Skip to content

Commit 4305edf

Browse files
authored
Merge pull request #9076 from zalando-incubator/revert-9071-disable-admission-protection
Revert "Disable resource protection via admission-controller in legacy clusters"
2 parents 6d1d311 + d6410d5 commit 4305edf

File tree

1 file changed

+1
-6
lines changed

1 file changed

+1
-6
lines changed

cluster/config-defaults.yaml

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -695,15 +695,10 @@ teapot_admission_controller_configmap_deletion_protection_factories_enabled: "tr
695695
# enable the rolebinding admission-controller webhook which validates rolebindings and clusterrolebindings
696696
teapot_admission_controller_enable_rolebinding_webhook: "true"
697697

698-
{{ if eq .Cluster.Provider "zalando-eks" }}
699698
# enable the resource protection admission webhook which prevents users from accessing system resources
700699
teapot_admission_controller_enable_write_protection_webhook: "true"
701-
# configure the behaviour of the resource protection admission webhook, `true` blocks everything, `false` allows everything
700+
# configure the behaviour of the resource protection admission webhook, `true` blocks, `false` allows
702701
teapot_admission_controller_prevent_write_operations: "true"
703-
{{ else }}
704-
teapot_admission_controller_enable_write_protection_webhook: "false"
705-
teapot_admission_controller_prevent_write_operations: "false"
706-
{{ end }}
707702

708703
# Enable and configure Pod Security Policy rules implemented in admission-controller.
709704
teapot_admission_controller_pod_security_policy_enabled: "true"

0 commit comments

Comments
 (0)