From a837b5c03d9aaed7861ea78eae60b7eafdd855ee Mon Sep 17 00:00:00 2001 From: Feilong Wang Date: Thu, 27 Aug 2020 13:24:27 +1200 Subject: [PATCH] Update default k8s admission controller list There are two issues with current k8s admission controller list: 1. The default existing list is not consistent when user passes in extra controller or not 2. The existing list is out of date. The new list are based on below consideration: 1. Get the default list based on k8s v1.16.x[1] because it's the supported oldest version. 2. Keep it consistent when user passes in extra controllers or not 3. Keep all the admission controllers we has used in the code [1] https://v1-16.docs.kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#which-plugins-are-enabled-by-default Task: 40767 Story: 2008076 Change-Id: Ie5b89b97710d2e2d41c9ce4f3ec30046390acbeb --- .../kubernetes/fragments/configure-kubernetes-master.sh | 2 +- magnum/drivers/k8s_fedora_coreos_v1/templates/kubecluster.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-master.sh b/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-master.sh index f250f46015..88d3b3e861 100644 --- a/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-master.sh +++ b/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-master.sh @@ -60,7 +60,7 @@ cat > /etc/kubernetes/apiserver < List of admission control plugins to activate - default: "NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota" + default: "NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,TaintNodesByCondition,Priority,DefaultTolerationSeconds,DefaultStorageClass,StorageObjectInUseProtection,PersistentVolumeClaimResize,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,RuntimeClass" kube_allow_priv: type: string