/kubernetes

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix decoding of admission config file #58439

Merged
merged 2 commits into from Jan 18, 2018

Conversation

Reviewers

@sttts sttts

@hzxuzhonghu hzxuzhonghu

Assignees

@sttts sttts

@mikedanese mikedanese

@deads2k deads2k

Labels
Projects
None yet
Milestone
No milestone
8 participants
@liggitt @deads2k @k8s-ci-robot @k8s-merge-robot @jennybuckley @sttts @hzxuzhonghu @mikedanese
@liggitt
Member

liggitt commented Jan 18, 2018 •
edited

Fixes #58426

1a552bb#diff-eb9532eb476083e1ab31da9dd6f83eceR41 attempted to use a locally constructed scheme, but the name scheme was shadowed by a function arg.

Attempts to run the apiserver with a structured plugin config file would fail to decode (since the passed scheme didn't know about the AdmissionConfiguration type), then fall back to treating the file as a legacy config, and silently continue without correct config

kube-apiserver: fixes loading of `--admission-control-config-file` containing AdmissionConfiguration apiserver.k8s.io/v1alpha1 config object

@k8s-ci-robot k8s-ci-robot added do-not-merge/release-note-label-needed size/S cncf-cla: yes labels Jan 18, 2018

@k8s-merge-robot k8s-merge-robot assigned sttts and mikedanese Jan 18, 2018

@liggitt liggitt referenced this pull request Jan 18, 2018

Closed

We have no way to simultaneously enable ImagePolicyWebhook and MutatingAdmissionWebhook admission plugins #58426

@k8s-ci-robot k8s-ci-robot added release-note and removed do-not-merge/release-note-label-needed labels Jan 18, 2018

liggitt added some commits Jan 18, 2018

@liggitt
Surface error loading admission plugin config
Unverified
The committer email address is not verified.
Learn about signing commits
ed53e8a
@liggitt
Fix loading structured admission plugin config
Unverified
The committer email address is not verified.
Learn about signing commits
Loading status checks…
34328ea

@k8s-ci-robot k8s-ci-robot added the approved label Jan 18, 2018

@liggitt

This comment has been minimized.

Sign in to view
Member

liggitt commented Jan 18, 2018

/assign @sttts @deads2k

@k8s-ci-robot k8s-ci-robot assigned deads2k Jan 18, 2018

@liggitt liggitt referenced this pull request Jan 18, 2018

Merged

Cherrypick of #58439 #56408: Fix decoding of admission config file #58441

@liggitt

This comment has been minimized.

Sign in to view
Member

liggitt commented Jan 18, 2018

cc @kubernetes/sig-api-machinery-pr-reviews

@k8s-ci-robot k8s-ci-robot added the sig/api-machinery label Jan 18, 2018

@deads2k

This comment has been minimized.

Sign in to view
Contributor

deads2k commented Jan 18, 2018

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm label Jan 18, 2018

@k8s-ci-robot

This comment has been minimized.

Sign in to view
Contributor

k8s-ci-robot commented Jan 18, 2018

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, liggitt

Associated issue: #58426

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment
@k8s-merge-robot

This comment has been minimized.

Sign in to view
Contributor

k8s-merge-robot commented Jan 18, 2018

/test all [submit-queue is verifying that this PR is safe to merge]
@liggitt

This comment has been minimized.

Sign in to view
Member

liggitt commented Jan 18, 2018

/retest
1 similar comment
@liggitt

This comment has been minimized.

Sign in to view
Member

liggitt commented Jan 18, 2018

/retest
@k8s-merge-robot

This comment has been minimized.

Sign in to view
Contributor

k8s-merge-robot commented Jan 18, 2018

Automatic merge from submit-queue (batch tested with PRs 57868, 58284, 56370, 58400, 58439). If you want to cherry-pick this change to another branch, please follow the instructions here.

@k8s-merge-robot k8s-merge-robot merged commit c7526fb into kubernetes:master Jan 18, 2018
13 checks passed

13 checks passed

Submit Queue Queued to run github e2e tests a second time.
Details
cla/linuxfoundation liggitt authorized
Details
pull-kubernetes-bazel-build Job succeeded.
Details
pull-kubernetes-bazel-test Job succeeded.
Details
pull-kubernetes-cross Skipped
pull-kubernetes-e2e-gce Job succeeded.
Details
pull-kubernetes-e2e-gce-device-plugin-gpu Job succeeded.
Details
pull-kubernetes-e2e-gke-gci Skipped
pull-kubernetes-e2e-kops-aws Job succeeded.
Details
pull-kubernetes-kubemark-e2e-gce Job succeeded.
Details
pull-kubernetes-node-e2e Job succeeded.
Details
pull-kubernetes-unit Job succeeded.
Details
pull-kubernetes-verify Job succeeded.
Details
@jennybuckley

This comment has been minimized.

Sign in to view
Contributor

jennybuckley commented Jan 18, 2018

@jennybuckley
staging/src/k8s.io/apiserver/pkg/server/options/admission.go
@@ -125,7 +125,7 @@ func (a *AdmissionOptions) ApplyTo(
pluginNames = a.enabledPluginNames()
}
pluginsConfigProvider, err := admission.ReadAdmissionConfiguration(pluginNames, a.ConfigFile, scheme)
pluginsConfigProvider, err := admission.ReadAdmissionConfiguration(pluginNames, a.ConfigFile, configScheme)

This comment has been minimized.

Sign in to view
Copy link
@sttts

sttts Jan 19, 2018

Contributor

thanks. Which brings us back to the observation that the testing of all of this is too weak.

This comment has been minimized.

Sign in to view
Copy link
@sttts

sttts Jan 19, 2018

Contributor

@hzxuzhonghu if you have capacity. improving the test coverage here would be awesome!

This comment has been minimized.

Sign in to view
Copy link
@hzxuzhonghu

hzxuzhonghu Jan 19, 2018

Member

I would like to.
@sttts

This comment has been minimized.

Sign in to view
Contributor

sttts commented Jan 19, 2018

@liggitt we need a cherry-pick in origin, if you haven't done so yet.

@hzxuzhonghu hzxuzhonghu referenced this pull request Jan 22, 2018

Closed

add test cases for ReadAdmissionConfiguration #58593

@liggitt liggitt deleted the liggitt:admission-scheme branch Jan 26, 2018

k8s-merge-robot added a commit that referenced this pull request Jan 27, 2018

@k8s-merge-robot
Merge pull request #58441 from liggitt/admission-scheme-1.9 
Automatic merge from submit-queue.

Cherrypick of #58439 #56408: Fix decoding of admission config file

Manual pick of #58439 and #56408 into release-1.9

```release-note
kube-apiserver: fixes loading of `--admission-control-config-file` containing AdmissionConfiguration apiserver.k8s.io/v1alpha1 config object
```
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
8b6f98a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment