scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-11-04 04:08:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Keep ResourceQuota admission at the end of the chain

Browse Source
This commit is contained in:
Jordan Liggitt
2017-03-21 01:53:11 -04:00
parent e3f6f14bf0
commit bc539151f3
11 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cluster/centos/config-default.sh
View File

@@ -117,7 +117,7 @@ export FLANNEL_NET=${FLANNEL_NET:-"172.16.0.0/16"}
# Admission Controllers to invoke prior to persisting objects in cluster # Admission Controllers to invoke prior to persisting objects in cluster
# If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely. # If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely.
export ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,DefaultTolerationSeconds export ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultTolerationSeconds,ResourceQuota
# Extra options to set on the Docker command line. # Extra options to set on the Docker command line.
# This is useful for setting --insecure-registry for local registries. # This is useful for setting --insecure-registry for local registries.

2
cluster/centos/master/scripts/apiserver.sh
View File

@@ -56,7 +56,7 @@ KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE}"
# Comma-delimited list of: # Comma-delimited list of:
# LimitRanger, AlwaysDeny, SecurityContextDeny, NamespaceExists, # LimitRanger, AlwaysDeny, SecurityContextDeny, NamespaceExists,
# NamespaceLifecycle, NamespaceAutoProvision, AlwaysAdmit, # NamespaceLifecycle, NamespaceAutoProvision, AlwaysAdmit,
# ServiceAccount, ResourceQuota, DefaultStorageClass, DefaultTolerationSeconds # ServiceAccount, DefaultStorageClass, DefaultTolerationSeconds, ResourceQuota
KUBE_ADMISSION_CONTROL="--admission-control=${ADMISSION_CONTROL}" KUBE_ADMISSION_CONTROL="--admission-control=${ADMISSION_CONTROL}"
# --client-ca-file="": If set, any request presenting a client certificate signed # --client-ca-file="": If set, any request presenting a client certificate signed

2
cluster/gce/config-default.sh
View File

@@ -173,7 +173,7 @@ ENABLE_RESCHEDULER="${KUBE_ENABLE_RESCHEDULER:-true}"
# Admission Controllers to invoke prior to persisting objects in cluster # Admission Controllers to invoke prior to persisting objects in cluster
# If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely. # If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely.
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota
# Optional: if set to true kube-up will automatically check for existing resources and clean them up. # Optional: if set to true kube-up will automatically check for existing resources and clean them up.
KUBE_UP_AUTOMATIC_CLEANUP=${KUBE_UP_AUTOMATIC_CLEANUP:-false} KUBE_UP_AUTOMATIC_CLEANUP=${KUBE_UP_AUTOMATIC_CLEANUP:-false}

2
cluster/gce/config-test.sh
View File

@@ -197,7 +197,7 @@ fi
ENABLE_RESCHEDULER="${KUBE_ENABLE_RESCHEDULER:-true}" ENABLE_RESCHEDULER="${KUBE_ENABLE_RESCHEDULER:-true}"
# If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely. # If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely.
ADMISSION_CONTROL="${KUBE_ADMISSION_CONTROL:-NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds,PodPreset}" ADMISSION_CONTROL="${KUBE_ADMISSION_CONTROL:-NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,PodPreset,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota}"
# Optional: if set to true kube-up will automatically check for existing resources and clean them up. # Optional: if set to true kube-up will automatically check for existing resources and clean them up.
KUBE_UP_AUTOMATIC_CLEANUP=${KUBE_UP_AUTOMATIC_CLEANUP:-false} KUBE_UP_AUTOMATIC_CLEANUP=${KUBE_UP_AUTOMATIC_CLEANUP:-false}

2
cluster/juju/layers/kubernetes-master/templates/kube-apiserver.defaults
View File

@@ -11,7 +11,7 @@ KUBE_API_ADDRESS="--insecure-bind-address=127.0.0.1"
KUBE_API_PORT="--insecure-port=8080" KUBE_API_PORT="--insecure-port=8080"
# default admission control policies # default admission control policies
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,DefaultTolerationSeconds" KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultTolerationSeconds,ResourceQuota"
# Add your own! # Add your own!
KUBE_API_ARGS="{{ kube_apiserver_flags }}" KUBE_API_ARGS="{{ kube_apiserver_flags }}"

2
cluster/libvirt-coreos/util.sh
View File

@@ -27,7 +27,7 @@ source "$KUBE_ROOT/cluster/common.sh"
export LIBVIRT_DEFAULT_URI=qemu:///system export LIBVIRT_DEFAULT_URI=qemu:///system
export SERVICE_ACCOUNT_LOOKUP=${SERVICE_ACCOUNT_LOOKUP:-false} export SERVICE_ACCOUNT_LOOKUP=${SERVICE_ACCOUNT_LOOKUP:-false}
export ADMISSION_CONTROL=${ADMISSION_CONTROL:-NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds} export ADMISSION_CONTROL=${ADMISSION_CONTROL:-NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota}
readonly POOL=kubernetes readonly POOL=kubernetes
readonly POOL_PATH=/var/lib/libvirt/images/kubernetes readonly POOL_PATH=/var/lib/libvirt/images/kubernetes

2
cluster/openstack-heat/kubernetes-heat/fragments/configure-salt.yaml
View File

@@ -58,7 +58,7 @@ write_files:
enable_dns_horizontal_autoscaler: "false" enable_dns_horizontal_autoscaler: "false"
federations_domain_map: '' federations_domain_map: ''
instance_prefix: kubernetes instance_prefix: kubernetes
admission_control: NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds admission_control: NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota
enable_cpu_cfs_quota: "true" enable_cpu_cfs_quota: "true"
network_provider: none network_provider: none
cluster_cidr: "$cluster_cidr" cluster_cidr: "$cluster_cidr"

2
cluster/photon-controller/templates/create-dynamic-salt-files.sh
View File

@@ -123,5 +123,5 @@ federations_domain_map: ''
e2e_storage_test_environment: "${E2E_STORAGE_TEST_ENVIRONMENT:-false}" e2e_storage_test_environment: "${E2E_STORAGE_TEST_ENVIRONMENT:-false}"
cluster_cidr: "$NODE_IP_RANGES" cluster_cidr: "$NODE_IP_RANGES"
allocate_node_cidrs: "${ALLOCATE_NODE_CIDRS:-true}" allocate_node_cidrs: "${ALLOCATE_NODE_CIDRS:-true}"
admission_control: NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds admission_control: NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota
EOF EOF

2
cluster/rackspace/cloud-config/master-cloud-config.yaml
View File

@@ -136,7 +136,7 @@ coreos:
--v=2 \ --v=2 \
--service-account-key-file=/var/run/kubernetes/kube-serviceaccount.key \ --service-account-key-file=/var/run/kubernetes/kube-serviceaccount.key \
--service-account-lookup=false \ --service-account-lookup=false \
--admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,DefaultTolerationSeconds --admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultTolerationSeconds,ResourceQuota
Restart=always Restart=always
RestartSec=5 RestartSec=5
- name: apiserver-advertiser.service - name: apiserver-advertiser.service

2
cluster/ubuntu/config-default.sh
View File

@@ -84,7 +84,7 @@ FLANNEL_OTHER_NET_CONFIG=${FLANNEL_OTHER_NET_CONFIG:-""}
# for release >= 1.4.0; see that doc for the recommended settings for # for release >= 1.4.0; see that doc for the recommended settings for
# earlier releases. # earlier releases.
export ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds export ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota
# Path to the pod manifest file or directory of files of kubelet # Path to the pod manifest file or directory of files of kubelet
export KUBELET_POD_MANIFEST_PATH=${KUBELET_POD_MANIFEST_PATH:-""} export KUBELET_POD_MANIFEST_PATH=${KUBELET_POD_MANIFEST_PATH:-""}

2
cluster/vagrant/config-default.sh
View File

@@ -56,7 +56,7 @@ MASTER_PASSWD="${MASTER_PASSWD:-vagrant}"
# Admission Controllers to invoke prior to persisting objects in cluster # Admission Controllers to invoke prior to persisting objects in cluster
# If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely. # If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely.
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota
# Optional: Enable node logging. # Optional: Enable node logging.
ENABLE_NODE_LOGGING=false ENABLE_NODE_LOGGING=false