1e879c69ec
Automatic merge from submit-queue (batch tested with PRs 43546, 43544) Default to enabling legacy ABAC policy in non-test kube-up.sh environments Fixes https://github.com/kubernetes/kubernetes/issues/43541 In 1.5, we unconditionally stomped the abac policy file if KUBE_USER was set, and unconditionally used ABAC mode pointing to that file. In 1.6, unless the user opts out (via `ENABLE_LEGACY_ABAC=false`), we want the same legacy policy included as a fallback to RBAC. This PR: * defaults legacy ABAC **on** in normal deployments * defaults legacy ABAC **on** in upgrade E2Es (ensures combination of ABAC and RBAC works properly for upgraded clusters) * defaults legacy ABAC **off** in non-upgrade E2Es (ensures e2e tests 1.6+ run with tightened permissions, and that default RBAC roles cover the required core components) GKE changes to drive the `ENABLE_LEGACY_ABAC` envvar were made by @cjcullen out of band ```release-note `kube-up.sh` using the `gce` provider enables both RBAC authorization and the permissive legacy ABAC policy that makes all service accounts superusers. To opt out of the permissive ABAC policy, export the environment variable `ENABLE_LEGACY_ABAC=false` before running `cluster/kube-up.sh`. ``` |
||
|---|---|---|
| .. | ||
| addons | ||
| aws | ||
| centos | ||
| gce | ||
| gke | ||
| images | ||
| juju | ||
| kubemark | ||
| lib | ||
| libvirt-coreos | ||
| local | ||
| openstack-heat | ||
| ovirt | ||
| photon-controller | ||
| rackspace | ||
| saltbase | ||
| skeleton | ||
| ubuntu | ||
| vagrant | ||
| vsphere | ||
| windows | ||
| BUILD | ||
| clientbin.sh | ||
| common.sh | ||
| get-kube-binaries.sh | ||
| get-kube-local.sh | ||
| get-kube.sh | ||
| kube-down.sh | ||
| kube-push.sh | ||
| kube-up.sh | ||
| kube-util.sh | ||
| kubeadm.sh | ||
| kubectl.sh | ||
| log-dump.sh | ||
| options.md | ||
| OWNERS | ||
| README.md | ||
| restore-from-backup.sh | ||
| test-e2e.sh | ||
| test-network.sh | ||
| test-smoke.sh | ||
| update-storage-objects.sh | ||
| validate-cluster.sh | ||
Cluster Configuration
Deprecation Notice: This directory has entered maintenance mode and will not be accepting new providers. Please submit new automation deployments to kube-deploy. Deployments in this directory will continue to be maintained and supported at their current level of support.
The scripts and data in this directory automate creation and configuration of a Kubernetes cluster, including networking, DNS, nodes, and master components.
See the getting-started guides for examples of how to use the scripts.
cloudprovider/config-default.sh contains a set of tweakable definitions/parameters for the cluster.
The heavy lifting of configuring the VMs is done by SaltStack.