Merge pull request #43164 from cjcullen/abac

Automatic merge from submit-queue Allow ABAC to be disabled easily on upgrades **What this PR does / why we need it**: Adds a local variable to the configure-helper script so that ABAC_AUTHZ_FILE can be set to a nonexistent file in kube-env to disable ABAC on a cluster that previously was using ABAC. @liggitt @Q-Lee

Merge pull request #43164 from cjcullen/abac
b2525d43 · Kubernetes Submit Queue · GitHub · 6656ffc3 · 1534cbf1 · b2525d43
Commit b2525d43 authored Mar 16, 2017 by Kubernetes Submit Queue Committed by GitHub Mar 16, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 3 deletions

configure-helper.sh cluster/gce/gci/configure-helper.sh +3 -3

No files found.
--- a/cluster/gce/gci/configure-helper.sh
+++ b/cluster/gce/gci/configure-helper.sh
@@ -1108,9 +1108,9 @@ function start-kube-apiserver {

  # Load existing ABAC policy files written by versions < 1.6 of this script
  # TODO: only default to this legacy path when in upgrade mode
-  ABAC_AUTHZ_FILE="${ABAC_AUTHZ_FILE:-/etc/srv/kubernetes/abac-authz-policy.jsonl}"
-  if [[ -n "${ABAC_AUTHZ_FILE:-}" && -e "${ABAC_AUTHZ_FILE}" ]]; then
-    params+=" --authorization-policy-file=${ABAC_AUTHZ_FILE}"
+  local abac_authorization_file="${ABAC_AUTHZ_FILE:-/etc/srv/kubernetes/abac-authz-policy.jsonl}"
+  if [[ -n "${abac_authorization_file:-}" && -e "${abac_authorization_file}" ]]; then
+    params+=" --authorization-policy-file=${abac_authorization_file}"
    authorization_mode+=",ABAC"
  fi
  local webhook_config_mount=""