From 77680299d97d3b05df2a3e5507a8183603010e42 Mon Sep 17 00:00:00 2001 From: TigerXu Date: Sat, 13 Jan 2018 07:06:14 +0800 Subject: [PATCH] fix admission plugins orders (#6900) fix admission plugins orders, MutatingAdmissionWebhook should be ahead of ValidatingAdmissionWebhook. see https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/server/options/admission.go#L69 --- docs/admin/admission-controllers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/admission-controllers.md b/docs/admin/admission-controllers.md index 240cfd7558..2d5369469a 100644 --- a/docs/admin/admission-controllers.md +++ b/docs/admin/admission-controllers.md @@ -546,7 +546,7 @@ Yes. For Kubernetes >= 1.9.0, we strongly recommend running the following set of admission controllers (order matters): ```shell ---admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds,MutatingAdmissionWebhook +--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds ``` It's worth reiterating that in 1.9 and up, these happen in a mutating phase