github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
9675c6935e
kubernetes/cluster/gce/gci
History
Kubernetes Submit Queue 1e879c69ec Merge pull request #43544 from liggitt/legacy-abac-kube-up 
Automatic merge from submit-queue (batch tested with PRs 43546, 43544)

Default to enabling legacy ABAC policy in non-test kube-up.sh environments

Fixes https://github.com/kubernetes/kubernetes/issues/43541

In 1.5, we unconditionally stomped the abac policy file if KUBE_USER was set, and unconditionally used ABAC mode pointing to that file.

In 1.6, unless the user opts out (via `ENABLE_LEGACY_ABAC=false`), we want the same legacy policy included as a fallback to RBAC.

This PR:
* defaults legacy ABAC **on** in normal deployments
* defaults legacy ABAC **on** in upgrade E2Es (ensures combination of ABAC and RBAC works properly for upgraded clusters)
* defaults legacy ABAC **off** in non-upgrade E2Es (ensures e2e tests 1.6+ run with tightened permissions, and that default RBAC roles cover the required core components)

GKE changes to drive the `ENABLE_LEGACY_ABAC` envvar were made by @cjcullen out of band

```release-note
`kube-up.sh` using the `gce` provider enables both RBAC authorization and the permissive legacy ABAC policy that makes all service accounts superusers. To opt out of the permissive ABAC policy, export the environment variable `ENABLE_LEGACY_ABAC=false` before running `cluster/kube-up.sh`.
```
2017-03-23 14:13:18 -07:00
..
mounter New packages added to hack/.linted_packages 2017-03-11 01:39:56 +05:30
configure-helper.sh Merge pull request #43544 from liggitt/legacy-abac-kube-up 2017-03-23 14:13:18 -07:00
configure.sh Bump CNI consumers to latest version 2017-03-22 16:03:13 -07:00
health-monitor.sh Fix the output of health-mointor.sh 2017-02-15 18:08:27 -08:00
helper.sh Ensure the GCI metadata files do not have whitespace at the end 2016-12-13 13:41:54 -08:00
master-helper.sh Added configurable etcd initial-cluster-state to kube-up script. 2017-02-13 16:10:47 +01:00
master.yaml Use chroot for containerized mounts 2017-02-24 13:46:26 -08:00
node-helper.sh Splitting OS_DISTRIBUTION into NODE_OS_DISTRIBUTION and 2016-07-15 12:02:31 -07:00
node.yaml Use chroot for containerized mounts 2017-02-24 13:46:26 -08:00
README.md Update Container-VM Image product name in docs 2016-09-09 10:08:56 -07:00

README.md

Container-VM Image

Container-VM Image is a container-optimized OS image for the Google Cloud Platform (GCP). It is primarily for running Google services on GCP. Unlike the open preview version of container-vm, the new Container-VM Image is based on the open source ChromiumOS project, allowing us greater control over the build management, security compliance, and customizations for GCP.

Analytics