Core Components

// From pkg/rancher/rancher.go:294
steve, err := steveserver.New(ctx, restConfig, &steveserver.Options{
    ServerVersion:   settings.ServerVersion.Get(),
    Controllers:     steveControllers,
    AccessSetLookup: wranglerContext.ASL,
    AuthMiddleware:  steveauth.ExistingContext,
    Next:            ui.New(...),
    ClusterRegistry: opts.ClusterRegistry,
    SQLCache:        features.UISQLCache.Enabled(),
})

// From pkg/rancher/rancher.go:390
Handler: responsewriter.Chain{
    auth.SetXAPICattleAuthHeader,
    responsewriter.ContentTypeOptions,
    responsewriter.NoCache,
    websocket.NewWebsocketHandler,
    proxy.RewriteLocalCluster,
    clusterProxy,
    aggregationMiddleware,
    additionalAPIPreMCM,
    wranglerContext.MultiClusterManager.Middleware,
    authServer.Management,
    additionalAPI,
    requests.NewRequireAuthenticatedFilter("/v1/", "/v1/management.cattle.io.setting"),
}.Handler(steve)

// From pkg/auth/server.go:31
type Server struct {
    Authenticator steveauth.Middleware
    Management    func(http.Handler) http.Handler
    scaledContext *config.ScaledContext
}

// API Tokens
- User tokens: Long-lived API access
- Kubeconfig tokens: For kubectl access  
- Cluster tokens: Agent registration

// Automatic token cleanup
tokens.StartPurgeDaemon(ctx, management)

// Standard controller registration
func Register(ctx context.Context, wrangler *wrangler.Context) {
    // Create controller
    controller := wrangler.Mgmt.Cluster().OnChange(ctx, "cluster-controller", handler)
    
    // Register indexers
    wrangler.Mgmt.Cluster().Cache().AddIndexer(indexName, indexFunc)
}

// Leader election
wrangler.OnLeader(func(ctx context.Context) error {
    // Start controllers that should only run on leader
    return controller.Start(ctx)
})

// From pkg/rancher/rancher.go:313
clusterProxy, err := proxy.NewProxyMiddleware(
    wranglerContext.K8s.AuthorizationV1(),
    wranglerContext.TunnelServer.Dialer,
    wranglerContext.Mgmt.Cluster().Cache(),
    localClusterEnabled(opts),
    steve,
)

// From pkg/tunnelserver/peermanager.go:33
type peerManager struct {
    leader    bool
    ready     bool  
    token     string
    urlFormat string
    server    *remotedialer.Server
    peers     map[string]bool
    listeners map[chan<- peermanager.Peers]bool
}

// Validates cluster registration tokens
// Ensures agent identity
// Enforces connection policies

// From pkg/agent/cluster/cluster.go:20
const (
    rancherCredentialsFolder = "/cattle-credentials"
    urlFilename              = "url"
    tokenFilename            = "token"  
    namespaceFilename        = "namespace"
)

// Agent reads connection parameters
func TokenAndURL() (string, string, error)

// From pkg/wrangler/context.go
type Context struct {
    K8s                    kubernetes.Interface
    SharedControllerFactory *controller.SharedControllerFactory
    MultiClusterManager    MultiClusterManager
    TunnelServer          *remotedialer.Server
    ASL                   accesscontrol.AccessSetLookup
    // ... controller groups
    Mgmt    mgmt.Interface
    Core    core.Interface
    RBAC    rbac.Interface
}

// From pkg/rancher/rancher.go:216
if err := crds.EnsureRequired(ctx, clientSet); err != nil {
    return nil, fmt.Errorf("failed to ensure CRDs: %w", err)
}

if err := dashboardcrds.Create(ctx, restConfig); err != nil {
    return nil, fmt.Errorf("failed to create CRDs: %w", err)  
}

// Key features with toggles
features.MCM.Enabled()              // Multi-cluster manager
features.Fleet.Enabled()            // GitOps fleet
features.ProvisioningV2.Enabled()   // New provisioning
features.Auth.Enabled()             // Authentication
features.UIExtension.Enabled()      // UI plugins
features.UISQLCache.Enabled()       // SQL caching

settings.ServerVersion.Get()        // Rancher version
settings.ServerURL.Get()            // Server URL
settings.CACerts.Get()              // CA certificates
settings.AgentTLSMode.Get()         // TLS validation mode
settings.Namespace.Get()            // System namespace
settings.PeerServices.Get()         // HA peer services

// Automatic secret creation for SA tokens (K8s 1.24+)
serviceaccounttoken.EnsureSecretForServiceAccount(ctx, ...)

// Cleanup of unused tokens
serviceaccounttoken.StartServiceAccountSecretCleaner(ctx, ...)

// From pkg/ext/
extensionAPIServer, err := ext.NewExtensionAPIServer(
    ctx, wranglerContext, extensionOpts,
)

// Provides:
// - Imperative shell access
// - Log streaming  
// - File operations
// - Custom actions