C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Enable RBAC by default

Browse source 
Change special rbac job to norbac to compensate.
This commit is contained in:
Matthew Mosesohn 2017-08-30 07:13:43 +01:00
parent 72a0d78b3c
commit ce7c9cfc52
3 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
.gitlab-ci.yml
View file

@ -371,9 +371,9 @@ before_script:
CLUSTER_MODE: separate CLUSTER_MODE: separate
STARTUP_SCRIPT: "" STARTUP_SCRIPT: ""
.ubuntu_flannel_rbac_variables: &ubuntu_flannel_rbac_variables .ubuntu_flannel_norbac_variables: &ubuntu_flannel_norbac_variables
# stage: deploy-gce-special # stage: deploy-gce-special
AUTHORIZATION_MODES: "{ 'authorization_modes': [ 'RBAC' ] }" AUTHORIZATION_MODES: "{ 'authorization_modes': [] }"
KUBE_NETWORK_PLUGIN: flannel KUBE_NETWORK_PLUGIN: flannel
CLOUD_IMAGE: ubuntu-1604-xenial CLOUD_IMAGE: ubuntu-1604-xenial
CLOUD_REGION: europe-west1-b CLOUD_REGION: europe-west1-b
@ -605,13 +605,13 @@ ubuntu-vault-sep:
except: ['triggers'] except: ['triggers']
only: ['master', /^pr-.*$/] only: ['master', /^pr-.*$/]
ubuntu-flannel-rbac-sep: ubuntu-flannel-norbac-sep:
stage: deploy-gce-special stage: deploy-gce-special
<<: *job <<: *job
<<: *gce <<: *gce
variables: variables:
<<: *gce_variables <<: *gce_variables
<<: *ubuntu_flannel_rbac_variables <<: *ubuntu_flannel_norbac_variables
when: manual when: manual
except: ['triggers'] except: ['triggers']
only: ['master', /^pr-.*$/] only: ['master', /^pr-.*$/]

3
inventory/group_vars/k8s-cluster.yml
View file

@ -25,6 +25,9 @@ kube_api_anonymous_auth: false
## Change this to use another Kubernetes version, e.g. a current beta release ## Change this to use another Kubernetes version, e.g. a current beta release
kube_version: v1.7.3 kube_version: v1.7.3
# Disable RBAC by setting this to an empty list. Other choices: AlwaysAllow, AlwaysDeny
authorization_modes: ['RBAC']
# Where the binaries will be downloaded. # Where the binaries will be downloaded.
# Note: ensure that you've enough disk space (about 1G) # Note: ensure that you've enough disk space (about 1G)
local_release_dir: "/tmp/releases" local_release_dir: "/tmp/releases"

2
roles/kubespray-defaults/defaults/main.yaml
View file

@ -129,7 +129,7 @@ openstack_lbaas_monitor_max_retries: false
## List of authorization modes that must be configured for ## List of authorization modes that must be configured for
## the k8s cluster. Only 'AlwaysAllow','AlwaysDeny', and ## the k8s cluster. Only 'AlwaysAllow','AlwaysDeny', and
## 'RBAC' modes are tested. ## 'RBAC' modes are tested.
authorization_modes: [] authorization_modes: ['RBAC']
rbac_enabled: "{{ 'RBAC' in authorization_modes }}" rbac_enabled: "{{ 'RBAC' in authorization_modes }}"
## List of key=value pairs that describe feature gates for ## List of key=value pairs that describe feature gates for