title: Should I edit the salt tar files after a Kubernetes cluster is running on Google Compute Engine?
body: <p>I've used <code>curl -sS https://get.k8s.io | bash</code> to create a cluster on Google Compute Engine using Kubernetes 1.2.4. This worked great. I wanted to enable ABAC authorization mode by adding a few flags to the <code>kube-apiserver</code> command specified in kube-apiserver pod spec.</p>
  
  <p>I'm unclear if I should adjust <a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/saltbase" rel="nofollow">the salt files</a> once they're tar/gzipped. The salt file that the pod spec is generated from is <a href="https://github.com/kubernetes/kubernetes/blob/master/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest" rel="nofollow">here</a>, but editing this after the cluster is stood up has a few additional requirements:</p>
  
  <ul>
  <li>I have to unpack the salt tarball that the install script uploaded to Google Cloud Storage for me</li>
  <li>Edit the salt files</li>
  <li>Tar/gzip them back up, generate a new checksum file</li>
  <li>Push these to GCS</li>
  <li>Update <em>all</em> of the instances' kube-metadata so that <code>SALT_TAR_HASH</code> is now correct</li>
  </ul>
  
  <p>It feels like I'm going down the wrong path with this, as this also will collide with upgrades.</p>
  
  <p>Is there a better way to configure pods, services, etc that are baked into the install script without having to do all of this?</p>