Skip to content

Commit 78d4757

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #17354 from ameukam/admission-controllers
Enable more admission controllers
2 parents 92cb98b + 4576e21 commit 78d4757

File tree

267 files changed

+1108
-774
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

267 files changed

+1108
-774
lines changed

‎nodeup/pkg/model/tests/golden/audit/tasks-kube-apiserver.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ contents: |
3434
- --client-ca-file=/srv/kubernetes/ca.crt
3535
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
3636
- --cloud-provider=external
37-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
37+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
3838
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
3939
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
4040
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/awsiam/tasks-kube-apiserver.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ contents: |
4848
- --client-ca-file=/srv/kubernetes/ca.crt
4949
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
5050
- --cloud-provider=external
51-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
51+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
5252
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
5353
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
5454
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/dedicated-apiserver/tasks-kube-apiserver.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ contents: |
2626
- --client-ca-file=/srv/kubernetes/ca.crt
2727
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
2828
- --cloud-provider=external
29-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
29+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
3030
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
3131
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
3232
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/envvars/tasks-kube-apiserver.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ contents: |
2626
- --client-ca-file=/srv/kubernetes/ca.crt
2727
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
2828
- --cloud-provider=external
29-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
29+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
3030
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
3131
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
3232
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/minimal/tasks-kube-apiserver.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ contents: |
2424
- --authorization-mode=AlwaysAllow
2525
- --bind-address=0.0.0.0
2626
- --client-ca-file=/srv/kubernetes/ca.crt
27-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
27+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
2828
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
2929
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
3030
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/oidc/tasks-kube-apiserver.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ contents: |
2626
- --client-ca-file=/srv/kubernetes/ca.crt
2727
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
2828
- --cloud-provider=external
29-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
29+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
3030
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
3131
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
3232
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/side-loading/tasks-kube-apiserver-amd64.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ contents: |
2626
- --client-ca-file=/srv/kubernetes/ca.crt
2727
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
2828
- --cloud-provider=external
29-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
29+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
3030
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
3131
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
3232
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/side-loading/tasks-kube-apiserver-arm64.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ contents: |
2626
- --client-ca-file=/srv/kubernetes/ca.crt
2727
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
2828
- --cloud-provider=external
29-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
29+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
3030
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
3131
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
3232
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎nodeup/pkg/model/tests/golden/without-etcd-events/tasks-kube-apiserver.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ contents: |
2626
- --client-ca-file=/srv/kubernetes/ca.crt
2727
- --cloud-config=/etc/kubernetes/in-tree-cloud.config
2828
- --cloud-provider=external
29-
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
29+
- --enable-admission-plugins=DefaultStorageClass,DefaultTolerationSeconds,LimitRanger,MutatingAdmissionWebhook,NamespaceLifecycle,NodeRestriction,ResourceQuota,RuntimeClass,ServiceAccount,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook
3030
- --etcd-cafile=/srv/kubernetes/kube-apiserver/etcd-ca.crt
3131
- --etcd-certfile=/srv/kubernetes/kube-apiserver/etcd-client.crt
3232
- --etcd-keyfile=/srv/kubernetes/kube-apiserver/etcd-client.key

‎pkg/model/components/apiserver.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -147,21 +147,21 @@ func (b *KubeAPIServerOptionsBuilder) BuildOptions(cluster *kops.Cluster) error
147147
}
148148
}
149149

150-
// TODO: We can probably rewrite these more clearly in descending order
151150
// Based on recommendations from:
152-
// https://kubernetes.io/docs/admin/admission-controllers/#is-there-a-recommended-set-of-admission-controllers-to-use
151+
// https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
153152
{
154153
c.EnableAdmissionPlugins = []string{
155-
"NamespaceLifecycle",
156-
"LimitRanger",
157-
"ServiceAccount",
158-
//"PersistentVolumeLabel",
159154
"DefaultStorageClass",
160155
"DefaultTolerationSeconds",
156+
"LimitRanger",
161157
"MutatingAdmissionWebhook",
162-
"ValidatingAdmissionWebhook",
158+
"NamespaceLifecycle",
163159
"NodeRestriction",
164160
"ResourceQuota",
161+
"RuntimeClass",
162+
"ServiceAccount",
163+
"ValidatingAdmissionPolicy",
164+
"ValidatingAdmissionWebhook",
165165
}
166166
c.EnableAdmissionPlugins = append(c.EnableAdmissionPlugins, c.AppendAdmissionPlugins...)
167167
}

0 commit comments

Comments
 (0)