External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-05-12 11:57:39 -02:30
Code Issues Packages Projects Releases Wiki Activity

Fix inconsistent handling of admission plugin list (#9407)

Browse Source 
* Fix inconsistent handling of admission plugin list

* Adjust hardening doc with the normalized admission plugin list

* Add pre-check for admission plugins format change

* Ignore checking admission plugins value when variable is not defined
This commit is contained in:
William Turner
2022-10-26 03:28:37 -04:00
committed by GitHub
parent ef707b3461
commit eeb376460d
5 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
View File

@@ -106,7 +106,7 @@
when:
- kube_apiserver_admission_control_config_file
- item in kube_apiserver_admission_plugins_needs_configuration
loop: "{{ kube_apiserver_enable_admission_plugins[0].split(',') }}"
loop: "{{ kube_apiserver_enable_admission_plugins }}"
- name: kubeadm | Check if apiserver.crt contains all needed SANs
shell: |

2
roles/kubernetes/control-plane/templates/admission-controls.yaml.j2
View File

@@ -1,7 +1,7 @@
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
{% for plugin in kube_apiserver_enable_admission_plugins[0].split(',') %}
{% for plugin in kube_apiserver_enable_admission_plugins %}
{% if plugin in kube_apiserver_admission_plugins_needs_configuration %}
- name: {{ plugin }}
path: {{ kube_config_dir }}/{{ plugin|lower }}.yaml