Merge pull request #4516 from kwoodson/limit_refs

Merged by openshift-bot

inventory/byo/hosts.origin.example

@@ -826,6 +826,9 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
 # Controls validity for etcd CA, peer, server and client certificates.
 #
 #etcd_ca_default_days=1825
+#
+# ServiceAccountConfig:LimitSecretRefences rejects pods that reference secrets their service accounts do not reference
+# openshift_master_saconfig_limitsecretreferences=false
 
 # Upgrade Control
 #

inventory/byo/hosts.ose.example

@@ -822,6 +822,9 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
 # Controls validity for etcd CA, peer, server and client certificates.
 #
 #etcd_ca_default_days=1825
+#
+# ServiceAccountConfig:LimitSecretRefences rejects pods that reference secrets their service accounts do not reference
+# openshift_master_saconfig_limitsecretreferences=false
 
 # Upgrade Control
 #

roles/openshift_master/README.md

@@ -15,18 +15,19 @@ Role Variables
 
 From this role:
 
-| Name                                | Default value         |                                                                               |
-|-------------------------------------|-----------------------|-------------------------------------------------------------------------------|
-| openshift_master_debug_level        | openshift_debug_level | Verbosity of the debug logs for master                                        |
-| openshift_node_ips                  | []                    | List of the openshift node ip addresses to pre-register when master starts up |
-| oreg_url                            | UNDEF                 | Default docker registry to use                                                |
-| oreg_url_master                     | UNDEF                 | Default docker registry to use, specifically on the master                    |
-| openshift_master_api_port           | UNDEF                 |                                                                               |
-| openshift_master_console_port       | UNDEF                 |                                                                               |
-| openshift_master_api_url            | UNDEF                 |                                                                               |
-| openshift_master_console_url        | UNDEF                 |                                                                               |
-| openshift_master_public_api_url     | UNDEF                 |                                                                               |
-| openshift_master_public_console_url | UNDEF                 |                                                                               |
+| Name                                             | Default value         |                                                                               |
+|---------------------------------------------------|-----------------------|-------------------------------------------------------------------------------|
+| openshift_master_debug_level                      | openshift_debug_level | Verbosity of the debug logs for master                                        |
+| openshift_node_ips                                | []                    | List of the openshift node ip addresses to pre-register when master starts up |
+| oreg_url                                          | UNDEF                 | Default docker registry to use                                                |
+| oreg_url_master                                   | UNDEF                 | Default docker registry to use, specifically on the master                    |
+| openshift_master_api_port                         | UNDEF                 |                                                                               |
+| openshift_master_console_port                     | UNDEF                 |                                                                               |
+| openshift_master_api_url                          | UNDEF                 |                                                                               |
+| openshift_master_console_url                      | UNDEF                 |                                                                               |
+| openshift_master_public_api_url                   | UNDEF                 |                                                                               |
+| openshift_master_public_console_url               | UNDEF                 |                                                                               |
+| openshift_master_saconfig_limit_secret_references | false                 |                                                                               |
 
 From openshift_common:
 

roles/openshift_master/templates/master.yaml.v1.j2

@@ -235,7 +235,7 @@ projectConfig:
 routingConfig:
   subdomain:  "{{ openshift_master_default_subdomain | default("") }}"
 serviceAccountConfig:
-  limitSecretReferences: false
+  limitSecretReferences: {{ openshift_master_saconfig_limitsecretreferences | default(false) }}
   managedNames:
   - default
   - builder