github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rename kubelet CSR admission feature gate

Browse Source 
Retitle the feature to the affirmative ("AllowInsecure...=false") instead of a
double-negative ("Disable$NEWTHING...=false") for clarity

Signed-off-by: Micah Hausler <mhausler@amazon.com>
This commit is contained in:
Micah Hausler
2024-07-29 09:58:26 -05:00
parent 7a4c962341
commit a7af830209
3 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/features/kube_features.go
View File

@@ -228,9 +228,10 @@ const (
// owner: @micahhausler
// Deprecated: v1.31
//
// Disable Node Admission plugin validation of CSRs for kubelet signers where CN=system:node:$nodeName.
// Setting AllowInsecureKubeletCertificateSigningRequests to true disables node admission validation of CSRs
// for kubelet signers where CN=system:node:$nodeName.
// Remove in v1.33
DisableKubeletCSRAdmissionValidation featuregate.Feature = "DisableKubeletCSRAdmissionValidation"
AllowInsecureKubeletCertificateSigningRequests featuregate.Feature = "AllowInsecureKubeletCertificateSigningRequests"
// owner: @HirazawaUi
// kep: http://kep.k8s.io/4004
@@ -1326,7 +1327,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
// ...
HPAScaleToZero: {Default: false, PreRelease: featuregate.Alpha},
DisableKubeletCSRAdmissionValidation: {Default: false, PreRelease: featuregate.Deprecated}, // remove in 1.33
AllowInsecureKubeletCertificateSigningRequests: {Default: false, PreRelease: featuregate.Deprecated}, // remove in 1.33
StorageNamespaceIndex: {Default: true, PreRelease: featuregate.Beta},

10
plugin/pkg/admission/noderestriction/admission.go
View File

@@ -74,9 +74,9 @@ type Plugin struct {
podsGetter corev1lister.PodLister
nodesGetter corev1lister.NodeLister
expansionRecoveryEnabled bool
dynamicResourceAllocationEnabled bool
kubeletCSRAdmissionValidationDisabled bool
expansionRecoveryEnabled bool
dynamicResourceAllocationEnabled bool
allowInsecureKubeletCertificateSigningRequests bool
}
var (
@@ -89,7 +89,7 @@ var (
func (p *Plugin) InspectFeatureGates(featureGates featuregate.FeatureGate) {
p.expansionRecoveryEnabled = featureGates.Enabled(features.RecoverVolumeExpansionFailure)
p.dynamicResourceAllocationEnabled = featureGates.Enabled(features.DynamicResourceAllocation)
p.kubeletCSRAdmissionValidationDisabled = featureGates.Enabled(features.DisableKubeletCSRAdmissionValidation)
p.allowInsecureKubeletCertificateSigningRequests = featureGates.Enabled(features.AllowInsecureKubeletCertificateSigningRequests)
}
// SetExternalKubeInformerFactory registers an informer factory into Plugin
@@ -176,7 +176,7 @@ func (p *Plugin) Admit(ctx context.Context, a admission.Attributes, o admission.
return p.admitResourceSlice(nodeName, a)
case csrResource:
if p.kubeletCSRAdmissionValidationDisabled {
if p.allowInsecureKubeletCertificateSigningRequests {
return nil
}
return p.admitCSR(nodeName, a)

2
plugin/pkg/admission/noderestriction/admission_test.go
View File

@@ -1278,7 +1278,7 @@ func Test_nodePlugin_Admit(t *testing.T) {
features: feature.DefaultFeatureGate,
setupFunc: func(t *testing.T) {
t.Helper()
featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, features.DisableKubeletCSRAdmissionValidation, true)
featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, features.AllowInsecureKubeletCertificateSigningRequests, true)
},
},
{