C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix node authorization for cloudprovider installs (#1794)

Browse source 
In 1.8, the Node authorization mode should be listed first to
allow kubelet to access secrets. This seems to only impact
environments with cloudprovider enabled.
This commit is contained in:
Matthew Mosesohn 2017-10-14 11:28:46 +01:00 committed by GitHub
parent 2972bceb90
commit 92d038062e
2 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/vars.md
View file

@ -72,8 +72,9 @@ following default cluster paramters:
alpha/experimental Kubernetes features. (defaults is `[]`) alpha/experimental Kubernetes features. (defaults is `[]`)
* *authorization_modes* - A list of [authorization mode]( * *authorization_modes* - A list of [authorization mode](
https://kubernetes.io/docs/admin/authorization/#using-flags-for-your-authorization-module) https://kubernetes.io/docs/admin/authorization/#using-flags-for-your-authorization-module)
that the cluster should be configured for. Defaults to `['RBAC', 'Node']` (RBAC and Node authorizers). that the cluster should be configured for. Defaults to `['Node', 'RBAC']`
Note: `RBAC` is enabled by default. Previously deployed clusters can be (Node and RBAC authorizers).
Note: `Node` and `RBAC` are enabled by default. Previously deployed clusters can be
converted to RBAC mode. However, your apps which rely on Kubernetes API will converted to RBAC mode. However, your apps which rely on Kubernetes API will
require a service account and cluster role bindings. You can override this require a service account and cluster role bindings. You can override this
setting by setting authorization_modes to `[]`. setting by setting authorization_modes to `[]`.

4
roles/kubespray-defaults/defaults/main.yaml
View file

@ -147,8 +147,8 @@ openstack_lbaas_enabled: false
## List of authorization modes that must be configured for ## List of authorization modes that must be configured for
## the k8s cluster. Only 'AlwaysAllow', 'AlwaysDeny', 'Node' and ## the k8s cluster. Only 'AlwaysAllow', 'AlwaysDeny', 'Node' and
## 'RBAC' modes are tested. ## 'RBAC' modes are tested. Order is important.
authorization_modes: ['RBAC', 'Node'] authorization_modes: ['Node', 'RBAC']
rbac_enabled: "{{ 'RBAC' in authorization_modes or kubeadm_enabled }}" rbac_enabled: "{{ 'RBAC' in authorization_modes or kubeadm_enabled }}"
## List of key=value pairs that describe feature gates for ## List of key=value pairs that describe feature gates for