mirror of
https://github.com/k3s-io/k3s.git
synced 2024-06-07 19:41:36 +00:00
166 lines
8.0 KiB
Go
166 lines
8.0 KiB
Go
/*
|
|
Copyright 2014 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package options
|
|
|
|
// This file exists to force the desired plugin implementations to be linked.
|
|
// This should probably be part of some configuration fed into the build for a
|
|
// given binary target.
|
|
import (
|
|
// Admission policies
|
|
"k8s.io/kubernetes/plugin/pkg/admission/admit"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/alwayspullimages"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/antiaffinity"
|
|
certapproval "k8s.io/kubernetes/plugin/pkg/admission/certificates/approval"
|
|
certsigning "k8s.io/kubernetes/plugin/pkg/admission/certificates/signing"
|
|
certsubjectrestriction "k8s.io/kubernetes/plugin/pkg/admission/certificates/subjectrestriction"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/defaultingressclass"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/defaulttolerationseconds"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/deny"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/eventratelimit"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/exec"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/extendedresourcetoleration"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/gc"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/imagepolicy"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/limitranger"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/namespace/autoprovision"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/namespace/exists"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/noderestriction"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/nodetaint"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/podnodeselector"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/podtolerationrestriction"
|
|
podpriority "k8s.io/kubernetes/plugin/pkg/admission/priority"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/runtimeclass"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/security/podsecuritypolicy"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/securitycontext/scdeny"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/serviceaccount"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/storage/persistentvolume/label"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/storage/persistentvolume/resize"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/storage/storageclass/setdefault"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/storage/storageobjectinuseprotection"
|
|
|
|
"k8s.io/apimachinery/pkg/util/sets"
|
|
"k8s.io/apiserver/pkg/admission"
|
|
"k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle"
|
|
"k8s.io/apiserver/pkg/admission/plugin/resourcequota"
|
|
mutatingwebhook "k8s.io/apiserver/pkg/admission/plugin/webhook/mutating"
|
|
validatingwebhook "k8s.io/apiserver/pkg/admission/plugin/webhook/validating"
|
|
)
|
|
|
|
// AllOrderedPlugins is the list of all the plugins in order.
|
|
var AllOrderedPlugins = []string{
|
|
admit.PluginName, // AlwaysAdmit
|
|
autoprovision.PluginName, // NamespaceAutoProvision
|
|
lifecycle.PluginName, // NamespaceLifecycle
|
|
exists.PluginName, // NamespaceExists
|
|
scdeny.PluginName, // SecurityContextDeny
|
|
antiaffinity.PluginName, // LimitPodHardAntiAffinityTopology
|
|
limitranger.PluginName, // LimitRanger
|
|
serviceaccount.PluginName, // ServiceAccount
|
|
noderestriction.PluginName, // NodeRestriction
|
|
nodetaint.PluginName, // TaintNodesByCondition
|
|
alwayspullimages.PluginName, // AlwaysPullImages
|
|
imagepolicy.PluginName, // ImagePolicyWebhook
|
|
podsecuritypolicy.PluginName, // PodSecurityPolicy
|
|
podnodeselector.PluginName, // PodNodeSelector
|
|
podpriority.PluginName, // Priority
|
|
defaulttolerationseconds.PluginName, // DefaultTolerationSeconds
|
|
podtolerationrestriction.PluginName, // PodTolerationRestriction
|
|
exec.DenyEscalatingExec, // DenyEscalatingExec
|
|
exec.DenyExecOnPrivileged, // DenyExecOnPrivileged
|
|
eventratelimit.PluginName, // EventRateLimit
|
|
extendedresourcetoleration.PluginName, // ExtendedResourceToleration
|
|
label.PluginName, // PersistentVolumeLabel
|
|
setdefault.PluginName, // DefaultStorageClass
|
|
storageobjectinuseprotection.PluginName, // StorageObjectInUseProtection
|
|
gc.PluginName, // OwnerReferencesPermissionEnforcement
|
|
resize.PluginName, // PersistentVolumeClaimResize
|
|
runtimeclass.PluginName, // RuntimeClass
|
|
certapproval.PluginName, // CertificateApproval
|
|
certsigning.PluginName, // CertificateSigning
|
|
certsubjectrestriction.PluginName, // CertificateSubjectRestriction
|
|
defaultingressclass.PluginName, // DefaultIngressClass
|
|
|
|
// new admission plugins should generally be inserted above here
|
|
// webhook, resourcequota, and deny plugins must go at the end
|
|
|
|
mutatingwebhook.PluginName, // MutatingAdmissionWebhook
|
|
validatingwebhook.PluginName, // ValidatingAdmissionWebhook
|
|
resourcequota.PluginName, // ResourceQuota
|
|
deny.PluginName, // AlwaysDeny
|
|
}
|
|
|
|
// RegisterAllAdmissionPlugins registers all admission plugins and
|
|
// sets the recommended plugins order.
|
|
func RegisterAllAdmissionPlugins(plugins *admission.Plugins) {
|
|
admit.Register(plugins) // DEPRECATED as no real meaning
|
|
alwayspullimages.Register(plugins)
|
|
antiaffinity.Register(plugins)
|
|
defaulttolerationseconds.Register(plugins)
|
|
defaultingressclass.Register(plugins)
|
|
deny.Register(plugins) // DEPRECATED as no real meaning
|
|
eventratelimit.Register(plugins)
|
|
exec.Register(plugins)
|
|
extendedresourcetoleration.Register(plugins)
|
|
gc.Register(plugins)
|
|
imagepolicy.Register(plugins)
|
|
limitranger.Register(plugins)
|
|
autoprovision.Register(plugins)
|
|
exists.Register(plugins)
|
|
noderestriction.Register(plugins)
|
|
nodetaint.Register(plugins)
|
|
label.Register(plugins) // DEPRECATED, future PVs should not rely on labels for zone topology
|
|
podnodeselector.Register(plugins)
|
|
podtolerationrestriction.Register(plugins)
|
|
runtimeclass.Register(plugins)
|
|
resourcequota.Register(plugins)
|
|
podsecuritypolicy.Register(plugins)
|
|
podpriority.Register(plugins)
|
|
scdeny.Register(plugins)
|
|
serviceaccount.Register(plugins)
|
|
setdefault.Register(plugins)
|
|
resize.Register(plugins)
|
|
storageobjectinuseprotection.Register(plugins)
|
|
certapproval.Register(plugins)
|
|
certsigning.Register(plugins)
|
|
certsubjectrestriction.Register(plugins)
|
|
}
|
|
|
|
// DefaultOffAdmissionPlugins get admission plugins off by default for kube-apiserver.
|
|
func DefaultOffAdmissionPlugins() sets.String {
|
|
defaultOnPlugins := sets.NewString(
|
|
lifecycle.PluginName, //NamespaceLifecycle
|
|
limitranger.PluginName, //LimitRanger
|
|
serviceaccount.PluginName, //ServiceAccount
|
|
setdefault.PluginName, //DefaultStorageClass
|
|
resize.PluginName, //PersistentVolumeClaimResize
|
|
defaulttolerationseconds.PluginName, //DefaultTolerationSeconds
|
|
mutatingwebhook.PluginName, //MutatingAdmissionWebhook
|
|
validatingwebhook.PluginName, //ValidatingAdmissionWebhook
|
|
resourcequota.PluginName, //ResourceQuota
|
|
storageobjectinuseprotection.PluginName, //StorageObjectInUseProtection
|
|
podpriority.PluginName, //PodPriority
|
|
nodetaint.PluginName, //TaintNodesByCondition
|
|
runtimeclass.PluginName, //RuntimeClass
|
|
certapproval.PluginName, // CertificateApproval
|
|
certsigning.PluginName, // CertificateSigning
|
|
certsubjectrestriction.PluginName, // CertificateSubjectRestriction
|
|
defaultingressclass.PluginName, //DefaultIngressClass
|
|
)
|
|
|
|
return sets.NewString(AllOrderedPlugins...).Difference(defaultOnPlugins)
|
|
}
|