From 816c56b61972ba787554df7687567a7ce0fb6d4e Mon Sep 17 00:00:00 2001 From: Jean-Francois Chevrette Date: Fri, 28 Sep 2018 20:49:13 -0400 Subject: [PATCH 1/2] set default admission plugins on local-up-cluster.sh --- hack/local-up-cluster.sh | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/hack/local-up-cluster.sh b/hack/local-up-cluster.sh index 4b797fa42bf..76f69488e8d 100755 --- a/hack/local-up-cluster.sh +++ b/hack/local-up-cluster.sh @@ -103,7 +103,11 @@ export KUBE_CACHE_MUTATION_DETECTOR KUBE_PANIC_WATCH_DECODE_ERROR="${KUBE_PANIC_WATCH_DECODE_ERROR:-true}" export KUBE_PANIC_WATCH_DECODE_ERROR -ENABLE_ADMISSION_PLUGINS=${ENABLE_ADMISSION_PLUGINS:-""} +# Default list of admission Controllers to invoke prior to persisting objects in cluster +# The order defined here does not matter. +DEFAULT_ENABLE_ADMISSION_PLUGINS="LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,StorageObjectInUseProtection" + +ENABLE_ADMISSION_PLUGINS=${ENABLE_ADMISSION_PLUGINS:-"${DEFAULT_ENABLE_ADMISSION_PLUGINS}"} DISABLE_ADMISSION_PLUGINS=${DISABLE_ADMISSION_PLUGINS:-""} ADMISSION_CONTROL_CONFIG_FILE=${ADMISSION_CONTROL_CONFIG_FILE:-""} @@ -507,11 +511,8 @@ function start_apiserver { RUNTIME_CONFIG+="scheduling.k8s.io/v1alpha1=true" fi - - # Admission Controllers to invoke prior to persisting objects in cluster - # - # The order defined here dose not matter. - ENABLE_ADMISSION_PLUGINS=LimitRanger,ServiceAccount${security_admission},DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,StorageObjectInUseProtection + # Append security_admission plugin + ENABLE_ADMISSION_PLUGINS="${ENABLE_ADMISSION_PLUGINS}${security_admission}" swagger_arg="" if [[ "${ENABLE_SWAGGER_UI}" = true ]]; then From c4ea93c42bbdaeec4956a41b2285d4323f7545f1 Mon Sep 17 00:00:00 2001 From: Jean-Francois Chevrette Date: Sun, 30 Sep 2018 15:40:34 -0400 Subject: [PATCH 2/2] update list of default admission plugins --- hack/local-up-cluster.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/hack/local-up-cluster.sh b/hack/local-up-cluster.sh index 76f69488e8d..ba4f5eba59e 100755 --- a/hack/local-up-cluster.sh +++ b/hack/local-up-cluster.sh @@ -105,9 +105,7 @@ export KUBE_PANIC_WATCH_DECODE_ERROR # Default list of admission Controllers to invoke prior to persisting objects in cluster # The order defined here does not matter. -DEFAULT_ENABLE_ADMISSION_PLUGINS="LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,StorageObjectInUseProtection" - -ENABLE_ADMISSION_PLUGINS=${ENABLE_ADMISSION_PLUGINS:-"${DEFAULT_ENABLE_ADMISSION_PLUGINS}"} +ENABLE_ADMISSION_PLUGINS=${ENABLE_ADMISSION_PLUGINS:-"NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota"} DISABLE_ADMISSION_PLUGINS=${DISABLE_ADMISSION_PLUGINS:-""} ADMISSION_CONTROL_CONFIG_FILE=${ADMISSION_CONTROL_CONFIG_FILE:-""}