Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding ObjectSelector to admission webhooks #78505

Merged

Conversation

@caesarxuchao
Copy link
Member

commented May 30, 2019

Supersedes #78226.

Based on #78491 and #78080, which are both reviewed and approved already

Implementing KEP#objectSelector and #78226 (comment).

/sig api-machinery
/assign @liggitt @jpbetz @sttts @roycaihw

Added objectSelector to admission webhook configurations. objectSelector is evaluated the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels.
@fejta-bot

This comment has been minimized.

Copy link

commented May 30, 2019

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

@liggitt liggitt added this to the v1.15 milestone May 30, 2019

@liggitt liggitt added this to In progress in API Reviews May 30, 2019

@caesarxuchao caesarxuchao force-pushed the caesarxuchao:dynamic-object-selector branch from b859b1f to 814a4a3 May 30, 2019

caesarxuchao added some commits May 17, 2019

api

@caesarxuchao caesarxuchao force-pushed the caesarxuchao:dynamic-object-selector branch from c95c02d to 3b5c1ea May 30, 2019

@@ -48,6 +48,14 @@ type VersionedAttributes struct {
Dirty bool
}

// GetObject overrides the Attributes.GetObject()
func (v *VersionedAttributes) GetObject() runtime.Object {

This comment has been minimized.

Copy link
@liggitt

liggitt May 31, 2019

Member

this seems likely to cause confusion... admission attributes GetObject() functions don't usually contain external objects

This comment has been minimized.

Copy link
@liggitt

liggitt May 31, 2019

Member

this is fine for now, and we have complete test coverage, but a follow-up issue to rework this a little in 1.16 would be good

}

func newValidatingDispatcher(cm *webhookutil.ClientManager) generic.Dispatcher {
return &validatingDispatcher{cm}
func newValidatingDispatcher(p *Plugin) func(cm *webhookutil.ClientManager) generic.Dispatcher {

This comment has been minimized.

Copy link
@liggitt

liggitt May 31, 2019

Member

this works for now, but is pretty awkward, can you open a follow-up issue to avoid needing to inject the full plugin into the dispatchers?

@liggitt

This comment has been minimized.

Copy link
Member

commented May 31, 2019

looks like a compile error in k8s.io/apiserver/pkg/admission/plugin/webhook/object, and openapi spec needs updating (I think that CI job was stale)

caesarxuchao added some commits May 29, 2019

@caesarxuchao caesarxuchao force-pushed the caesarxuchao:dynamic-object-selector branch from 3b5c1ea to 7738c7e May 31, 2019

@liggitt

This comment has been minimized.

Copy link
Member

commented May 31, 2019

ran against #78309, v1.14.0 compatibility looked good, new fields showed up as expected in the data fixtures for HEAD

@liggitt

This comment has been minimized.

Copy link
Member

commented May 31, 2019

/lgtm
/approve

API change looks good

@k8s-ci-robot k8s-ci-robot added the lgtm label May 31, 2019

@liggitt

This comment has been minimized.

Copy link
Member

commented May 31, 2019

/priority important-soon

@liggitt liggitt moved this from In progress to Completed, 1.15 in API Reviews May 31, 2019

@k8s-ci-robot

This comment has been minimized.

Copy link
Contributor

commented May 31, 2019

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: caesarxuchao, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@liggitt

This comment has been minimized.

Copy link
Member

commented May 31, 2019

included in docs PR for 1.15 at kubernetes/website#14671

@liggitt liggitt referenced this pull request May 31, 2019

Merged

Webhook admission 1.15 docs #14671

7 of 7 tasks complete

@k8s-ci-robot k8s-ci-robot merged commit bada1c6 into kubernetes:master Jun 1, 2019

21 checks passed

cla/linuxfoundation caesarxuchao authorized
Details
pull-kubernetes-bazel-build Job succeeded.
Details
pull-kubernetes-bazel-test Job succeeded.
Details
pull-kubernetes-conformance-image-test Skipped.
pull-kubernetes-cross Skipped.
pull-kubernetes-dependencies Job succeeded.
Details
pull-kubernetes-e2e-gce Job succeeded.
Details
pull-kubernetes-e2e-gce-100-performance Job succeeded.
Details
pull-kubernetes-e2e-gce-csi-serial Skipped.
pull-kubernetes-e2e-gce-device-plugin-gpu Job succeeded.
Details
pull-kubernetes-e2e-gce-storage-slow Skipped.
pull-kubernetes-godeps Skipped.
pull-kubernetes-integration Job succeeded.
Details
pull-kubernetes-kubemark-e2e-gce-big Job succeeded.
Details
pull-kubernetes-local-e2e Skipped.
pull-kubernetes-node-e2e Job succeeded.
Details
pull-kubernetes-node-e2e-containerd Job succeeded.
Details
pull-kubernetes-typecheck Job succeeded.
Details
pull-kubernetes-verify Job succeeded.
Details
pull-publishing-bot-validate Skipped.
tide In merge pool.
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.