openstack/magnum
Code Issues Proposed changes

[k8s] Fix default admission controller

Browse Source 
The default admission controller list of k8s is being updated in
this patch by removing the SecurityContextDeny controller, which
will fix the k8s dashboard and metrics/prometheus creating issue.

Story: 2008426

Change-Id: I2cd53bc9c59a60b90f708b1434381f120ace8c49
This commit is contained in:
Feilong Wang 2020-12-08 08:47:03 +13:00 committed by Spyros Trigazis
parent 1af0cd0a97
commit fade245170
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
magnum/drivers/k8s_fedora_coreos_v1/templates/kubecluster.yaml
View File

@ -222,7 +222,7 @@ parameters:
type: string
description: >
List of admission control plugins to activate
default: "NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,TaintNodesByCondition,Priority,DefaultTolerationSeconds,DefaultStorageClass,StorageObjectInUseProtection,PersistentVolumeClaimResize,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,RuntimeClass"
default: "PodSecurityPolicy,NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,TaintNodesByCondition,Priority,DefaultTolerationSeconds,DefaultStorageClass,StorageObjectInUseProtection,PersistentVolumeClaimResize,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,RuntimeClass"
kube_allow_priv:
type: string

5
releasenotes/notes/default-admission-controller-04398548cf63597c.yaml Normal file
View File

@ -0,0 +1,5 @@
---
upgrade:
- |
Now the default admission controller list is updated by as
"NodeRestriction, PodSecurityPolicy, NamespaceLifecycle, LimitRanger, ServiceAccount, ResourceQuota, TaintNodesByCondition, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, RuntimeClass"