update admission webhook to handle multiple auth domains #54414

deads2k · 2017-10-23T13:36:44Z

Adds some wiring to have the admission plugin accept a config file for per-apiserver configuration.

@kubernetes/sig-auth-api-reviews @deads2k @ericchiang @liggitt in particular
@kubernetes/sig-api-machinery-pr-reviews @lavalamp @caesarxuchao @sttts @cheftako

generic webhook admission now takes a config file which describes how to authenticate to webhook servers

k8s-ci-robot · 2017-10-23T13:36:45Z

@deads2k: Adding do-not-merge/release-note-label-needed because the release note process has not been followed.

One of the following labels is required "release-note", "release-note-action-required", or "release-note-none".
Please see: https://github.com/kubernetes/community/blob/master/contributors/devel/pull-requests.md#write-release-notes-if-needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

liggitt · 2017-10-23T15:10:57Z

plugin/pkg/admission/webhook/admission.go

+		if err != nil {
+			return nil, err
+		}
+		kubeconfigFile = config.AdmissionWebhookConfig.KubeConfigFile


shouldn't need the extra layer of nesting... I thought the configFile reader you got here was just the config for this admission plugin

shouldn't need the extra layer of nesting... I thought the configFile reader you got here was just the config for this admission plugin

I followed the pattern from the ImagePolicyWebhook. I agree and I'll fix up the TODO about creating a versioned type, but adding types drowns out content. How about we make ourselves consistent with other webhooks and I promise to create a versioned config in the next 24 hours?

shouldn't need the extra layer of nesting... I thought the configFile reader you got here was just the config for this admission plugin

I'll remove the layering here and do versioned types in a close followup.

liggitt · 2017-10-23T15:14:03Z

plugin/pkg/admission/webhook/authentication.go

+	// star prefixed match
+	serverSteps := strings.Split(server, ".")
+	for i := 1; i < len(serverSteps); i++ {
+		nickName := "*." + strings.Join(serverSteps[i:], ".")


does this try *.svc? that's a little weird

does this try *.svc? that's a little weird

It does, but it doesn't make anyone use it. Doing it like this makes the matching rules consistent and predictable for users. The requirement to be a .svc is artificial and I'd rather not have a file format that precludes supporting other possible use-cases.

I don't think that ever makes it behave incorrectly.

liggitt · 2017-10-23T15:14:34Z

plugin/pkg/admission/webhook/authentication.go

+
+	// if we're trying to hit the kube-apiserver and there wasn't an explicit config, use the in-cluster config
+	if server == "kubernetes.default.svc" {
+		return rest.InClusterConfig()


if this returns an error we should continue

if this returns an error we should continue

True. Will fix.

liggitt · 2017-10-23T15:14:57Z

plugin/pkg/admission/webhook/authentication.go

+	if authConfig, ok := c.kubeconfig.AuthInfos["*"]; ok {
+		return restConfigFromKubeconfig(authConfig)
+	}
+


fall back to current-context.user if present before anonymous

fall back to current-context.user if present before anonymous

ok.

deads2k · 2017-10-23T15:26:51Z

Comments addressed.

ericchiang · 2017-10-23T19:43:18Z

Works for me. Please follow up with caching for the restclient construction and API types for the config.

lavalamp · 2017-10-23T19:44:45Z

Please don't merge this until we're all agreed. I am not convinced that this is the best option yet.

lavalamp · 2017-10-24T20:42:04Z

plugin/pkg/admission/webhook/admission.go

@@ -266,16 +279,21 @@ func (a *GenericAdmissionWebhook) callHook(ctx context.Context, h *v1alpha1.Exte
 }

 func (a *GenericAdmissionWebhook) hookClient(h *v1alpha1.ExternalAdmissionHook) (*rest.RESTClient, error) {
+	serverName := h.ClientConfig.Service.Name + "." + h.ClientConfig.Service.Namespace + ".svc"


Given this auth model we'd need to change the API to not use k8s services--this wouldn't work for something hosted outside of the cluster. Another PR though.

lavalamp · 2017-10-24T20:48:58Z

plugin/pkg/admission/webhook/authentication.go

+
+func (c *defaultAuthenticationInfoResolver) ClientConfigFor(server string) (*rest.Config, error) {
+	// exact match
+	if authConfig, ok := c.kubeconfig.AuthInfos[server]; ok {


I don't understand the part that turns a kubeconfig file into this structure; it needs examples & at least a comment explaining it? Maybe this already exists or is coming in another PR? Maybe an example in a test?

I don't understand the part that turns a kubeconfig file into this structure; it needs examples & at least a comment explaining it? Maybe this already exists or is coming in another PR? Maybe an example in a test?

It's the normal decoding path. The types were written long ago when the hub version was optimized for code (with maps) and the external was optimized for serialization.

I think we still need examples specifically for this feature. They don't have to be in this PR. The field names in kubeconfig files aren't intuitive.

I think it will look like, (@deads2k correct me if I'm wrong)

users: - name: "*.svc" user: token-file: ".../token" - name: "*.namespace.svc" user: client-certificate-file: ".../client.crt" client-key-file: ".../client.key"

lavalamp · 2017-10-24T21:09:24Z

plugin/pkg/admission/webhook/authentication_test.go

+			serverName: "one.two.three.com",
+			kubeconfig: clientcmdapi.Config{
+				AuthInfos: map[string]*clientcmdapi.AuthInfo{
+					"*.two.three.com": {Token: "first"},


What is the use case for this? Won't it be more obvious to system administrators what will happen if we just require exact match? (I don't object to the implementation, it just seems like it will help < 1% of people while making 100% of people have to understand it.)

What is the use case for this? Won't it be more obvious to system administrators what will happen if we just require exact match? (I don't object to the implementation, it just seems like it will help < 1% of people while making 100% of people have to understand it.)

Authentication domains often follow real domains. If you don't allow any wildcarding, then adding a new service in an existing namespace could require rolling a large number of configmaps. If you do allow wildcarding, then people can choose to use the feature and avoid unnecessary config changes if they understand their deployment topology.

Supporting wildcards does not force anyone to use them, so until someone asks the question, "I have multiple webhooks for my domain, how can I avoid fanning out in this file", they won't care, they'll be able to use exact matches.

lavalamp · 2017-10-25T23:10:53Z

/lgtm

k8s-github-robot · 2017-10-25T23:11:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, lavalamp

Associated issue: 54404

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~cmd/kube-apiserver/OWNERS~~ [deads2k,lavalamp]
~~plugin/pkg/admission/OWNERS~~ [deads2k,lavalamp]
~~staging/src/k8s.io/apiserver/OWNERS~~ [deads2k,lavalamp]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

jennybuckley · 2018-02-13T22:05:41Z

Can this be done using the WebhookClientConfig part of *WebhookConfiguration objects when the each webhook is registered so it could be updated dynamically?

It already stores the CA to validate the webhook's identity, why couldn't it also include information about how to verify the apiserver's identity to the webhook?

liggitt · 2018-02-13T22:15:34Z

why couldn't it also include information about how to verify the apiserver's identity to the webhook?

Two main reasons:

We don't want to store confidential data (credentials) in this object, since that greatly limits who you can allow to read it
There are multiple apiservers (kube-apiserver, and extension api servers), not just one, each (potentially) requiring distinct credentials

@ericchiang

Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Make versioned types for webhook admission config Versioned webhook admission config type as promised in kubernetes/kubernetes#54414. @kubernetes/sig-api-machinery-pr-reviews @ericchiang as promised. fyi. ```yaml kind: AdmissionConfiguration apiVersion: apiserver.k8s.io/v1alpha1 plugins: - name: GenericAdmissionWebhook configuration: kind: WebhookAdmission apiVersion: apiserver.config.k8s.io/v1alpha1 kubeConfigFile: /path/to/my/file ``` `ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh` Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec

deads2k assigned lavalamp Oct 23, 2017

deads2k assigned liggitt and ericchiang Oct 23, 2017

k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 23, 2017

deads2k force-pushed the admission-08-options branch 2 times, most recently from 504cf1c to 0743acb Compare October 23, 2017 14:37

liggitt reviewed Oct 23, 2017

View reviewed changes

deads2k force-pushed the admission-08-options branch from 0743acb to 8de800f Compare October 23, 2017 15:26

update admission webhook to handle multiple auth domains

fd4ab3e

deads2k force-pushed the admission-08-options branch from 8de800f to fd4ab3e Compare October 23, 2017 16:33

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Oct 24, 2017

deads2k mentioned this pull request Oct 24, 2017

move webhook admission to generic apiserver #54513

Merged

lavalamp reviewed Oct 24, 2017

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 25, 2017

deads2k deleted the admission-08-options branch July 3, 2018 18:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

update admission webhook to handle multiple auth domains #54414

update admission webhook to handle multiple auth domains #54414

deads2k commented Oct 23, 2017 •

edited

Loading

k8s-ci-robot commented Oct 23, 2017

liggitt Oct 23, 2017

deads2k Oct 23, 2017

deads2k Oct 23, 2017

liggitt Oct 23, 2017

deads2k Oct 23, 2017

liggitt Oct 23, 2017

deads2k Oct 23, 2017

liggitt Oct 23, 2017

deads2k Oct 23, 2017

deads2k commented Oct 23, 2017

ericchiang commented Oct 23, 2017

lavalamp commented Oct 23, 2017

lavalamp Oct 24, 2017

lavalamp Oct 24, 2017

deads2k Oct 24, 2017

lavalamp Oct 25, 2017

jennybuckley Nov 16, 2017 •

edited

Loading

lavalamp Oct 24, 2017

deads2k Oct 24, 2017

lavalamp commented Oct 25, 2017

k8s-github-robot commented Oct 25, 2017

jennybuckley commented Feb 13, 2018 •

edited

Loading

liggitt commented Feb 13, 2018

update admission webhook to handle multiple auth domains #54414

update admission webhook to handle multiple auth domains #54414

Conversation

deads2k commented Oct 23, 2017 • edited Loading

k8s-ci-robot commented Oct 23, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k commented Oct 23, 2017

ericchiang commented Oct 23, 2017

lavalamp commented Oct 23, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jennybuckley Nov 16, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lavalamp commented Oct 25, 2017

k8s-github-robot commented Oct 25, 2017

jennybuckley commented Feb 13, 2018 • edited Loading

liggitt commented Feb 13, 2018

deads2k commented Oct 23, 2017 •

edited

Loading

jennybuckley Nov 16, 2017 •

edited

Loading

jennybuckley commented Feb 13, 2018 •

edited

Loading