Skip to content

K
k3s
Commit 76f22a02 authored by Mike Danese's avatar Mike Danese
Browse files
Options

gce: reorder authorizers

to the order Node,Webhook,RBAC,ABAC
parent f3024879
Show whitespace changes
Inline Side-by-side
Showing with 3 additions and 2 deletions
cluster/gce/gci/configure-helper.sh
View file @ 76f22a02
...@@ -1682,7 +1682,7 @@ function start-kube-apiserver { ...@@ -1682,7 +1682,7 @@ function start-kube-apiserver {
fi fi
local authorization_mode="Node,RBAC" local authorization_mode="RBAC"
local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty" local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty"
# Enable ABAC mode unless the user explicitly opts out with ENABLE_LEGACY_ABAC=false # Enable ABAC mode unless the user explicitly opts out with ENABLE_LEGACY_ABAC=false
...@@ -1707,11 +1707,12 @@ function start-kube-apiserver { ...@@ -1707,11 +1707,12 @@ function start-kube-apiserver {
local webhook_config_mount="" local webhook_config_mount=""
local webhook_config_volume="" local webhook_config_volume=""
if [[ -n "${GCP_AUTHZ_URL:-}" ]]; then if [[ -n "${GCP_AUTHZ_URL:-}" ]]; then
authorization_mode+=",Webhook" authorization_mode="Webhook,${authorization_mode}"
params+=" --authorization-webhook-config-file=/etc/gcp_authz.config" params+=" --authorization-webhook-config-file=/etc/gcp_authz.config"
webhook_config_mount="{\"name\": \"webhookconfigmount\",\"mountPath\": \"/etc/gcp_authz.config\", \"readOnly\": false}," webhook_config_mount="{\"name\": \"webhookconfigmount\",\"mountPath\": \"/etc/gcp_authz.config\", \"readOnly\": false},"
webhook_config_volume="{\"name\": \"webhookconfigmount\",\"hostPath\": {\"path\": \"/etc/gcp_authz.config\", \"type\": \"FileOrCreate\"}}," webhook_config_volume="{\"name\": \"webhookconfigmount\",\"hostPath\": {\"path\": \"/etc/gcp_authz.config\", \"type\": \"FileOrCreate\"}},"
fi fi
authorization_mode="Node,${authorization_mode}"
params+=" --authorization-mode=${authorization_mode}" params+=" --authorization-mode=${authorization_mode}"
local container_env="" local container_env=""
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment