Turn on quota related admission control plug-ins #1048
Conversation
|
Do we want this enabled by default? |
|
Yes - it's a no-op when ResourceQuota and LimitRange are not used, so there is no reason to not have them on. |
|
Well, let me rephrase, it will be a no-op after my change to upstream makes these two plug-ins cache backed. But I am waiting for kubernetes/kubernetes#4453 to get merged to send the follow-on PR. |
|
The upstream change to make the admission control plug-in cache based is here: Once we rebase on a version with that change, we can enable the plug-in by default. |
|
Rebase |
derekwaynecarr
force-pushed
the
enable_quota_on_admission
branch
from
7afe1c7 to
a23f926
Compare
|
Rebased. @deads2k @liggitt - this is easier to follow now with the new code split in start.go. When starting Kube, I start the admission control plug-ins that we require in base Kube if we were to run on Kube. Right now for Origin based master, we just run the AlwaysAdmit until we have our unique plug-ins that need to handle our own custom fields on LimitRange (i.e. layer size, etc.) |
pkg/cmd/server/kube_master.go
Outdated
There was a problem hiding this comment.
Is AlwaysAdmit needed at the end of the chain? I thought admission plugins only gave errors, so if it made it to the end of the chain without an error, it was implicitly accepted
There was a problem hiding this comment.
You are correct.
Updating.
derekwaynecarr
force-pushed
the
enable_quota_on_admission
branch
from
a23f926 to
9f48fd3
Compare
|
LGTM |
|
[merge] |
|
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_openshift3/1133/) (Image: devenv-fedora_997) |
|
Evaluated for origin up to 9f48fd3 |
…scon-mounts-bp-3.8 [3.8] Add node system-container ADDLT_MOUNTS
4 participants
Turn on the admission control plug-ins from upstream Kubernetes that control quota usage.
This change will cause LimitRange and ResourceQuota to be enforced on admission.
Note: If and only if you add a ResourceQuota to a project, all create and update operations in that project will not work until #1047 is merged. This is because the manager needs to update actual usage stats before new requests are accepted by these plug-ins.
Review please @jwforres @smarterclayton @deads2k