Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Admission webhook #492

Open
caesarxuchao opened this issue Oct 23, 2017 · 47 comments

Comments

@caesarxuchao
Copy link
Member

commented Oct 23, 2017

Feature Description

  • One-line feature description (can be used as a release note):

The admission webhook feature now supports both mutating webhook and validation (non-mutating) webhook. The dynamic registration API of webhook is promoted to v1beta1. The admission API is promoted to v1beta1.

community proposal: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/admission-control-webhooks.md

tasks tracked in https://github.com/orgs/kubernetes/projects/32

  • Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:

@cheftako @liggitt @deads2k

  • Approver (likely from SIG/area to which feature belongs):

@erictune @lavalamp @deads2k

  • Feature target (which target equals to which milestone):
    • Alpha release target (x.y)
    • Beta release target 1.9
    • Stable release target 1.16
@caesarxuchao

This comment has been minimized.

Copy link
Member Author

commented Oct 23, 2017

/sig api-machinery

@caesarxuchao

This comment has been minimized.

Copy link
Member Author

commented Oct 23, 2017

/kind feature

@caesarxuchao

This comment has been minimized.

Copy link
Member Author

commented Oct 23, 2017

/milestone 1.9

@caesarxuchao caesarxuchao added this to the 1.9 milestone Oct 23, 2017

@deads2k

This comment has been minimized.

Copy link
Contributor

commented Oct 24, 2017

Design proposal link (community repo):
https://docs.google.com/document/d/1c4kdkY3ha9rm0OIRbGleCeaHknZ-NR1nNtDp-i8eH8E/edit?ts=59e8c984#

Let's get this in the community repo.

@erictune

This comment has been minimized.

Copy link
Member

commented Oct 24, 2017

@erictune

This comment has been minimized.

Copy link
Member

commented Oct 26, 2017

Please use area/admission-control label for k/k issues/pulls Applied to a few dozen existing ones. @ae6rt

k8s-github-robot pushed a commit to kubernetes/kubernetes that referenced this issue Oct 28, 2017
Kubernetes Submit Queue
Merge pull request #54165 from caesarxuchao/webhook-e2e-test
Automatic merge from submit-queue (batch tested with PRs 54165, 53909). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adding an e2e test for admission webhook

Part of kubernetes/enhancements#492

The purpose of this test is making sure the webhooks get called, and the apiserver can communicate with the webhook.

We will expand the test cover more webhook features in followups.

The webhook used in the test rejects pods with container names "webhook-disallow". Will upload the source code of the example in a follow up PR.
sttts pushed a commit to sttts/apiserver that referenced this issue Oct 28, 2017
Merge pull request #54165 from caesarxuchao/webhook-e2e-test
Automatic merge from submit-queue (batch tested with PRs 54165, 53909). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adding an e2e test for admission webhook

Part of kubernetes/enhancements#492

The purpose of this test is making sure the webhooks get called, and the apiserver can communicate with the webhook.

We will expand the test cover more webhook features in followups.

The webhook used in the test rejects pods with container names "webhook-disallow". Will upload the source code of the example in a follow up PR.

Kubernetes-commit: 444d0c11153647d45b899b25a5dbbd3a5ea4a123
k8s-github-robot pushed a commit to kubernetes/kubernetes that referenced this issue Nov 10, 2017
Kubernetes Submit Queue
Merge pull request #55282 from mbohlool/webhooks
Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Add MutatingWebhookConfiguration type

As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed.

Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic.

ref: kubernetes/enhancements#492
sttts pushed a commit to sttts/api that referenced this issue Nov 10, 2017
Merge pull request #55282 from mbohlool/webhooks
Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Add MutatingWebhookConfiguration type

As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed.

Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic.

ref: kubernetes/enhancements#492

Kubernetes-commit: 61f210859d9c4bd64af254ba696f6f693596ced9
sttts pushed a commit to sttts/client-go that referenced this issue Nov 10, 2017
Merge pull request #55282 from mbohlool/webhooks
Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Add MutatingWebhookConfiguration type

As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed.

Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic.

ref: kubernetes/enhancements#492

Kubernetes-commit: 61f210859d9c4bd64af254ba696f6f693596ced9
sttts pushed a commit to sttts/apiserver that referenced this issue Nov 10, 2017
Merge pull request #55282 from mbohlool/webhooks
Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Add MutatingWebhookConfiguration type

As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed.

Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic.

ref: kubernetes/enhancements#492

Kubernetes-commit: 61f210859d9c4bd64af254ba696f6f693596ced9
k8s-github-robot pushed a commit to kubernetes/kubernetes that referenced this issue Nov 12, 2017
Kubernetes Submit Queue
Merge pull request #54889 from lavalamp/wh-api
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix webhook API to also support URLs

ref: kubernetes/enhancements#492

```release-note
The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks.
```
k8s-github-robot pushed a commit to kubernetes/kubernetes that referenced this issue Nov 12, 2017
Kubernetes Submit Queue
Merge pull request #55534 from lavalamp/wh-api-fixes
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Tighten webhook client config validation

ref kubernetes/enhancements#492

Fix up some nits left from #54889.

```release-note
NONE
```
sttts pushed a commit to sttts/api that referenced this issue Nov 12, 2017
Merge pull request #54889 from lavalamp/wh-api
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix webhook API to also support URLs

ref: kubernetes/enhancements#492

```release-note
The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks.
```

Kubernetes-commit: e93819049db49694718bc9c96e67050d366c6f63
sttts pushed a commit to sttts/api that referenced this issue Nov 12, 2017
Merge pull request #55534 from lavalamp/wh-api-fixes
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Tighten webhook client config validation

ref kubernetes/enhancements#492

Fix up some nits left from #54889.

```release-note
NONE
```

Kubernetes-commit: 2db28383e1151e5d442b81eb73a02b3cf144615c
sttts pushed a commit to sttts/apiserver that referenced this issue Nov 12, 2017
Merge pull request #54889 from lavalamp/wh-api
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix webhook API to also support URLs

ref: kubernetes/enhancements#492

```release-note
The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks.
```

Kubernetes-commit: e93819049db49694718bc9c96e67050d366c6f63
sttts pushed a commit to sttts/apiserver that referenced this issue Nov 12, 2017
Merge pull request #55534 from lavalamp/wh-api-fixes
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Tighten webhook client config validation

ref kubernetes/enhancements#492

Fix up some nits left from #54889.

```release-note
NONE
```

Kubernetes-commit: 2db28383e1151e5d442b81eb73a02b3cf144615c

@idvoretskyi idvoretskyi changed the title Beta admission webhook Admission webhook Nov 13, 2017

@mbohlool

This comment has been minimized.

Copy link
Member

commented Apr 15, 2019

/unassign mbohlool

@makoscafee

This comment has been minimized.

Copy link
Member

commented May 10, 2019

Hey, @caesarxuchao @liggitt 👋 I'm the v1.15 docs Lead.
Does this enhancement require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.15) due by Thursday, May 30th. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions

@cheftako

This comment has been minimized.

Copy link
Member

commented May 10, 2019

/assign @jpbetz

@kacole2

This comment has been minimized.

Copy link
Member

commented May 28, 2019

Hi @jpbetz caesarxuchao. Code Freeze is Thursday, May 30th 2019 @ EOD PST. All enhancements going into the release must be code-complete, including tests, and have docs PRs open.

It looks like all these are merged and this is in good shape. Let me know if there are any k/k PRs in flight.
kubernetes/kubernetes#76346
kubernetes/kubernetes#74998
kubernetes/kubernetes#74855
kubernetes/kubernetes#74154
kubernetes/kubernetes#74477
kubernetes/kubernetes#74448

If you know this will slip, please reply back and let us know. Thanks!

@makoscafee

This comment has been minimized.

Copy link
Member

commented May 28, 2019

Hey, @caesarxuchao @liggitt . Deadline for submitting at least Draft/Placeholder PR by May 30th 2019 @ EOD PST. Does this enhancement require any new docs (or modifications)?

@liggitt

This comment has been minimized.

Copy link
Member

commented May 30, 2019

@liggitt

This comment has been minimized.

Copy link
Member

commented May 31, 2019

draft docs PR for 1.15 changes at kubernetes/website#14671

@liggitt liggitt referenced this issue May 31, 2019
7 of 7 tasks complete

@liggitt liggitt added this to Required for GA, in progress in Admission Webhooks Jun 12, 2019

@liggitt

This comment has been minimized.

Copy link
Member

commented Jun 12, 2019

status for 1.15 is still beta, continuing improvements.

/stage beta

@liggitt

This comment has been minimized.

Copy link
Member

commented Jul 8, 2019

/milestone v1.16
/stage stable

@k8s-ci-robot k8s-ci-robot added stage/stable and removed stage/beta labels Jul 8, 2019

@k8s-ci-robot k8s-ci-robot modified the milestones: v1.15, v1.16 Jul 8, 2019

@mariantalla

This comment has been minimized.

Copy link
Contributor

commented Jul 11, 2019

Hey @jpbetz / @liggitt / @caesarxuchao - I'm adding this to the tracked enhancements for 1.16 as expected to graduate to stable. Please let me know if I got any of this wrong.

As a reminder, 1.16 milestone dates are Enhancement Freeze 7/30 and Code Freeze 8/29.

Thanks!

@simplytunde

This comment has been minimized.

Copy link
Member

commented Jul 29, 2019

Hey, @jpbetz @liggitt @caesarxuchao I'm the v1.16 docs release lead.

Does this enhancement (or the work planned for v1.16) require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.16) due by Friday,August 23rd. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions!

@hh

This comment has been minimized.

Copy link
Member

commented Jul 30, 2019

There is a requirement that GA/stable APIs must have conformance tests:
See: https://github.com/kubernetes/community/pull/1806/files

I created an umbrella issue for missing conformance tests using https://apisnoop.cncf.io:
See: kubernetes/kubernetes#80767

/assign @timothysc

@liggitt liggitt removed this from Required for GA, in progress in Admission Webhooks Jul 31, 2019

@liggitt liggitt referenced this issue Aug 21, 2019
10 of 10 tasks complete
@liggitt

This comment has been minimized.

Copy link
Member

commented Aug 21, 2019

1.16 WIP docs PR at kubernetes/website#15985

@kacole2

This comment has been minimized.

Copy link
Member

commented Aug 26, 2019

@liggitt code freeze for 1.16 is on Thursday 8/29. Are there any outstanding k/k PRs that still need to be merged for this to go Stable?

@jpbetz

This comment has been minimized.

Copy link
Contributor

commented Aug 26, 2019

I believe there is just two in-progress bug fixes and then everything is ready: kubernetes/kubernetes#81399, kubernetes/kubernetes#81896

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.