@@ -5,21 +5,20 @@ import (
55 "io"
66 "io/ioutil"
77 "net"
8+ "os"
89 "reflect"
910
1011 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1112 "k8s.io/apimachinery/pkg/util/sets"
1213 "k8s.io/apiserver/pkg/admission"
1314 "k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle"
14- kclientsetinternal "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
1515 noderestriction "k8s.io/kubernetes/plugin/pkg/admission/noderestriction"
1616 saadmit "k8s.io/kubernetes/plugin/pkg/admission/serviceaccount"
1717 storageclassdefaultadmission "k8s.io/kubernetes/plugin/pkg/admission/storageclass/setdefault"
1818
1919 oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
2020 configapi "github.com/openshift/origin/pkg/cmd/server/api"
21- configlatest "github.com/openshift/origin/pkg/cmd/server/api/latest"
22- "github.com/openshift/origin/pkg/cmd/util/pluginconfig"
21+ configapilatest "github.com/openshift/origin/pkg/cmd/server/api/latest"
2322 imageadmission "github.com/openshift/origin/pkg/image/admission"
2423 imagepolicy "github.com/openshift/origin/pkg/image/admission/imagepolicy/api"
2524 ingressadmission "github.com/openshift/origin/pkg/ingress/admission"
@@ -131,12 +130,36 @@ func fixupAdmissionPlugins(plugins []string) []string {
131130
132131func NewAdmissionChains (
133132 options configapi.MasterConfig ,
134- kubeClientSet kclientsetinternal.Interface ,
135133 admissionInitializer admission.PluginInitializer ,
136134) (admission.Interface , error ) {
137135 admissionPluginConfigFilename := ""
138136 if len (options .KubernetesMasterConfig .APIServerArguments ["admission-control-config-file" ]) > 0 {
139137 admissionPluginConfigFilename = options .KubernetesMasterConfig .APIServerArguments ["admission-control-config-file" ][0 ]
138+
139+ } else {
140+ pluginConfig := map [string ]configapi.AdmissionPluginConfig {}
141+ for pluginName , config := range options .AdmissionConfig .PluginConfig {
142+ pluginConfig [pluginName ] = config
143+ }
144+ upstreamAdmissionConfig , err := configapilatest .ConvertOpenshiftAdmissionConfigToKubeAdmissionConfig (pluginConfig )
145+ if err != nil {
146+ return nil , err
147+ }
148+ configBytes , err := configapilatest .WriteYAML (upstreamAdmissionConfig )
149+ if err != nil {
150+ return nil , err
151+ }
152+
153+ tempFile , err := ioutil .TempFile ("" , "master-config.yaml" )
154+ if err != nil {
155+ return nil , err
156+ }
157+ defer os .Remove (tempFile .Name ())
158+ if _ , err := tempFile .Write (configBytes ); err != nil {
159+ return nil , err
160+ }
161+ tempFile .Close ()
162+ admissionPluginConfigFilename = tempFile .Name ()
140163 }
141164
142165 admissionPluginNames := combinedAdmissionControlPlugins
@@ -145,13 +168,8 @@ func NewAdmissionChains(
145168 }
146169 admissionPluginNames = fixupAdmissionPlugins (admissionPluginNames )
147170
148- // if we have a unified chain, build the combined config
149- pluginConfig := map [string ]configapi.AdmissionPluginConfig {}
150- for pluginName , config := range options .AdmissionConfig .PluginConfig {
151- pluginConfig [pluginName ] = config
152- }
171+ admissionChain , err := newAdmissionChainFunc (admissionPluginNames , admissionPluginConfigFilename , options , admissionInitializer )
153172
154- admissionChain , err := newAdmissionChainFunc (admissionPluginNames , admissionPluginConfigFilename , pluginConfig , options , kubeClientSet , admissionInitializer )
155173 if err != nil {
156174 return nil , err
157175 }
@@ -162,12 +180,11 @@ func NewAdmissionChains(
162180// newAdmissionChainFunc is for unit testing only. You should NEVER OVERRIDE THIS outside of a unit test.
163181var newAdmissionChainFunc = newAdmissionChain
164182
165- func newAdmissionChain (pluginNames []string , admissionConfigFilename string , pluginConfig map [ string ]configapi. AdmissionPluginConfig , options configapi.MasterConfig , kubeClientSet kclientsetinternal. Interface , admissionInitializer admission.PluginInitializer ) (admission.Interface , error ) {
183+ func newAdmissionChain (pluginNames []string , admissionConfigFilename string , options configapi.MasterConfig , admissionInitializer admission.PluginInitializer ) (admission.Interface , error ) {
166184 plugins := []admission.Interface {}
167185 for _ , pluginName := range pluginNames {
168186 var (
169- plugin admission.Interface
170- skipInitialization bool
187+ plugin admission.Interface
171188 )
172189
173190 switch pluginName {
@@ -189,6 +206,7 @@ func newAdmissionChain(pluginNames []string, admissionConfigFilename string, plu
189206 return nil , err
190207 }
191208 plugin = lc
209+ admissionInitializer .Initialize (plugin )
192210
193211 case serviceadmit .ExternalIPPluginName :
194212 // this needs to be moved upstream to be part of core config
@@ -202,6 +220,7 @@ func newAdmissionChain(pluginNames []string, admissionConfigFilename string, plu
202220 allowIngressIP = true
203221 }
204222 plugin = serviceadmit .NewExternalIPRanger (reject , admit , allowIngressIP )
223+ admissionInitializer .Initialize (plugin )
205224
206225 case serviceadmit .RestrictedEndpointsPluginName :
207226 // we need to set some customer parameters, so create by hand
@@ -216,46 +235,32 @@ func newAdmissionChain(pluginNames []string, admissionConfigFilename string, plu
216235 return nil , err
217236 }
218237 plugin = serviceadmit .NewRestrictedEndpointsAdmission (restrictedNetworks )
238+ admissionInitializer .Initialize (plugin )
219239
220240 case saadmit .PluginName :
221241 // we need to set some custom parameters on the service account admission controller, so create that one by hand
222242 saAdmitter := saadmit .NewServiceAccount ()
223- saAdmitter .SetInternalKubeClientSet (kubeClientSet )
224243 saAdmitter .LimitSecretReferences = options .ServiceAccountConfig .LimitSecretReferences
225244 plugin = saAdmitter
245+ admissionInitializer .Initialize (plugin )
226246
227247 default :
228- configFile , err := pluginconfig .GetAdmissionConfigurationFile (pluginConfig , pluginName , admissionConfigFilename )
229- if err != nil {
230- return nil , err
231- }
232- configReader , err := admission .ReadAdmissionConfiguration ([]string {pluginName }, configFile )
248+ pluginsConfigProvider , err := admission .ReadAdmissionConfiguration ([]string {pluginName }, admissionConfigFilename )
233249 if err != nil {
234250 return nil , err
235251 }
236- pluginConfigReader , err := configReader .ConfigFor (pluginName )
237- if err != nil {
238- return nil , err
239- }
240-
241- plugin , err = OriginAdmissionPlugins .InitPlugin (pluginName , pluginConfigReader , admissionInitializer )
252+ plugin , err = OriginAdmissionPlugins .NewFromPlugins ([]string {pluginName }, pluginsConfigProvider , admissionInitializer )
242253 if err != nil {
243254 // should have been caught with validation
244255 return nil , err
245256 }
246257 if plugin == nil {
247258 continue
248259 }
249-
250- // skip initialization below because admission.InitPlugin does all the work
251- skipInitialization = true
252260 }
253261
254262 plugins = append (plugins , plugin )
255263
256- if ! skipInitialization {
257- admissionInitializer .Initialize (plugin )
258- }
259264 }
260265
261266 // ensure that plugins have been properly initialized
@@ -307,7 +312,7 @@ func filterEnableAdmissionConfigs(delegate admission.Factory) admission.Factory
307312 }
308313 // if the config isn't a DefaultAdmissionConfig, then assume we're enabled (we were called after all)
309314 // if the config *is* a DefaultAdmissionConfig and it explicitly said
310- obj , err := configlatest .ReadYAML (config1 )
315+ obj , err := configapilatest .ReadYAML (config1 )
311316 // if we can't read it, let the plugin deal with it
312317 if err != nil {
313318 return delegate (config2 )
0 commit comments