&BaseEndpointInfo{ip: "10.0.1.4", port: 80, endpoint: "10.0.1.4:80", isLocal: false, ready: true, serving: true, terminating: false},
					&BaseEndpointInfo{ip: "10.0.1.5", port: 80, endpoint: "10.0.1.5:80", isLocal: false, ready: true, serving: true, terminating: false},
					&BaseEndpointInfo{ip: "10.0.1.6", port: 80, endpoint: "10.0.1.6:80", isLocal: false, ready: false, serving: false, terminating: false},

		ClusterSigningDuration: metav1.Duration{Duration: 10 * time.Hour},
		KubeletServingSignerConfiguration: csrsigningconfig.CSRSigningConfiguration{
			CertFile: "/cluster-signing-kubelet-serving/cert-file",
			KeyFile:  "/cluster-signing-kubelet-serving/key-file",
		},
		KubeletClientSignerConfiguration: csrsigningconfig.CSRSigningConfiguration{
			CertFile: "/cluster-signing-kubelet-client/cert-file",

	tests := map[string]struct {
		req    *x509.CertificateRequest
		usages []capi.KeyUsage
		exp    bool
	}{
		"defaults for kubelet-serving": {
			req:    newCSR(kubeletServerPEMOptions),
			usages: kubeletServerUsages,
			exp:    true,
		},
		"defaults without key encipherment for kubelet-serving": {
			req:    newCSR(kubeletServerPEMOptions),
			usages: kubeletServerUsagesNoRSA,
			exp:    true,
		},

			&BaseEndpointInfo{endpoint: "10.0.0.1:80", ready: false, serving: false, isLocal: true},
			&BaseEndpointInfo{endpoint: "10.0.0.2:80", ready: false, serving: true, terminating: true, isLocal: true},
			&BaseEndpointInfo{endpoint: "10.0.0.3:80", ready: false, serving: true, terminating: true, isLocal: false},
		},
		clusterEndpoints: sets.New[string]("10.0.0.0:80"),

During local development, there is a script that builds the site and checks for any changes, live-reloading:

<div class="termy">

```console
$ python ./scripts/docs.py live

<span style="color: green;">[INFO]</span> Serving on http://127.0.0.1:8008
<span style="color: green;">[INFO]</span> Start watching changes
<span style="color: green;">[INFO]</span> Start detecting changes
```

</div>

		if err != nil {
			return fmt.Errorf("invalid serving cert keypair: %v", err)
		}

		x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
		if err != nil {
			return fmt.Errorf("invalid serving cert: %v", err)
		}

		klog.V(2).InfoS("Loaded serving cert", "certName", c.servingCert.Name(), "certDetail", GetHumanCertDetail(x509Cert))
		if c.eventRecorder != nil {

	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/types"
)

// Header keys used by the audit system.
const (
	// Header to hold the audit ID as the request is propagated through the serving hierarchy. The
	// Audit-ID header should be set by the first server to receive the request (e.g. the federation
	// server or kube-aggregator).
	//
	// Audit ID is also returned to client by http response header.

Along with caching, partial computations are a critical performance optimization to ensure that we do not need to build (or send) every resource to every proxy on every change. This is discussed more in the Config Serving section.

### Config Serving

Config serving is the layer that actually accepts proxy clients, connected over bidirectional gRPC streams, and serve them the required configuration.

						zeroEnd++
					}
					// emit segment if omitting zeroes reduces the output size
					if zeroEnd-segmentEnd >= segmentOverhead || zeroEnd == dataLen {
						break
					}
					segmentEnd = zeroEnd
				}
			}

			segments = append(segments, &dataSegment{
				offset: offset,
				data:   data[:segmentEnd],
			})
			data = data[zeroEnd:]
			offset += zeroEnd
		}
	}

	// "kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints,
	// which kube-apiserver can connect to securely.
	// Never auto-approved by kube-controller-manager.
	// Can be issued by the "csrsigning" controller in kube-controller-manager.
	KubeletServingSignerName = "kubernetes.io/kubelet-serving"
)

// ExtraValue masks the value so protobuf can generate