diff --git a/cmd/kube-apiserver/app/options/options_test.go b/cmd/kube-apiserver/app/options/options_test.go index 14bacec9a49..591a73633a2 100644 --- a/cmd/kube-apiserver/app/options/options_test.go +++ b/cmd/kube-apiserver/app/options/options_test.go @@ -103,7 +103,8 @@ func TestAddFlags(t *testing.T) { MinRequestTimeout: 1800, }, Admission: &apiserveroptions.AdmissionOptions{ - RecommendedPluginOrder: []string{"NamespaceLifecycle"}, + RecommendedPluginOrder: []string{"NamespaceLifecycle", "Initializers"}, + DefaultOffPlugins: []string{"Initializers"}, PluginNames: []string{"AlwaysDeny"}, ConfigFile: "/admission-control-config", Plugins: s.Admission.Plugins, diff --git a/cmd/kube-apiserver/app/options/plugins.go b/cmd/kube-apiserver/app/options/plugins.go index 0e86e7cfdb5..8656eb157ce 100644 --- a/cmd/kube-apiserver/app/options/plugins.go +++ b/cmd/kube-apiserver/app/options/plugins.go @@ -34,7 +34,6 @@ import ( "k8s.io/kubernetes/plugin/pkg/admission/exec" "k8s.io/kubernetes/plugin/pkg/admission/gc" "k8s.io/kubernetes/plugin/pkg/admission/imagepolicy" - "k8s.io/kubernetes/plugin/pkg/admission/initialization" "k8s.io/kubernetes/plugin/pkg/admission/initialresources" "k8s.io/kubernetes/plugin/pkg/admission/limitranger" "k8s.io/kubernetes/plugin/pkg/admission/namespace/autoprovision" @@ -65,7 +64,6 @@ func RegisterAllAdmissionPlugins(plugins *admission.Plugins) { exec.Register(plugins) gc.Register(plugins) imagepolicy.Register(plugins) - initialization.Register(plugins) initialresources.Register(plugins) limitranger.Register(plugins) autoprovision.Register(plugins) diff --git a/federation/cmd/federation-apiserver/app/plugins.go b/federation/cmd/federation-apiserver/app/plugins.go index f8891540354..a10a3edbabe 100644 --- a/federation/cmd/federation-apiserver/app/plugins.go +++ b/federation/cmd/federation-apiserver/app/plugins.go @@ -29,7 +29,6 @@ import ( "k8s.io/kubernetes/plugin/pkg/admission/admit" "k8s.io/kubernetes/plugin/pkg/admission/deny" "k8s.io/kubernetes/plugin/pkg/admission/gc" - "k8s.io/kubernetes/plugin/pkg/admission/initialization" ) // RegisterAllAdmissionPlugins registers all admission plugins @@ -37,6 +36,5 @@ func RegisterAllAdmissionPlugins(plugins *admission.Plugins) { admit.Register(plugins) deny.Register(plugins) gc.Register(plugins) - initialization.Register(plugins) schedulingpolicy.Register(plugins) } diff --git a/plugin/pkg/admission/webhook/admission.go b/plugin/pkg/admission/webhook/admission.go index f6642439144..5037a3dfd8c 100644 --- a/plugin/pkg/admission/webhook/admission.go +++ b/plugin/pkg/admission/webhook/admission.go @@ -38,13 +38,13 @@ import ( utilruntime "k8s.io/apimachinery/pkg/util/runtime" "k8s.io/apimachinery/pkg/util/wait" "k8s.io/apiserver/pkg/admission" + "k8s.io/apiserver/pkg/admission/configuration" genericadmissioninit "k8s.io/apiserver/pkg/admission/initializer" clientset "k8s.io/client-go/kubernetes" "k8s.io/client-go/rest" "k8s.io/kubernetes/pkg/api" admissionv1alpha1helper "k8s.io/kubernetes/pkg/apis/admission/v1alpha1" admissioninit "k8s.io/kubernetes/pkg/kubeapiserver/admission" - "k8s.io/kubernetes/pkg/kubeapiserver/admission/configuration" // install the clientgo admission API for use with api registry _ "k8s.io/kubernetes/pkg/apis/admission/install" diff --git a/pkg/kubeapiserver/admission/configuration/BUILD b/staging/src/k8s.io/apiserver/pkg/admission/configuration/BUILD similarity index 100% rename from pkg/kubeapiserver/admission/configuration/BUILD rename to staging/src/k8s.io/apiserver/pkg/admission/configuration/BUILD diff --git a/pkg/kubeapiserver/admission/configuration/configuration_manager.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager.go similarity index 100% rename from pkg/kubeapiserver/admission/configuration/configuration_manager.go rename to staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager.go diff --git a/pkg/kubeapiserver/admission/configuration/configuration_manager_test.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager_test.go similarity index 100% rename from pkg/kubeapiserver/admission/configuration/configuration_manager_test.go rename to staging/src/k8s.io/apiserver/pkg/admission/configuration/configuration_manager_test.go diff --git a/pkg/kubeapiserver/admission/configuration/external_admission_hook_manager.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/external_admission_hook_manager.go similarity index 100% rename from pkg/kubeapiserver/admission/configuration/external_admission_hook_manager.go rename to staging/src/k8s.io/apiserver/pkg/admission/configuration/external_admission_hook_manager.go diff --git a/pkg/kubeapiserver/admission/configuration/external_admission_hook_manager_test.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/external_admission_hook_manager_test.go similarity index 100% rename from pkg/kubeapiserver/admission/configuration/external_admission_hook_manager_test.go rename to staging/src/k8s.io/apiserver/pkg/admission/configuration/external_admission_hook_manager_test.go diff --git a/pkg/kubeapiserver/admission/configuration/initializer_manager.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/initializer_manager.go similarity index 100% rename from pkg/kubeapiserver/admission/configuration/initializer_manager.go rename to staging/src/k8s.io/apiserver/pkg/admission/configuration/initializer_manager.go diff --git a/pkg/kubeapiserver/admission/configuration/initializer_manager_test.go b/staging/src/k8s.io/apiserver/pkg/admission/configuration/initializer_manager_test.go similarity index 100% rename from pkg/kubeapiserver/admission/configuration/initializer_manager_test.go rename to staging/src/k8s.io/apiserver/pkg/admission/configuration/initializer_manager_test.go diff --git a/plugin/pkg/admission/initialization/BUILD b/staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization/BUILD similarity index 100% rename from plugin/pkg/admission/initialization/BUILD rename to staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization/BUILD diff --git a/plugin/pkg/admission/initialization/initialization.go b/staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization.go similarity index 95% rename from plugin/pkg/admission/initialization/initialization.go rename to staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization.go index a105fc012f4..e536e290dfb 100644 --- a/plugin/pkg/admission/initialization/initialization.go +++ b/staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization.go @@ -24,6 +24,7 @@ import ( "github.com/golang/glog" "k8s.io/api/admissionregistration/v1alpha1" + "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/meta" "k8s.io/apimachinery/pkg/api/validation" @@ -32,17 +33,21 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/apimachinery/pkg/util/wait" "k8s.io/apiserver/pkg/admission" + "k8s.io/apiserver/pkg/admission/configuration" "k8s.io/apiserver/pkg/authorization/authorizer" "k8s.io/apiserver/pkg/features" utilfeature "k8s.io/apiserver/pkg/util/feature" clientset "k8s.io/client-go/kubernetes" - "k8s.io/kubernetes/pkg/api" - "k8s.io/kubernetes/pkg/kubeapiserver/admission/configuration" +) + +const ( + // Name of admission plug-in + PluginName = "Initializers" ) // Register registers a plugin func Register(plugins *admission.Plugins) { - plugins.Register("Initializers", func(config io.Reader) (admission.Interface, error) { + plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) { return NewInitializer(), nil }) } @@ -183,8 +188,13 @@ func (i *initializer) Admit(a admission.Attributes) (err error) { // Mirror pods are exempt from initialization because they are created and initialized // on the Kubelet before they appear in the API. // TODO: once this moves to REST storage layer, this becomes a pod specific concern - if pod, ok := a.GetObject().(*api.Pod); ok && pod != nil { - if _, isMirror := pod.Annotations[api.MirrorPodAnnotationKey]; isMirror { + if a.GetKind().GroupKind() == v1.SchemeGroupVersion.WithKind("Pod").GroupKind() { + accessor, err := meta.Accessor(a.GetObject()) + if err != nil { + return err + } + annotations := accessor.GetAnnotations() + if _, isMirror := annotations[v1.MirrorPodAnnotationKey]; isMirror { return nil } } diff --git a/plugin/pkg/admission/initialization/initialization_test.go b/staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization_test.go similarity index 100% rename from plugin/pkg/admission/initialization/initialization_test.go rename to staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization_test.go diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/admission.go b/staging/src/k8s.io/apiserver/pkg/server/options/admission.go index 5b3e3ab3f40..3bdd0bdcfa8 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/admission.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/admission.go @@ -23,6 +23,7 @@ import ( "github.com/spf13/pflag" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/admission/initializer" + "k8s.io/apiserver/pkg/admission/plugin/initialization" "k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle" "k8s.io/apiserver/pkg/server" "k8s.io/client-go/informers" @@ -53,7 +54,8 @@ func NewAdmissionOptions() *AdmissionOptions { options := &AdmissionOptions{ Plugins: &admission.Plugins{}, PluginNames: []string{}, - RecommendedPluginOrder: []string{lifecycle.PluginName}, + RecommendedPluginOrder: []string{lifecycle.PluginName, initialization.PluginName}, + DefaultOffPlugins: []string{initialization.PluginName}, } server.RegisterAllAdmissionPlugins(options.Plugins) return options diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/admission_test.go b/staging/src/k8s.io/apiserver/pkg/server/options/admission_test.go index 0dfcbccce04..37d824eb65e 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/admission_test.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/admission_test.go @@ -56,7 +56,7 @@ func TestEnabledPluginNamesMethod(t *testing.T) { actualPluginNames := target.enabledPluginNames() if len(actualPluginNames) != len(scenario.expectedPluginNames) { - t.Errorf("incorrect number of items, got %d, expected = %d", len(actualPluginNames), len(scenario.expectedPluginNames)) + t.Fatalf("incorrect number of items, got %d, expected = %d", len(actualPluginNames), len(scenario.expectedPluginNames)) } for i := range actualPluginNames { if scenario.expectedPluginNames[i] != actualPluginNames[i] { diff --git a/staging/src/k8s.io/apiserver/pkg/server/plugins.go b/staging/src/k8s.io/apiserver/pkg/server/plugins.go index 404e8afc4c8..c54a4f41d88 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/plugins.go +++ b/staging/src/k8s.io/apiserver/pkg/server/plugins.go @@ -19,10 +19,12 @@ package server // This file exists to force the desired plugin implementations to be linked into genericapi pkg. import ( "k8s.io/apiserver/pkg/admission" + "k8s.io/apiserver/pkg/admission/plugin/initialization" "k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle" ) // RegisterAllAdmissionPlugins registers all admission plugins func RegisterAllAdmissionPlugins(plugins *admission.Plugins) { lifecycle.Register(plugins) + initialization.Register(plugins) }