pluginOrderOverride validation always output Invalid value

[mdshuai]

If we set valid value for pluginOrderOverride,then it will output "Invalid value ... " in log. In this log we don't know it's really works or really invalid.
https://github.com/openshift/origin/blob/master/pkg/cmd/server/api/validation/master.go#L192-L194
https://github.com/openshift/origin/blob/master/pkg/cmd/server/api/validation/master.go#L518-L520

Aug 16 08:27:19 openshift-169.lab.sjc.redhat.com docker[60435]: W0816 04:27:19.395216       1 start_master.go:272] admissionConfig.pluginOrderOverride: Invalid value: ["ProjectRequestLimit"]: specified admission ordering is being phased out.  Convert to DefaultAdmissionConfig in admissionConfig.pluginConfig.

admissionConfig:
  pluginOrderOverride:
  - ProjectRequestLimit
  pluginConfig:
    ProjectRequestLimit:
      configuration:
        apiVersion: v1
        kind: ProjectRequestLimitConfig
        limits:
        - selector:
            level:
              platinum
          maxProjects: 10
        - selector: {}
          maxProjects: 1

[mdshuai]

@deads2k

[deads2k]

If we set valid value for pluginOrderOverride,then it will output "Invalid value ... " in log. In this log we don't know it's really works or really invalid.

It's a warning out of the master-config.yaml to let people know they're specifying values they shouldn't. We still respect that value (for now), but at some point we're going to disable it and make that warning an error.

Specifying the admission chain is extremely fragile, since we rely on new admission plugins to secure new features. You shouldn't have to specify a whitelist of what you want to run. What's missing from the default chain for you?

[mdshuai]

@deads2k When I enable AlwaysPullImages admission ( which default off ), even I set the correct value, I saw this warning Invalid value log, it make me think I set wrong value or some configure is changed, then I check again and again.

If we want some waring, it shouldn't use "Invalid value ... Convert to DefaultAdmissionConfig in admissionConfig.pluginConfig." it really make user think what they set is useless and the system use the DefaultAdmissionConfig(we also need doc what the defaultAdmission is and which is default off which default on).

As you said if we make that really warning an error it will be better.
thanks.

[deads2k]

@deads2k When I enable AlwaysPullImages admission ( which default off ), even I set the correct value, I saw this warning Invalid value log, it make me think I set wrong value or some configure is changed, then I check again and again.

The "proper" way to enable that plugin in 3.3 is to create a stanza like this:

admissionConfig:
  pluginConfig:
    AlwaysPullImages:
      configuration:
        kind: DefaultAdmissionConfig
        apiVersion: v1

in your master-config.yaml. That will activate the admission plugin you're looking for without changing the entire admission chain.

I'll see what I can do about making warnings obviously warnings.