UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

UPSTREAM: <carry>: Copy hack scripts and tools from openshift/origin

UPSTREAM: <carry>: Fix shellcheck failures for copied openshift-hack bash

UPSTREAM: <carry>: Enable build, test and verify

UPSTREAM: <carry>: Copy README content from origin

UPSTREAM: <carry>: Copy watch-termination command from openshift/origin

UPSTREAM: <carry>: Switch image and rpm build to golang 1.14

UPSTREAM: <carry>: Copy test annotation from origin

UPSTREAM: <carry>: Build openshift-compatible kube e2e binary

UPSTREAM: <carry>: Updating openshift-hack/images/hyperkube/Dockerfile.rhel baseimages to mach ocp-build-data config

UPSTREAM: <carry>: Update test annotation rules

UPSTREAM: <carry>: Enable k8s-e2e-serial

UPSTREAM: <carry>: Build with golang 1.15

UPSTREAM: <carry>: (squash) Stop installing recent bash and protoc from source

UPSTREAM: <carry>: Add rebase instructions

UPSTREAM: <carry>: (squash) Update README.openshift to reflect transition

UPSTREAM: <carry>: (squash) Stop annotating origin tests with [Suite:openshift]

The detection logic was error-prone (different results based on the
repo existing in GOPATH vs not) and whether a test comes from origin
can be inferred from the absence of the `[Suite:k8s]` tag.

UPSTREAM: <carry>: (squash) Update hyperkube version

UPSTREAM: <carry>: (squash) Update OpenShift docs

UPSTREAM: <carry>: watch-termination: fix deletion race and write non-graceful message also to termination.log

UPSTREAM: <carry>: watch-termination: avoid false positives of NonGracefulTermination events

UPSTREAM: <carry>: (squash) remove servicecatalog e2e that was dropped upstream

UPSTREAM: <carry>: (squash) Fix annotation rules

UPSTREAM: <carry>: (squash) Fix image refs

UPSTREAM: <carry>: Updating openshift-enterprise-hyperkube builder & base images to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/b0ab44b419faae6b18e639e780a1fa50a1df8521/images/openshift-enterprise-hyperkube.yml

UPSTREAM: <carry>: (squash) Retry upstream flakes

UPSTREAM: <carry>: (squash) Update test exclussions for 1.20.0

UPSTREAM: <carry>: (squash) Add detail to rebase doc

- Add new section 'Maintaining this document'
- Move checklist above the instructions to emphasize their importance
- Add new section 'Reacting to new commits'
- Mention that generated changes in carries should be dropped

UPSTREAM: <carry>: Enable CSI snapshot e2e tests

All images were uploaded to our quay.io mirror and the tests should
succeed.

UPSTREAM: <carry>: Stop skipping multi-az test (skipped upstream)

UPSTREAM: <carry>: bump tag version & update rebase doc

UPSTREAM: <carry>: update rebase doc & image

UPSTREAM: <carry>: Add Dockerfile to build pause image

Ensuring the target directory exists before writing a file to it.

UPSTREAM: <carry>: disable part of hack/verify-typecheck-providerless.sh due to our carry patches

UPSTREAM: <carry>: Updating openshift-enterprise-pod images to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/691e628254f318ce56efda5edc7448ec743c37b8/images/openshift-enterprise-pod.yml

UPSTREAM: <carry>: Updating openshift-enterprise-hyperkube images to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/691e628254f318ce56efda5edc7448ec743c37b8/images/openshift-enterprise-hyperkube.yml

UPSTREAM: <carry>: Add process overlap detection event to watch-termination

NOTE: Squash this to watch-termination commit on rebase.

UPSTREAM: <carry>: openshift-hack/images/os/Dockerfile: Add io.openshift.build.versions, etc.

For example, consider the current 4.10 RHCOS:

  $ oc image info -o json registry.ci.openshift.org/ocp/4.10:machine-os-content
  io.k8s.description: The Universal Base Image is designed and engineered to be the base layer for all of your containerized applications, middleware and utilities. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly.
  io.k8s.display-name: Red Hat Universal Base Image 8
  io.openshift.build.version-display-names: machine-os=Red Hat Enterprise Linux CoreOS
  io.openshift.build.versions: machine-os=49.84.202109102026-0
  io.openshift.expose-services:
  io.openshift.tags: base rhel8

A bunch of those seem to be inherited from the UBI base image, so we
can leave them alone.  But the io.openshift.build.* entries are
RHCOS-specific, and are consumed by 'oc adm release new ...' [1,2] and
friends to answer questions like "which RHCOS is in this release?":

  $ oc adm release info -o json quay.io/openshift-release-dev/ocp-release:4.8.12-x86_64
  {
    "kubernetes": {
      "Version": "1.21.1",
      "DisplayName": ""
    },
    "machine-os": {
      "Version": "48.84.202109100857-0",
      "DisplayName": "Red Hat Enterprise Linux CoreOS"
    }
  }

Setting this label will avoid failures when consumers like
driver-toolkit's version consumer [3]:

  name: 0.0.1-snapshot-machine-os

bump into ci-tools-built machine-os-content images that lack the
io.openshift.build.versions declaration of machine-os version [4]:

  error: unable to create a release: unknown version reference "machine-os"

I've gone with generic testing values, so hopefully this is not
something that local maintainers need to remember to bump for each
OpenShift z stream.

[1]: https://github.com/openshift/oc/blob/f94afb52dc8a3185b3b9eacaf92ec34d80f8708d/pkg/cli/admin/release/image_mapper.go#L328-L334
[2]: https://github.com/openshift/oc/blob/f94afb52dc8a3185b3b9eacaf92ec34d80f8708d/pkg/cli/admin/release/annotations.go#L19-L28
[3]: openshift/driver-toolkit@464acca#diff-4caed9b2b966a8fa7a016ae28976634a2d3d1b635c4e820d5c038b2305d6af53R18
[4]: https://prow.ci.openshift.org/view/gs/origin-ci-test/pr-logs/pull/openshift_kubernetes/959/pull-ci-openshift-kubernetes-master-images/1438398678602616832#1:build-log.txt%3A97

UPSTREAM: <carry>: update rebase doc

UPSTREAM: <carry>: squash with the rest of tooling

UPSTREAM: <carry>: Updating openshift-enterprise-pod images to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/5b89f5b601508a0bcc0399fd3f34b7aa2e86e90e/images/openshift-enterprise-pod.yml

UPSTREAM: <carry>: Updating openshift-enterprise-hyperkube images to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/5b89f5b601508a0bcc0399fd3f34b7aa2e86e90e/images/openshift-enterprise-hyperkube.yml

UPSTREAM: <carry>: rebase script

UPSTREAM: <carry>: Fix networking-related test exclusions

Tests that fail on openshift-sdn specifically should be tagged as
such, so that they don't also get skipped when running under
ovn-kubernetes or third-party network plugins.

UPSTREAM: <carry>: Skip "subPath should be able to unmount" NFS test

Due to a kernel bug https://bugzilla.redhat.com/show_bug.cgi?id=1854379
in Linux 5.7+ this test fails - the bind-mounted NFS share cannot be
cleanly unmounted, gets "Stale file handle" error instead on umount.
As a result this test is permafailing on Fedora CoreOS nodes.

UPSTREAM: <carry>: Skip GlusterFS tests

GlusterFS is not supported in 4.x, we've been running its tests just
because we could. Now it does not work on IPv6 systems.

E [MSGID: 101075] [common-utils.c:312:gf_resolve_ip6] 0-resolver: getaddrinfo failed (Address family for hostname not supported)

UPSTREAM: <carry>: Skip GlusterFS tests

The previous commit left two GlusterFS test still running:

[sig-storage] Volumes GlusterFS should be mountable [Skipped:ibmcloud] [Suite:openshift/conformance/parallel] [Suite:k8s]
[sig-storage] Dynamic Provisioning GlusterDynamicProvisioner should create and delete persistent volumes

Skip it, we don't support Gluster and it does not work on ipv6

UPSTREAM: <carry>: 1.22 alpha & other tests disablement

UPSTREAM: <carry>: 1.21 alpha & other tests disablement

UPSTREAM: <carry>: Enable GenerciEphemeralVolume tests

UPSTREAM: <carry>: Re-enable [Feature:NetworkPolicy] tests which were wrongly disabled in rebase

UPSTREAM: <carry>: Reenable NetworkPolicy test

UPSTREAM: <carry>: Conformance tests (sysctls) should be run

We have to run this test for conformance, and the tests pass. Reenable
this block which has been disabled for 2 releases (but appears to work fine).

UPSTREAM: <carry>: Don't force-disable IPv6, dual-stack, and SCTP tests

Instead, openshift-tests will enable or disable them depending on
cluster configuration.

UPSTREAM: <carry>: update Multi-AZ Cluster Volumes test name

This test was renamed upstream in
kubernetes@006dc74

UPSTREAM: <carry>: re-enable networking tests after rebase

During a bump to k8 ver. 1.22.0, networking
tests were disabled to accomplish the bump.
This disabled netpol and older network tests.
Netpol tests will be enabled in a following
PR and therefore only partially fixes BZ.

This commit partially fixes bug 1986307.
https://bugzilla.redhat.com/show_bug.cgi?id=1986307

UPSTREAM: <drop>: update test annotate rules

UPSTREAM: <carry>: Add DOWNSTREAM_OWNERS

UPSTREAM: <carry>: clarify downstream approver rules

UPSTREAM: <carry>: copy extensions into resulting image

UPSTREAM: <carry>: update rebase doc

UPSTREAM: <carry>: Fix conformance and serial tests by stopping node cordoning

Master nodes already have `master` taint which
cannot be tolerated by normal workloads. If we manually
cordon the master nodes again, some of the control plane
components cannot get rescheduled unless they have
toleration to the `node.kubernetes.io/unschedulable`
taint. Even if we have the toleration in the pod
spec, because of the backwards compability issues
scheduler will ignore nodes which have `unschedulable`
field set. IOW:

- Cordoning master nodes is redundant as masters already
  have taints
- Cordoning master nodes can cause issues which are hard
  to debug as control-plane components may be evicted/preempted
  during e2e run(highly unlikely but a possibility).

So, let's stop cordoning master nodes.

UPSTREAM: <carry>: enable internal traffic policy tests

Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=1986307

UPSTREAM: <carry>: update rebase doc

UPSTREAM: <carry>: enable e2e test after 1.23 rebase in sdn

Enable "[sig-network] Conntrack should be able to preserve UDP traffic when initial unready endpoints get ready" after 1.23 rebase in openshift/sdn

UPSTREAM: <carry>: Unskip OCP SDN related tests

Unskip networkPolicy tests concerning IpBlock and
egress rules since both features have now been
implemented.

UPSTREAM: <carry>: enable should drop INVALID conntrack entries test

UPSTREAM: <carry>: update e2es

UPSTREAM: revert: <carry>: Unskip OCP SDN related tests

These newly-enabled tests are breaking some CI, possibly due to race
conditions in the tests. Re-disable them for now.

This reverts commit aba8d20.

UPSTREAM: <carry>: update hyperkube and image version

UPSTREAM: <drop>: disable e2e tests

- disable 'ProxyTerminatingEndpoints' feature e2e tests

- disable [sig-network] [Feature:Topology Hints] should distribute endpoints evenly
see https://bugzilla.redhat.com/show_bug.cgi?id=2079958 for more context

UPSTREAM: <carry>: Add kubensenter to the openshift RPM

This carry-patch adds the kubensenter script to the openshift-hyperkube
RPM, by importing it via the new hack/update-kubensenter.sh script.

UPSTREAM: <carry>: Skip session affinity timeout tests

in 4.12 and higher the default CNI is OVNKubernetes and
these two tests do not pass. Skip them. They are also
skipping in the origin test suites for ovnk.

UPSTREAM: <carry>: Update kubensenter to use exec instead of direct call

Because kubelet relies on systemd's Type=notify mechanism, we don't need
or want kubensenter to keep itself in the process tree. exec is best.

UPSTREAM: <carry>: update to ginkgo v2 - squash to tooling

UPSTREAM: <carry>: update rebase doc

UPSTREAM: <carry>: allow annotating with a specific suite

If a test specifies a suite, don't append another one to it. We want the
ability to add tests to a particular suite without automatically being
added to parallel conformance.

UPSTREAM: <carry>: Ensure balanced brackets in annotated test names

We recently started marking tests with apigroups, and in one case we
missed the closing bracket on the annotation resulting in the test being
erroneously skipped.

This adds a check in the annotation generation, and errors when brackets
are unbalanced.

```
Example:
$ ./hack/verify-generated.sh
FAILURE after 12.870s: hack/verify-generated.sh:13: executing '/home/stbenjam/go/src/github.com/openshift/origin/hack/update-generated.sh' expecting success: the command returned the wrong error code
Standard output from the command:
Nov  4 14:11:25.026: INFO: Enabling in-tree volume drivers
Nov  4 14:11:25.026: INFO: Warning: deprecated ENABLE_STORAGE_GCE_PD_DRIVER used. This will be removed in a future release. Use --enabled-volume-drivers=gcepd instead
Nov  4 14:11:25.026: INFO: Enabled gcepd and windows-gcepd in-tree volume drivers

Standard error from the command:
failed: unbalanced brackets in test name:
[Top Level] [sig-scheduling][Early] The openshift-console console pods [apigroup:console.openshift.io should be scheduled on different nodes
                                                                       ^
```

UPSTREAM: <carry>: add CSI migration feature gates for vSphere and Azure File

This commit is the next natural step for commits 2d9a8f9
and d37e84c. It introduces custom feature gates to enable
the CSI migration in vSphere and Azure File plugins.

See openshift/enhancements#549 for details.

Stop <carrying> the patch when CSI migration becomes GA (i.e.
features.CSIMigrationAzureFile / features.CSIMigrationVSphere
are GA).

UPSTREAM: <carry>: Skip in-tree topology tests win Azure Disk migrated to CSI

Skip test that depend on in-tree Azure Disk volume plugin that (wrongly)
uses failure domains for value of "topology.kubernetes.io/zone" label in
Azure regions that don't have availability zones.

Our e2e tests blindly use that label and expect that a volume provisioned
in such a "zone" can be used only by nodes in that "zone" (= topology
domain). This is false, Azure Disk CSI driver can use such a volume in any
zone and therefore the test may randomly fail.

See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2066865

UPSTREAM: <carry>: Stop ignoring generated openapi definitions

openshift/origin needs to be able to vendor these definitions so they
need to be committed.

OpenShift-Rebase-Source: 514f181
OpenShift-Rebase-Source: 87e220b
OpenShift-Rebase-Source: b25e156
OpenShift-Rebase-Source: 2256387
OpenShift-Rebase-Source: e4d66c1
OpenShift-Rebase-Source: 5af594b

UPSTREAM: <carry>: disable tests for features in alpha

UPSTREAM: <carry>: disable tests dependent on StackDriver

UPSTREAM: <carry>: add default sysctls for kubelet in rpm

UPSTREAM: <carry>: add new approvers

UPSTREAM: <carry>: update rebase doc

UPSTREAM: <carry>: update hyperkube image version

Updated builder as well.

UPSTREAM: <carry>: add missing generated file

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Add CSI mock volume tests. In upstream these tests were moved
to a different package, so we stopped generating their names
in OpenShift. This patch fixes that.

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Disable CSI mock tests for SELinux and RecoverVolumeExpansionFailure, which
are alpha features and require additional work to get enabled.

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

UPSTREAM: <carry>: update rebase doc

UPSTREAM: <carry>: disable failing dnsPolicy test

UPSTREAM: <carry>: Create minimal wrapper needed to run k8s e2e tests

UPSTREAM: <carry>: Change annotation mechanics to allow injecting testMaps and filter out tests

UPSTREAM: <carry>: Move k8s-specific rules to our fork

UPSTREAM: <carry>: Create minimal wrapper needed to run k8s e2e tests

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Update the list of tests that should be skipped.

UPSTREAM: <carry>: Force using host go always and use host libriaries

UPSTREAM: <carry>: ignore vendor when generating code

UPSTREAM: <carry>: ignore vendor when installing ncpu from hack/tools

UPSTREAM: <carry>: move test rules from origin

These were brought back in o/o PRs as follows:
- netpol - openshift/origin#26775
- schedulerpreemption - openshift/origin#27874

UPSTREAM: <carry>: UserNamespacesSupport feature was rename to UserNamespacesStatelessPodsSupport

See commit 531d38e.

UPSTREAM: <carry>: allow apiserver-library-go to depend on k8s.io/kubernetes

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Remove commitchecker.

UPSTREAM: <carry>: Force using host go always and use host libriaries

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Update builder images.

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Bump builder and base images to OCP 4.15 and RHEL 9 (where possible).

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Update REBASE.openshift.md file with new RHEL 9 images.

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

Remove "git rerere" suggestion. This has shown to be problematic in some cases.

UPSTREAM: <carry>: Fix sporadic 141 errors in build-rpms

"head" sometimes exits before "rpmspec" finishes piping it all its data.
Workaround that by separating the rpmspec and head calls.

UPSTREAM: <carry>: Disable e2e tests related to AdmissionWebhookMatchConditions

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs
1. Fix failure while running the verify.import-boss case
2. Add verify-govulncheck.sh to the excluded pattern
   This requires a new package to be installed on the fly and the same fails with the following error.
   `go: golang.org/x/vuln/cmd/[email protected]: cannot query module due to -mod=vendor`
   The above error needs to be fixed before enabling this `govulncheck`

UPSTREAM: <carry>: switch to go1.21

UPSTREAM: <carry>: use snyk file

UPSTREAM: <carry>: RPM: Split apiserver, scheduler, k-c-m, kubelet into subpackages

This change should allow us to install a much smaller set of binaries
into RHCOS while preserving functional compatibility with with anyone
who installs `openshift-hyperkube` today as it requires all sub packages.
Those wishing to have just the kubelet can begin installing
`openshift-hyperkube-kubelet`

-rwxr-xr-x. 2 root root 129M Jan  1  1970 /usr/bin/kube-apiserver
-rwxr-xr-x. 2 root root 114M Jan  1  1970 /usr/bin/kube-controller-manager
-rwxr-xr-x. 2 root root  54M Jan  1  1970 /usr/bin/kube-scheduler
-rwxr-xr-x. 2 root root 105M Jan  1  1970 /usr/bin/kubelet
-rwxr-xr-x. 2 root root 3.5K Jan  1  1970 /usr/bin/kubensenter

Should save about 297M or 74% in most environments where the kubelet is
all that's desired.

It's not clear to me why these were ever in the RPM since OCP 4.x but this
packaging should remain compatible as openshift-hyperkube depends on
 - openshift-kubelet
 - openshift-kube-apiserver
 - openshift-kube-scheduler
 - openshift-kube-controller-manager

UPSTREAM: <carry>: openshift-hack/images/os: delete

All the logic there is geared towards `machine-os-content` which is no
longer used at all in the cluster.

Nowadays, the container to modify is `rhel-coreos`, which is what is
already being done in CI:

https://github.com/openshift/release/blob/463a8f244ba0f807e76e6fdf974f98d24efd1ced/ci-operator/config/openshift/kubernetes/openshift-kubernetes-master.yaml#L87-L97

UPSTREAM: <carry>: Disable SCCs in k8s-e2e.test namespaces

We want to run upstream e2e tests ignored by SCCs. Make sure the test
namespaces have label
security.openshift.io/disable-securitycontextconstraints: true and disabled
podSecurityLabelSync.

UPSTREAM: <carry>: Enable SELinux tests

Now that k8s-e2e.test is not affected by SCCs, all SELinux tests should
pass.

UPSTREAM: <carry>: update test rules

UPSTREAM: <carry>: permanently disable NodeLogQuery e2e test

Tests require SSH configuration and is part of the parallel suite, which
does not create the bastion host. Enabling the test would result in the
bastion being created for every parallel test execution. Given that we
have existing oc and WMCO  tests that cover this functionality, we can
safely disable it.

UPSTREAM: <carry>: clean OpenShift tooling

UPSTREAM: <carry>: Add Dockerfile to buld kube-apiserver for openshift-install architectures

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

UPSTREAM: <carry>: Create minimal wrapper needed to run k8s e2e tests

UPSTREAM: <carry>: Add update go workspace step to the update flow

Given we verify go workspace, we need to do `update-go-workspace`
step during `make update`

UPSTREAM: <carry>: Provide SCC access via RBAC

UPSTREAM: <carry>: add native build to installer image

This is needed for the s390x/ppc64le arches since we just cross-compile
to linux amd/arm64.

UPSTREAM: <carry>: update docker image to use go 1.22

UPSTREAM: <carry>: update rules.go

UPSTREAM: <carry>: Skip eviction test on tainted nodes for SNO jobs

UPSTREAM: <carry>: OCPBUGS-34102: force static build of linux binaries

Setting `KUBE_STATIC_OVERRIDES` is necessary for the kubernetes build
system to attempt a static build but we also need to set
`GO_COMPLIANCE_EXCLUDE` so the `CGO_ENABLED` value is not overridden by
the fips-or-die toolchain used to build the release payload.

This fixes an issue when running the openshift-installer in
centos7/rhel8 systems which fails with:
```
E0521 18:04:24.925722    2077 server.go:317] "unable to start the controlplane" err="unable to run command \"cluster-api/kube-apiserver\" to check for flag \"insecure-port\": exit status 1" logger="controller-runtime.test-env" tries=4
ERROR failed to fetch Cluster: failed to generate asset "Cluster": failed to create cluster: failed to run cluster api system: failed to run local control plane: unable to start control plane itself: failed to start the controlplane. ret\
ried 5 times: unable to run command "cluster-api/kube-apiserver" to check for flag "insecure-port": exit status 1
```
because it's trying to run a dynamically-linked kube-apiserver binary.

UPSTREAM: <carry>: inject k8s version from hyperkube Dockerfile

Squash to openshift tooling.

UPSTREAM: <carry>: sync imports and update test rules

This should be suqashed with tooling.

UPSTREAM: <carry>: use host etcd

UPSTREAM: <carry>: skip storage tests

UPSTREAM: <carry>: skip PodLifecycleSleepAction test

UPSTREAM: <carry>: add tool to validate test packages imported

UPSTREAM: <carry>: update test annotations for sno

recent addition of upstream architecture package to openshift tests include.go is breaking conformance tests for sno
should squash with tooling

Signed-off-by: ehila <[email protected]>

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

bump images to 4.18 and kubernetes to 1.31.0

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

update Disabled:Alpha test rules

UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

disable verify-e2e-suites.sh

UPSTREAM: <carry>: skip VolumeAttributesClass tests

Author: marun

.ci-operator.yaml

@@ -0,0 +1,4 @@
+build_root_image:
+  name: release
+  namespace: openshift
+  tag: rhel-9-release-golang-1.23-openshift-4.19

.gitignore

@@ -124,3 +124,10 @@ zz_generated_*_test.go
 
 # generated by verify-vendor.sh
 vendordiff.patch
+
+# Ignore openshift source archives produced as part of rpm build
+openshift*.tar.gz
+
+# Ensure that openapi definitions are not ignored to ensure that
+# openshift/origin can vendor them.
+!pkg/generated/openapi/zz_generated.openapi.go