Admission Controller Fix

[gambol99]

A previous PR #5221 introduced the --enable-admission-plugins for >= 1.10.0 as recommended, it does however cause an issue if you already have AdmissionControl specified in the Spec as both flags get rendered and they are mutually exclusive, causing the kube-apiserver not to start

[gambol99]

I'm guessing the e2e tests didn't pick this up because they aren't specifying any AdmissionControl. Without this the kube-apiserver throws the below and refuses to start.

I0602 18:35:54.052373       1 server.go:135] Version: v1.10.3
I0602 18:35:54.052787       1 server.go:724] external host was not specified, using 10.250.31.254
admission-control and enable-admission-plugins/disable-admission-plugins flags are mutually exclusive

[gambol99]

Just double checked by building out a cluster

core@ip-10-250-31-61 /etc/kubernetes/manifests $ cat kube-apiserver.manifest
...
  containers:
  - command:
    - /bin/sh
    - -c
    - mkfifo /tmp/pipe; (tee -a /var/log/kube-apiserver.log < /tmp/pipe & ) ; exec
      /usr/local/bin/kube-apiserver --allow-privileged=true --anonymous-auth=false
      --apiserver-count=3 --audit-log-maxage=3 --audit-log-path=/var/lib/docker/kubernetes/logs/apiserver-audit.log
      --audit-policy-file=/srv/kubernetes/audit-policy.yaml --authentication-token-webhook-cache-ttl=3m0s
      --authentication-token-webhook-config-file=/srv/kubernetes/token-webhook.yaml
      --authorization-mode=RBAC --basic-auth-file=/srv/kubernetes/basic_auth.csv --bind-address=0.0.0.0
      --client-ca-file=/srv/kubernetes/ca.crt --cloud-provider=aws --enable-admission-plugins=Initializers,MutatingAdmissionWebhook,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,PodSecurityPolicy,ResourceQuota,DefaultTolerationSeconds,ValidatingAdmissionWebhook
      --etcd-cafile=/srv/kubernetes/ca.crt --etcd-certfile=/srv/kubernetes/etcd-client.pem
      --etcd-keyfile=/srv/kubernetes/etcd-client-key.pem --etcd-servers-overrides=/events#https://127.0.0.1:4002
      --etcd-servers=https://127.0.0.1:4001 --experimental-encryption-provider-config=/srv/kubernetes/encryptionconfig.yaml
      --feature-gates=ExpandPersistentVolumes=true --insecure-bind-address=127.0.0.1
      --insecure-port=8080 --kubelet-client-certificate=/srv/kubernetes/kubelet-api.pem
      --kubelet-client-key=/srv/kubernetes/kubelet-api-key.pem --kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP
      --proxy-client-cert-file=/srv/kubernetes/apiserver-aggregator.cert --proxy-client-key-file=/srv/kubernetes/apiserver-aggregator.key
      --requestheader-allowed-names=aggregator --requestheader-client-ca-file=/srv/kubernetes/apiserver-aggregator-ca.cert
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --runtime-config=admissionregistration.k8s.io/v1beta1=true
      --secure-port=443 --service-cluster-ip-range=10.10.0.0/19 --storage-backend=etcd3
      --tls-cert-file=/srv/kubernetes/server.cert --tls-private-key-file=/srv/kubernetes/server.key
      --token-auth-file=/srv/kubernetes/known_tokens.csv --v=1 > /tmp/pipe 2>&1
    image: k8s.gcr.io/kube-apiserver:v1.10.3

[gambol99]

/assign @justinsb

[justinsb]

Thanks for the fix.

/approve
/lgtm

We should also validate that users haven't set both (we should make that an error, because we aren't going to honor both).

I think it would also make more sense to do this in pkg/model/components/apiserver.go - we can also raise an error if users have set both, which we can't do in nodeup (though this would be a failsafe test; we should primarily do this in validation).

Ideally we would also log a warning if users are setting AdmissionControl with k8s >= 1.10 as they should be moving to EnableAdmissionControl.

I will try to tackle these if I have time (unless you beat me to it), but this is a good and important fix - thank you!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gambol99, justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [gambol99,justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment