Fix setting admission plugins on local-up-cluster.sh

[jfchevrette]

What this PR does / why we need it:

hack/local-up-cluster.sh currently do not honor setting ENABLE_ADMISSION_PLUGINS because the list is overriden later on in the script before the apiserver is started.

This PR moves the list higher up as a default list of admission plugins and then allows overriding the defaults via the expected ENV variable when starting the cluster.

Which issue(s) this PR fixes
No issue created. Should I create one?

Special notes for your reviewer:
I have not found tests for this script. I did run it and was able to manually validate that the list of admission plugin is either set to default or to those I chose via the environment variable.

This is a first contribution. I will appreciate any comments on how I can improve future contributions.

Release note:

NONE

[dims]

/ok-to-test

[jfchevrette]

/assign @dims
PTAL

[yue9944882]

the default on plugins are defined in:

kubernetes/pkg/kubeapiserver/options/plugins.go

Lines 132 to 142 in 72dd54e

	defaultOnPlugins := sets.NewString(
	lifecycle.PluginName, //NamespaceLifecycle
	limitranger.PluginName, //LimitRanger
	serviceaccount.PluginName, //ServiceAccount
	setdefault.PluginName, //DefaultStorageClass
	resize.PluginName, //PersistentVolumeClaimResize
	defaulttolerationseconds.PluginName, //DefaultTolerationSeconds
	mutatingwebhook.PluginName, //MutatingAdmissionWebhook
	validatingwebhook.PluginName, //ValidatingAdmissionWebhook
	resourcequota.PluginName, //ResourceQuota
	)

so we can trim the list, amiright?

[jfchevrette]

The only plugin that is in the list but not in the default on plugins list is StorageObjectInUseProtection which according to the cli feature gates docs is enabled by default.

Regardless of the above, as a user using local-up-cluster.sh I would expect that the default plugins are loaded unless I specify additional plugins using ENABLE_ADMISSION_PLUGINS (or disable plugins using DISABLE_ADMISSION_PLUGINS)

WDYT?

[yue9944882]

what about removing L106 and change this line to

ENABLE_ADMISSION_PLUGINS=${ENABLE_ADMISSION_PLUGINS:-""}${security_admission}

[jfchevrette]

I've removed the additional DEFAULT_ variable but left (and updated) the list to match the recommended defaults from the docs

It is my understanding that if --enable-admission-plugins is passed with an empty value/list, no plugins will be loaded.

[yue9944882]

thx so much for fixing this @jfchevrette ! if memory serves, i hit the exact same problem before. 🎉

[yue9944882]

/assign
/sig cluster-lifecycle
/sig api-machinery
/kind bug

[jfchevrette]

@yue9944882 I just found out that kube-apiserver / hyperkube can return the list of default plugins. We can use that to generate the list dynamically and that would avoid the need to keep a static list up-to-date.

hyperkube apiserver -h | grep -E '^\s+\-\-enable\-admission\-plugins' | sed  's/.*(\(.*\)).*/\1/' | tr -d ' '

[dims]

/test pull-kubernetes-e2e-kops-aws

[jennybuckley]

/assign

[dims]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, jfchevrette

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• hack/OWNERS [dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment