kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,549 Commits 30 Branches 1,482 Tags 31 MiB
Commit Graph

316 Commits

Author SHA1 Message Date
Davanum Srinivas fe1610f3fe switch from golang-lru to the one in k8s.io/utils 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: 79d0c6cdc10293c9bfe644ce31dc186a936579b0
 2021-07-07 13:45:07 -04:00
Dinghua Li 7edb7c1c1e Add attr to the argument list of ObserveWebhookRejection, and remove 
operation, as it is included in attr.

Kubernetes-commit: fb23e449ab680bc53fc1aae826e377c1153d51e4
 2021-05-18 17:42:02 +00:00
Xiaojun Hu f9b4d95442 add fail-open audit logs to validating and mutating admission webhook 
Kubernetes-commit: 9fe7c8955bcb1edbb5aa4fe6bfb8bb6d93d381de
 2021-05-18 13:31:03 -04:00
Steve Kuznetsov 8c01d7fe18 apiserver: wrap errors in admission with context 
When the API server encounters an error during admission webhook
handling, lower-level errors are bubbled up without any additional
context added. This leads to fairly opaque and unintelligible errors. It
is not clear to users if the API server itself is having an error (for
instance, fetching the REST client) or if the request to the webhook
failed in some way.

Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>

Kubernetes-commit: ae9e71ba68cb1dd00bb5ed2635bac9aab2abbafe
 2021-04-27 11:19:01 -07:00
lala123912 887895128f staging/src/k8s.io/apiserver/pkg/admission: migrate to structured logs 
Kubernetes-commit: 2dc8cadd00962512fa90c460b9fa86a175ca73fc
 2021-01-18 17:19:32 +08:00
yoyinzyc 4c292300d7 add context to metrics in apiserver admission webhook 
Kubernetes-commit: b3aeaa4ed7bf8d419a96b4456a97bdf4c29e4330
 2020-12-09 16:46:15 -08:00
pacoxu ee05a4663e bugfix: check Spec.AllocateLoadBalancerNodePorts for nodeport and skip zero usage in delta evaluator 
Signed-off-by: pacoxu <paco.xu@daocloud.io>

When Spec.AllocateLoadBalancerNodePorts is "false" NodePort shall
not be included when computing quota for type:LoadBalancer.

Co-authored-by: uablrek

Kubernetes-commit: 15867d9e8a1faf007f6df563c26a9b5e8744b2a1
 2020-12-22 19:19:15 +08:00
Ken Sipe 5d58b175c8 fix S1021 var declaration 
Signed-off-by: Ken Sipe <kensipe@gmail.com>

Kubernetes-commit: 6c49299739a9819c3672248517ab3d6636d1d8c6
 2020-06-25 17:10:34 -05:00
Marcio Caroso 8e88bf25dd Fix go lint on folder apimachinery/pkg/runtime/serializer/json 
Kubernetes-commit: 4b8b9c92bfc4bffe2fbaca3c5a5f731b77dc8915
 2020-11-06 20:20:57 -03:00
Andrea Nodari 618f4b129a Make the creation of namespace using POST and PATCH consistent 
PATCH verb is used when creating a namespace using server-side apply,
while POST verb is used when creating a namespace using client-side
apply.

The difference in path between the two ways to create a namespace led to
an inconsistency when calling webhooks. When server-side apply is used,
the request sent to webhooks has the field "namespace" populated with
the name of namespace being created. On the other hand, when using
client-side apply the "namespace" field is omitted.

This commit aims to make the behaviour consistent and populates the
"namespace" field when creating a namespace using POST verb (i.e.
client-side apply).

Kubernetes-commit: 3cb510e33eecbdc37aad14f121396ccfbf5268cb
 2020-09-21 12:13:12 +02:00
Haowei Cai 8622b05104 fix duplicate testcase names 
Kubernetes-commit: c3f71ad5487844e4cdd01702d4df3ac8606ca397
 2020-09-17 17:15:05 -07:00
Tim Usner db03041f4b Add more tests for LRU cache lookup 
Kubernetes-commit: cc0b86fa3c5d83ab8023f9403feee3928794f85a
 2020-08-04 14:57:45 +02:00
Tim Usner 50305ec465 Move ResourceQuota admission to k8s.io/apiserver 
Kubernetes-commit: 70d440bc7e3ec31b3f193b85f265b39d629aa3bb
 2020-07-29 10:34:39 +02:00
gongguan ada9fc3d08 extend ShouldCallHook benchmark to verify performance imporvement 
Kubernetes-commit: 850a913ea98a070e26cc62cbf95508084e8cc66b
 2020-07-28 10:09:37 +08:00
gongguan 7e3b5e44da skip mismatched webhookAccessor and object 
Kubernetes-commit: c1d78f2619b69585713597e4ffdaeef12b6c20ec
 2020-07-01 23:57:04 +08:00
Joe Betz 97937c66f2 Revert nested trace PR#88936 
Kubernetes-commit: 02cf58102a61b6d1e021e256381ff750573ce55d
 2020-07-20 09:55:05 -07:00
Joe Betz 7a467399ac Enable nested tracing, add request filter chain tracing incl. authn/authz tracing 
Kubernetes-commit: b12ac0abc64adb71d97fbde12f373b1424631f20
 2020-03-06 16:11:21 -08:00
Jordan Liggitt ff5372c83d Add warnings capability for admission webhooks 
Kubernetes-commit: 5eef60a00aeb18eda4238dbd8f6dc96930a6a05a
 2020-06-30 16:27:56 -04:00
Davanum Srinivas 5879417a28 switch over k/k to use klog v2 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: 442a69c3bdf6fe8e525b05887e57d89db1e2f3a5
 2020-04-17 15:25:06 -04:00
Mike Danese 337d7943db generated: run refactor 
Kubernetes-commit: 3aa59f7f3077642592dc8a864fcef8ba98699894
 2020-02-07 18:16:47 -08:00
Mike Danese f7c2e26715 cleanup req.Context() and ResponseWrapper 
Kubernetes-commit: 968adfa99362f733ef82f4aabb34a59dbbd6e56a
 2020-01-27 18:52:27 -08:00
Mike Danese 5737088b7f refactor 
Kubernetes-commit: d55d6175f8e2cfdab0b79aac72046a652c2eb515
 2020-01-27 18:19:44 -08:00
Jordan Liggitt b858bded65 Promote WebhookAdmissionConfiguration to v1 
Kubernetes-commit: 71fad812caf6be07be3c5eabe9fdc39c29f7b2a9
 2019-11-12 09:43:35 -05:00
David Eads 331894196f add featuregate inspection as admission plugin initializer 
Kubernetes-commit: 675c2fb924e82091f7ce4601e48daf4cc7030e72
 2019-11-05 14:28:40 -05:00
Clayton Coleman 3d42d38e70 namespace: Provide a special status cause when a namespace is terminating 
Clients should be able to identify when a namespace is being terminated and
take special action such as backing off or giving up. Add a helper for
getting the cause of an error and then add a special cause to the forbidden
error that namespace lifecycle admission returns. We can't change the forbidden
reason without potentially breaking older clients and so cause is the
appropriate tool.

Add `StatusCause` and `HasStatusCause` to the errors package to make checking
for causes simpler. Add `NamespaceTerminatingCause` to the v1 API as a constant.

Kubernetes-commit: a62c5b282fda7c0832d329cde45e5e0a836924e8
 2019-10-19 22:57:21 -04:00
Jordan Liggitt c51b9411f6 Switch admission webhook config manager to v1 
Kubernetes-commit: f247e75980061d7cf83c63c0fb1f12c7060c599f
 2019-08-01 21:57:39 -04:00
Jordan Liggitt 25bf5d3b30 Add integration test for webhook client auth 
Kubernetes-commit: e734c70e037cf1311581eb61ae3e45adaa76771b
 2019-09-02 22:37:07 -04:00
Jordan Liggitt 80b9dc503b Plumb service port, URL port to webhook client auth resolution 
Kubernetes-commit: d127042cb81cbf545332ec3124161525ef84183c
 2019-09-02 22:38:36 -04:00
Jordan Liggitt ce4eaaeeb3 Make webhook benchmarks parallel 
Kubernetes-commit: 601b7d33a9cf0b724cdabb5de81b0bf2821f0fca
 2019-08-28 13:27:38 -04:00
Haowei Cai 8d86fef522 wire up the webhook rejection metrics in webhook handlers 
Kubernetes-commit: 620f5f2c587971be50cb27bb2a2d35209b3dc058
 2019-08-28 17:32:07 -07:00
Haowei Cai e248b8b513 fix semantics of the rejected label in webhook metrics 
when error calling webhook is ignored, do not log the request as
rejected

Kubernetes-commit: f3c793512b45ea3910d5e5a379292c13b62ab64b
 2019-08-28 15:31:27 -07:00
Jordan Liggitt 58f780d1e2 Use cached selectors/client for webhooks 
Kubernetes-commit: 8c10d929cac13dc50ca4ffaca83e7ae5c8e41292
 2019-08-24 17:12:14 -04:00
Jordan Liggitt b7340127c3 Add admission benchmarks 
go test ./vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/validating -bench . -benchmem -run DoNotRun
go test ./vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating -bench . -benchmem -run DoNotRun

Kubernetes-commit: 27f535e26ad88fa30d5c0fcde4bc31897b9d521c
 2019-08-24 17:40:07 -04:00
Jordan Liggitt eb2a4467ba Let webhook accessors construct client/selectors once 
Kubernetes-commit: 14154c2345e7e467be0ff003c61cec9c0bd2be3e
 2019-08-20 17:16:21 -04:00
Haowei Cai db2bae4d84 tests 
Kubernetes-commit: d35757c653893279df566985c3368f0277fe7c02
 2019-05-31 16:22:55 -07:00
Haowei Cai f4a47ec53f mutating webhook: audit log mutation existence and actual patch 
Kubernetes-commit: 7784353a69932a4e7b4dde55b78828abf5fa4ee6
 2019-05-31 16:22:30 -07:00
Haowei Cai 70c200c6a0 audit & admission: associate annotation with audit level 
Kubernetes-commit: 318226f3403f56aaf796af3f439c13674aa2b7ab
 2019-05-31 15:36:29 -07:00
Jordan Liggitt 71ef46fa12 Use lesser of context or webhook-specific timeout in webhooks 
Kubernetes-commit: c63284b1f3996e7830c1aca85281d349d0091c82
 2019-08-19 11:23:05 -04:00
Jordan Liggitt 0c706a033c Plumb context to admission Admit/Validate 
Kubernetes-commit: 61774cd7176cae0c0324d23ab20e6c6b3038153f
 2019-08-19 10:48:08 -04:00
Joe Betz f103fcda51 Replace string concatination with trace fields 
Kubernetes-commit: 46a04d50af78e01d06a9879d62cc71fbe892076f
 2019-08-02 23:47:24 -07:00
Joe Betz 81b56d7030 Add trace to webhook invocations 
Kubernetes-commit: 31799ebe88534272d45c2a33396e343a5083c773
 2019-05-31 16:50:54 -07:00
Jordan Liggitt 90d670a108 AdmissionReview: Allow webhook admission to dispatch v1 or v1beta1 
Kubernetes-commit: dda9bcb082be058c30c83d45e757edbaac8dc65f
 2019-07-12 08:44:24 -04:00
Chao Xu 65ba1e64bc Adding test cases to make sure objectSelector works for CRD 
Kubernetes-commit: 58fa71d1ed375876a86fe5961ad5a87a0eb23fa2
 2019-05-31 10:12:42 -07:00
Joe Betz 32d3c876b0 Flake fix: poll for webhook registration to complete in reinvocation integration tests 
Kubernetes-commit: e51320f69d92e4d08bc25eec5a4b7a58d23184ab
 2019-06-04 14:19:26 -07:00
Chao Xu ec622aa8bd minor changes, propagating interface changes 
Kubernetes-commit: 7738c7ee8fbbaa79aed2ca221141a6b3b4f826be
 2019-05-29 17:20:43 -07:00
Chao Xu 8658264258 object matcher 
Kubernetes-commit: 6cf499db6c1dd464c6072706106dec6c5284dff7
 2019-05-29 15:56:52 -07:00
Joe Betz b22ec2bd98 Add mutating admission webhook reinvocation 
Kubernetes-commit: 95fa928ecb636e8d16af31ab613678c555fc76a3
 2019-05-29 22:31:26 -07:00
Joe Betz b2b1ef14ec split admissionregistration.v1beta1/Webhook into MutatingWebhook and ValidatingWebhook 
Kubernetes-commit: 55ecc45455f191c404e355097bf1beae9c42f895
 2019-05-29 21:30:45 -07:00
Jordan Liggitt 0e6c33d9b7 Consider equivalent resources when calling webhook 
Kubernetes-commit: f2abdcf43f5e0435824104fe6f1af9fb3871d455
 2019-05-20 14:36:19 -04:00
Jordan Liggitt d555b9c5d2 Move object conversion to webhook dispatch point 
convert versionedattrs as needed

Allow per-webhook kind/version

Kubernetes-commit: fc495f457f8b7c58d062d12b03a96abd0879e4d2
 2019-05-20 12:10:49 -04:00
Jordan Liggitt 054e44a286 make ObjectInterfaces impl generic 
Kubernetes-commit: 9071d21e3b1989ffeee4f533406e4fef6bf32aa8
 2019-05-13 11:22:11 -04:00
Jordan Liggitt afec0f3efa Skip namespace selector evaluation for 'select all' selectors 
Kubernetes-commit: e068a98f4fed7ad1fa92acc00c5d3210acd29675
 2019-05-20 17:45:34 -04:00
Joe Betz f384b59525 Update tests for: Pass {Operation}Option to Webhooks 
Kubernetes-commit: 900d652a9ac11e53293950b3d191295c21430215
 2019-05-07 13:37:07 -07:00
Joe Betz 19327df6d5 Pass {Operation}Option to Webhooks 
Kubernetes-commit: 140c8c73a64deb102b528109138ca9fb7dbb2392
 2019-05-07 13:34:18 -07:00
Jordan Liggitt 7c5dd5a07b Ensure 4xx+ response codes from webhook rejections 
Kubernetes-commit: 50076439fccb4ed6cf7b59f6f4add279ee7751aa
 2019-04-24 15:27:19 -04:00
zhouhaibing089 5ba3621283 webhook: respect the status error from webhook 
today, apiserver generates an internal server error for any call
to mutatingwebhook if it gives allowed=false. this is not right as
it is really not an intenal error, it can be a forbidden as well
if the webhook wants it to be.

Kubernetes-commit: c2fcdc818be1441dd788cae22648c04b1650d3af
 2019-01-09 14:28:33 -08:00
Mehdy Bohlool 6c13576bf2 Add port to ServiceResolvers 
Kubernetes-commit: 11f37d757fc0b710245446c80a8c9578ce2c02f1
 2019-03-01 16:32:50 -08:00
Mehdy Bohlool 81939cee8f Add AdmissionReviewVersions to admissionregistration and default it 
Kubernetes-commit: f7dff4725f8dc694a852e7fdbdde2c8a6dd5b7d4
 2019-03-04 20:52:57 -08:00
Jordan Liggitt e63ca1e6d5 Add scope restrictions to webhook admission rules 
Kubernetes-commit: 0797d812220be9b76716d366f13215b94b70bf5d
 2019-02-24 15:18:05 -05:00
Haowei Cai 30a9fb6e25 honor timeout when dispatch 
Kubernetes-commit: e1e9ee53113413a1038a3f12c87acc61baaf726b
 2019-02-26 14:42:55 -08:00
Jordan Liggitt 3f0755b631 Explicitly set GVK when sending objects to webhooks 
Kubernetes-commit: e752a48a3012e43e4471cce0412cd9beadd3be57
 2019-02-23 00:19:47 -05:00
Mehdy Bohlool 0fbb46dc25 Remove the propagated scheme from the Admission chain 
Kubernetes-commit: cebb4ee2ac9e19fe90f78c3285978e585e67a3ac
 2019-02-16 13:28:14 -08:00
Mehdy Bohlool 792921debf Mechanical changes due to signature change for Admit and Validate functions 
Kubernetes-commit: d08bc3774dfd93ba9fa389062900a5ffb25768d6
 2019-02-16 00:44:29 -08:00
Mehdy Bohlool 87b5ac0c06 Add ObjectInterfaces to Admission and Validation 
Kubernetes-commit: 513a87c7b25aa58f84fafe0dc170cee4c76e481b
 2019-02-16 12:27:24 -08:00
danielqsj 8f8d23605e fix shellcheck in k8s.io/apiserver 
Kubernetes-commit: 481c2d8e03508dba2c28aeb4bba48ce48904183b
 2019-01-24 13:55:09 +08:00
Jordan Liggitt 123cf8011f Remove alpha InitializerConfiguration types, Initializers admission plugin 
Kubernetes-commit: dc1fa870bff65c20f48a83ea3af54adb3f526e28
 2019-01-16 10:19:44 -05:00
Jordan Liggitt d294e6b5b4 Update non-test code to use DefaultMutableFeatureGate 
Kubernetes-commit: d440ecdd3b41a4fc4a207195e1bb976422d6d35e
 2018-11-20 23:59:52 -05:00
Davanum Srinivas 2710b17b80 Move from glog to klog 
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135

Kubernetes-commit: 954996e231074dc7429f7be1256a579bedd8344c
 2018-11-09 13:49:10 -05:00
Mehdy Bohlool 26065df432 CRD Conversion 
Kubernetes-commit: e2ca575d0f40d94578c7c0babce543ab5199d2d0
 2018-11-09 14:55:06 -08:00
tanshanshan 8d99f185d1 fix some golint in staging/src/k8s.io/apiserver/pkg/admission/plugin/ 
Kubernetes-commit: 3de8767dc6ca8d47d29f99c2956a5fcf54df84d9
 2018-09-26 14:30:50 +08:00
Jingyi Hu 90f716757e *: Remove comment tags in GoDoc 
Adding blank line between comment tag and package name in doc.go. So
that the comment tags such as '+k8s:deepcopy-gen=package' do not show up
in GoDoc.

Kubernetes-commit: 61117761cd4a1b2e6ad9ff2d7eb915f3d2739dc6
 2018-09-04 14:08:32 -07:00
fengzixu 0e8a1a0c6e Modification: revise some errors about golint in some packages 
1. pkg/client
2. staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testing

Related to: https://github.com/kubernetes/kubernetes/issues/68026

Kubernetes-commit: 1fbb8b20e20616e1a1e957c01b1bb595c7703433
 2018-08-31 13:22:25 +08:00
Mehdy Bohlool 21f6e2bcdd Refactor addmission webhook hook client to a util package 
Kubernetes-commit: 5652d5cffadcd8a2f107b6aecf5fc06c0fc473f1
 2018-08-26 23:20:23 +10:00
jennybuckley 817f61120c Support dry run in admission webhooks 
Kubernetes-commit: 2d0ec48f9beea6182a9a3bfdcc5eb98e50b44f77
 2018-08-21 16:06:27 -07:00
Cao Shufeng 9ee094cdf2 support annotations for admission webhook 
Kubernetes-commit: 0ebfc3e07866494049f44cd008e5cbfe4d81d4af
 2018-07-31 13:25:53 +08:00
jennybuckley fef02d6bec Add test cases for webhook dry run 
Kubernetes-commit: 3a506be626398f927049c3ce735fd29ac0efd5f1
 2018-08-07 14:59:29 -07:00
jennybuckley 53e7058d7c Fix typo in webhook dry-run check 
Kubernetes-commit: aa36dc94cd7a2e538ad5e6ef8999fbbe9dc0df78
 2018-08-07 14:37:24 -07:00
jennybuckley dc1d8e7050 block dry run if a webhook would be called 
Kubernetes-commit: e4c219df42c77ecb8f0588197072bef81bca7429
 2018-08-07 09:27:18 -07:00
jennybuckley 91278157f6 Support dry run in admission plugins 
Kubernetes-commit: adafb1365e2b9f6c422c437e916e22a4fe1c2e3a
 2018-08-06 10:37:44 -07:00
Cao Shufeng 0511e4e41d fix a TODO in ValidatingAdmissionWebhook 
Kubernetes-commit: 162499515c0813f579770091dc30925207d063b2
 2018-06-04 14:55:46 +08:00
Jordan Liggitt a1b44cc72f Do not attempt to convert nil object during DELETE webhook admission 
Kubernetes-commit: aad0e2e15f789fc3768d6e5607b86e8b824b3917
 2018-07-20 00:15:49 -04:00
Clayton Coleman 7694cbf962 generated: Avoid use of reflect.Call in conversion code paths 
Kubernetes-commit: ef561ba8b58a4427a51b2b5dbb9ad633e45f04a7
 2018-07-03 16:17:14 -04:00
Mikhail Mazurskiy 0f7bbcadfb Add missing error handling in schema-related code 
Kubernetes-commit: bfe313d5f351dfae086a85a97e7103183173e5b5
 2018-06-03 14:59:58 +10:00
Dmitry Rozhkov d51f943047 fix field removal in mutating admission webhooks 
A mutating admission controller webhook doesn't remove object fields
when instructed to.

E.g. when the JSON patch

  [
    {"op": "remove", "path": "/spec/containers/0/resources/limits/fpga-arria10"},
    {"op": "add", "path": "/spec/containers/0/resources/limits/fpga-interface-id-524abcf", "value": 1}
  ]

is applied to this pod

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  restartPolicy: Never
  containers:
    -
      name: test-pod-container
      image: ubuntu:bionic
      imagePullPolicy: IfNotPresent
      command: [ "ls", "-l", "/" ]
      resources:
        limits:
          fpga-arria10: 1

in order to replace the resource name "fpga-arria10" with something understandable
by the device plugin the resulting pod spec still contains the old field plus
a new one. The resulting pod looks like

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  restartPolicy: Never
  containers:
    -
      name: test-pod-container
      image: ubuntu:bionic
      imagePullPolicy: IfNotPresent
      command: [ "ls", "-l", "/" ]
      resources:
        limits:
          fpga-arria10: 1
          fpga-interface-id-524abcf: 1

The patch unmarshals patched JSON into a new empty object instead of
existing one. Otherwise JSON unmarshaling reuses existing maps, keeping
existing entries as specified in the "encoding/json" standard package.

Kubernetes-commit: 4a72e17bd227b79ed89981735691af3601043bf9
 2018-05-23 16:57:54 +03:00
Mikhail Mazurskiy 5b356b15a2 Use Dial with context 
Kubernetes-commit: 5e8e570dbda6ed89af9bc2e0a05e3d94bfdfcb61
 2018-05-19 08:14:37 +10:00
David Eads c41d1d0993 simplify api registration 
Kubernetes-commit: c5445d3c56e06ab366b9cca34bd69c5cc386ec47
 2018-05-07 08:32:20 -04:00
Matthias Bertschy 0203b2aa93 Update all script to use /usr/bin/env bash in shebang 
Kubernetes-commit: 9b15af19b22e91284eeb89827b2091caaec25bf6
 2018-04-16 18:31:44 +02:00
David Eads 88d943c0e6 eliminate indirection from type registration 
Kubernetes-commit: e7fbbe0e3c91f34836b999e695aa133503cfdae5
 2018-04-24 08:21:23 -04:00
Jordan Liggitt 62408eb418 Honor existing CA bundle and TLS server name in webhook client 
Kubernetes-commit: 54c883f27bdb9ac1bd6602e34643296644e574f7
 2018-04-17 01:01:30 -04:00
Dr. Stefan Schimanski 584fe98b64 admission/webhook: fix panic from empty response in mutating webhooks 
Kubernetes-commit: 10969e1b8dcb89cc97d591df63be7464cefb454b
 2018-02-12 14:58:57 +01:00
Dr. Stefan Schimanski 378bb80fc8 admission/webhook: refactor to webhook = generic-webhook + source + dispatcher 
- unify test cases
- remove broken VersionedAttributes override abstraction

  This overriding had no effect. The versioned.Attributes were never
  used as admission.Attributes.Better make the versioned objects
  explicit than hiding them under a wrong abstraction.
- remove wrapping of scheme.Convert
- internalize conversion package

Kubernetes-commit: 72f8a369d021037ca6179339d50ad595b5462a6c
 2018-01-16 10:37:41 +01:00
fisherxu 716af975eb regenerated all files and remove all YEAR fields 
Kubernetes-commit: b49ef6531c11f1c834e0d7591f5c965f6193c711
 2018-01-22 20:37:53 +08:00
Kubernetes Publisher 627fa76a8b sync: initially remove files BUILD */BUILD BUILD.bazel */BUILD.bazel 2018-03-15 09:38:17 +00:00
Chao Xu f86f44d94d Make admission webhooks work in custom apiservers. 
Created a scheme that only understands admission/v1beta1 and use it to
encode/decode admissionReviews.

Also made the NegotiationSerializer setup static

Kubernetes-commit: 3ab516035d17c2b2798797eb8ee85522ccbc051e
 2018-03-09 11:25:34 -08:00
jennybuckley c28dea8a20 Make admission webhooks not ignore scheme 
Kubernetes-commit: 7d5696eb6d98a0ce76e4fe18c3e37aec05060b46
 2018-03-08 11:35:13 -08:00
jennybuckley 89e1aa5933 Prevent webhooks from affecting admission requests for webhooks 
Kubernetes-commit: 58b43ad27d00191cf5291d8508dc346f1924b785
 2018-03-05 16:35:52 -08:00
jennybuckley 9fa0aca343 Run hack/update-all.sh 
Kubernetes-commit: c8dacd8e631f59ef158c79156d77a99fd2a632cc
 2018-02-26 17:16:14 -08:00
Jeff Grafton 1ab12b2dc8 Autogenerated: hack/update-bazel.sh 
Kubernetes-commit: ef56a8d6bb3800ab7803713eafc4191e8202ad6e
 2018-02-16 13:43:01 -08:00
hzxuzhonghu 9535cc877f run update bazel staging-dep 
Kubernetes-commit: ea7a71301009fb3e0426ea93f070c27538e59f86
 2017-11-29 23:28:53 +08:00
hzxuzhonghu 3dc2191ae3 add wait ready for mutating/validating webhook configuration 
Kubernetes-commit: ec3925978511cc6b844c5b479c9b30ae21a0136a
 2017-12-06 11:06:04 +08:00
hzxuzhonghu 3661bfee32 admission registration use shared informer instead of poll 
Kubernetes-commit: f2875274423dac61293069f79eddf1c397e7376a
 2017-11-29 23:12:19 +08:00
halfcrazy 6f8c3a80da fix typo in package apiserver 
Kubernetes-commit: 0da91a8577ddfdeaff985cbb6c0da69d5a2ffc81
 2018-02-01 03:04:33 +08:00
Yang Guo 3db227c747 Split ClientConfigFor() 
Kubernetes-commit: 05fbc22064b0502e3f66a60c82a34302850dcb41
 2018-01-25 21:31:02 -08:00
Yang Guo 907f1ed78c Use SSH tunnel for webhook communication iff the webhook is deployed as a service 
Kubernetes-commit: 454276c23ce39f261564e9cbebe0df8adab14a6d
 2018-01-22 16:18:34 -08:00
Chao Xu fcee784ffb Never let cluster-scoped resources skip webhooks 
Kubernetes-commit: 0d717272ccbec12189946325594a8a5f29d6bd68
 2018-01-11 18:05:54 -08:00
Cao Shufeng 2a2505e824 remove duplicated import 
Kubernetes-commit: 4e7398b67b12390486012dd6f9d708dd64f961f3
 2018-01-11 19:15:11 +08:00
Cao Shufeng f193a275c6 remove invalid and useless functions from unit test 
Kubernetes-commit: eb1650ce567e0bf19f310817502a7a4fe3049a11
 2018-01-12 17:22:33 +08:00
Dr. Stefan Schimanski 574b95f04b admission: do not leak admission config types outside of the plugins 
Kubernetes-commit: 1a552bbe149373c056ee004304d7e5abaa89f4c6
 2017-11-27 14:44:04 +01:00
Chao Xu 0055602f99 fix a typo 
Kubernetes-commit: 9d1b687914226514992d9f47c639847930d315b2
 2018-01-11 18:24:24 -08:00
Chao Xu b0adab5a27 Let mutating webhook defaults the object after applying the patch sent back by the webhook 
Kubernetes-commit: 5029bb56c434c0099fd1d2e78de7531c69430753
 2018-01-09 15:58:18 -08:00
Christoph Blecker e0f0630269 Regenerate all generated code 
Kubernetes-commit: 80e344644e2b6222296f2f03551a8d0273c7cbce
 2018-01-02 00:21:07 -08:00
Jeff Grafton c8a97ee31a Autogenerate BUILD files 
Kubernetes-commit: efee0704c60a2ee3049268a41535aaee7f661f6c
 2017-12-23 13:06:26 -08:00
hzxuzhonghu d14a5efcb8 remove dead code in lifecycle admission 
Kubernetes-commit: 22398f8d3c0d71db5869eace174f5721f8499224
 2017-12-05 19:40:31 +08:00
David Eads 6d575ed0c4 require webhook admission kubeconfigfile to be absolute 
Kubernetes-commit: 7e6ce2a04ce8ede20e3bdbcb8a5680a8e54c47a2
 2017-11-22 08:17:47 -05:00
Kubernetes Submit Queue e16244b0bc Merge pull request #55812 from deads2k/admission-17-external 
Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make versioned types for webhook admission config

Versioned webhook admission config type as promised in https://github.com/kubernetes/kubernetes/pull/54414.

@kubernetes/sig-api-machinery-pr-reviews
@ericchiang as promised.  fyi.

```yaml
kind: AdmissionConfiguration
apiVersion: apiserver.k8s.io/v1alpha1
plugins:
- name: GenericAdmissionWebhook
  configuration:
    kind: WebhookAdmission
    apiVersion: apiserver.config.k8s.io/v1alpha1
    kubeConfigFile: /path/to/my/file
```

`ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh`

Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec
 2017-12-07 04:34:43 +00:00
Chao Xu 98e2d6d11f remove reference to v1alpha1 
Kubernetes-commit: 7945ae68d0c7cffb070d60ad4d8bfe6ef585c279
 2017-11-19 13:54:50 -08:00
Dr. Stefan Schimanski 2ee052ccdf admission: make metrics compositional and move to metrics sub-package 
Kubernetes-commit: baba0c827bfddfdc56b69c88e19406966ef900a2
 2017-11-17 11:49:55 +01:00
Chao Xu 86dc6e7b4e Update the validating webhook plugin to be a ValidatingInterface, rather than a MutatingInterface 
Kubernetes-commit: cbfc9d33b7c6b9e767e4259910f783c047e83583
 2017-11-20 14:57:07 -08:00
Dr. Stefan Schimanski 45dc4adcc3 admission/webhook: move webhook initializer into plugin 
Kubernetes-commit: e19257f2ec87d8091defb7935bb3a161fbb229d0
 2017-11-15 13:00:24 +01:00
Chao Xu 8a572a63d4 Rename GenericAdmissionWebhook to ValidatingAdmissionWebhook 
Kubernetes-commit: d3c0765780fed5576670d6624cc3cc8d691d6392
 2017-11-17 21:05:11 -08:00
Chao Xu ed64135818 Rename the testdata package to testcerts. 
`godep save` somehow fails if there is a testdata go package. See
https://github.com/kubernetes/kubernetes/pull/54892#issuecomment-345035489

Kubernetes-commit: 2052a7e2a3483e341a5a8d1fc5ae8510dd32b2c6
 2017-11-17 13:24:48 -08:00
Chao Xu 1b638a5be7 generated bazel 
Kubernetes-commit: 6193360eb52b00727df08f67eb8fc364a8df85e9
 2017-11-15 16:21:28 -08:00
Chao Xu cb8d15718f Adding the mutating webhook 
Kubernetes-commit: ea123f82aae5bc46b9a91c4543c8f742d0db52da
 2017-11-14 16:36:28 -08:00
cheftako 556a83dbf9 Admission request/response handling 
AdmissionResponse allows mutating webhook to send apiserver a json patch
to mutate the object.
This reflects the imperative nature of AdmissionReview. It adds
AdmissionRequest and AdmissionResponse in place of status/spec.
The AdmissionResponse the allows the mutating webhook
to send back a json path with the mutated version of the requested
object.
Fixed the integration test to clean up properly.
Switched test image to 1.8v5 to reflect API changes.
Make sure to cache test framework client for cleaup test code.
Switched to pointer for patch type.
Factored in @liggitt's feedback.
Factored in @lavalamp's feedback.

Kubernetes-commit: dac3c2e168784bbcf1cbfef8bf5430101e191715
 2017-11-06 15:41:26 -08:00
Chao Xu 0159c24faf generated bazel 
Kubernetes-commit: 47ef9aaf2297829998eb1a0a804de9209c1008f1
 2017-11-14 16:29:23 -08:00
Chao Xu da1d210644 Reorganize the code in webhook admission plugin. 
Move the namespace selector code to package webhook/namespace
Move the conversion related code to package to webhook/versioned
Move errors related code to package webhook/errors
Move admission review related code to package webhook/request

Kubernetes-commit: 51774697b35314b078270e9da24fbe0ff843b981
 2017-11-14 15:20:45 -08:00
Chao Xu f88f0f12a1 Reorganize the admission webhook code. 
Moved client and kubeconfig related code to webhook/config;
Moved the rule matcher to webhook/rules;
Left TODOs saying we are going to move some other common utilities;
Other code is moved to webhook/validation.

Kubernetes-commit: 1adfacc7eb41da109e970a9c2985fd55b4cbbdfd
 2017-11-05 18:11:47 -08:00
Joe Betz 5f443f1654 Align admission metric names with prometheus guidelines 
Kubernetes-commit: 369fd81ca151fe2ccb1ac0e6d44aad0eee99abf1
 2017-11-14 11:18:31 -08:00
Joe Betz a1e35e7bfe Add system namespaces to admission metrics. Add tests and leverage test code from PR#55086 
Kubernetes-commit: 9d13d1baece20fc611176aad3b6f39ccf9fa4b36
 2017-11-06 17:48:59 -08:00
Joe Betz f2028cc5a5 Add admission metrics 
Kubernetes-commit: 3940e4f0533a7ee8e50ec939cdcb44c33d4a0ae9
 2017-11-06 14:14:33 -08:00
Chao Xu 9dda7d3efb let validation webhook convert objects to the external version before sending them 
Kubernetes-commit: ab053a224d27aa48ea4b34ba7591cfd72c3f567d
 2017-11-03 16:49:56 -07:00
Daniel Smith bee24b37a5 fix docs and validation 
Kubernetes-commit: e73fd8784484235d5010f4b2bba2251a584c5dd0
 2017-11-11 18:00:32 -08:00
Daniel Smith 51c2612984 Add URL beside service 
Kubernetes-commit: a0cb2ce697c195d22daeef4fbe6545bdaba11e2f
 2017-10-31 16:28:06 -07:00
Chao Xu 640cf74d8c generated 
Kubernetes-commit: 2f83748068e45fd548b1caaac2cc0ca06a769653
 2017-11-10 11:06:07 -08:00
Chao Xu 512274139c add NamespaceSelector to the api 
business logic in webhook plugin and unit test

add a e2e test for namespace selector

Kubernetes-commit: 7006d224bebb5a1aee9c70387a8584e0a0e8b10f
 2017-10-27 14:42:09 -07:00
hzxuzhonghu 69a65358c5 update bazel 
Kubernetes-commit: b845e26983741c5d12e621604b5e064e03d4fed1
 2017-11-03 10:06:07 +08:00
hzxuzhonghu 45d6a78b3f cache admission webhook restClient 
Kubernetes-commit: 42d9153a03e971453ccf8e46e149a20a9ff3d656
 2017-10-31 19:08:29 +08:00
hzxuzhonghu c37db061da remove redundant code in admission initializer 
Kubernetes-commit: 9d1e6d3e2cc25db8e07db446d00390059c8264f8
 2017-11-08 10:54:06 +08:00
mbohlool 3846cb803e Rename ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration 
Kubernetes-commit: 9ddea83a2ce0937cf0fc8f8c35614bb18e74cfad
 2017-11-07 12:46:54 -08:00
Dr. Stefan Schimanski d10f10b8ac pkg/apis/core: mechanical import fixes in dependencies 
Kubernetes-commit: 012b085ac870d359131f4251213bf2fff1d15aa0
 2017-11-08 23:34:54 +01:00
supereagle 80475e014f use versiond group clients from client-go 
Kubernetes-commit: b694d518428ac655780d812f7dd4cf72d3e24763
 2017-07-28 15:54:13 +08:00
Mike Danese 06a5d25846 move authorizers over to new interface 
Kubernetes-commit: 12125455d84c75562e6dd6a183762549adff747f
 2017-09-29 14:21:40 -07:00
Janet Kuo 201480baa2 Add hook information when rejecting a request 
Kubernetes-commit: 948bd7bbc18b343161120b365c089528f8fc0550
 2017-10-27 14:59:54 -07:00
Dr. Stefan Schimanski 45afa13373 admission: rename Validate{ -> Initialization}, Validat{ingAdmit -> e} 
Kubernetes-commit: aedcf681b32618be3cf9ad40eeb039f1bb26c5ae
 2017-10-27 17:09:39 +02:00
Dr. Stefan Schimanski 3eeded3a29 admission: wire create+update validation func into kube registries 
Kubernetes-commit: 2452afffe09e1ced9487e5a701beb1443a92b741
 2017-10-24 15:33:28 +02:00
Dr. Stefan Schimanski 777cf3c0ef admission: unify plugin constructors 
Kubernetes-commit: 131905cdb8b929f7c15f810e02ec9a45b306b769
 2017-10-30 14:20:40 +01:00
hzxuzhonghu 749c4d2360 fix import warning 
Kubernetes-commit: fcf4a0e191449925148783517cfe7ade234a2510
 2017-10-30 10:16:13 +08:00
Chao Xu 7d5fb56d23 Add a e2e test for the admission webhook 
Kubernetes-commit: 88cb71c421e4db6c15b9ec9f4c605c8779b15a33
 2017-10-13 14:37:37 -07:00
Chao Xu 3843f2885c remove the nesting directory webhook/webhook 
Kubernetes-commit: ca8131877ad4fcab76388360e04ff9eb05af41a4
 2017-10-26 14:19:49 -07:00
Kevin 41430fda7c use core client with explicit version globally 
Kubernetes-commit: 4c8539cece2f0a6e6974b30d00c7341e10320bc5
 2017-10-25 23:54:32 +08:00
David Eads 3cb246ace6 move webhook admission to generic apiserver 
Kubernetes-commit: 8c1fe1f61a1de754a2cfed1966f4a1f8024ca618
 2017-10-24 08:48:05 -04:00
David Eads d3f753a815 update admission webhook to accept client config 
Kubernetes-commit: 0859798e8e278ec382dcbeb77914f40bf2c78a2c
 2017-10-18 12:57:59 -04:00
Jeff Grafton f4dbe23125 update BUILD files 
Kubernetes-commit: aee5f457dbfd70c2d15c33e392dce6a3ca710116
 2017-10-12 13:52:10 -07:00
p0lyn0mial 136304ddb2 removes k8s.io/kubernetes/pkg/api dependency from the webhook plugin. 
Kubernetes-commit: fa96700b76de3df759b3dddb747da575c909acec
 2017-10-09 22:15:25 +02:00
Chao Xu 9074f20eb7 generated 
Kubernetes-commit: bbac32c299eb0660e89870a7fbc698c79af04b51
 2017-10-04 17:27:09 -07:00
Chao Xu 9696b0c05e move initializer to the generic apiserver 
move k8s.io/kubernetes/plugin/pkg/admission/initialization to
k8s.io/apiserver/pkg/admission/plugin/initialization/initialization.go;
move k8s.io/kubernetes/pkg/kubeapiserver/admission/configuration to
k8s.io/apiserver/pkg/admission/configuration.

Kubernetes-commit: 89a0511fcb22caf23427587c026952b2a387f293
 2017-10-04 16:54:08 -07:00
p0lyn0mial 941c87ca76 moved admission interfaces WantsClientCert, WantsAuthorizer and WantsExternalKubeClientSet to apiserver 
Kubernetes-commit: 475493ced69f47dd78d72ff98bf2c5853fc5ea19
 2017-09-27 22:05:34 +02:00
Jeff Grafton 6c539a43c6 Use buildozer to delete licenses() rules except under third_party/ 
Kubernetes-commit: a7f49c906df816123e7d4ccbd4cebab411519465
 2017-08-29 13:15:24 +00:00
Jeff Grafton 6caa2933ae Use buildozer to remove deprecated automanaged tags 
Kubernetes-commit: 33276f06be5e872bf53ca62a095fcf0a6b6c11a8
 2017-08-29 13:15:24 +00:00
Jeff Grafton 44942b068a Run hack/update-bazel.sh to generate BUILD files 
Kubernetes-commit: 3579017b865ddbc5449d6bba87346f086e4b93ff
 2017-08-29 13:13:51 +00:00
Cao Shufeng 157dcc8988 fix NamespaceLifecycle admission 
forceLiveLookupCache is designed to save recently deleted namespaces.
But currently, cluster scoped resources are also put into it.
For example, when we run:
kubectl delete clusterrole edit
The "edit" is put into forceLiveLookupCache as a deleted namespace.
This change fix the invalid action.

Kubernetes-commit: a8693b63b910d02397eb4a27873cd7da08242a14
 2017-07-28 13:56:11 +00:00
Jordan Liggitt 4c5bbed295 Never prevent deletion of resources as part of namespace lifecycle 
Kubernetes-commit: 95bf4983dec5909c536d6d602b4cf7a9b5c78c99
 2017-07-19 03:49:08 +00:00
Chao Xu 8be42ee0d0 run hack/update-all 
Kubernetes-commit: 60604f8818aecbc9c3736fbc32747cc0a535bc80
 2017-06-28 00:14:31 +00:00
Chao Xu 81b7aaaa7d run root-rewrite-import-client-go-api-types 
Kubernetes-commit: f2d3220a11111f86b2f481e70e3c1ca4f5896f44
 2017-06-28 00:14:31 +00:00
p0lyn0mial 42d367c84c register all generic admission plugins when AdmissionOptions are created. 
lifecycle plugin: make use of the libraries under k8s.io/client-go/pkg/api and k8s.io/client-go/kubernetes
for the client libraries instead of k8s.io/kubernetes/client/*

move registration to AdmissionOptions

Kubernetes-commit: 77eb2f39500f1fcf66899ea557791e7bca851449
 2017-06-13 20:47:29 +00:00
p0lyn0mial d3a026ac63 move namespace lifecycle plugin to apiserver 
Kubernetes-commit: 1a5da9afc804eed6630caa1a17540d1a171b211a
 2017-06-13 20:47:29 +00:00