move the GenericAdmissionWebhook plugin to be after ResourceQuota to

avoid charge quota prematurely
This commit is contained in:
Chao Xu 2017-10-30 18:20:31 -07:00
parent 7d759ba0c9
commit 667fcbd4eb

View File

@ -313,7 +313,7 @@ if [[ -z "${KUBE_ADMISSION_CONTROL:-}" ]]; then
ADMISSION_CONTROL="${ADMISSION_CONTROL},PodSecurityPolicy"
fi
# ResourceQuota must come last, or a creation is recorded, but the pod may be forbidden.
ADMISSION_CONTROL="${ADMISSION_CONTROL},ResourceQuota,GenericAdmissionWebhook"
ADMISSION_CONTROL="${ADMISSION_CONTROL},GenericAdmissionWebhook,ResourceQuota"
else
ADMISSION_CONTROL=${KUBE_ADMISSION_CONTROL}
fi