From 9cfd20ef1ce3a001afc1ac62580db82ade1c5f9b Mon Sep 17 00:00:00 2001 From: Chao Xu Date: Thu, 4 Jan 2018 14:39:35 -0800 Subject: [PATCH] enable mutating and validating admission webhook by default on gce and centos clusters setup by kube/cluster-up.sh --- cluster/centos/config-default.sh | 10 +++++++--- cluster/gce/config-default.sh | 5 +++++ cluster/kubemark/gce/config-default.sh | 2 +- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/cluster/centos/config-default.sh b/cluster/centos/config-default.sh index d75d1b606d3..5f72934b13a 100755 --- a/cluster/centos/config-default.sh +++ b/cluster/centos/config-default.sh @@ -118,9 +118,13 @@ ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}" # define the IP range used for flannel overlay network, should not conflict with above SERVICE_CLUSTER_IP_RANGE export FLANNEL_NET=${FLANNEL_NET:-"172.16.0.0/16"} -# Admission Controllers to invoke prior to persisting objects in cluster -# If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely. -export ADMISSION_CONTROL=${ADMISSION_CONTROL:-"Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeClaimResize,DefaultTolerationSeconds,Priority,StorageProtection,ResourceQuota"} +# Admission Controllers to invoke prior to persisting objects in cluster. +# MutatingAdmissionWebhook should be the last controller that modifies the +# request object, otherwise users will be confused if the mutating webhooks' +# modification is overwritten. +# If we included ResourceQuota, we should keep it at the end of the list to +# prevent incrementing quota usage prematurely. +export ADMISSION_CONTROL=${ADMISSION_CONTROL:-"Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeClaimResize,DefaultTolerationSeconds,Priority,StorageProtection,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota"} # Extra options to set on the Docker command line. # This is useful for setting --insecure-registry for local registries. diff --git a/cluster/gce/config-default.sh b/cluster/gce/config-default.sh index 767a27b19a6..254e9371b8c 100755 --- a/cluster/gce/config-default.sh +++ b/cluster/gce/config-default.sh @@ -301,6 +301,11 @@ if [[ "${ENABLE_POD_SECURITY_POLICY:-}" == "true" ]]; then ADMISSION_CONTROL="${ADMISSION_CONTROL},PodSecurityPolicy" fi +# MutatingAdmissionWebhook should be the last controller that modifies the +# request object, otherwise users will be confused if the mutating webhooks' +# modification is overwritten. +ADMISSION_CONTROL="${ADMISSION_CONTROL},MutatingAdmissionWebhook,ValidatingAdmissionWebhook" + # ResourceQuota must come last, or a creation is recorded, but the pod was forbidden. ADMISSION_CONTROL="${ADMISSION_CONTROL},ResourceQuota" diff --git a/cluster/kubemark/gce/config-default.sh b/cluster/kubemark/gce/config-default.sh index 6d9282d061a..9c54753fad4 100644 --- a/cluster/kubemark/gce/config-default.sh +++ b/cluster/kubemark/gce/config-default.sh @@ -89,7 +89,7 @@ TEST_CLUSTER_API_CONTENT_TYPE="${TEST_CLUSTER_API_CONTENT_TYPE:-}" KUBEMARK_MASTER_COMPONENTS_QPS_LIMITS="${KUBEMARK_MASTER_COMPONENTS_QPS_LIMITS:-}" -CUSTOM_ADMISSION_PLUGINS="${CUSTOM_ADMISSION_PLUGINS:-Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,PodPreset,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,ResourceQuota}" +CUSTOM_ADMISSION_PLUGINS="${CUSTOM_ADMISSION_PLUGINS:-Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,PodPreset,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota}" # Master components' test arguments. APISERVER_TEST_ARGS="${KUBEMARK_APISERVER_TEST_ARGS:-} --runtime-config=extensions/v1beta1 ${API_SERVER_TEST_LOG_LEVEL} ${TEST_CLUSTER_MAX_REQUESTS_INFLIGHT} ${TEST_CLUSTER_DELETE_COLLECTION_WORKERS}"