Adding e2e test for the admission webhook #52368
Assignees
Labels
lifecycle/rotten
Denotes an issue or PR that has aged beyond stale and will be auto-closed.
sig/api-machinery
Categorizes an issue or PR as relevant to SIG API Machinery.
Comments
k8s-github-robot
added
the
needs-sig
|
/sig apimachinery |
k8s-github-robot
pushed a commit
that referenced
this issue
Sep 15, 2017
Automatic merge from submit-queue (batch tested with PRs 51824, 50476, 52451, 52009, 52237) Plumbing the proxy dialer to the webhook admission plugin * Fixing #49987. Plumb the `Dial` function to the `transport.Config` * Fixing #52366. Let the webhook admission plugin sets the `TLSConfg.ServerName`. I tested it in my gke setup. I don't have time to implement an e2e test before 1.8 release. I think it's ok to add the test later, because *i)* the change only affects the alpha webhook admission feature, and *ii)* the webhook feature is unusable without the fix. That said, it's up to my reviewer to decide. Filed #52368 for the missing e2e test. ( The second commit is #52372, which is just a cleanup of client configuration in e2e tests. It removed a function that marshalled the client config to json and then unmarshalled it. It is a prerequisite of this PR, because this PR added the `Dial` function to the config which is not json marshallable.) ```release-note Fixed the webhook admission plugin so that it works even if the apiserver and the nodes are in two networks (e.g., in GKE). Fixed the webhook admission plugin so that webhook author could use the DNS name of the service as the CommonName when generating the server cert for the webhook. Action required: Anyone who generated server cert for admission webhooks need to regenerate the cert. Previously, when generating server cert for the admission webhook, the CN value doesn't matter. Now you must set it to the DNS name of the webhook service, i.e., `<service.Name>.<service.Namespace>.svc`. ```
sttts
pushed a commit
to sttts/client-go
that referenced
this issue
Sep 22, 2017
Automatic merge from submit-queue (batch tested with PRs 51824, 50476, 52451, 52009, 52237) Plumbing the proxy dialer to the webhook admission plugin * Fixing kubernetes/kubernetes#49987. Plumb the `Dial` function to the `transport.Config` * Fixing kubernetes/kubernetes#52366. Let the webhook admission plugin sets the `TLSConfg.ServerName`. I tested it in my gke setup. I don't have time to implement an e2e test before 1.8 release. I think it's ok to add the test later, because *i)* the change only affects the alpha webhook admission feature, and *ii)* the webhook feature is unusable without the fix. That said, it's up to my reviewer to decide. Filed kubernetes/kubernetes#52368 for the missing e2e test. ( The second commit is kubernetes/kubernetes#52372, which is just a cleanup of client configuration in e2e tests. It removed a function that marshalled the client config to json and then unmarshalled it. It is a prerequisite of this PR, because this PR added the `Dial` function to the config which is not json marshallable.) ```release-note Fixed the webhook admission plugin so that it works even if the apiserver and the nodes are in two networks (e.g., in GKE). Fixed the webhook admission plugin so that webhook author could use the DNS name of the service as the CommonName when generating the server cert for the webhook. Action required: Anyone who generated server cert for admission webhooks need to regenerate the cert. Previously, when generating server cert for the admission webhook, the CN value doesn't matter. Now you must set it to the DNS name of the webhook service, i.e., `<service.Name>.<service.Namespace>.svc`. ``` Kubernetes-commit: 7181dd49460787871b602a47ab2ad05babacb820
|
/sig api-machinery |
k8s-ci-robot
added
the
sig/api-machinery
k8s-github-robot
removed
the
needs-sig
|
Issues go stale after 90d of inactivity. Prevent issues from auto-closing with an If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or |
k8s-ci-robot
added
the
lifecycle/stale
|
Stale issues rot after 30d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
k8s-ci-robot
added
lifecycle/rotten
|
Rotten issues close after 30d of inactivity. Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
As a followup of #50476.
We need to test:
The text was updated successfully, but these errors were encountered: