diff --git a/cmd/kube-apiserver/app/options/options.go b/cmd/kube-apiserver/app/options/options.go index 7078dcf8f52..5d8ee77f135 100644 --- a/cmd/kube-apiserver/app/options/options.go +++ b/cmd/kube-apiserver/app/options/options.go @@ -48,6 +48,7 @@ type ServerRunOptions struct { InsecureServing *kubeoptions.InsecureServingOptions Audit *genericoptions.AuditLogOptions Features *genericoptions.FeatureOptions + Admission *genericoptions.AdmissionOptions Authentication *kubeoptions.BuiltInAuthenticationOptions Authorization *kubeoptions.BuiltInAuthorizationOptions CloudProvider *kubeoptions.CloudProviderOptions @@ -72,12 +73,13 @@ type ServerRunOptions struct { // NewServerRunOptions creates a new ServerRunOptions object with default parameters func NewServerRunOptions() *ServerRunOptions { s := ServerRunOptions{ - GenericServerRunOptions: genericoptions.NewServerRunOptions(&kubeapiserveradmission.Plugins), + GenericServerRunOptions: genericoptions.NewServerRunOptions(), Etcd: genericoptions.NewEtcdOptions(storagebackend.NewDefaultConfig(kubeoptions.DefaultEtcdPathPrefix, api.Scheme, nil)), SecureServing: kubeoptions.NewSecureServingOptions(), InsecureServing: kubeoptions.NewInsecureServingOptions(), Audit: genericoptions.NewAuditLogOptions(), Features: genericoptions.NewFeatureOptions(), + Admission: genericoptions.NewAdmissionOptions(&kubeapiserveradmission.Plugins), Authentication: kubeoptions.NewBuiltInAuthenticationOptions().WithAll(), Authorization: kubeoptions.NewBuiltInAuthorizationOptions(), CloudProvider: kubeoptions.NewCloudProviderOptions(), @@ -129,6 +131,7 @@ func (s *ServerRunOptions) AddFlags(fs *pflag.FlagSet) { s.CloudProvider.AddFlags(fs) s.StorageSerialization.AddFlags(fs) s.APIEnablement.AddFlags(fs) + s.Admission.AddFlags(fs) // Note: the weird ""+ in below lines seems to be the only way to get gofmt to // arrange these text blocks sensibly. Grrr. diff --git a/cmd/kube-apiserver/app/server.go b/cmd/kube-apiserver/app/server.go index 16d05061210..35915073c80 100644 --- a/cmd/kube-apiserver/app/server.go +++ b/cmd/kube-apiserver/app/server.go @@ -360,7 +360,7 @@ func BuildGenericConfig(s *options.ServerRunOptions) (*genericapiserver.Config, } genericConfig.AdmissionControl, err = BuildAdmission(s, - s.GenericServerRunOptions.AdmissionPlugins, + s.Admission.Plugins, client, sharedInformers, genericConfig.Authorizer, @@ -374,7 +374,7 @@ func BuildGenericConfig(s *options.ServerRunOptions) (*genericapiserver.Config, // BuildAdmission constructs the admission chain func BuildAdmission(s *options.ServerRunOptions, plugins *admission.Plugins, client internalclientset.Interface, sharedInformers informers.SharedInformerFactory, apiAuthorizer authorizer.Authorizer) (admission.Interface, error) { - admissionControlPluginNames := strings.Split(s.GenericServerRunOptions.AdmissionControl, ",") + admissionControlPluginNames := strings.Split(s.Admission.Control, ",") var cloudConfig []byte var err error @@ -387,7 +387,7 @@ func BuildAdmission(s *options.ServerRunOptions, plugins *admission.Plugins, cli // TODO: use a dynamic restmapper. See https://github.com/kubernetes/kubernetes/pull/42615. restMapper := api.Registry.RESTMapper() pluginInitializer := kubeapiserveradmission.NewPluginInitializer(client, sharedInformers, apiAuthorizer, cloudConfig, restMapper) - admissionConfigProvider, err := admission.ReadAdmissionConfiguration(admissionControlPluginNames, s.GenericServerRunOptions.AdmissionControlConfigFile) + admissionConfigProvider, err := admission.ReadAdmissionConfiguration(admissionControlPluginNames, s.Admission.ControlConfigFile) if err != nil { return nil, fmt.Errorf("failed to read plugin config: %v", err) } diff --git a/federation/cmd/federation-apiserver/app/options/options.go b/federation/cmd/federation-apiserver/app/options/options.go index 449d551653c..224d52c0f62 100644 --- a/federation/cmd/federation-apiserver/app/options/options.go +++ b/federation/cmd/federation-apiserver/app/options/options.go @@ -40,6 +40,7 @@ type ServerRunOptions struct { InsecureServing *kubeoptions.InsecureServingOptions Audit *genericoptions.AuditLogOptions Features *genericoptions.FeatureOptions + Admission *genericoptions.AdmissionOptions Authentication *kubeoptions.BuiltInAuthenticationOptions Authorization *kubeoptions.BuiltInAuthorizationOptions CloudProvider *kubeoptions.CloudProviderOptions @@ -52,12 +53,13 @@ type ServerRunOptions struct { // NewServerRunOptions creates a new ServerRunOptions object with default values. func NewServerRunOptions() *ServerRunOptions { s := ServerRunOptions{ - GenericServerRunOptions: genericoptions.NewServerRunOptions(&kubeapiserveradmission.Plugins), + GenericServerRunOptions: genericoptions.NewServerRunOptions(), Etcd: genericoptions.NewEtcdOptions(storagebackend.NewDefaultConfig(kubeoptions.DefaultEtcdPathPrefix, api.Scheme, nil)), SecureServing: kubeoptions.NewSecureServingOptions(), InsecureServing: kubeoptions.NewInsecureServingOptions(), Audit: genericoptions.NewAuditLogOptions(), Features: genericoptions.NewFeatureOptions(), + Admission: genericoptions.NewAdmissionOptions(&kubeapiserveradmission.Plugins), Authentication: kubeoptions.NewBuiltInAuthenticationOptions().WithAll(), Authorization: kubeoptions.NewBuiltInAuthorizationOptions(), CloudProvider: kubeoptions.NewCloudProviderOptions(), @@ -85,6 +87,7 @@ func (s *ServerRunOptions) AddFlags(fs *pflag.FlagSet) { s.CloudProvider.AddFlags(fs) s.StorageSerialization.AddFlags(fs) s.APIEnablement.AddFlags(fs) + s.Admission.AddFlags(fs) fs.DurationVar(&s.EventTTL, "event-ttl", s.EventTTL, "Amount of time to retain events. Default is 1h.") diff --git a/federation/cmd/federation-apiserver/app/server.go b/federation/cmd/federation-apiserver/app/server.go index 9eee022a25f..8cea7ece4fb 100644 --- a/federation/cmd/federation-apiserver/app/server.go +++ b/federation/cmd/federation-apiserver/app/server.go @@ -185,7 +185,7 @@ func NonBlockingRun(s *options.ServerRunOptions, stopCh <-chan struct{}) error { return fmt.Errorf("invalid Authorization Config: %v", err) } - admissionControlPluginNames := strings.Split(s.GenericServerRunOptions.AdmissionControl, ",") + admissionControlPluginNames := strings.Split(s.Admission.Control, ",") var cloudConfig []byte if s.CloudProvider.CloudConfigFile != "" { @@ -195,7 +195,7 @@ func NonBlockingRun(s *options.ServerRunOptions, stopCh <-chan struct{}) error { } } pluginInitializer := kubeapiserveradmission.NewPluginInitializer(client, sharedInformers, apiAuthorizer, cloudConfig, nil) - admissionConfigProvider, err := admission.ReadAdmissionConfiguration(admissionControlPluginNames, s.GenericServerRunOptions.AdmissionControlConfigFile) + admissionConfigProvider, err := admission.ReadAdmissionConfiguration(admissionControlPluginNames, s.Admission.ControlConfigFile) if err != nil { return fmt.Errorf("failed to read plugin config: %v", err) } diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/admission.go b/staging/src/k8s.io/apiserver/pkg/server/options/admission.go new file mode 100644 index 00000000000..6f1774a72b1 --- /dev/null +++ b/staging/src/k8s.io/apiserver/pkg/server/options/admission.go @@ -0,0 +1,49 @@ +/* +Copyright 2017 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package options + +import ( + "strings" + + "github.com/spf13/pflag" + "k8s.io/apiserver/pkg/admission" +) + +// AdmissionOptions holds the admission options +type AdmissionOptions struct { + Control string + ControlConfigFile string + Plugins *admission.Plugins +} + +// NewAdmissionOptions creates a new instance of AdmissionOptions +func NewAdmissionOptions(plugins *admission.Plugins) *AdmissionOptions { + return &AdmissionOptions{ + Plugins: plugins, + Control: "AlwaysAdmit", + } +} + +// AddFlags adds flags related to admission for a specific APIServer to the specified FlagSet +func (a *AdmissionOptions) AddFlags(fs *pflag.FlagSet) { + fs.StringVar(&a.Control, "admission-control", a.Control, ""+ + "Ordered list of plug-ins to do admission control of resources into cluster. "+ + "Comma-delimited list of: "+strings.Join(a.Plugins.Registered(), ", ")+".") + + fs.StringVar(&a.ControlConfigFile, "admission-control-config-file", a.ControlConfigFile, + "File with admission control configuration.") +} diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/server_run_options.go b/staging/src/k8s.io/apiserver/pkg/server/options/server_run_options.go index 40fef0dab99..0ca9d5973a1 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/server_run_options.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/server_run_options.go @@ -19,11 +19,9 @@ package options import ( "fmt" "net" - "strings" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime/serializer" - "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/server" utilfeature "k8s.io/apiserver/pkg/util/feature" @@ -35,9 +33,7 @@ import ( // ServerRunOptions contains the options while running a generic api server. type ServerRunOptions struct { - AdmissionControl string - AdmissionControlConfigFile string - AdvertiseAddress net.IP + AdvertiseAddress net.IP CorsAllowedOriginList []string ExternalHost string @@ -46,18 +42,14 @@ type ServerRunOptions struct { MinRequestTimeout int TargetRAMMB int WatchCacheSizes []string - - AdmissionPlugins *admission.Plugins } -func NewServerRunOptions(admissionPlugins *admission.Plugins) *ServerRunOptions { +func NewServerRunOptions() *ServerRunOptions { defaults := server.NewConfig(serializer.CodecFactory{}) return &ServerRunOptions{ - AdmissionControl: "AlwaysAdmit", MaxRequestsInFlight: defaults.MaxRequestsInFlight, MaxMutatingRequestsInFlight: defaults.MaxMutatingRequestsInFlight, MinRequestTimeout: defaults.MinRequestTimeout, - AdmissionPlugins: admissionPlugins, } } @@ -96,13 +88,6 @@ func (s *ServerRunOptions) AddUniversalFlags(fs *pflag.FlagSet) { // Note: the weird ""+ in below lines seems to be the only way to get gofmt to // arrange these text blocks sensibly. Grrr. - fs.StringVar(&s.AdmissionControl, "admission-control", s.AdmissionControl, ""+ - "Ordered list of plug-ins to do admission control of resources into cluster. "+ - "Comma-delimited list of: "+strings.Join(s.AdmissionPlugins.Registered(), ", ")+".") - - fs.StringVar(&s.AdmissionControlConfigFile, "admission-control-config-file", s.AdmissionControlConfigFile, - "File with admission control configuration.") - fs.IPVar(&s.AdvertiseAddress, "advertise-address", s.AdvertiseAddress, ""+ "The IP address on which to advertise the apiserver to members of the cluster. This "+ "address must be reachable by the rest of the cluster. If blank, the --bind-address "+