Admission webhook #492

caesarxuchao · 2017-10-23T23:20:24Z

Feature Description

One-line feature description (can be used as a release note):

The admission webhook feature now supports both mutating webhook and validation (non-mutating) webhook. The dynamic registration API of webhook is promoted to v1beta1. The admission API is promoted to v1beta1.

Primary contact (assignee):
@mbhlool
Responsible SIGs:
/sig api-machinery
Design proposal link (community repo):
markdown version (latest): https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/00xx-admission-webhooks-to-ga.md

community proposal: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/admission-control-webhooks.md

tasks tracked in https://github.com/orgs/kubernetes/projects/32

Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:

@cheftako @liggitt @deads2k

Approver (likely from SIG/area to which feature belongs):

@erictune @lavalamp @deads2k

Feature target (which target equals to which milestone):
- Alpha release target (x.y)
- Beta release target 1.9
- Stable release target 1.16

caesarxuchao · 2017-10-23T23:20:44Z

/sig api-machinery

caesarxuchao · 2017-10-23T23:20:52Z

/kind feature

caesarxuchao · 2017-10-23T23:21:28Z

/milestone 1.9

deads2k · 2017-10-24T12:12:35Z

Design proposal link (community repo):
https://docs.google.com/document/d/1c4kdkY3ha9rm0OIRbGleCeaHknZ-NR1nNtDp-i8eH8E/edit?ts=59e8c984#

Let's get this in the community repo.

erictune · 2017-10-24T16:28:15Z

Ack, wil do.

…

On Tue, Oct 24, 2017 at 5:12 AM, David Eads ***@***.***> wrote: Design proposal link (community repo): https://docs.google.com/document/d/1c4kdkY3ha9rm0OIRbGleCeaHknZ- NR1nNtDp-i8eH8E/edit?ts=59e8c984# Let's get this in the community repo. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#492 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHuudrHnp8GGEQi3Xg2_P53JMApTFPMFks5svdQ6gaJpZM4QDoLK> .

erictune · 2017-10-26T17:21:36Z

Please use area/admission-control label for k/k issues/pulls Applied to a few dozen existing ones. @ae6rt

Automatic merge from submit-queue (batch tested with PRs 54165, 53909). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Adding an e2e test for admission webhook Part of kubernetes/enhancements#492 The purpose of this test is making sure the webhooks get called, and the apiserver can communicate with the webhook. We will expand the test cover more webhook features in followups. The webhook used in the test rejects pods with container names "webhook-disallow". Will upload the source code of the example in a follow up PR.

Automatic merge from submit-queue (batch tested with PRs 54165, 53909). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Adding an e2e test for admission webhook Part of kubernetes/enhancements#492 The purpose of this test is making sure the webhooks get called, and the apiserver can communicate with the webhook. We will expand the test cover more webhook features in followups. The webhook used in the test rejects pods with container names "webhook-disallow". Will upload the source code of the example in a follow up PR. Kubernetes-commit: 444d0c11153647d45b899b25a5dbbd3a5ea4a123

Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Add MutatingWebhookConfiguration type As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed. Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic. ref: kubernetes/enhancements#492

Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Add MutatingWebhookConfiguration type As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed. Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic. ref: kubernetes/enhancements#492 Kubernetes-commit: 61f210859d9c4bd64af254ba696f6f693596ced9

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Fix webhook API to also support URLs ref: kubernetes/enhancements#492 ```release-note The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks. ```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Tighten webhook client config validation ref kubernetes/enhancements#492 Fix up some nits left from #54889. ```release-note NONE ```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Fix webhook API to also support URLs ref: kubernetes/enhancements#492 ```release-note The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks. ``` Kubernetes-commit: e93819049db49694718bc9c96e67050d366c6f63

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Tighten webhook client config validation ref kubernetes/enhancements#492 Fix up some nits left from #54889. ```release-note NONE ``` Kubernetes-commit: 2db28383e1151e5d442b81eb73a02b3cf144615c

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Fix webhook API to also support URLs ref: kubernetes/enhancements#492 ```release-note The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks. ``` Kubernetes-commit: e93819049db49694718bc9c96e67050d366c6f63

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Tighten webhook client config validation ref kubernetes/enhancements#492 Fix up some nits left from #54889. ```release-note NONE ``` Kubernetes-commit: 2db28383e1151e5d442b81eb73a02b3cf144615c

cheftako · 2019-05-10T20:10:41Z

/assign @jpbetz

kacole2 · 2019-05-28T01:52:45Z

Hi @jpbetz caesarxuchao. Code Freeze is Thursday, May 30th 2019 @ EOD PST. All enhancements going into the release must be code-complete, including tests, and have docs PRs open.

It looks like all these are merged and this is in good shape. Let me know if there are any k/k PRs in flight.
kubernetes/kubernetes#76346
kubernetes/kubernetes#74998
kubernetes/kubernetes#74855
kubernetes/kubernetes#74154
kubernetes/kubernetes#74477
kubernetes/kubernetes#74448

If you know this will slip, please reply back and let us know. Thanks!

makoscafee · 2019-05-28T05:44:04Z

Hey, @caesarxuchao @liggitt . Deadline for submitting at least Draft/Placeholder PR by May 30th 2019 @ EOD PST. Does this enhancement require any new docs (or modifications)?

liggitt · 2019-05-30T14:38:53Z

PRs we're tracking for this feature:
kubernetes/kubernetes#78491
kubernetes/kubernetes#78080
kubernetes/kubernetes#78505

liggitt · 2019-05-31T16:02:34Z

draft docs PR for 1.15 changes at kubernetes/website#14671

liggitt · 2019-06-12T21:43:42Z

status for 1.15 is still beta, continuing improvements.

/stage beta

liggitt · 2019-07-08T13:26:01Z

/milestone v1.16
/stage stable

mariantalla · 2019-07-11T12:57:58Z

Hey @jpbetz / @liggitt / @caesarxuchao - I'm adding this to the tracked enhancements for 1.16 as expected to graduate to stable. Please let me know if I got any of this wrong.

As a reminder, 1.16 milestone dates are Enhancement Freeze 7/30 and Code Freeze 8/29.

Thanks!

simplytunde · 2019-07-29T12:58:53Z

Hey, @jpbetz @liggitt @caesarxuchao I'm the v1.16 docs release lead.

Does this enhancement (or the work planned for v1.16) require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.16) due by Friday,August 23rd. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions!

hh · 2019-07-30T22:12:05Z

There is a requirement that GA/stable APIs must have conformance tests:
See: https://github.com/kubernetes/community/pull/1806/files

I created an umbrella issue for missing conformance tests using https://apisnoop.cncf.io:
See: kubernetes/kubernetes#80767

/assign @timothysc

liggitt · 2019-08-21T13:31:37Z

1.16 WIP docs PR at kubernetes/website#15985

kacole2 · 2019-08-26T15:49:38Z

@liggitt code freeze for 1.16 is on Thursday 8/29. Are there any outstanding k/k PRs that still need to be merged for this to go Stable?

jpbetz · 2019-08-26T22:49:40Z

I believe there is just two in-progress bug fixes and then everything is ready: kubernetes/kubernetes#81399, kubernetes/kubernetes#81896

liggitt · 2019-09-19T13:25:47Z

Released as stable in v1.16.0

Post-GA work tracked in https://github.com/orgs/kubernetes/projects/32

/close

k8s-ci-robot · 2019-09-19T13:25:49Z

@liggitt: Closing this issue.

In response to this:

Released as stable in v1.16.0

Post-GA work tracked in https://github.com/orgs/kubernetes/projects/32

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot added the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Oct 23, 2017

k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Oct 23, 2017

caesarxuchao added the stage/beta Denotes an issue tracking an enhancement targeted for Beta status label Oct 23, 2017

caesarxuchao added this to the 1.9 milestone Oct 23, 2017

idvoretskyi assigned caesarxuchao Oct 24, 2017

caesarxuchao mentioned this issue Oct 27, 2017

Adding an e2e test for admission webhook kubernetes/kubernetes#54165

Merged

mbohlool mentioned this issue Nov 9, 2017

Add MutatingWebhookConfiguration type kubernetes/kubernetes#55282

Merged

cheftako mentioned this issue Nov 9, 2017

Admission response kubernetes/kubernetes#55441

Closed

lavalamp mentioned this issue Nov 11, 2017

Fix webhook API to also support URLs kubernetes/kubernetes#54889

Merged

caesarxuchao mentioned this issue Nov 12, 2017

Validation webhook plugin converts objects to the external version before sending to webhooks kubernetes/kubernetes#55127

Merged

lavalamp mentioned this issue Nov 12, 2017

Tighten webhook client config validation kubernetes/kubernetes#55534

Merged

idvoretskyi changed the title ~~Beta admission webhook~~ Admission webhook Nov 13, 2017

k8s-ci-robot assigned jpbetz May 10, 2019

liggitt mentioned this issue May 20, 2019

Convert to admission webhook-recognized versions kubernetes/kubernetes#78135

Merged

2 tasks

liggitt mentioned this issue May 31, 2019

Webhook admission 1.15 docs kubernetes/website#14671

Merged

7 tasks

liggitt added this to Required for GA, in progress in Admission Webhooks Jun 12, 2019

k8s-ci-robot added stage/beta Denotes an issue tracking an enhancement targeted for Beta status and removed stage/stable Denotes an issue tracking an enhancement targeted for Stable/GA status labels Jun 12, 2019

k8s-ci-robot added stage/stable Denotes an issue tracking an enhancement targeted for Stable/GA status and removed stage/beta Denotes an issue tracking an enhancement targeted for Beta status labels Jul 8, 2019

k8s-ci-robot modified the milestones: v1.15, v1.16 Jul 8, 2019

k8s-ci-robot assigned timothysc Jul 30, 2019

liggitt removed this from Required for GA, in progress in Admission Webhooks Jul 31, 2019

liggitt mentioned this issue Aug 21, 2019

Admission v1 docs kubernetes/website#15985

Merged

10 tasks

k8s-ci-robot closed this as completed Sep 19, 2019

kacole2 removed the tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team label Sep 19, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Admission webhook #492

Admission webhook #492

caesarxuchao commented Oct 23, 2017 •

edited by kacole2

caesarxuchao commented Oct 23, 2017

caesarxuchao commented Oct 23, 2017

caesarxuchao commented Oct 23, 2017

deads2k commented Oct 24, 2017

erictune commented Oct 24, 2017 via email

erictune commented Oct 26, 2017

cheftako commented May 10, 2019

kacole2 commented May 28, 2019

makoscafee commented May 28, 2019 •

edited

liggitt commented May 30, 2019

liggitt commented May 31, 2019

liggitt commented Jun 12, 2019

liggitt commented Jul 8, 2019

mariantalla commented Jul 11, 2019

simplytunde commented Jul 29, 2019

hh commented Jul 30, 2019

liggitt commented Aug 21, 2019

kacole2 commented Aug 26, 2019

jpbetz commented Aug 26, 2019 •

edited

liggitt commented Sep 19, 2019

k8s-ci-robot commented Sep 19, 2019

Admission webhook #492

Admission webhook #492

Comments

caesarxuchao commented Oct 23, 2017 • edited by kacole2

Feature Description

caesarxuchao commented Oct 23, 2017

caesarxuchao commented Oct 23, 2017

caesarxuchao commented Oct 23, 2017

deads2k commented Oct 24, 2017

erictune commented Oct 24, 2017 via email

erictune commented Oct 26, 2017

cheftako commented May 10, 2019

kacole2 commented May 28, 2019

makoscafee commented May 28, 2019 • edited

liggitt commented May 30, 2019

liggitt commented May 31, 2019

liggitt commented Jun 12, 2019

liggitt commented Jul 8, 2019

mariantalla commented Jul 11, 2019

simplytunde commented Jul 29, 2019

hh commented Jul 30, 2019

liggitt commented Aug 21, 2019

kacole2 commented Aug 26, 2019

jpbetz commented Aug 26, 2019 • edited

liggitt commented Sep 19, 2019

k8s-ci-robot commented Sep 19, 2019

caesarxuchao commented Oct 23, 2017 •

edited by kacole2

makoscafee commented May 28, 2019 •

edited

jpbetz commented Aug 26, 2019 •

edited