Add MaxRequestsInflight field and flag

docs/cluster_spec.md

@@ -160,6 +160,16 @@ spec:
 
 Note: you could use the fileAssets feature to push an advanced audit policy file on the master nodes.
 
+#### Max Requests Inflight 
+
+The maximum number of non-mutating requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit. (default 400)
+
+```yaml
+spec:
+  kubeAPIServer:
+    maxRequestsInflight: 1000
+```
+
 #### runtimeConfig
 
 Keys and values here are translated into `--runtime-config` values for `kube-apiserver`, separated by commas.

nodeup/pkg/model/kube_apiserver_test.go

@@ -31,38 +31,52 @@ func Test_KubeAPIServer_BuildFlags(t *testing.T) {
 	}{
 		{
 			kops.KubeAPIServerConfig{},
-			"--insecure-port=0 --secure-port=0",
+			"--insecure-port=0 --max-requests-inflight=0 --secure-port=0",
 		},
 		{
 			kops.KubeAPIServerConfig{
 				SecurePort: 443,
 			},
-			"--insecure-port=0 --secure-port=443",
+			"--insecure-port=0 --max-requests-inflight=0 --secure-port=443",
+		},
+		{
+			kops.KubeAPIServerConfig{
+				MaxRequestsInflight: 1000,
+			},
+			"--insecure-port=0 --max-requests-inflight=1000 --secure-port=0",
 		},
 		{
 			kops.KubeAPIServerConfig{
 				InsecurePort: 8080,
 				SecurePort:   443,
 			},
-			"--insecure-port=8080 --secure-port=443",
+			"--insecure-port=8080 --max-requests-inflight=0 --secure-port=443",
+		},
+		{
+			kops.KubeAPIServerConfig{
+				InsecurePort:        8080,
+				SecurePort:          443,
+				MaxRequestsInflight: 1000,
+			},
+			"--insecure-port=8080 --max-requests-inflight=1000 --secure-port=443",
 		},
 		{
 			kops.KubeAPIServerConfig{
 				InsecurePort: 8080,
 			},
-			"--insecure-port=8080 --secure-port=0",
+			"--insecure-port=8080 --max-requests-inflight=0 --secure-port=0",
 		},
 		{
 			kops.KubeAPIServerConfig{
 				ServiceNodePortRange: "30000-33000",
 			},
-			"--insecure-port=0 --secure-port=0 --service-node-port-range=30000-33000",
+			"--insecure-port=0 --max-requests-inflight=0 --secure-port=0 --service-node-port-range=30000-33000",
 		},
 		{
 			kops.KubeAPIServerConfig{
 				ExperimentalEncryptionProviderConfig: fi.String("/srv/kubernetes/encryptionconfig.yaml"),
 			},
-			"--experimental-encryption-provider-config=/srv/kubernetes/encryptionconfig.yaml --insecure-port=0 --secure-port=0",
+			"--experimental-encryption-provider-config=/srv/kubernetes/encryptionconfig.yaml --insecure-port=0 --max-requests-inflight=0 --secure-port=0",
 		},
 	}
 

pkg/apis/kops/componentconfig.go

@@ -293,6 +293,8 @@ type KubeAPIServerConfig struct {
 	RequestheaderAllowedNames []string `json:"requestheaderAllowedNames,omitempty" flag:"requestheader-allowed-names"`
 	// FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features.
 	FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"`
+	// MaxRequestsInflight The maximum number of non-mutating requests in flight at a given time.
+	MaxRequestsInflight int `json:"maxRequestsInflight,omitempty" flag:"max-requests-inflight"`
 }
 
 // KubeControllerManagerConfig is the configuration for the controller

pkg/apis/kops/v1alpha1/componentconfig.go

@@ -293,6 +293,8 @@ type KubeAPIServerConfig struct {
 	RequestheaderAllowedNames []string `json:"requestheaderAllowedNames,omitempty" flag:"requestheader-allowed-names"`
 	// FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features.
 	FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"`
+	// MaxRequestsInflight The maximum number of non-mutating requests in flight at a given time.
+	MaxRequestsInflight int `json:"maxRequestsInflight,omitempty" flag:"max-requests-inflight"`
 }
 
 // KubeControllerManagerConfig is the configuration for the controller

pkg/apis/kops/v1alpha1/zz_generated.conversion.go

@@ -1802,6 +1802,7 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
 	out.RequestheaderClientCAFile = in.RequestheaderClientCAFile
 	out.RequestheaderAllowedNames = in.RequestheaderAllowedNames
 	out.FeatureGates = in.FeatureGates
+	out.MaxRequestsInflight = in.MaxRequestsInflight
 	return nil
 }
 
@@ -1864,6 +1865,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko
 	out.RequestheaderClientCAFile = in.RequestheaderClientCAFile
 	out.RequestheaderAllowedNames = in.RequestheaderAllowedNames
 	out.FeatureGates = in.FeatureGates
+	out.MaxRequestsInflight = in.MaxRequestsInflight
 	return nil
 }
 

pkg/apis/kops/v1alpha2/componentconfig.go

@@ -293,6 +293,8 @@ type KubeAPIServerConfig struct {
 	RequestheaderAllowedNames []string `json:"requestheaderAllowedNames,omitempty" flag:"requestheader-allowed-names"`
 	// FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features.
 	FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"`
+	// MaxRequestsInflight The maximum number of non-mutating requests in flight at a given time.
+	MaxRequestsInflight int `json:"maxRequestsInflight,omitempty" flag:"max-requests-inflight"`
 }
 
 // KubeControllerManagerConfig is the configuration for the controller

pkg/apis/kops/v1alpha2/zz_generated.conversion.go

@@ -2064,6 +2064,7 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
 	out.RequestheaderClientCAFile = in.RequestheaderClientCAFile
 	out.RequestheaderAllowedNames = in.RequestheaderAllowedNames
 	out.FeatureGates = in.FeatureGates
+	out.MaxRequestsInflight = in.MaxRequestsInflight
 	return nil
 }
 
@@ -2126,6 +2127,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko
 	out.RequestheaderClientCAFile = in.RequestheaderClientCAFile
 	out.RequestheaderAllowedNames = in.RequestheaderAllowedNames
 	out.FeatureGates = in.FeatureGates
+	out.MaxRequestsInflight = in.MaxRequestsInflight
 	return nil
 }