EventRateLimit Admission control plugin issue

[bheemareddy]

Hi, I'm trying to add an admission plugin to k3s.
https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#eventratelimit

I'm facing an issue while applying limits to the event rate limit plugin.

[root@appliance-1 ~]# cat /etc/kubernetes/admission.yaml 
apiVersion: apiserver.k8s.io/v1alpha1
kind: AdmissionConfiguration
plugins:
- name: EventRateLimit
  path: /etc/kubernetes/event.yaml
[root@appliance-1 ~]# 
[root@appliance-1 ~]# cat /etc/kubernetes/event.yaml 
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
kind: Configuration
limits:
- type: Namespace
  qps: 1
  burst: 10
  cacheSize: 2
- type: User
  qps: 1
  burst: 5
- type: Server
  qps: 1
  burst: 5

[root@appliance-1 ~]# kubectl apply -f /etc/kubernetes/admission.yaml 
error: unable to recognize "/etc/kubernetes/admission.yaml": no matches for kind "AdmissionConfiguration" in version "apiserver.k8s.io/v1alpha1"
[root@appliance-1 ~]# 
[root@appliance-1 ~]# 
[root@appliance-1 ~]# kubectl apply -f /etc/kubernetes/event.ayml
error: the path "/etc/kubernetes/event.ayml" does not exist
[root@appliance-1 ~]# kubectl apply -f /etc/kubernetes/event.yaml
error: unable to recognize "/etc/kubernetes/event.yaml": no matches for kind "Configuration" in version "eventratelimit.admission.k8s.io/v1alpha1"

Thanks in Advance

[brandond]

As noted in the docs you linked to, EventRateLimit is still in alpha which means that it's not enabled by default. Did you enable the featuregates on the apiserver to turn it on? Did you enable the admission controller? I suspect that without enabling it the resource types aren't even registered.

The docs also mention that you need to point the apiserver at that file with --admission-control-config-file. It is not something that you can apply to the cluster after it's up. Maybe take a second look at those docs?

[lazzio7]

Hi bheemareddy,

have you fix this issue ?
im in same situation regarding PSA security report...

rancher-03:/var/log/containers # cat /var/log/pods/kube-system_kube-apiserver-rancher-03_4874a08227e8932676b83ca998a390f3/kube-apiserver/1058.log
2023-09-27T10:34:10.366968508+02:00 stderr F I0927 08:34:10.366647       1 server.go:563] external host was not specified, using 192.168.47.116
2023-09-27T10:34:10.367201739+02:00 stderr F I0927 08:34:10.367094       1 server.go:161] Version: v1.25.9+rke2r1
2023-09-27T10:34:10.367215213+02:00 stderr F I0927 08:34:10.367126       1 server.go:163] "Golang settings" GOGC="" GOMAXPROCS="" GOTRACEBACK=""
2023-09-27T10:34:10.673893439+02:00 stderr F I0927 08:34:10.673741       1 shared_informer.go:252] Waiting for caches to sync for node_authorizer
2023-09-27T10:34:10.674649831+02:00 stderr F E0927 08:34:10.674403       1 run.go:74] "command failed" err="failed to initialize admission: failed to read plugin config: no kind \"Configuration\" is registered for version \"eventratelimit.admission.k8s.io/v1alpha1\" in scheme \"k8s.io/apiserver/pkg/server/options/admission.go:44\""

Thanks

[brandond]

@lazzio7 please read the comment you're replying to:

EventRateLimit is still in alpha which means that it's not enabled by default. Did you enable the admission controller? I suspect that without enabling it the resource types aren't even registered.

Please post the complete RKE2 configuration that you're using on this node.

[lazzio7]

Hi brandond,

well, i have followed this approach and it works now,
question is, wheter is ok to implement into the production if it an alpha.

Thank You

[brandond]

I'm glad you got it working! Whether or not you feel comfortable using an Alpha feature in production is probably a question you'll need to answer for yourself.

[lazzio7]

:-)
Thanks