Adding ObjectSelector to admission webhooks #78505

caesarxuchao · 2019-05-30T00:35:07Z

Supersedes #78226.

Based on #78491 and #78080, which are both reviewed and approved already

Implementing KEP#objectSelector and #78226 (comment).

/sig api-machinery
/assign @liggitt @jpbetz @sttts @roycaihw

Added objectSelector to admission webhook configurations. objectSelector is evaluated the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels.

fejta-bot · 2019-05-30T01:34:11Z

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/object/matcher.go

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook.go

staging/src/k8s.io/api/admissionregistration/v1beta1/types.go

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/dispatcher.go

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/dispatcher.go

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go

…hook and ValidatingWebhook

…ValidatingWebhook

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go

liggitt · 2019-05-30T23:52:00Z

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go

@@ -48,6 +48,14 @@ type VersionedAttributes struct {
 	Dirty bool
 }

+// GetObject overrides the Attributes.GetObject()
+func (v *VersionedAttributes) GetObject() runtime.Object {


this seems likely to cause confusion... admission attributes GetObject() functions don't usually contain external objects

this is fine for now, and we have complete test coverage, but a follow-up issue to rework this a little in 1.16 would be good

liggitt · 2019-05-31T00:06:22Z

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/dispatcher.go

 }

-func newValidatingDispatcher(cm *webhookutil.ClientManager) generic.Dispatcher {
-	return &validatingDispatcher{cm}
+func newValidatingDispatcher(p *Plugin) func(cm *webhookutil.ClientManager) generic.Dispatcher {


this works for now, but is pretty awkward, can you open a follow-up issue to avoid needing to inject the full plugin into the dispatchers?

liggitt · 2019-05-31T00:07:06Z

looks like a compile error in k8s.io/apiserver/pkg/admission/plugin/webhook/object, ~~and openapi spec needs updating~~ (I think that CI job was stale)

liggitt · 2019-05-31T00:35:30Z

ran against #78309, v1.14.0 compatibility looked good, new fields showed up as expected in the data fixtures for HEAD

liggitt · 2019-05-31T00:37:03Z

/lgtm
/approve

API change looks good

liggitt · 2019-05-31T00:37:14Z

/priority important-soon

k8s-ci-robot · 2019-05-31T00:38:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: caesarxuchao, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~api/OWNERS~~ [liggitt]
~~hack/OWNERS~~ [liggitt]
~~pkg/apis/OWNERS~~ [liggitt]
~~staging/src/k8s.io/api/OWNERS~~ [liggitt]
~~staging/src/k8s.io/apiserver/OWNERS~~ [liggitt]
~~test/OWNERS~~ [liggitt]
~~vendor/OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

liggitt · 2019-05-31T16:04:03Z

included in docs PR for 1.15 at kubernetes/website#14671

Ark-kun · 2020-09-09T06:44:04Z

/cc @caesarxuchao

k8s-ci-robot · 2020-09-09T06:44:05Z

@Ark-kun: GitHub didn't allow me to request PR reviews from the following users: caesarxuchao.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @caesarxuchao

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

liggitt · 2020-09-09T11:11:27Z

This looks like a breaking change.

The type name changed, but the wire serialization of the two types is identical.

k8s-ci-robot assigned jpbetz, liggitt, roycaihw and sttts May 30, 2019

caesarxuchao mentioned this pull request May 30, 2019

Adding ObjectSelector to admission webhooks #78226

Closed

k8s-ci-robot requested review from lavalamp and pwittrock May 30, 2019 00:35

k8s-ci-robot added area/apiserver kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API and removed needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels May 30, 2019

liggitt added the area/admission-control label May 30, 2019

liggitt added this to the v1.15 milestone May 30, 2019

liggitt added this to In progress in API Reviews May 30, 2019

liggitt reviewed May 30, 2019

View reviewed changes

This was referenced May 30, 2019

Admission webhook kubernetes/enhancements#492

Closed

Add json/protobuf/yaml fixtures #78309

Merged

jpbetz reviewed May 30, 2019

View reviewed changes

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/dispatcher.go Outdated Show resolved Hide resolved

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/dispatcher.go Outdated Show resolved Hide resolved

liggitt reviewed May 30, 2019

View reviewed changes

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go Outdated Show resolved Hide resolved

liggitt reviewed May 30, 2019

View reviewed changes

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go Outdated Show resolved Hide resolved

caesarxuchao force-pushed the dynamic-object-selector branch from b859b1f to 814a4a3 Compare May 30, 2019 21:28

jpbetz added 3 commits May 30, 2019 14:31

codegen: split admissionregistration.v1beta1/Webhook into MutatingWeb…

9356561

…hook and ValidatingWebhook

split admissionregistration.v1beta1/Webhook into MutatingWebhook and …

55ecc45

…ValidatingWebhook

codegen: Add mutating admission webhook reinvocation

939a04f

roycaihw reviewed May 30, 2019

View reviewed changes

staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go Show resolved Hide resolved

liggitt reviewed May 31, 2019

View reviewed changes

caesarxuchao mentioned this pull request May 31, 2019

Clean up ObjectSelector wiring #78554

Closed

Chao Xu added 2 commits May 30, 2019 17:23

object matcher

6cf499d

minor changes, propagating interface changes

7738c7e

caesarxuchao force-pushed the dynamic-object-selector branch from 3b5c1ea to 7738c7e Compare May 31, 2019 00:23

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 31, 2019

k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels May 31, 2019

liggitt moved this from In progress to Completed, 1.15 in API Reviews May 31, 2019

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 31, 2019

This was referenced May 31, 2019

Add reinvocation of mutating admission controllers #78080

Closed

split admissionregistration.v1beta1/Webhook into MutatingWebhook and ValidatingWebhook #78491

Closed

liggitt mentioned this pull request May 31, 2019

Webhook admission 1.15 docs kubernetes/website#14671

Merged

7 tasks

alpeb mentioned this pull request May 31, 2019

Admission Controllers don't run over the proxy and init injected containers. Check consequences. linkerd/linkerd2#2767

Closed

caesarxuchao mentioned this pull request May 31, 2019

Unit tests that make sure object selector works with CRD #78591

Merged

k8s-ci-robot merged commit bada1c6 into kubernetes:master Jun 1, 2019

masa213f mentioned this pull request Aug 20, 2019

update client-go to kubernetes-1.15.2 topolvm/topolvm#28

Merged

liggitt added this to Complete in Admission Webhooks Sep 4, 2019

timuthy mentioned this pull request Dec 31, 2019

Make validator AWS support all offered core shoot versions gardener-attic/gardener-extensions#525

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding ObjectSelector to admission webhooks #78505

Adding ObjectSelector to admission webhooks #78505

caesarxuchao commented May 30, 2019 •

edited by liggitt

fejta-bot commented May 30, 2019

liggitt May 30, 2019 •

edited

liggitt May 31, 2019

liggitt May 31, 2019

liggitt commented May 31, 2019 •

edited

liggitt commented May 31, 2019

liggitt commented May 31, 2019

liggitt commented May 31, 2019

k8s-ci-robot commented May 31, 2019

liggitt commented May 31, 2019

Ark-kun commented Sep 9, 2020

k8s-ci-robot commented Sep 9, 2020

liggitt commented Sep 9, 2020

Adding ObjectSelector to admission webhooks #78505

Adding ObjectSelector to admission webhooks #78505

Conversation

caesarxuchao commented May 30, 2019 • edited by liggitt

fejta-bot commented May 30, 2019

liggitt May 30, 2019 • edited

Choose a reason for hiding this comment

liggitt May 31, 2019

Choose a reason for hiding this comment

liggitt May 31, 2019

Choose a reason for hiding this comment

liggitt commented May 31, 2019 • edited

liggitt commented May 31, 2019

liggitt commented May 31, 2019

liggitt commented May 31, 2019

k8s-ci-robot commented May 31, 2019

liggitt commented May 31, 2019

Ark-kun commented Sep 9, 2020

k8s-ci-robot commented Sep 9, 2020

liggitt commented Sep 9, 2020

caesarxuchao commented May 30, 2019 •

edited by liggitt

liggitt May 30, 2019 •

edited

liggitt commented May 31, 2019 •

edited