Merge pull request #87582 from mrueg/ptr

PodTolerationRestriction: Mention Whitelist Scope in Error
This commit is contained in:
Kubernetes Prow Robot 2020-06-29 13:07:59 -07:00 committed by GitHub
commit 71c352dee3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -127,6 +127,7 @@ func (p *Plugin) Validate(ctx context.Context, a admission.Attributes, o admissi
pod := a.GetObject().(*api.Pod)
if len(pod.Spec.Tolerations) > 0 {
whitelist, err := p.getNamespaceTolerationsWhitelist(a.GetNamespace())
whitelistScope := "namespace"
if err != nil {
return err
}
@ -135,12 +136,13 @@ func (p *Plugin) Validate(ctx context.Context, a admission.Attributes, o admissi
// fall back to cluster's whitelist of tolerations.
if whitelist == nil {
whitelist = p.pluginConfig.Whitelist
whitelistScope = "cluster"
}
if len(whitelist) > 0 {
// check if the merged pod tolerations satisfy its namespace whitelist
if !tolerations.VerifyAgainstWhitelist(pod.Spec.Tolerations, whitelist) {
return fmt.Errorf("pod tolerations (possibly merged with namespace default tolerations) conflict with its namespace whitelist")
return fmt.Errorf("pod tolerations (possibly merged with namespace default tolerations) conflict with its %s whitelist", whitelistScope)
}
}
}