Admission response alt #55829

cheftako · 2017-11-16T00:23:30Z

What this PR does / why we need it: This reflects the imperative nature of AdmissionReview. It adds AdmissionRequest and AdmissionResponse in place of status/spec. The AdmissionResponse the allows the mutating webhook to send back a json path with the mutated version of the requested object.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Ref #kubernetes/enhancements#492

Special notes for your reviewer:Port of caesarxuchao's fix with outcome of #55729

Release note:

action-required: please update your admission webhook to use the latest [Admission API](https://github.com/kubernetes/api/tree/master/admission).

`admission/v1alpha1#AdmissionReview` now contains `AdmissionRequest` and `AdmissionResponse`. `AdmissionResponse` includes a `Patch` field to allow mutating webhooks to send json patch to the apiserver.

cheftako · 2017-11-16T18:50:16Z

/test pull-kubernetes-e2e-gce

lavalamp

Just a few thoughts.

lavalamp · 2017-11-16T19:08:57Z

pkg/apis/admission/types.go

+// AdmissionRequest describes the admission.Attributes for the admission request.
+type AdmissionRequest struct {
+	// UID is an identifier for the individual request. It allows us to distinguish instances of requests which are
+	// otherwise identical (parallel requests, requests when earlier requests did not modify etc)


// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.

?

Is it unique to the webhook request or to the originating user request (would two webhooks get the same uid for calls resulting from a single user request, or would they each get their own unique uid)?

They should each get their own, I think--if we did a UID per request then we'd probably also want a nonce or something here.

sounds ok, should clarify that in the field doc

lavalamp · 2017-11-16T19:10:23Z

pkg/apis/admission/types.go

+	Patch []byte
+	// PatchType indicates the form the Patch will take. Currently we only support "JSONPatch".
+	// +optional
+	PatchType string


We often make special types for this, and define constants.

type PatchType string const ( PatchTypeJSONPatch PatchType = "JSONPatch" )

lavalamp · 2017-11-16T19:11:52Z

pkg/apis/admission/types.go

-// AdmissionReviewStatus describes the status of the admission request.
-type AdmissionReviewStatus struct {
+// AdmissionResponse describes an admission response.
+type AdmissionResponse struct {
 	// Allowed indicates whether or not the admission request was permitted.


Should we add UID here too?

I feel that the UID belongs with the request of the metadata about the request (UserInfo, Operation, Namespace etc). If we are not copying them into the response then it doesn't feel right to copy just the UID in. (If we want to abstract them into a type and reflect that in both request/response, I would be fine with that)

If we are not copying them into the response then it doesn't feel right to copy just the UID in.

Not sure I follow... the point of the uid is to identify the unique request, right? If the point of echoing is to bind the response to a particular request, the uid seems like the right thing to copy (it implies the rest of the request fields)

So from the discussions I was in, it seems we want things like UserInfo, Operation, Namespace coming back from the Webhook to the KAS (Just like we want the UID coming back). I'm not objecting to putting the UID in the Response field, so much as saying that I think all the fields want round tripping should be dealt with consistently. So we should either leave all of the in the "Request" field for the return trip (so the KAS can confirm the request the webhook operated on) or we should have the webhook copy all of the fields we want in the return trip into the "Response" object. At that point I would suggest we just package them up to make copying them over a but easier and tidier.

caesarxuchao · 2017-11-16T20:33:19Z

staging/src/k8s.io/api/admission/v1alpha1/types.go

-	// Since this admission controller is non-mutating the webhook should avoid setting this in its response to avoid the
-	// cost of deserializing it.
+	// Request describes the attributes for the admission request.
+	Request AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`


Should Request be optional?

Do you make it required because the UID/Kind/Resource are required even if the AdmissionReview is a response from the webhook?

I made it non optional so as you suggest fields like UID/Kind/Resource are present on the response and could be validated by the KAS.

Things required in the response should probably be in the response portion of the object, and the request optional to echo. The unique identifier makes particular sense.

caesarxuchao · 2017-11-16T20:43:46Z

pkg/apis/admission/types.go

+	// Name is the name of the object as presented in the request.  On a CREATE operation, the client may omit name and
+	// rely on the server to generate the name.  If that is the case, this method will return the empty string.
+	// +optional
+	Name string


This is violating our API convention that the empty value of an optional field has to be nil. But I guess we don't care anymore since there are so many violations in our code base.

This is reflecting the optionality of what was already in the API. I agree we need to come up with a consistent story on what and when we are going to do about our large base of optional/non-pointer fields.

"If that is the case, this method will return the empty string." ...so, it's not really optional, is it?

cheftako · 2017-11-16T22:20:12Z

/assign @deads2k @liggitt

caesarxuchao · 2017-11-16T22:43:05Z

pkg/apis/admission/types.go

+	Patch []byte
+	// PatchType indicates the form the Patch will take. Currently we only support "JSONPatch".
+	// +optional
+	PatchType PatchType


Could you make this field a pointer? Validating webhooks will leave this field nil.

Also could you add validation code to check that this field is either nil or equal to PatchTypeJSONPatch?

cheftako · 2017-11-16T23:43:58Z

/test pull-kubernetes-bazel-build

liggitt · 2017-11-17T04:35:42Z

staging/src/k8s.io/api/admission/v1alpha1/types.go

-	// Status is filled in by the webhook and indicates whether the admission request should be permitted.
-	// +optional
-	Status AdmissionReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
+	Response AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`


The field name and protobuf tag changes throughout mean any existing webhook impl or protobuf client cannot correctly decode the content.

I think that's acceptable given the API and feature was alpha, but worth a check against the deprecation policy,

Yeah I think it should be OK.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Adding mutating webhook admission plugin Ref #kubernetes/enhancements#492 I made a change to the API to plumb the `Patch` into the response. I'll rebase onto the actual API once kubernetes/kubernetes#55829 is merged. We should update the release notes to point to the user docs when we have any. ```release-note Added mutation supports to admission webhooks. ``` TODO: - [ ] update test image to v6 after #55829 is merged - [ ] rename the GenericAdmissionWebhook to ValidatingAdmissionWebhook - [ ] reduce json marshal/unmarshal roundtrip: kubernetes/kubernetes#54892 (comment) - [ ] move the matching function to a common package that validating and mutating webhooks can both import. - [ ] handle namespace GET failure gracefully for fail open webhook? Kubernetes-commit: 638add6ddfb6d2f9fbc3224d0ce1e8cab9aa3049

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Nov 16, 2017

k8s-github-robot assigned yifan-gu and pwittrock Nov 16, 2017

k8s-github-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API labels Nov 16, 2017

caesarxuchao mentioned this pull request Nov 16, 2017

Adding mutating webhook admission plugin #54892

Merged

5 tasks

cheftako force-pushed the admissionResponseAlt branch from 09ecaac to 201c3f0 Compare November 16, 2017 01:57

k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 16, 2017

cheftako force-pushed the admissionResponseAlt branch 2 times, most recently from 767883b to 49de924 Compare November 16, 2017 02:32

cheftako force-pushed the admissionResponseAlt branch from 49de924 to c89d0b2 Compare November 16, 2017 19:10

lavalamp reviewed Nov 16, 2017

View reviewed changes

caesarxuchao assigned lavalamp and unassigned yifan-gu and pwittrock Nov 16, 2017

caesarxuchao reviewed Nov 16, 2017

View reviewed changes

cheftako force-pushed the admissionResponseAlt branch 2 times, most recently from f448fea to 281563a Compare November 16, 2017 22:15

k8s-ci-robot assigned deads2k and liggitt Nov 16, 2017

caesarxuchao reviewed Nov 16, 2017

View reviewed changes

cheftako force-pushed the admissionResponseAlt branch from 281563a to bf78973 Compare November 16, 2017 23:27

cheftako force-pushed the admissionResponseAlt branch from bf78973 to 8abf2d1 Compare November 17, 2017 00:02

liggitt reviewed Nov 17, 2017

View reviewed changes

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 17, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Admission response alt #55829

Admission response alt #55829

cheftako commented Nov 16, 2017 •

edited by lavalamp

Loading

cheftako commented Nov 16, 2017

lavalamp left a comment

lavalamp Nov 16, 2017

cheftako Nov 16, 2017

liggitt Nov 17, 2017

lavalamp Nov 17, 2017

liggitt Nov 17, 2017

lavalamp Nov 16, 2017

cheftako Nov 16, 2017

lavalamp Nov 16, 2017

cheftako Nov 16, 2017

liggitt Nov 17, 2017

cheftako Nov 17, 2017

caesarxuchao Nov 16, 2017

cheftako Nov 16, 2017

liggitt Nov 17, 2017 •

edited

Loading

caesarxuchao Nov 16, 2017

cheftako Nov 16, 2017

lavalamp Nov 17, 2017

cheftako commented Nov 16, 2017

caesarxuchao Nov 16, 2017

cheftako commented Nov 16, 2017

liggitt Nov 17, 2017 •

edited

Loading

lavalamp Nov 17, 2017

Admission response alt #55829

Admission response alt #55829

Conversation

cheftako commented Nov 16, 2017 • edited by lavalamp Loading

cheftako commented Nov 16, 2017

lavalamp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt Nov 17, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cheftako commented Nov 16, 2017

Choose a reason for hiding this comment

cheftako commented Nov 16, 2017

liggitt Nov 17, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cheftako commented Nov 16, 2017 •

edited by lavalamp

Loading

liggitt Nov 17, 2017 •

edited

Loading

liggitt Nov 17, 2017 •

edited

Loading