anchor.diff:  files can be created with the `--write-config` option and then used with the
   `--config` option.
   
  -[[creating-new-configuration-files]]
  -
  -== Creating New Configuration Files
  -For masters, the `openshift start` command accepts options that indicate that it
  -should simply write the configuration files that it would have used, then
  -terminate. For nodes, a configuration file can be written using the `oadm
  -create-node-config` command. Creating new configuration files is useful to get a
  -starting point for defining your configuration.
  -
  -The following commands write the relevant launch configuration file(s),
  -certificate files, and any other necessary files to the specified
  -`--write-config` or `--node-dir` directory.
  -
  -To create configuration files for an all-in-one server (a master and a node on
  -the same host) in the specified directory:
  -
  -[options="nowrap"]
  -----
  -$ openshift start --write-config=/openshift.local.config
  -----
  -
  -To create a xref:master-configuration-files[master configuration file] and
  -other required files in the specified directory:
  -
  -[options="nowrap"]
  -----
  -$ openshift start master --write-config=/openshift.local.config/master
  -----
  -
  -To create a xref:node-configuration-files[node configuration file] and other
  -related files in the specified directory:
  -
  -[options="nowrap"]
  -----
  -$ oadm create-node-config --node-dir=/openshift.local.config/node-<node_hostname> --node=<node_hostname> --hostnames=<hostname>,<ip_address>
  -----
  -
  -For the `--hostnames` option in the above command, use a comma-delimited list of
  -every host name or IP address you want server certificates to be valid for. The
  -above command also assumes that certificate files are located in an
  -*_openshift.local.config/master/_* directory. If they are not, you can include
  -options to specify their location. Run the command with the `-h` option to see
  -details.
  -
  -[[launching-servers-using-configuration-files]]
  -
  -== Launching Servers Using Configuration Files
  -Once you have modified the master and/or node configuration files to your
  -specifications, you can use them when launching servers by specifying them as an
  -argument. Keep in mind that if you specify a configuration file, none of the
  -other command line options you pass are respected.
  -
  -To launch an all-in-one server using a master configuration and a node
  -configuration file:
  -
  -[options="nowrap"]
  -----
  -$ openshift start --master-config=/openshift.local.config/master/master-config.yaml --node-config=/openshift.local.config/node-<node_hostname>/node-config.yaml
  -----
  -
  -To launch a master server using a master configuration file:
  -
  -[options="nowrap"]
  -----
  -$ openshift start master --config=/openshift.local.config/master/master-config.yaml
  -----
  -
  -To launch a node server using a node configuration file:
  -
  -[options="nowrap"]
  -----
  -$ openshift start node --config=/openshift.local.config/node-<node_hostname>/node-config.yaml
  -----
  -
   [[master-configuration-files]]
  -
   == Master Configuration Files
  -The following *_master-config.yaml_* file is a sample master configuration
  -file that was generated with the default values as of writing. You can
  -xref:creating-new-configuration-files[create a new master configuration file]
  -to see the valid options for your installed version of {product-title}.
  -
  -.Sample Master Configuration File
  -====
  -[source,yaml]
  -----
  -admissionConfig:
  -  pluginConfig: null
  -apiLevels:
  -- v1
  -apiServerArguments:
  -  event-ttl: <1>
  -  - "15m"
  -apiVersion: v1
  -assetConfig:
  -  extensionDevelopment: false
  -  extensionScripts: null
  -  extensionStylesheets: null
  -  extensions: null
  -  loggingPublicURL: ""
  -  logoutURL: ""
  -  masterPublicURL: https://10.0.2.15:8443
  -  metricsPublicURL: ""
  -  publicURL: https://10.0.2.15:8443/console/
  -  servingInfo:
  -    bindAddress: 0.0.0.0:8443
  -    bindNetwork: tcp4
  -    certFile: master.server.crt
  -    clientCA: ""
  -    keyFile: master.server.key
  -    maxRequestsInFlight: 0
  -    namedCertificates: null
  -    requestTimeoutSeconds: 0
  -controllerLeaseTTL: 0
  -controllers: '*'
  -corsAllowedOrigins:
  -- 10.0.2.15:8443
  -- 127.0.0.1
  -- localhost
  -disabledFeatures: null
  -dnsConfig: allowRecursiveQueries: false
  -  bindAddress: 0.0.0.0:8053
  -  bindNetwork: tcp4
  -etcdClientInfo:
  -  ca: ca.crt
  -  certFile: master.etcd-client.crt
  -  keyFile: master.etcd-client.key
  -  urls:
  -  - https://10.0.2.15:4001
  -etcdConfig:
  -  address: 10.0.2.15:4001
  -  peerAddress: 10.0.2.15:7001
  -  peerServingInfo:
  -    bindAddress: 0.0.0.0:7001
  -    bindNetwork: tcp4
  -    certFile: etcd.server.crt
  -    clientCA: ca.crt
  -    keyFile: etcd.server.key
  -    namedCertificates: null
  -  servingInfo:
  -    bindAddress: 0.0.0.0:4001
  -    bindNetwork: tcp4
  -    certFile: etcd.server.crt
  -    clientCA: ca.crt
  -    keyFile: etcd.server.key
  -    namedCertificates: null
  -  storageDirectory: /root/openshift.local.etcd
  -etcdStorageConfig:
  -  kubernetesStoragePrefix: kubernetes.io
  -  kubernetesStorageVersion: v1
  -  openShiftStoragePrefix: openshift.io
  -  openShiftStorageVersion: v1
  -imageConfig:
  -  format: openshift/origin-${component}:${version}
  -  latest: false
  -imagePolicyConfig:
  -  disableScheduledImport: false
  -  maxImagesBulkImportedPerRepository: 5
  -  maxScheduledImageImportsPerMinute: 60
  -  scheduledImageImportMinimumIntervalSeconds: 900
  -kind: MasterConfig
  -kubeletClientInfo:
  -  ca: ca.crt
  -  certFile: master.kubelet-client.crt
  -  keyFile: master.kubelet-client.key
  -  port: 10250
  -kubernetesMasterConfig:
  -  admissionConfig:
  -    pluginConfig: null
  -  apiServerArguments: null
  -  controllerArguments: null
  -  disabledAPIGroupVersions: {}
  -  masterCount: 1
  -  masterIP: 10.0.2.15
  -  podEvictionTimeout: 5m
  -  proxyClientInfo:
  -    certFile: master.proxy-client.crt
  -    keyFile: master.proxy-client.key
  -  schedulerConfigFile: ""
  -  servicesNodePortRange: 30000-32767
  -  servicesSubnet: 172.30.0.0/16
  -masterClients:
  -  externalKubernetesKubeConfig: ""
  -  openshiftLoopbackKubeConfig: openshift-master.kubeconfig
  -masterPublicURL: https://10.0.2.15:8443
  -networkConfig:
  -  clusterNetworkCIDR: 10.128.0.0/14
  -  hostSubnetLength: 9
  -  networkPluginName: redhat/openshift-ovs-subnet
  -  serviceNetworkCIDR: 172.30.0.0/16
  -oauthConfig:
  -  alwaysShowProviderSelection: false
  -  assetPublicURL: https://10.0.2.15:8443/console/
  -  grantConfig:
  -    method: auto
  -  identityProviders:
  -  - challenge: true
  -    login: true
  -    mappingMethod: claim
  -    name: anypassword
  -    provider:
  -      apiVersion: v1
  -      kind: AllowAllPasswordIdentityProvider
  -  masterCA: ca.crt
  -  masterPublicURL: https://10.0.2.15:8443
  -  masterURL: https://10.0.2.15:8443
  -  sessionConfig:
  -    sessionMaxAgeSeconds: 300
  -    sessionName: ssn
  -    sessionSecretsFile: ""
  -  templates: null
  -  tokenConfig:
  -    accessTokenMaxAgeSeconds: 86400
  -    authorizeTokenMaxAgeSeconds: 300
  -pauseControllers: false
  -policyConfig:
  -  bootstrapPolicyFile: policy.json
  -  openshiftInfrastructureNamespace: openshift-infra
  -  openshiftSharedResourcesNamespace: openshift
  -projectConfig:
  -  defaultNodeSelector: ""
  -  projectRequestMessage: ""
  -  projectRequestTemplate: ""
  -  securityAllocator:
  -    mcsAllocatorRange: s0:/2
  -    mcsLabelsPerProject: 5
  -    uidAllocatorRange: 1000000000-1999999999/10000
  -routingConfig:
  -  subdomain: router.default.svc.cluster.local
  -serviceAccountConfig:
  -  limitSecretReferences: false
  -  managedNames:
  -  - default
  -  - builder
  -  - deployer
  -  masterCA: ca.crt
  -  privateKeyFile: serviceaccounts.private.key
  -  publicKeyFiles:
  -  - serviceaccounts.public.key
  -servingInfo:
  -  bindAddress: 0.0.0.0:8443
  -  bindNetwork: tcp4
  -  certFile: master.server.crt
  -  clientCA: ca.crt
  -  keyFile: master.server.key
  -  maxRequestsInFlight: 500
  -  namedCertificates: null
  -  requestTimeoutSeconds: 3600
  -----
  -<1> Prevents memory overload by defining a lower limit (for example, 15m) for
  -stored events. This prevents excessive memory growth that can be the result of
  -etcd storing too many events. By default, this is set to two hours.
  -====
  +This section reviews parameters mentioned in the *_master-config.yaml_* file.
  +
  +You can xref:creating-new-configuration-files[create a new master configuration
  +file] to see the valid options for your installed version of {product-title}.
  +
  +[[master-config-admission-control-config]]
  +=== Admission Control Configuration
  +
  +.Admission Control Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*AdmissionConfig*`
  +|Contains admission control plug-in configuration.
  +
  +|`*APIServerArguments*`
  +|Key-value pairs that will be passed directly to the Kube API server that match
  +the API servers' command line arguments. These are not migrated, but if you
  +reference a value that does not exist the server will not start. These values
  +may override other settings in `*KubernetesMasterConfig*`, which may cause
  +invalid configurations.
  +
  +|`*ControllerArguments*`
  +|Key-value pairs that will be passed directly to the Kube controller manager
  +that match the controller manager's command line arguments. These are not
  +migrated, but if you reference a value that does not exist the server will not
  +start. These values may override other settings in `*KubernetesMasterConfig*`,
  +which may cause invalid configurations.
  +
  +|`*DefaultAdmissionConfig*`
  +|Used to enable or disable various admission plug-ins. When this type is present
  +as the *configuration* object under `*pluginConfig*` and if the admission
  +plug-in supports it, this will cause an *off by default* admission plug-in to be
  +enabled.
  +
  +|`*PluginConfig*`
  +|Allows specifying a configuration file per admission control plug-in.
  +
  +|`*PluginOrderOverride*`
  +|A list of admission control plug-in names that will be installed on the master.
  +Order is significant. If empty, a default list of plug-ins is used.
  +
  +|`*SchedulerArguments*`
  +|Key-value pairs that will be passed directly to the Kube scheduler that match
  +the scheduler's command line arguments. These are not migrated, but if you
  +reference a value that does not exist the server will not start. These values
  +may override other settings in `*KubernetesMasterConfig*`, which may cause
  +invalid configurations.
  +
  +|===
  +
  +
  +[[master-config-asset-config]]
  +=== Asset Configuration
  +
  +.Asset Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*AssetConfig*`
  +|Holds the necessary configuration options for serving assets.
  +
  +|`*DisabledFeatures*`
  +|A list of features that should not be started. You will likely want to set this
  +as *null*. It is very unlikely that anyone will want to manually disable
  +features and that is not encouraged.
  +
  +|`*Extensions*`
  +|Files to serve from the asset server file system under a subcontext.
  +
  +|`*ExtensionDevelopment*`
  +|When  set to *true*, tells the asset server to reload extension scripts and
  +stylesheets for every request rather than only at startup. It lets you develop
  +extensions without having to restart the server for every change.
  +
  +|`*ExtensionProperties*`
  +|Key- (string) and value- (string) pairs that will be injected into the console under
  +the global variable `*OPENSHIFT_EXTENSION_PROPERTIES*`.
  +
  +|`*ExtensionScripts*`
  +|File paths on the asset server files to load as scripts when the web console loads.
  +
  +|`*ExtensionStylesheets*`
  +|File paths on the asset server files to load as style sheets when the web console loads.
  +
  +|`*LoggingPublicURL*`
  +|The public endpoint for logging (optional).
  +
  +|`*LogoutURL*`
  +|An optional, absolute URL to redirect web browsers to after logging out of the
  +web console. If not specified, the built-in logout page is shown.
  +
  +|`*MasterPublicURL*`
  +|How the web console can access the {product-title} server.
  +
  +|`*MetricsPublicURL*`
  +|The public endpoint for metrics (optional).
  +
  +|`*PublicURL*`
  +|URL of the the asset server.
  +
  +|===
  +
  +[[master-config-authentication-authorization-config]]
  +=== Authentication and Authorization Configuration
  +
  +.Authentication and Authorization Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*authConfig*`
  +|Holds authentication and authorization configuration options.
  +
  +|`*AuthenticationCacheSize*`
  +|Indicates how many authentication results should be cached. If 0, the default
  +cache size is used.
  +
  +|`*AuthorizationCacheTTL*`
  +|Indicates how long an authorization result should be cached. It takes a valid
  +time duration string (e.g. "5m"). If empty, you get the default timeout. If zero
  +(e.g. "0m"), caching is disabled.
  +
  +|===
  +
  +[[master-config-controller-config]]
  +=== Controller Configuration
  +
  +.Controller Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*Controllers*`
  +|List of the controllers that should be started. If set to *none*, no
  +controllers will start automatically. The default value is * which will start
  +all controllers. When using *, you may exclude controllers by prepending a `-`
  +in front of their name. No other values are recognized at this time.
  +
  +|`*ControllerLeaseTTL*`
  +|Enables controller election, instructing the master to attempt to acquire a
  +lease before controllers start and renewing it within a number of seconds
  +defined by this value. Setting this value non-negative forces
  +`*pauseControllers=true*`. This value defaults off (0, or omitted) and controller
  +election can be disabled with -1.
  +
  +|`*PauseControllers*`
  +|Instructs the master to not automatically start controllers, but instead to
  +wait until a notification to the server is received before launching them.
  +
  +|===
  +
  +
  +[[master-config-etcd]]
  +=== etcd Configuration
  +
  +.etcd Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*Address*`
  +|The advertised host:port for client connections to etcd.
  +
  +|`*etcdClientInfo*`
  +|Contains information about how to connect to etcd.
  +
  +|`*etcdConfig*`
  +|Holds the necessary configuration options for connecting with an etcd database.
  +
  +|`*etcdStorageConfig*`
  +|Contains information about how API resources are stored in etcd. These values
  +are only relevant when etcd is the backing store for the cluster.
  +
  +|`*KubernetesStoragePrefix*`
  +|The path within etcd that the Kubernetes resources will be rooted under. This
  +value, if changed, will mean existing objects in *_etcd_* will no longer be
  +located. The default value is *kubernetes.io*.
  +
  +|`*KubernetesStorageVersion*`
  +|The API version that Kubernetes resources in *_etcd_* should be serialized to.
  +This value should *not* be advanced until all clients in the cluster that read
  +from etcd have code that allows them to read the new version.
  +
  +|`*OpenShiftStoragePrefix*`
  +|The path within etcd that the {product-title} resources will be rooted under.
  +This value, if changed, will mean existing objects in etcd will no longer be
  +located. The default value is *openshift.io*.
  +
  +|`*OpenShiftStorageVersion*`
  +|API version that OS resources in *_etcd_* should be serialized to. This value
  +should *not* be advanced until all clients in the cluster that read from
  +*_etcd_* have code that allows them to read the new version.
  +
  +|`*PeerAddress*`
  +|The advertised host:port for peer connections to *_etcd_*.
  +
  +|`*PeerServingInfo*`
  +|Describes how to start serving the *_etcd_* peer.
  +
  +|`*ServingInfo*`
  +|Describes how to start serving the etcd master.
  +
  +|`*StorageDir*`
  +|The path to the *_etcd_* storage directory.
  +
  +|===
  +
  +
  +[[master-node-config-grant-config]]
  +=== Grant Configuration
  +
  +.Grant Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*GrantConfig*`
  +|Describes how to handle grants.
  +
  +|`*GrantHandlerAuto*`
  +|Auto-approves client authorization grant requests.
  +
  +|`*GrantHandlerDeny*`
  +|Auto-denies client authorization grant requests.
  +
  +|`*GrantHandlerPrompt*`
  +|Prompts the user to approve new client authorization grant requests.
  +
  +|`*Method*`
  +a|Determines the default strategy to use when an OAuth client requests a
  +grant.This method will be used only if the specific OAuth client does not
  +provide a strategy of their own. Valid grant handling methods are:
  +
  +- auto: always approves grant requests, useful for trusted clients
  +- prompt: prompts the end user for approval of grant requests, useful for third-party clients
  +- deny: always denies grant requests, useful for black-listed clients
  +
  +|===
  +
  +[[master-config-image-config]]
  +=== Image Configuration
  +
  +.Image Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*DisableScheduledImport*`
  +|Allows scheduled background import of images to be disabled.
  +
  +|`*Format*`
  +|The format of the name to be built for the system component.
  +
  +|`*ImageConfig*`
  +|Holds options that describe how to build image names for system components.
  +
  +|`*ImagePolicyConfig*`
  +|Controls limits and behavior for importing images.
  +
  +|`*Latest*`
  +|Determines if the latest tag will be pulled from the registry.
  +
  +|`*MaxImagesBulkImportedPerRepository*`
  +|Controls the number of images that are imported when a user does a bulk import
  +of a Docker repository. This number defaults to 5 to prevent users from
  +importing large numbers of images accidentally. Set *-1* for no limit.
  +
  +|`*MaxScheduledImageImportsPerMinute*`
  +|The maximum number of scheduled image streams that will be imported in the
  +background per minute. The default value is 60. Set to -1 for unlimited.
  +
  +|`*ScheduledImageImportMinimumIntervalSeconds*`
  +|The minimum number of seconds that can elapse between when image streams
  +scheduled for background import are checked against the upstream repository. The
  +default value is 15 minutes.
  +
  +|===
  +
  +[[master-node-config-kubernetes-master-config]]
  +=== Kubernetes Master Configuration
  +
  +.Kubernetes Master Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*APILevels*`
  +|A list of API levels that should be enabled on startup, v1 as examples.
  +
  +|`*DisabledAPIGroupVersions*`
  +|A map of groups to the versions (or `*`) that should be disabled.
  +
  +|`*KubeletClientInfo*`
  +|Contains information about how to connect to kubelets.
  +
  +|`*KubernetesMasterConfig*`
  +|Holds the necessary configuration options for the Kubernetes master.
  +
  +|`*MasterCount*`
  +|The number of expected masters that should be running. This value defaults to 1
  +and may be set to a positive integer, or if set to -1, indicates this is part of
  +a cluster.
  +
  +|`*MasterIP*`
  +|The public IP address of Kubernetes resources. If empty, the first result from
  +`*net.InterfaceAddrs*` will be used.
  +
  +|`*MasterKubeConfig*`
  +|File name for the *_.kubeconfig_* file that describes how to connect this node to the master.
  +
  +|`*ServicesNodePortRange*`
  +|The range to use for assigning service public ports on a host.
  +
  +|`*ServicesSubnet*`
  +|The subnet to use for assigning service IPs.
  +
  +|`*StaticNodeNames*`
  +|The list of nodes that are statically known.
  +
  +|===
  +
  +[[master-node-config-network-config]]
  +=== Network Configuration
  +
  +.Network Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*ClusterNetworkCIDR*`
  +|The CIDR string to specify the global overlay network's L3 space.
  +
  +|`*ExternalIPNetworkCIDRs*`
  +|Controls what values are acceptable for the service external IP field. If
  +empty, no `*externalIP*` may be set. It may contain a list of CIDRs which are
  +checked for access. If a CIDR is prefixed with *!*, IPs in that CIDR will be
  +rejected. Rejections will be applied first, then the IP checked against one of
  +the allowed CIDRs. You hould ensure this range does not overlap with your nodes,
  +pods, or service CIDRs for security reasons.
  +
  +|`*HostSubnetLength*`
  +|The number of bits to allocate to each host's subnet. For example, 8 would mean a
  +/24 network on the host.
  +
  +|`*IngressIPNetworkCIDR*`
  +|Controls the range to assign ingress IPs from for services of type
  +*LoadBalancer* on bare metal. If empty, ingress IPs will not be assigned. It may
  +contain a single CIDR that will be allocated from. For security reasons, you
  +should ensure that this range does not overlap with the CIDRs reserved for
  +external IPs, nodes, pods, or services.
  +
  +|`*NetworkConfig*`
  +|Provides network options for the node.
  +
  +|`*NetworkPluginName*`
  +|The name of the network plug-in to use.
  +
  +|`*ServiceNetwork*`
  +|The CIDR string to specify the service networks.
  +
  +|===
  +
  +[[master-config-oath-authentication-config]]
  +=== OAuth Authentication Configuration
  +
  +.OAuth Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*AlwaysShowProviderSelection*`
  +|Forces the provider selection page to render even when there is only a single provider.
  +
  +|`*AssetPublicURL*`
  +|Used for building valid client redirect URLs for external access.
  +
  +|`*Error*`
  +|A path to a file containing a go template used to render error pages during the
  +authentication or grant flow If unspecified, the default error page is used.
  +
  +|`*IdentityProviders*`
  +|Ordered list of ways for a user to identify themselves.
  +
  +|`*Login*`
  +|A path to a file containing a go template used to render the login page. If
  + unspecified, the default login page is used.
  +
  +|`*MasterCA*`
  +|CA for verifying the TLS connection back to the `*MasterURL*`.
  +
  +|`*MasterPublicURL*`
  +|Used for building valid client redirect URLs for external access.
  +
  +|`*MasterURL*`
  +|Used for making server-to-server calls to exchange authorization codes for
  +access tokens.
  +
  +|`*OAuthConfig*`
  +|Holds the necessary configuration options for OAuth authentication.
  +
  +|`*OAuthTemplates*`
  +|Allows for customization of pages like the login page.
  +
  +|`*ProviderSelection*`
  +|A path to a file containing a go template used to render the provider selection
  +page. If unspecified, the default provider selection page is used.
  +
  +|`*SessionConfig*`
  +|Holds information about configuring sessions.
  +
  +|`*Templates*`
  +|Allows you to customize pages like the login page.
  +
  +|`*TokenConfig*`
  +|Contains options for authorization and access tokens.
  +
  +|===
  +
  +[[master-node-config-project-config]]
  +=== Project Configuration
  +
  +.Project Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*DefaultNodeSelector*`
  +|Holds default project node label selector.
  +
  +|`*ProjectConfig*`
  +|Holds information about project creation and defaults.
  +
  +|`*ProjectRequestMessage*`
  +|The string presented to a user if they are unable to request a project via the
  +project request API endpoint.
  +
  +|`*ProjectRequestTemplate*`
  +|The template to use for creating projects in response to *projectrequest*. It
  +is in the format namespace/template and it is optional. If it is not specified,
  +a default template is used.
  +
  +|===
  +
  +[[master-node-config-scheduler-config]]
  +=== Scheduler Configuration
  +
  +.Scheduler Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*SchedulerConfigFile*`
  +|Points to a file that describes how to set up the scheduler. If empty, you get
  +the default scheduling rules
  +
  +|===
  +
  +=== Security Allocator Configuration
  +
  +.Security Allocator Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*MCSAllocatorRange*`
  +|Defines the range of MCS categories that will be assigned to namespaces. The
  +format is `<prefix>/<numberOfLabels>[,<maxCategory>]`. The default is *s0/2* and
  +will allocate from c0 to c1023, which means a total of 535k labels are available
  +(1024 choose 2 ~ 535k). If this value is changed after startup, new projects may
  +receive labels that are already allocated to other projects. Prefix may be any
  +valid SELinux set of terms (including user, role, and type), although leaving
  +them as the default will allow the server to set them automatically.
  +
  +|`*SecurityAllocator*`
  +|Controls the automatic allocation of UIDs and MCS labels to a project. If nil,
  +allocation is disabled.
  +
  +|`*UIDAllocatorRange*`
  +|Defines the total set of Unix user IDs (UIDs) that will be allocated to
  +projects automatically, and the size of the block each namespace gets. For
  +example, 1000-1999/10 will allocate ten UIDs per namespace, and will be able to
  +allocate up to 100 blocks before running out of space. The default is to
  +allocate from 1 billion to 2 billion in 10k blocks (which is the expected size
  +of the ranges Docker images will use once user namespaces are started).
  +
  +|===
  +
  +
  +[[master-config-service-account-config]]
  +=== Service Account Configuration
  +
  +.Service Account Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*LimitSecretReferences*`
  +|Controls whether or not to allow a service account to reference any secret in a
  +namespace without explicitly referencing them.
  +
  +|`*ManagedNames*`
  +|A list of service account names that will be auto-created in every namespace.
  +If no names are specified, the `*ServiceAccountsController*` will not be
  +started.
  +
  +|`*MasterCA*`
  +|The CA for verifying the TLS connection back to the master. The service account
  +controller will automatically inject the contents of this file into pods so they
  +can verify connections to the master.
  +
  +|`*PrivateKeyFile*`
  +|A file containing a PEM-encoded private RSA key, used to sign service account
  +tokens. If no private key is specified, the service account `*TokensController*`
  +will not be started.
  +
  +|`*PublicKeyFiles*`
  +|A list of files, each containing a PEM-encoded public RSA key. If any file
  +contains a private key, the public portion of the key is used. The list of
  +public keys is used to verify presented service account tokens. Each key is
  +tried in order until the list is exhausted or verification succeeds. If no keys
  +are specified, no service account authentication will be available.
  +
  +|`*ServiceAccountConfig*`
  +|Holds the necessary configuration options for a service account.
  +
  +|===
  +
  +[[master-config-serving-information-config]]
  +=== Serving Information Configuration
  +
  +.Serving Information Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*AllowRecursiveQueries*`
  +|Allows the DNS server on the master to answer queries recursively. Note that
  +open resolvers can be used for DNS amplification attacks and the master DNS
  +should not be made accessible to public networks.
  +
  +|`*BindAddress*`
  +|The *ip:port* to serve on.
  +
  +|`*BindNetwork*`
  +|Controls limits and behavior for importing images.
  +
  +|`*CertFile*`
  +|A file containing a PEM-encoded certificate.
  +
  +|`*CertInfo*`
  +|TLS cert information for serving secure traffic.
  +
  +|`*ClientCA*`
  +|The certificate bundle for all the signers that you recognize for incoming
  +client certificates.
  +
  +|`*dnsConfig*`
  +|Holds the necessary configuration options for DNS.
  +
  +|`*DNSDomain*`
  +|Holds the domain suffix.
  +
  +|`*DNSIP*`
  +|Holds the IP.
  +
  +|`*KeyFile*`
  +|A file containing a PEM-encoded private key for the certificate specified by
  +`*CertFile*`.
  +
  +|`*MasterClientConnectionOverrides*`
  +|Provides overrides to the client connection used to connect to the master.
  +
  +|`*MaxRequestsInFlight*`
  +|The number of concurrent requests allowed to the server. If zero, no limit.
  +
  +|`*NamedCertificates*`
  +|A list of certificates to use to secure requests to specific host names.
  +
  +|`*RequestTimeoutSecond*`
  +|The number of seconds before requests are timed out. The default is 60 minutes.
  +If -1, there is no limit on requests.
  +
  +|`*ServingInfo*`
  +|The HTTP serving information for the assets.
  +
  +|===
  +
  +[[master-node-config-volume-config]]
  +=== Volume Configuration
  +
  +.Volume Configuration Parameters
  +[cols="3a,6a",options="header"]
  +|===
  +
  +| Parameter Name | Description
  +
  +|`*DynamicProvisioningEnabled*`
  +|A boolean to enable or disable dynamic provisioning. Default is *true*.
  +
  +|FSGroup
  +|Can be specified to enable a quota on local storage use per unique FSGroup ID.
  +At present this is only implemented for emptyDir volumes, and if the underlying
  +`*volumeDirectory*` is on an XFS filesystem.
  +
  +|`*LocalQuota*`
  +|Contains options for controlling local volume quota on the node.
  +
  +|`*MasterVolumeConfig*`
  +|Contains options for configuring volume plug-ins in the master node.
  +
  +|`*NodeVolumeConfig*`
  +|Contains options for configuring volumes on the node.
  +
  +|`*VolumeConfig*`
  +|Contains options for configuring volumes on the node.
  +
  +|`*VolumeDirectory*`
  +|The directory that volumes are stored under.
  +
  +|===
   
   [[node-configuration-files]]
   
  
positive.code: type set to 'MustRunAs'.
  ====
  
  [[master-node-configuration-parallel-image-pulls-with-docker]]
  === Parallel Image Pulls with Docker 1.9+
  
  
negative.code: Encrypted data is only as secure as the decrypting key. Care should be taken
  to limit filesystem permissions and access to the key file.
  ====
  
  [[creating-new-configuration-files]]
  
  == Creating New Configuration Files
  For masters, the `openshift start` command accepts options that indicate that it
  should simply write the configuration files that it would have used, then
  terminate. For nodes, a configuration file can be written using the `oadm
  create-node-config` command. Creating new configuration files is useful to get a
  starting point for defining your configuration.
  
  The following commands write the relevant launch configuration file(s),
  certificate files, and any other necessary files to the specified
  `--write-config` or `--node-dir` directory.
  
  To create configuration files for an all-in-one server (a master and a node on
  the same host) in the specified directory:
  
  [options="nowrap"]
  ----
  $ openshift start --write-config=/openshift.local.config
  ----
  
  To create a xref:master-configuration-files[master configuration file] and
  other required files in the specified directory:
  
  [options="nowrap"]
  ----
  $ openshift start master --write-config=/openshift.local.config/master
  ----
  
  To create a xref:node-configuration-files[node configuration file] and other
  related files in the specified directory:
  
  [options="nowrap"]
  ----
  $ oadm create-node-config --node-dir=/openshift.local.config/node-<node_hostname> --node=<node_hostname> --hostnames=<hostname>,<ip_address>
  ----
  
  For the `--hostnames` option in the above command, use a comma-delimited list of
  every host name or IP address you want server certificates to be valid for. The
  above command also assumes that certificate files are located in an
  *_openshift.local.config/master/_* directory. If they are not, you can include
  options to specify their location. Run the command with the `-h` option to see
  details.
  
  [[launching-servers-using-configuration-files]]
  
  == Launching Servers Using Configuration Files
  Once you have modified the master and/or node configuration files to your
  specifications, you can use them when launching servers by specifying them as an
  argument. Keep in mind that if you specify a configuration file, none of the
  other command line options you pass are respected.
  
  To launch an all-in-one server using a master configuration and a node
  configuration file:
  
  [options="nowrap"]
  ----
  $ openshift start --master-config=/openshift.local.config/master/master-config.yaml --node-config=/openshift.local.config/node-<node_hostname>/node-config.yaml
  ----
  
  To launch a master server using a master configuration file:
  
  [options="nowrap"]
  ----
  $ openshift start master --config=/openshift.local.config/master/master-config.yaml
  ----
  
  To launch a node server using a node configuration file:
  
  [options="nowrap"]
  ----
  $ openshift start node --config=/openshift.local.config/node-<node_hostname>/node-config.yaml
  ----
  