initializeESClientConfig() {
+
+	var outputs []logging.OutputDBBinding
+	var configs *es.ESConfigs
+
+	db := mysql.Client()
+	if !db.HasTable(&logging.OutputDBBinding{}) {
+		// Panic
+		log.Fatal("Flyway migration is not completed")
+	}
+
+	err := db.Find(&outputs).Error
+	if err != nil {
+		return
+	}
+
+	// Retrieve es-type output from db
+	var params []fb.Parameter
+	for _, output := range outputs {
+		err := jsonIter.UnmarshalFromString(output.Parameters, &params)
+		if err == nil {
+			if configs = logging.ParseEsOutputParams(params); configs != nil {
+				configs.WriteESConfigs()
+				return
+			}
+		}
+	}
+}
+
+func waitForResourceSync() {
+	stopChan := signals.SetupSignalHandler()
+
+	informerFactory := informers.SharedInformerFactory()
+	informerFactory.Rbac().V1().Roles().Lister()
+	informerFactory.Rbac().V1().RoleBindings().Lister()
+	informerFactory.Rbac().V1().ClusterRoles().Lister()
+	informerFactory.Rbac().V1().ClusterRoleBindings().Lister()
+
+	informerFactory.Storage().V1().StorageClasses().Lister()
+
+	informerFactory.Core().V1().Namespaces().Lister()
+	informerFactory.Core().V1().Nodes().Lister()
+	informerFactory.Core().V1().ResourceQuotas().Lister()
+	informerFactory.Core().V1().Pods().Lister()
+	informerFactory.Core().V1().Services().Lister()
+	informerFactory.Core().V1().PersistentVolumeClaims().Lister()
+	informerFactory.Core().V1().Secrets().Lister()
+	informerFactory.Core().V1().ConfigMaps().Lister()
+
+	informerFactory.Apps().V1().ControllerRevisions().Lister()
+	informerFactory.Apps().V1().StatefulSets().Lister()
+	informerFactory.Apps().V1().Deployments().Lister()
+	informerFactory.Apps().V1().DaemonSets().Lister()
+
+	informerFactory.Batch().V1().Jobs().Lister()
+	informerFactory.Batch().V1beta1().CronJobs().Lister()
+
+	informerFactory.Start(stopChan)
+	informerFactory.WaitForCacheSync(stopChan)
+
+	s2iInformerFactory := informers.S2iSharedInformerFactory()
+	s2iInformerFactory.Devops().V1alpha1().S2iBuilderTemplates().Lister()
+	s2iInformerFactory.Devops().V1alpha1().S2iRuns().Lister()
+	s2iInformerFactory.Devops().V1alpha1().S2iBuilders().Lister()
+
+	s2iInformerFactory.Start(stopChan)
+	s2iInformerFactory.WaitForCacheSync(stopChan)
+	log.Println("resources sync success")
+}

cmd/ks-iam/apiserver.go

+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+package main
+
+import (
+	"kubesphere.io/kubesphere/cmd/ks-iam/app"
+	"log"
+	// Install apis
+	_ "kubesphere.io/kubesphere/pkg/apis/iam/install"
+)
+
+func main() {
+
+	cmd := app.NewAPIServerCommand()
+
+	if err := cmd.Execute(); err != nil {
+		log.Fatalln(err)
+	}
+}

cmd/ks-iam/app/options/options.go

+package options
+
+import (
+	"github.com/spf13/pflag"
+	genericoptions "kubesphere.io/kubesphere/pkg/options"
+)
+
+type ServerRunOptions struct {
+	GenericServerRunOptions *genericoptions.ServerRunOptions
+}
+
+func NewServerRunOptions() *ServerRunOptions {
+	s := &ServerRunOptions{
+		GenericServerRunOptions: genericoptions.NewServerRunOptions(),
+	}
+
+	return s
+}
+
+func (s *ServerRunOptions) AddFlags(fs *pflag.FlagSet) {
+	s.GenericServerRunOptions.AddFlags(fs)
+}

cmd/ks-iam/app/server.go

+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+package app
+
+import (
+	goflag "flag"
+	"fmt"
+	"github.com/golang/glog"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"kubesphere.io/kubesphere/cmd/ks-iam/app/options"
+	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
+	"kubesphere.io/kubesphere/pkg/filter"
+	"kubesphere.io/kubesphere/pkg/informers"
+	"kubesphere.io/kubesphere/pkg/models/iam"
+	"kubesphere.io/kubesphere/pkg/signals"
+	"log"
+	"net/http"
+)
+
+func NewAPIServerCommand() *cobra.Command {
+	s := options.NewServerRunOptions()
+
+	cmd := &cobra.Command{
+		Use: "ks-iam",
+		Long: `The KubeSphere API server validates and configures data
+for the api objects. The API Server services REST operations and provides the frontend to the
+cluster's shared state through which all other components interact.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return Run(s)
+		},
+	}
+	s.AddFlags(cmd.Flags())
+	cmd.Flags().AddGoFlagSet(goflag.CommandLine)
+	glog.CopyStandardLogTo("INFO")
+
+	return cmd
+}
+
+func Run(s *options.ServerRunOptions) error {
+
+	pflag.VisitAll(func(flag *pflag.Flag) {
+		log.Printf("FLAG: --%s=%q", flag.Name, flag.Value)
+	})
+
+	var err error
+
+	err = iam.DatabaseInit()
+
+	if err != nil {
+		return err
+	}
+
+	waitForResourceSync()
+
+	container := runtime.Container
+	container.Filter(filter.Logging)
+
+	if s.GenericServerRunOptions.InsecurePort != 0 {
+		err = http.ListenAndServe(fmt.Sprintf("%s:%d", s.GenericServerRunOptions.BindAddress, s.GenericServerRunOptions.InsecurePort), container)
+	}
+
+	if s.GenericServerRunOptions.SecurePort != 0 && len(s.GenericServerRunOptions.TlsCertFile) > 0 && len(s.GenericServerRunOptions.TlsPrivateKey) > 0 {
+		err = http.ListenAndServeTLS(fmt.Sprintf("%s:%d", s.GenericServerRunOptions.BindAddress, s.GenericServerRunOptions.SecurePort), s.GenericServerRunOptions.TlsCertFile, s.GenericServerRunOptions.TlsPrivateKey, container)
+	}
+
+	return err
+}
+
+func waitForResourceSync() {
+	stopChan := signals.SetupSignalHandler()
+
+	informerFactory := informers.SharedInformerFactory()
+	informerFactory.Rbac().V1().Roles().Lister()
+	informerFactory.Rbac().V1().RoleBindings().Lister()
+	informerFactory.Rbac().V1().ClusterRoles().Lister()
+	informerFactory.Rbac().V1().ClusterRoleBindings().Lister()
+
+	informerFactory.Core().V1().Namespaces().Lister()
+
+	informerFactory.Start(stopChan)
+	informerFactory.WaitForCacheSync(stopChan)
+	log.Println("resources sync success")
+}

config/crds/app_v1beta1_application.yaml

+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  labels:
+    controller-tools.k8s.io: "1.0"
+  name: applications.app.k8s.io
+spec:
+  group: app.k8s.io
+  names:
+    kind: Application
+    plural: applications
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        apiVersion:
+          type: string
+        kind:
+          type: string
+        metadata:
+          type: object
+        spec:
+          properties:
+            assemblyPhase:
+              type: string
+            componentKinds:
+              items:
+                type: object
+              type: array
+            descriptor:
+              properties:
+                description:
+                  type: string
+                icons:
+                  items:
+                    properties:
+                      size:
+                        type: string
+                      src:
+                        type: string
+                      type:
+                        type: string
+                    required:
+                    - src
+                    type: object
+                  type: array
+                keywords:
+                  items:
+                    type: string
+                  type: array
+                links:
+                  items:
+                    properties:
+                      description:
+                        type: string
+                      url:
+                        type: string
+                    type: object
+                  type: array
+                maintainers:
+                  items:
+                    properties:
+                      email:
+                        type: string
+                      name:
+                        type: string
+                      url:
+                        type: string
+                    type: object
+                  type: array
+                notes:
+                  type: string
+                owners:
+                  items:
+                    properties:
+                      email:
+                        type: string
+                      name:
+                        type: string
+                      url:
+                        type: string
+                    type: object
+                  type: array
+                type:
+                  type: string
+                version:
+                  type: string
+              type: object
+            info:
+              items:
+                properties:
+                  name:
+                    type: string
+                  type:
+                    type: string
+                  value:
+                    type: string
+                  valueFrom:
+                    properties:
+                      configMapKeyRef:
+                        properties:
+                          apiVersion:
+                            type: string
+                          fieldPath:
+                            type: string
+                          key:
+                            type: string
+                          kind:
+                            type: string
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                          resourceVersion:
+                            type: string
+                          uid:
+                            type: string
+                        type: object
+                      ingressRef:
+                        properties:
+                          apiVersion:
+                            type: string
+                          fieldPath:
+                            type: string
+                          host:
+                            type: string
+                          kind:
+                            type: string
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                          path:
+                            type: string
+                          resourceVersion:
+                            type: string
+                          uid:
+                            type: string
+                        type: object
+                      secretKeyRef:
+                        properties:
+                          apiVersion:
+                            type: string
+                          fieldPath:
+                            type: string
+                          key:
+                            type: string
+                          kind:
+                            type: string
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                          resourceVersion:
+                            type: string
+                          uid:
+                            type: string
+                        type: object
+                      serviceRef:
+                        properties:
+                          apiVersion:
+                            type: string
+                          fieldPath:
+                            type: string
+                          kind:
+                            type: string
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                          path:
+                            type: string
+                          port:
+                            format: int32
+                            type: integer
+                          resourceVersion:
+                            type: string
+                          uid:
+                            type: string
+                        type: object
+                      type:
+                        type: string
+                    type: object
+                type: object
+              type: array
+            selector:
+              type: object
+          type: object
+        status:
+          properties:
+            components:
+              items:
+                properties:
+                  group:
+                    type: string
+                  kind:
+                    type: string
+                  link:
+                    type: string
+                  name:
+                    type: string
+                  status:
+                    type: string
+                type: object
+              type: array
+            conditions:
+              items:
+                properties:
+                  lastTransitionTime:
+                    format: date-time
+                    type: string
+                  lastUpdateTime:
+                    format: date-time
+                    type: string
+                  message:
+                    type: string
+                  reason:
+                    type: string
+                  status:
+                    type: string
+                  type:
+                    type: string
+                required:
+                - type
+                - status
+                type: object
+              type: array
+            observedGeneration:
+              format: int64
+              type: integer
+          type: object
+  version: v1beta1
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

config/crds/istio_v1alpha3_gateway.yaml

+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  labels:
+    controller-tools.k8s.io: "1.0"
+  name: gateways.istio.kubesphere.io
+spec:
+  group: istio.kubesphere.io
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          properties:
+            selector:
+              description: One or more labels that indicate a specific set of pods/VMs
+                on which this gateway configuration should be applied. If no selectors
+                are provided, the gateway will be implemented by the default istio-ingress
+                controller.
+              type: object
+            servers:
+              description: 'REQUIRED: A list of server specifications.'
+              items:
+                properties:
+                  hosts:
+                    description: A list of hosts exposed by this gateway. While typically
+                      applicable to HTTP services, it can also be used for TCP services
+                      using TLS with SNI. Standard DNS wildcard prefix syntax is permitted.  A
+                      VirtualService that is bound to a gateway must having a matching
+                      host in its default destination. Specifically one of the VirtualService
+                      destination hosts is a strict suffix of a gateway host or a
+                      gateway host is a suffix of one of the VirtualService hosts.
+                    items:
+                      type: string
+                    type: array
+                  port:
+                    description: 'REQUIRED: The Port on which the proxy should listen
+                      for incoming connections'
+                    properties:
+                      name:
+                        description: Label assigned to the port.
+                        type: string
+                      number:
+                        description: 'REQUIRED: A valid non-negative integer port
+                          number.'
+                        format: int64
+                        type: integer
+                      protocol:
+                        description: 'REQUIRED: The protocol exposed on the port.
+                          MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP.'
+                        type: string
+                    required:
+                    - number
+                    - protocol
+                    type: object
+                  tls:
+                    description: Set of TLS related options that govern the server's
+                      behavior. Use these options to control if all http requests
+                      should be redirected to https, and the TLS modes to use.
+                    properties:
+                      caCertificates:
+                        description: REQUIRED if mode is "MUTUAL". The path to a file
+                          containing certificate authority certificates to use in
+                          verifying a presented client side certificate.
+                        type: string
+                      httpsRedirect:
+                        description: If set to true, the load balancer will send a
+                          302 redirect for all http connections, asking the clients
+                          to use HTTPS.
+                        type: boolean
+                      mode:
+                        description: 'Optional: Indicates whether connections to this
+                          port should be secured using TLS. The value of this field
+                          determines how TLS is enforced.'
+                        type: string
+                      privateKey:
+                        description: REQUIRED if mode is "SIMPLE" or "MUTUAL". The
+                          path to the file holding the server's private key.
+                        type: string
+                      serverCertificate:
+                        description: REQUIRED if mode is "SIMPLE" or "MUTUAL". The
+                          path to the file holding the server-side TLS certificate
+                          to use.
+                        type: string
+                      subjectAltNames:
+                        description: A list of alternate names to verify the subject
+                          identity in the certificate presented by the client.
+                        items:
+                          type: string
+                        type: array
+                    required:
+                    - httpsRedirect
+                    - serverCertificate
+                    - privateKey
+                    - caCertificates
+                    - subjectAltNames
+                    type: object
+                required:
+                - port
+                type: object
+              type: array
+          required:
+          - servers
+          type: object
+      required:
+      - spec
+  version: v1alpha3
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

config/default/kustomization.yaml

+# Adds namespace to all resources.
+namespace: t-system
+
+# Value of this field is prepended to the
+# names of all resources, e.g. a deployment named
+# "wordpress" becomes "alices-wordpress".
+# Note that it should also match with the prefix (text before '-') of the namespace
+# field above.
+namePrefix: t-
+
+# Labels to add to all resources and selectors.
+#commonLabels:
+#  someName: someValue
+
+# Each entry in this list must resolve to an existing
+# resource definition in YAML.  These are the resource
+# files that kustomize reads, modifies and emits as a
+# YAML string, with resources separated by document
+# markers ("---").
+resources:
+- ../rbac/rbac_role.yaml
+- ../rbac/rbac_role_binding.yaml
+- ../manager/manager.yaml
+  # Comment the following 3 lines if you want to disable
+  # the auth proxy (https://github.com/brancz/kube-rbac-proxy)
+  # which protects your /metrics endpoint.
+#- ../rbac/auth_proxy_service.yaml
+#- ../rbac/auth_proxy_role.yaml
+#- ../rbac/auth_proxy_role_binding.yaml
+
+patches:
+- manager_image_patch.yaml
+  # Protect the /metrics endpoint by putting it behind auth.
+  # Only one of manager_auth_proxy_patch.yaml and
+  # manager_prometheus_metrics_patch.yaml should be enabled.
+- manager_auth_proxy_patch.yaml
+  # If you want your controller-manager to expose the /metrics
+  # endpoint w/o any authn/z, uncomment the following line and
+  # comment manager_auth_proxy_patch.yaml.
+  # Only one of manager_auth_proxy_patch.yaml and
+  # manager_prometheus_metrics_patch.yaml should be enabled.
+#- manager_prometheus_metrics_patch.yaml
+
+vars:
+- name: WEBHOOK_SECRET_NAME
+  objref:
+    kind: Secret
+    name: webhook-server-secret
+    apiVersion: v1

config/default/manager_auth_proxy_patch.yaml

+# This patch inject a sidecar container which is a HTTP proxy for the controller manager,
+# it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    spec:
+      containers:
+      - name: kube-rbac-proxy
+        image: quay.io/coreos/kube-rbac-proxy:v0.4.0
+        args:
+        - "--secure-listen-address=0.0.0.0:8443"
+        - "--upstream=http://127.0.0.1:8080/"
+        - "--logtostderr=true"
+        - "--v=10"
+        ports:
+        - containerPort: 8443
+          name: https
+      - name: manager
+        args:
+        - "--metrics-addr=127.0.0.1:8080"

config/default/manager_image_patch.yaml

+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    spec:
+      containers:
+      # Change the value of image field below to your controller image URL
+      - image: kubespheredev/controller-manager:latest
+        name: manager

config/default/manager_prometheus_metrics_patch.yaml

+# This patch enables Prometheus scraping for the manager pod.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    metadata:
+      annotations:
+        prometheus.io/scrape: 'true'
+    spec:
+      containers:
+      # Expose the prometheus metrics on default port
+      - name: manager
+        ports:
+        - containerPort: 8080
+          name: metrics
+          protocol: TCP

config/manager/manager.yaml

+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    control-plane: controller-manager
+    controller-tools.k8s.io: "1.0"
+  name: system
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: controller-manager-service
+  namespace: system
+  labels:
+    control-plane: controller-manager
+    controller-tools.k8s.io: "1.0"
+spec:
+  selector:
+    control-plane: controller-manager
+    controller-tools.k8s.io: "1.0"
+  ports:
+  - port: 443
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: controller-manager
+  namespace: system
+  labels:
+    control-plane: controller-manager
+    controller-tools.k8s.io: "1.0"
+spec:
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+      controller-tools.k8s.io: "1.0"
+  serviceName: controller-manager-service
+  template:
+    metadata:
+      labels:
+        control-plane: controller-manager
+        controller-tools.k8s.io: "1.0"
+    spec:
+      containers:
+      - command:
+        - ./controller-manager
+        image: kubespheredev/controller-manager:latest
+        imagePullPolicy: Always
+        name: manager
+        env:
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          - name: SECRET_NAME
+            value: $(WEBHOOK_SECRET_NAME)
+        resources:
+          limits:
+            cpu: 100m
+            memory: 30Mi
+          requests:
+            cpu: 100m
+            memory: 20Mi
+        ports:
+        - containerPort: 9876
+          name: webhook-server
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /tmp/cert
+          name: cert
+          readOnly: true
+      terminationGracePeriodSeconds: 10
+      volumes:
+      - name: cert
+        secret:
+          defaultMode: 420
+          secretName: webhook-server-secret
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: webhook-server-secret
+  namespace: system

config/rbac/auth_proxy_role.yaml

+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: proxy-role
+rules:
+- apiGroups: ["authentication.k8s.io"]
+  resources:
+  - tokenreviews
+  verbs: ["create"]
+- apiGroups: ["authorization.k8s.io"]
+  resources:
+  - subjectaccessreviews
+  verbs: ["create"]

config/rbac/auth_proxy_role_binding.yaml

+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: proxy-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: proxy-role
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: system

config/rbac/auth_proxy_service.yaml

+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    prometheus.io/port: "8443"
+    prometheus.io/scheme: https
+    prometheus.io/scrape: "true"
+  labels:
+    control-plane: controller-manager
+    controller-tools.k8s.io: "1.0"
+  name: controller-manager-metrics-service
+  namespace: system
+spec:
+  ports:
+  - name: https
+    port: 8443
+    targetPort: https
+  selector:
+    control-plane: controller-manager
+    controller-tools.k8s.io: "1.0"

config/rbac/rbac_role.yaml

+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: manager-role
+rules:
+- apiGroups:
+  - networking.istio.io
+  resources:
+  - virtualservices
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - networking.istio.io
+  resources:
+  - virtualservices/status
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - servicemesh.kubesphere.io
+  resources:
+  - strategies
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - servicemesh.kubesphere.io
+  resources:
+  - strategies/status
+  verbs:
+  - get
+  - update
+  - patch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete

config/rbac/rbac_role_binding.yaml

+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  creationTimestamp: null
+  name: manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: manager-role
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: system

config/samples/servicemesh_v1alpha2_strategy.yaml

+apiVersion: servicemesh.kubesphere.io/v1alpha2
+kind: Strategy
+metadata:
+  labels:
+    controller-tools.k8s.io: "1.0"
+  name: strategy-sample
+spec:
+  # Add fields here
+  type: Canary
+  selector:
+    matchLabels:
+      "servicemesh.kubesphere.io/type": "canary"
+  template:
+    spec:
+      hosts:
+      - details
+      http:
+      - route:
+        - destination:
+            host: "details"
+            subset: v1
+          weight: 60
+        - destination:
+            host: "details"
+            subset: v2
+          weight: 40

doc.go

+// Copyright 2017 The OpenPitrix Authors. All rights reserved.
+// Use of this source code is governed by a Apache license
+// that can be found in the LICENSE file.
+
+// Package openpitrix provides the best Paas and Iaas platform.
+package kubesphere

docs/code-of-conduct.md

+# KubeSphere Code of Conduct
+
+KubeSphere follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).  
+
+# Best practice of committing code
+Besides following above conduct from CNCF, we also hope every contributor in this project could help us to improve the quality of code, something you should know before checking in any new code:
+ - As gopher, make sure you already read [the conduct of Go language](https://golang.org/conduct) and [the instruction of writting Go](https://golang.org/doc/effective_go.html).  
+ - Fork the project under your account and make the changes you want there.  
+ - Execute 'go fmt' for every piece of new code.  
+ - Every pulling request(PR) would be better constructed with only one commit, this could help code reviewer to go through your code efficiently, also helpful for every follower of this project to understand what happens in this PR. If you need to make any further code change to address the comments from reviewers, which means some new commits will be generated under this PR, you need to use 'git rebase' to combine those commits together.
+ - Every PR should only solve one problem or provide one feature, don't put several different fixes into one PR.  
+ - At lease two code reviewers should involve into code reviewing process. 
+ - Please introduce new third-party packages as little as possible to reduce the vendor dependency of this project. For example, don't import a full unit converting package but only use one function from it. For this case, you'd better write that function by yourself.
+ - more.
\ No newline at end of file

docs/design/README.md

+# Architecture
+
+Basic idea is to decouple application repository and runtime environment. The runtime environment an application can run is by matching the labels of runtime environment and the selector of the repository where the application is from.
+
+## Design key points:
+

docs/design/arch.dot

+// Copyright 2017 The OpenPitrix Authors. All rights reserved.
+// Use of this source code is governed by a Apache license
+// that can be found in the LICENSE file.
+
+// dot -Tpng -o output.png input.dot
+
+digraph G {
+	rankdir = LR;
+
+	subgraph clusterClient {
+		node [
+			fixedsize = true,
+			width = 1, height = 1,
+		]
+		WebUI [shape = doublecircle];
+		MobileApp [shape = doublecircle];
+		XClient [shape = doublecircle];
+	}
+
+	WebUI -> ApiGateway[
+		label = "rest api",
+		dir   = both,
+		style = bold,
+	];
+	MobileApp -> ApiGateway[
+		label = "rest api",
+		dir   = both,
+		style = bold,
+	];
+	XClient -> ApiGateway[
+		label = "rest api",
+		dir   = both,
+		style = bold,
+	];
+
+	subgraph clusterOpenpitrix {
+
+		// rest api gateway
+		ApiGateway [shape = rect,
+			fixedsize = true,
+			width = 1.4, height = 6.2,
+		];
+
+		// microservice
+		subgraph clusterServices {
+			node [
+				shape=record,
+				fixedsize = true,
+				width = 2.6, height = 1.3,
+			];
+			Cluster [shape = Mrecord];
+			Runtime [shape = Mrecord,
+				label="Runtime |{ plugin |{k8s|QingCloud|Other} }"
+			];
+			App [shape = Mrecord];
+			Repo [shape = Mrecord];
+		}
+
+		// service database
+		subgraph clusterDB {
+			node [
+				fixedsize = true,
+				width = 2.6, height = 1.3,
+			];
+			RepoDB [shape = cylinder];
+			AppDB [shape = cylinder];
+			RuntimeDB [shape = cylinder];
+			ClusterDB [shape = cylinder];
+		}
+
+		// api gateway
+		ApiGateway -> Cluster [
+			label = "grpc",
+			dir   = both,
+			style = bold,
+		];
+		ApiGateway -> Repo [
+			label = "grpc",
+			dir   = both,
+			style = bold,
+		];
+		ApiGateway -> App [
+			label = "grpc",
+			dir   = both,
+			style = bold,
+		];
+		ApiGateway -> Runtime [
+			label = "grpc",
+			dir   = both,
+			style = bold,
+		];
+
+		Repo -> RepoDB [label="SQL"];
+		App -> AppDB [label="SQL"];
+		Runtime -> RuntimeDB [label="SQL"];
+		Cluster -> ClusterDB [label="SQL"];
+	}
+}
+

docs/prereqs.md

+# Developing for KubeSphere [deprecated]
+
+This document is intended to be the canonical source of truth for things like
+supported toolchain versions for building KubeSphere.
+If you find a requirement that this doc does not capture, or if you find other
+docs with references to requirements that are not simply links to this doc,
+please [submit an issue](https://github.com/kubesphere/kubesphere/issues/new).
+
+This document is intended to be relative to the branch in which it is found.
+It is guaranteed that requirements will change over time for the development
+branch, but release branches should not change.
+
+- [Prerequisites](#prerequisites)
+  - [Setting up Go](#setting-up-go)
+- [To start developing KubeSphere](#to-start-developing-kubesphere)
+- [DevOps](#devops)
+
+## Prerequisites
+
+KubeSphere only has few external dependencies you need to setup before being
+able to build and run the code.
+
+### Setting up Go
+
+KubeSphere written in the [Go](http://golang.org) programming language.
+To build, you'll need a Go (version 1.9+) development environment.
+If you haven't set up a Go development environment, please follow
+[these instructions](https://golang.org/doc/install)
+to install the Go tools.
+
+Set up your GOPATH and add a path entry for Go binaries to your PATH. Typically
+added to your ~/.profile:
+
+```shell
+$ export GOPATH=~/go
+$ export PATH=$PATH:$GOPATH/bin
+```
+
+## To start developing KubeSphere
+
+There are two options to get KubeSphere source code and build the project:
+
+**You have a working Go environment.**
+
+```shell
+$ go get -d kubesphere.io/kubesphere
+$ cd $GOPATH/src/kubesphere.io/kubesphere
+$ make all
+```
+
+**You have a working Docker environment.**
+
+```shell
+$ git clone https://github.com/kubesphere/kubesphere
+$ cd kubesphere
+$ make
+```

hack/boilerplate.go.txt

+/*
+Copyright 2019 The KubeSphere authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
\ No newline at end of file

hack/docker_build.sh

+#!/usr/bin/env bash
+
+ docker build -f build/ks-apigateway/Dockerfile -t kubespheredev/ks-apigateway:latest .
+ docker build -f build/ks-apiserver/Dockerfile -t kubespheredev/ks-apiserver:latest .
+ docker build -f build/ks-iam/Dockerfile -t kubespheredev/ks-iam:latest .
\ No newline at end of file

hack/docker_push.sh

+#!/usr/bin/env bash
+
+# Push image to dockerhub, need to support multiple push
+
+echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
+docker push kubespheredev/ks-apigateway:latest
+docker push kubespheredev/ks-apiserver:latest
+docker push kubespheredev/ks-iam:latest