allow admission control plug-ins to be easily customized

2017-04-16 22:03:45 -04:00 · 2017-04-16 22:03:45 -04:00 · 49be805001
parent 5c4980c6e0
commit 49be805001
2 changed files with 8 additions and 1 deletions
--- a/roles/kubernetes/master/defaults/main.yml
+++ b/roles/kubernetes/master/defaults/main.yml
@ -36,6 +36,13 @@ kube_apiserver_cpu_limit: 800m
 kube_apiserver_memory_requests: 256M
 kube_apiserver_cpu_requests: 100m

+# Admission control plug-ins
+kube_apiserver_admission_control:
+  - NamespaceLifecycle
+  - LimitRanger
+  - ServiceAccount
+  - DefaultStorageClass
+  - ResourceQuota

 ## Enable/Disable Kube API Server Authentication Methods
 kube_basic_auth: true
--- a/roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2
+++ b/roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2
@ -33,7 +33,7 @@ spec:
    - --etcd-keyfile={{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem
    - --insecure-bind-address={{ kube_apiserver_insecure_bind_address }}
    - --apiserver-count={{ kube_apiserver_count }}
-    - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota
+    - --admission-control={{ kube_apiserver_admission_control | join(',') }}
    - --service-cluster-ip-range={{ kube_service_addresses }}
    - --service-node-port-range={{ kube_apiserver_node_port_range }}
    - --client-ca-file={{ kube_cert_dir }}/ca.pem