Skip to content

Commit a1b6dbe

Browse files
ArtfulCoderArtfulCoder
committed
Removed DenyEscalatingExec from the list of default admission controllers.
1 parent 4856c7c commit a1b6dbe

File tree

12 files changed

+13
-14
lines changed

12 files changed

+13
-14
lines changed

‎cluster/aws/config-default.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ DNS_REPLICAS=1
8787
ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"
8888

8989
# Admission Controllers to invoke prior to persisting objects in cluster
90-
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
90+
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
9191

9292
# Optional: Enable/disable public IP assignment for minions.
9393
# Important Note: disable only if you have setup a NAT instance for internet access and configured appropriate routes!

‎cluster/aws/config-test.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ DNS_REPLICAS=1
8383
ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"
8484

8585
# Admission Controllers to invoke prior to persisting objects in cluster
86-
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
86+
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
8787

8888
# Optional: Enable/disable public IP assignment for minions.
8989
# Important Note: disable only if you have setup a NAT instance for internet access and configured appropriate routes!

‎cluster/azure/config-default.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,4 +55,4 @@ ENABLE_CLUSTER_MONITORING="${KUBE_ENABLE_CLUSTER_MONITORING:-influxdb}"
5555
ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"
5656

5757
# Admission Controllers to invoke prior to persisting objects in cluster
58-
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
58+
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota

‎cluster/centos/master/scripts/apiserver.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE}"
5151
# to do admission control of resources into cluster.
5252
# Comma-delimited list of:
5353
# LimitRanger, AlwaysDeny, SecurityContextDeny, NamespaceExists,
54-
# NamespaceLifecycle, NamespaceAutoProvision, DenyEscalatingExec,
54+
# NamespaceLifecycle, NamespaceAutoProvision,
5555
# AlwaysAdmit, ServiceAccount, ResourceQuota
5656
#KUBE_ADMISSION_CONTROL="--admission-control=\"${ADMISSION_CONTROL}\""
5757

‎cluster/gce/config-default.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ if [[ "${ENABLE_DEPLOYMENTS}" == "true" ]]; then
110110
fi
111111

112112
# Admission Controllers to invoke prior to persisting objects in cluster
113-
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
113+
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
114114

115115
# Optional: if set to true kube-up will automatically check for existing resources and clean them up.
116116
KUBE_UP_AUTOMATIC_CLEANUP=${KUBE_UP_AUTOMATIC_CLEANUP:-false}

‎cluster/gce/config-test.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ if [[ "${ENABLE_DEPLOYMENTS}" == "true" ]]; then
117117
ENABLE_EXPERIMENTAL_API=true
118118
fi
119119

120-
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
120+
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
121121

122122
# Optional: if set to true kube-up will automatically check for existing resources and clean them up.
123123
KUBE_UP_AUTOMATIC_CLEANUP=${KUBE_UP_AUTOMATIC_CLEANUP:-false}

‎cluster/mesos/docker/docker-compose.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ apiserver:
7474
--external-hostname=apiserver
7575
--etcd-servers=http://etcd:4001
7676
--port=8888
77-
--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
77+
--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
7878
--authorization-mode=AlwaysAllow
7979
--token-auth-file=/var/run/kubernetes/auth/token-users
8080
--basic-auth-file=/var/run/kubernetes/auth/basic-users

‎cluster/vagrant/config-default.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ MASTER_USER=vagrant
5353
MASTER_PASSWD=vagrant
5454

5555
# Admission Controllers to invoke prior to persisting objects in cluster
56-
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
56+
ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
5757

5858
# Optional: Enable experimental API features
5959
ENABLE_EXPERIMENTAL_API="${KUBE_ENABLE_EXPERIMENTAL_API:-true}"

‎docs/admin/admission-controllers.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ Yes.
172172
For Kubernetes 1.0, we strongly recommend running the following set of admission control plug-ins (order matters):
173173

174174
```
175-
--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
175+
--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
176176
```
177177

178178

‎docs/admin/high-availability/kube-apiserver.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ spec:
1111
- /bin/sh
1212
- -c
1313
- /usr/local/bin/kube-apiserver --address=127.0.0.1 --etcd-servers=http://127.0.0.1:4001
14-
--cloud-provider=gce --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
14+
--cloud-provider=gce --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
1515
--service-cluster-ip-range=10.0.0.0/16 --client-ca-file=/srv/kubernetes/ca.crt
1616
--basic-auth-file=/srv/kubernetes/basic_auth.csv --cluster-name=e2e-test-bburns
1717
--tls-cert-file=/srv/kubernetes/server.cert --tls-private-key-file=/srv/kubernetes/server.key

‎docs/getting-started-guides/coreos/cloud-configs/master.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ coreos:
8989
ExecStart=/opt/bin/kube-apiserver \
9090
--service-account-key-file=/opt/bin/kube-serviceaccount.key \
9191
--service-account-lookup=false \
92-
--admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota \
92+
--admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
9393
--runtime-config=api/v1 \
9494
--allow-privileged=true \
9595
--insecure-bind-address=0.0.0.0 \

‎hack/local-up-cluster.sh

+2-3
Original file line numberDiff line numberDiff line change
@@ -203,11 +203,10 @@ function set_service_accounts {
203203
function start_apiserver {
204204
# Admission Controllers to invoke prior to persisting objects in cluster
205205
if [[ -z "${ALLOW_SECURITY_CONTEXT}" ]]; then
206-
ADMISSION_CONTROL=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,DenyEscalatingExec,ResourceQuota
206+
ADMISSION_CONTROL=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
207207
else
208-
ADMISSION_CONTROL=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,ServiceAccount,DenyEscalatingExec,ResourceQuota
208+
ADMISSION_CONTROL=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,ServiceAccount,ResourceQuota
209209
fi
210-
211210
# This is the default dir and filename where the apiserver will generate a self-signed cert
212211
# which should be able to be used as the CA to verify itself
213212
CERT_DIR=/var/run/kubernetes

0 commit comments

Comments
 (0)