Extensible admission controller #4092

caesarxuchao · 2017-06-15T00:32:54Z

The text is not readable yet. I opened this PR just to reserve a slot for us in 1.7 docs.

cc @smarterclayton @lavalamp @whitlockjc

This change is

chenopis · 2017-06-21T16:32:40Z

@caesarxuchao You will also need to add an entry for this doc in the Reference table of contents, /_data/reference.yml, probably after - docs/admin/admission-controllers.md (line 14).

Ping me when this is ready for review. Cheers

chenopis · 2017-06-26T04:47:19Z

@abiogenesis-now Can you take a look at this? Thx

chenopis · 2017-06-26T16:25:16Z

FYI, all feedback must be addressed and LGTMs given by EOD Tue, June 27th so that this can be merged for the 1.7 release on June 28th.

jesscodez

Couple of rewrite/typo suggestions, as well as a question about structure.

This is WIP but seems like it needs to be released soon. There were some things I didn't address because the sections hadn't been written yet; I can offer more specific feedback when that is done.

jesscodez · 2017-06-26T16:25:09Z

docs/admin/extensible-admission-controllers.md

+
+## How to write an initializer (@Clayton)
+## How to deploy an initializer (@Clayton)
+## How to configure initializers on the fly?


Style change: Titles for sections should be phrases, not questions.

For example, instead of "How to configure initializers on the fly?", this section should be called "Configure initializers on the fly".

jesscodez · 2017-06-26T16:40:31Z

docs/admin/extensible-admission-controllers.md

+* TOC
+{:toc}
+
+## The plugin-style admission controllers are not flexible enough


I would call this section "Overview", and combine it with the section below ("How do I extend admission controllers?").

"Overview" should explain why (e.g. the use case/motivation for extending admission controllers) and summarize terminology that the reader might not know. (See Authenticating with Bootstrap Tokens) for an example.

I might rewrite as follows:

Using Admission Controllers introduces how to use standard, plugin-style admission controllers. However, plugin admissions controllers are not flexible enough for all use cases, due to the following:

They need to be compiled in-tree

They are only configurable when the apiserver starts up.

1.7 introduces two alpha features, Initializers and External Admission Hooks, that address these limitations. These features allow admission controllers to be developed out-of-tree and configured at runtime.

This page describes how to use Initializers and External Admission Hooks.

jesscodez · 2017-06-26T16:41:21Z

docs/admin/extensible-admission-controllers.md

+
+## Initializers
+
+###what are they?


you need to have a space between "###" and "what" --- the markdown is not being parsed correctly

jesscodez · 2017-06-26T16:43:36Z

docs/admin/extensible-admission-controllers.md

+## Initializers
+
+###what are they?
+* muntating AC; called in serial


s/muntating/mutating?

Also, it's not clear to me what an AC is---it might be worth spelling out the whole word and linking to an article

jesscodez · 2017-06-26T16:46:39Z

docs/admin/extensible-admission-controllers.md

+
+* uninitialized objects are not visible ...
+
+### When are initializers called?


May or may not be useful to have a section called "When to use initializers?" (vs. admission webhooks). Just a suggestion though.

jesscodez · 2017-06-26T16:55:02Z

docs/admin/extensible-admission-controllers.md

+            - pods
+```
+
+For a Create request received by the apiserver, if the request matches any of the `rules` of an initializer, the `Initializer` admission controller will add the initializer to the `metadate.initializers` field of the created object, thus the initializer controller will notice the creation and initialize the object.


typo: s/metadate/metadata

Also break this up into two sentences---separate before the word "thus"

jesscodez · 2017-06-26T16:55:53Z

docs/admin/extensible-admission-controllers.md

+
+For a Create request received by the apiserver, if the request matches any of the `rules` of an initializer, the `Initializer` admission controller will add the initializer to the `metadate.initializers` field of the created object, thus the initializer controller will notice the creation and initialize the object.
+
+It is recommended to make sure that all expansions of the `<apiGroup, apiVersions,resources>` tuple in a `rule` are valid; if they are not, separate them to different `rules`.


remove "it is recommended to"

the sentence should read "Make sure that..."

jesscodez · 2017-06-26T16:56:07Z

docs/admin/extensible-admission-controllers.md

+
+It is recommended to make sure that all expansions of the `<apiGroup, apiVersions,resources>` tuple in a `rule` are valid; if they are not, separate them to different `rules`.
+
+After you create the initializerConfiguration, please give the system a few seconds to honor the new configuration.


remove "please...reword:

After you create the InitializerConfiguration, the system will take a few seconds to honor the new configuration.

jesscodez · 2017-06-26T16:59:32Z

docs/admin/extensible-admission-controllers.md

+***TODO: find a home for the example***
+See (https://github.com/caesarxuchao/example-webhook-admission-controller) for an example webhook admission controller.
+
+The communication between the webhook admission controller and the apiserver, or more precisely, the GenericAdmissionWebhook admission controller, needs to be TLS secured. You need to generate a CA cert and use it to sign the server cert used by your webhook admission controller. The pem formatted CA cert is supplied to the apiserver via the dynamic registration API `externaladmissionhookconfigurations.clientConfig.caBundle`.


you should simplify and just say:

The communication between the webhook admission controller and the apiserver needs to be TLS secured.

Either that or you should clarify what a "GenericAdmissionWebhook" and how/if it is different from other special types of webhook admission controllers

Will explain it in a previous section.

jesscodez · 2017-06-26T17:05:52Z

docs/admin/extensible-admission-controllers.md

+
+After you create the initializerConfiguration, please give the system a few seconds to honor the new configuration.
+
+## How to write a webhook admission controller?


Consolidate all the Initializer stuff together and all of the Webhook Admission Controller stuff together.

e.g. (1) what is it?/when to use it? (2) when is it called? (3) how to write it? (4) how to deploy it? (5) how to configure it? These should all be in one section, rather than interwoven (as they are currently).

chenopis · 2017-06-26T18:04:07Z

@caesarxuchao are the folks cc'ed in your descriptions going to be the tech reviewers?

chenopis · 2017-06-27T07:58:15Z

@caesarxuchao BTW, you still need to add an entry for this doc in the Reference table of contents, /_data/reference.yml.

caesarxuchao · 2017-06-27T18:13:09Z

Somehow i can't assign @whitlockjc as reviewer.

caesarxuchao · 2017-06-27T18:13:30Z

@chenopis i'll fix the entry. Thanks.

whitlockjc · 2017-06-27T18:14:00Z

I'm not a committer. :) But I will gladly review. As for the webhook stuff, I just got to a point where I can put some time into that if it's not too late.

chenopis · 2017-06-27T18:39:48Z

@whitlockjc Yeah, if you can get that in by the end of day today, that would be great. Also, this still needs a tech review. Thx

chenopis · 2017-06-27T18:41:02Z

@abiogenesis-now Were your issues addressed? Is this ready for a docs lgtm?

jesscodez · 2017-06-27T19:18:13Z

taking a look now

jesscodez · 2017-06-27T19:24:00Z

@caesarxuchao are there meant to be TODOs in the documentation? It seems like parts of this are still pretty WIP; were you planning on having those done by EOD?

caesarxuchao · 2017-06-27T21:39:06Z

are there meant to be TODOs in the documentation?

No, they should be all filled out.

chenopis · 2017-06-27T21:41:13Z

Did anyone push the changes up to GitHub? I haven't seen any commits since yesterday.

caesarxuchao · 2017-06-27T22:26:36Z

docs/admin/extensible-admission-controllers.md

+### Write a webhook admission controller
+
+***TODO: find a home for the example***
+See (https://github.com/caesarxuchao/example-webhook-admission-controller) for an example webhook admission controller.


@chenopis do you know where should i contribute the example to?

chenopis · 2017-06-28T18:05:37Z

@caesarxuchao What is the status of this PR? It doesn't look complete yet. Also, I think it needs to be broken up into separate Concept and Task docs.

caesarxuchao · 2017-06-28T22:48:31Z

@chenopis sorry for the delay. I talked with @lavalamp and he's ok with iterating the docs after the release, so the doc team can review it now.

I'll add the reference entry. (done)

cc @whitlockjc @smarterclayton

chenopis · 2017-06-28T23:36:04Z

@caesarxuchao Ok, no problem. Thanks!

chenopis · 2017-06-28T23:38:35Z

I'm going to merge this and make some changes in a follow-up PR.

* Docs changes to PR #4092 * address feedback

@nikhiljindal

* Minor fixes in the Deployment doc Signed-off-by: Michail Kargakis <mkargaki@redhat.com> * add NodeRestriction to admission-controllers (#3842) * Admins Can Configure Zones in Storage Class The PR #38505 (kubernetes/kubernetes#38505) added zones optional parameter to Storage Class for AWS and GCE provisioners. That's why documentation needs to be updated accordingly. * document custom resource definitions * add host paths to psp (#3971) * add host paths to psp * add italics * Update ConfigMap doc to explain TTL-based cache updates (#3989) * Update ConfigMap doc to explain TTL-based cache updates * swap word order Change "When a ConfigMap being already consumed..." to "When a ConfigMap already being consumed..." * Update NetworkPolicy docs for v1 * StorageOS Volume plugin * Update GPU docs * docs: HPA autoscaling/v2alpha1 status conditions This commit documents the new status conditions feature for HPA autoscaling/v2alpha1. It demonstrates how to get the status conditions using `kubectl describe`, and how to interpret them. * Update description about NodeRestriction kubelet node can alse create mirror pods for their own static pods. * adding storage as a supported resource to node allocatable Signed-off-by: Vishnu kannan <vishnuk@google.com> * Add documentation for podpreset opt-out annotation This adds the annotation for having the podpreset admission controller to skip (opt-out) manipulating the pod spec. Also, the annotation format for what presets have acted on a pod has been modified to add a prefix of "podpreset-". The new naming makes it such that there is no chance of collision with the newly introduced opt-out annotation (or future ones yet to be added). Opt-out annotation PR: kubernetes/kubernetes#44965 * Update PDB documentation to explain new field (#3885) * update-docs-pdb * Addressed erictune@'s comments * Fix title and add a TOC to the logging concept page * Patch #4118 for typos * Describe setting coredns server in nameserver resolv chain * Address comments in PR #3997. Comment is in https://github.com/kubernetes/kubernetes.github.io/pull/3997/files/f6eb59c67e28efc298c87b1ef49a96bc6adacd1e#diff-7a14981f3dd8eb203f897ce6c11d9828 * Update task for DaemonSet history and rollback (#4098) * Update task for DaemonSet history and rollback Also remove mentions of templateGeneration field because it's deprecated * Address comments * removed lt and gt as operators (#4152) * removed lt and gt as operators * replace lt and gt for node-affinfity * updated based on bsalamat review * Initial draft of upgrade guide for kubeadm clusters. In-place upgrades are supported between 1.6 and 1.7 releases. Rollback instructions to come in a separate commit. Fixes kubernetes/kubeadm#278 * Add local volume documentation (#4050) * Add local volume documentation * Add PV local volume example * Patch PR #3999 * Add documentation for Stackdriver event exporter * Add documentation about controller metrics * Federation: Add task for setting up placement policies (#4075) * Add task for setting up placement policies * Update version of management sidecar in policy engine deployment * Address @nikhiljindal's comments - Lower case filenames - Comments in policy - Typo fixes - Removed type LoadBalancer from OPA Service * Add example that sets cluster selector Per-@nikhiljindal's suggestion * Fix wording and templating per @chenopis * PodDisruptionBudget documentation Improvements (#4140) * Changes from #3885 Title: Update PDB documentation to explain new field Author: foxish * Added Placeholder Disruptions Concept Guide New file: docs/concepts/workloads/pods/disruptions.md Intented contents: concept for Pod Disruption Budget, cross reference to Eviction and Preemption docs. Linked from: concepts > workloads > pods * Added placeholder Configuring PDB Task New file: docs/tasks/run-application/configure-pdb.md Intented contents: task for writing a Pod Disruption Budget. Linked from: tasks > configuring-applications > configure pdb. * Add refs to the "drain a node" task. * Refactor PDB docs. Move the "Requesting an eviction" section from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md -- which is going away -- to: docs/tasks/administer-cluster/safely-drain-node.md The move is verbatim, except for an introductory sentence. Also added assignees. * Refactor of PDB docs Moved the section: Specifying a PodDisruptionBudget from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/tasks/run-application/configure-pdb.md because that former file is going away. Move is verbatim. * Explain how Eviction tools should handle failures * Refactor PDB docs Move text from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/concepts/workloads/pods/disruptions.md Delete the now empty: docs/tasks/administer-cluster/configure-pod-disruption-budget.md Added a redirects_from section to the new doc, containing the path of the now-deleted doc, plus all the redirects from the deleted doc. * Expand PDB Concept guide Building on a little content from the old task, greatly expanded the Disruptions concept guide, including an abstract example. * Update creating a pdb Task. * Address review comments. * Fixed for all cody-clark's review comments * Address review comments from mml * Address review comments from maisem * Fix missing backtick * Api and Kubectl reference docs updates for 1.7 (#4193) * Fix includes groups * Generated kubectl docs for 1.7 * Generated references docs for 1.7 api * Document node authorization mode * API Aggregator (#4173) * API Aggregator * Additional bullet points * incorporated feedback for apiserver-aggregation.md * split setup-api-aggregator.md into two docs and address feedback * fix link * addressed docs feedback * incorporate feedback * integrate feedback * Add documentation for DNS stub domains (#4063) * Add documentation for DNS stub domains * add additional prereq * fix image path * review feedback * minor grammar and style nits * documentation for using hostAliases to manage hosts file (#4080) * documentation for using hostAliases to manage hosts file * add to table of contents * review comments * update the right command to see hosts file * reformat doc based on suggestion and change some wording * Fix typo for #4080 * Patch PR #4063 * Fix wording in placement policy task introduction * Add update to statefulset concepts and basic tutorial (#4174) * Add update to statefulset concpets and basic tutorial * Address tech comments. * Update ESIPP docs for new added API fields * Custom resource docs * update audit document with advanced audit features added in 1.7 * kubeadm v1.7 documentation updates (#4018) * v1.7 updates for kubeadm * Address review comments * Address Luke's comments * Encrypting secrets at rest and cluster security guide * Edits for Custom DNS Documentation (#4207) * reorganize custom dns doc * format fixes * Update version numbers to 1.7 * Patch PR #4140 (#4215) * Patch PR #4140 * fix link and typos * Update PR template * Update TLS bootstrapping with 1.7 features This includes documenting the new CSR approver built into the controller manager and the kubelet alpha features for certificate rotation. Since the CSR approver changed over the 1.7 release cycle we need to call out the migration steps for those using the alpha feature. This document as a whole could probably use some updates, but the main focus of this PR is just to get these features minimally documented before the release. * Federated ClusterSelector formatting updates from review * complete PR #4181 (#4223) * complete PR #4181 * fix security link * Extensible admission controller (#4092) * extensible-admission-controllers * Update extensible-admission-controllers.md * more on initializers * fixes * Expand external admission webhooks documentation * wrap at 80 chars * more * add reference * Use correct apigroup for network policy * Docs changes to PR #4092 (#4224) * Docs changes to PR #4092 * address feedback * add doc for --as-group in cli Add doc for this pr: kubernetes/kubernetes#43696

* extensible-admission-controllers * Update extensible-admission-controllers.md * more on initializers * fixes * Expand external admission webhooks documentation * wrap at 80 chars * more * add reference

* Docs changes to PR #4092 * address feedback

@nikhiljindal

* Minor fixes in the Deployment doc Signed-off-by: Michail Kargakis <mkargaki@redhat.com> * add NodeRestriction to admission-controllers (#3842) * Admins Can Configure Zones in Storage Class The PR #38505 (kubernetes/kubernetes#38505) added zones optional parameter to Storage Class for AWS and GCE provisioners. That's why documentation needs to be updated accordingly. * document custom resource definitions * add host paths to psp (#3971) * add host paths to psp * add italics * Update ConfigMap doc to explain TTL-based cache updates (#3989) * Update ConfigMap doc to explain TTL-based cache updates * swap word order Change "When a ConfigMap being already consumed..." to "When a ConfigMap already being consumed..." * Update NetworkPolicy docs for v1 * StorageOS Volume plugin * Update GPU docs * docs: HPA autoscaling/v2alpha1 status conditions This commit documents the new status conditions feature for HPA autoscaling/v2alpha1. It demonstrates how to get the status conditions using `kubectl describe`, and how to interpret them. * Update description about NodeRestriction kubelet node can alse create mirror pods for their own static pods. * adding storage as a supported resource to node allocatable Signed-off-by: Vishnu kannan <vishnuk@google.com> * Add documentation for podpreset opt-out annotation This adds the annotation for having the podpreset admission controller to skip (opt-out) manipulating the pod spec. Also, the annotation format for what presets have acted on a pod has been modified to add a prefix of "podpreset-". The new naming makes it such that there is no chance of collision with the newly introduced opt-out annotation (or future ones yet to be added). Opt-out annotation PR: kubernetes/kubernetes#44965 * Update PDB documentation to explain new field (#3885) * update-docs-pdb * Addressed erictune@'s comments * Fix title and add a TOC to the logging concept page * Patch #4118 for typos * Describe setting coredns server in nameserver resolv chain * Address comments in PR #3997. Comment is in https://github.com/kubernetes/kubernetes.github.io/pull/3997/files/f6eb59c67e28efc298c87b1ef49a96bc6adacd1e#diff-7a14981f3dd8eb203f897ce6c11d9828 * Update task for DaemonSet history and rollback (#4098) * Update task for DaemonSet history and rollback Also remove mentions of templateGeneration field because it's deprecated * Address comments * removed lt and gt as operators (#4152) * removed lt and gt as operators * replace lt and gt for node-affinfity * updated based on bsalamat review * Initial draft of upgrade guide for kubeadm clusters. In-place upgrades are supported between 1.6 and 1.7 releases. Rollback instructions to come in a separate commit. Fixes kubernetes/kubeadm#278 * Add local volume documentation (#4050) * Add local volume documentation * Add PV local volume example * Patch PR #3999 * Add documentation for Stackdriver event exporter * Add documentation about controller metrics * Federation: Add task for setting up placement policies (#4075) * Add task for setting up placement policies * Update version of management sidecar in policy engine deployment * Address @nikhiljindal's comments - Lower case filenames - Comments in policy - Typo fixes - Removed type LoadBalancer from OPA Service * Add example that sets cluster selector Per-@nikhiljindal's suggestion * Fix wording and templating per @chenopis * PodDisruptionBudget documentation Improvements (#4140) * Changes from #3885 Title: Update PDB documentation to explain new field Author: foxish * Added Placeholder Disruptions Concept Guide New file: docs/concepts/workloads/pods/disruptions.md Intented contents: concept for Pod Disruption Budget, cross reference to Eviction and Preemption docs. Linked from: concepts > workloads > pods * Added placeholder Configuring PDB Task New file: docs/tasks/run-application/configure-pdb.md Intented contents: task for writing a Pod Disruption Budget. Linked from: tasks > configuring-applications > configure pdb. * Add refs to the "drain a node" task. * Refactor PDB docs. Move the "Requesting an eviction" section from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md -- which is going away -- to: docs/tasks/administer-cluster/safely-drain-node.md The move is verbatim, except for an introductory sentence. Also added assignees. * Refactor of PDB docs Moved the section: Specifying a PodDisruptionBudget from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/tasks/run-application/configure-pdb.md because that former file is going away. Move is verbatim. * Explain how Eviction tools should handle failures * Refactor PDB docs Move text from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/concepts/workloads/pods/disruptions.md Delete the now empty: docs/tasks/administer-cluster/configure-pod-disruption-budget.md Added a redirects_from section to the new doc, containing the path of the now-deleted doc, plus all the redirects from the deleted doc. * Expand PDB Concept guide Building on a little content from the old task, greatly expanded the Disruptions concept guide, including an abstract example. * Update creating a pdb Task. * Address review comments. * Fixed for all cody-clark's review comments * Address review comments from mml * Address review comments from maisem * Fix missing backtick * Api and Kubectl reference docs updates for 1.7 (#4193) * Fix includes groups * Generated kubectl docs for 1.7 * Generated references docs for 1.7 api * Document node authorization mode * API Aggregator (#4173) * API Aggregator * Additional bullet points * incorporated feedback for apiserver-aggregation.md * split setup-api-aggregator.md into two docs and address feedback * fix link * addressed docs feedback * incorporate feedback * integrate feedback * Add documentation for DNS stub domains (#4063) * Add documentation for DNS stub domains * add additional prereq * fix image path * review feedback * minor grammar and style nits * documentation for using hostAliases to manage hosts file (#4080) * documentation for using hostAliases to manage hosts file * add to table of contents * review comments * update the right command to see hosts file * reformat doc based on suggestion and change some wording * Fix typo for #4080 * Patch PR #4063 * Fix wording in placement policy task introduction * Add update to statefulset concepts and basic tutorial (#4174) * Add update to statefulset concpets and basic tutorial * Address tech comments. * Update ESIPP docs for new added API fields * Custom resource docs * update audit document with advanced audit features added in 1.7 * kubeadm v1.7 documentation updates (#4018) * v1.7 updates for kubeadm * Address review comments * Address Luke's comments * Encrypting secrets at rest and cluster security guide * Edits for Custom DNS Documentation (#4207) * reorganize custom dns doc * format fixes * Update version numbers to 1.7 * Patch PR #4140 (#4215) * Patch PR #4140 * fix link and typos * Update PR template * Update TLS bootstrapping with 1.7 features This includes documenting the new CSR approver built into the controller manager and the kubelet alpha features for certificate rotation. Since the CSR approver changed over the 1.7 release cycle we need to call out the migration steps for those using the alpha feature. This document as a whole could probably use some updates, but the main focus of this PR is just to get these features minimally documented before the release. * Federated ClusterSelector formatting updates from review * complete PR #4181 (#4223) * complete PR #4181 * fix security link * Extensible admission controller (#4092) * extensible-admission-controllers * Update extensible-admission-controllers.md * more on initializers * fixes * Expand external admission webhooks documentation * wrap at 80 chars * more * add reference * Use correct apigroup for network policy * Docs changes to PR #4092 (#4224) * Docs changes to PR #4092 * address feedback * add doc for --as-group in cli Add doc for this pr: kubernetes/kubernetes#43696

caesarxuchao added this to the 1.7 milestone Jun 15, 2017

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 15, 2017

k8s-github-robot assigned mikedanese Jun 15, 2017

chenopis added the kind/feature label Jun 19, 2017

chenopis assigned chenopis and unassigned mikedanese Jun 20, 2017

chenopis added Needs Docs Review labels Jun 20, 2017

chenopis added Docs Review: Open Issues and removed Needs Docs Review labels Jun 26, 2017

jesscodez reviewed Jun 26, 2017

View reviewed changes

chenopis requested review from lavalamp and smarterclayton June 26, 2017 18:03

caesarxuchao assigned lavalamp and smarterclayton Jun 27, 2017

caesarxuchao commented Jun 27, 2017

View reviewed changes

Chao Xu and others added 7 commits June 28, 2017 15:45

extensible-admission-controllers

80d791f

Update extensible-admission-controllers.md

f461fbc

more on initializers

59b2cfe

Expand external admission webhooks documentation

6ad39ba

fixes

ed9d5b2

wrap at 80 chars

92edf9b

more

c59022a

caesarxuchao force-pushed the extensible-admission-controller branch from 9e8d99f to c59022a Compare June 28, 2017 22:45

caesarxuchao changed the title ~~[WIP] Extensible admission controller~~ Extensible admission controller Jun 28, 2017

add reference

5176380

chenopis merged commit 19b386d into kubernetes:release-1.7 Jun 28, 2017

chenopis added a commit that referenced this pull request Jun 29, 2017

Docs changes to PR #4092

c344bbe

chenopis mentioned this pull request Jun 29, 2017

Docs changes to PR #4092 #4224

Merged

chenopis added a commit that referenced this pull request Jun 29, 2017

Docs changes to PR #4092 (#4224)

61892b8

* Docs changes to PR #4092 * address feedback

jesscodez pushed a commit that referenced this pull request Sep 22, 2017

Docs changes to PR #4092 (#4224)

1e8d3b8

* Docs changes to PR #4092 * address feedback

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Extensible admission controller #4092

Extensible admission controller #4092

caesarxuchao commented Jun 15, 2017 •

edited by k8s-reviewable

chenopis commented Jun 21, 2017

chenopis commented Jun 26, 2017

chenopis commented Jun 26, 2017

jesscodez left a comment

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

jesscodez Jun 26, 2017

caesarxuchao Jun 26, 2017

jesscodez Jun 26, 2017

caesarxuchao Jun 26, 2017

chenopis commented Jun 26, 2017

chenopis commented Jun 27, 2017

caesarxuchao commented Jun 27, 2017

caesarxuchao commented Jun 27, 2017 •

edited

whitlockjc commented Jun 27, 2017

chenopis commented Jun 27, 2017

chenopis commented Jun 27, 2017

jesscodez commented Jun 27, 2017

jesscodez commented Jun 27, 2017 •

edited

caesarxuchao commented Jun 27, 2017

chenopis commented Jun 27, 2017

caesarxuchao Jun 27, 2017

chenopis commented Jun 28, 2017

caesarxuchao commented Jun 28, 2017 •

edited

chenopis commented Jun 28, 2017

chenopis commented Jun 28, 2017


		* uninitialized objects are not visible ...

		### When are initializers called?


		For a Create request received by the apiserver, if the request matches any of the `rules` of an initializer, the `Initializer` admission controller will add the initializer to the `metadate.initializers` field of the created object, thus the initializer controller will notice the creation and initialize the object.

		It is recommended to make sure that all expansions of the `<apiGroup, apiVersions,resources>` tuple in a `rule` are valid; if they are not, separate them to different `rules`.


		It is recommended to make sure that all expansions of the `<apiGroup, apiVersions,resources>` tuple in a `rule` are valid; if they are not, separate them to different `rules`.

		After you create the initializerConfiguration, please give the system a few seconds to honor the new configuration.


		After you create the initializerConfiguration, please give the system a few seconds to honor the new configuration.

		## How to write a webhook admission controller?

Extensible admission controller #4092

Extensible admission controller #4092

Conversation

caesarxuchao commented Jun 15, 2017 • edited by k8s-reviewable

chenopis commented Jun 21, 2017

chenopis commented Jun 26, 2017

chenopis commented Jun 26, 2017

jesscodez left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chenopis commented Jun 26, 2017

chenopis commented Jun 27, 2017

caesarxuchao commented Jun 27, 2017

caesarxuchao commented Jun 27, 2017 • edited

whitlockjc commented Jun 27, 2017

chenopis commented Jun 27, 2017

chenopis commented Jun 27, 2017

jesscodez commented Jun 27, 2017

jesscodez commented Jun 27, 2017 • edited

caesarxuchao commented Jun 27, 2017

chenopis commented Jun 27, 2017

Choose a reason for hiding this comment

chenopis commented Jun 28, 2017

caesarxuchao commented Jun 28, 2017 • edited

chenopis commented Jun 28, 2017

chenopis commented Jun 28, 2017

caesarxuchao commented Jun 15, 2017 •

edited by k8s-reviewable

caesarxuchao commented Jun 27, 2017 •

edited

jesscodez commented Jun 27, 2017 •

edited

caesarxuchao commented Jun 28, 2017 •

edited