Skip to content

K
k3s
Unverified Commit e9381904 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #54889 from lavalamp/wh-api

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Fix webhook API to also support URLs ref: https://github.com/kubernetes/features/issues/492 ```release-note The dynamic admission webhook now supports a URL in addition to a service reference, to accommodate out-of-cluster webhooks. ```
parents 858f3cbf fc0924cd
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 489 additions and 163 deletions
api/openapi-spec/swagger.json
View file @ e9381904
...@@ -67928,11 +67928,15 @@ ...@@ -67928,11 +67928,15 @@
], ],
"properties": { "properties": {
"name": { "name": {
"description": "Name is the name of the service Required", "description": "`name` is the name of the service. Required",
"type": "string" "type": "string"
}, },
"namespace": { "namespace": {
"description": "Namespace is the namespace of the service Required", "description": "`namespace` is the namespace of the service. Required",
"type": "string"
},
"path": {
"description": "`path` is an optional URL path which will be sent in any request to this service.",
"type": "string" "type": "string"
} }
} }
...@@ -68039,22 +68043,20 @@ ...@@ -68039,22 +68043,20 @@
"io.k8s.api.admissionregistration.v1alpha1.WebhookClientConfig": { "io.k8s.api.admissionregistration.v1alpha1.WebhookClientConfig": {
"description": "WebhookClientConfig contains the information to make a TLS connection with the webhook", "description": "WebhookClientConfig contains the information to make a TLS connection with the webhook",
"required": [ "required": [
"service",
"urlPath",
"caBundle" "caBundle"
], ],
"properties": { "properties": {
"caBundle": { "caBundle": {
"description": "CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate. Required", "description": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. Required.",
"type": "string", "type": "string",
"format": "byte" "format": "byte"
}, },
"service": { "service": {
"description": "Service is a reference to the service for this webhook. If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error. Required", "description": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nIf there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error.",
"$ref": "#/definitions/io.k8s.api.admissionregistration.v1alpha1.ServiceReference" "$ref": "#/definitions/io.k8s.api.admissionregistration.v1alpha1.ServiceReference"
}, },
"urlPath": { "url": {
"description": "URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object.", "description": "`url` gives the location of the webhook, in standard URL form (`[scheme://]host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nIf the scheme is present, it must be \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.",
"type": "string" "type": "string"
} }
} }
api/swagger-spec/admissionregistration.k8s.io_v1alpha1.json
View file @ e9381904
...@@ -2631,21 +2631,20 @@ ...@@ -2631,21 +2631,20 @@
"description": "WebhookClientConfig contains the information to make a TLS connection with the webhook", "description": "WebhookClientConfig contains the information to make a TLS connection with the webhook",
"required": [ "required": [
"service", "service",
"urlPath",
"caBundle" "caBundle"
], ],
"properties": { "properties": {
"url": {
"type": "string",
"description": "`url` gives the location of the webhook, in standard URL form (`[scheme://]host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nIf the scheme is present, it must be \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier."
},
"service": { "service": {
"$ref": "v1alpha1.ServiceReference", "$ref": "v1alpha1.ServiceReference",
"description": "Service is a reference to the service for this webhook. If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error. Required" "description": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nIf there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error."
},
"urlPath": {
"type": "string",
"description": "URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object."
}, },
"caBundle": { "caBundle": {
"type": "string", "type": "string",
"description": "CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate. Required" "description": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. Required."
} }
} }
}, },
...@@ -2659,11 +2658,15 @@ ...@@ -2659,11 +2658,15 @@
"properties": { "properties": {
"namespace": { "namespace": {
"type": "string", "type": "string",
"description": "Namespace is the namespace of the service Required" "description": "`namespace` is the namespace of the service. Required"
}, },
"name": { "name": {
"type": "string", "type": "string",
"description": "Name is the name of the service Required" "description": "`name` is the name of the service. Required"
},
"path": {
"type": "string",
"description": "`path` is an optional URL path which will be sent in any request to this service."
} }
} }
}, },
......
docs/api-reference/admissionregistration.k8s.io/v1alpha1/definitions.html
View file @ e9381904
...@@ -627,22 +627,34 @@ Depending on the enclosing object, subresources might not be allowed. Required.< ...@@ -627,22 +627,34 @@ Depending on the enclosing object, subresources might not be allowed. Required.<
</thead> </thead>
<tbody> <tbody>
<tr> <tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">service</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">url</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Service is a reference to the service for this webhook. If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error. Required</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>url</code> gives the location of the webhook, in standard URL form (<code>[scheme://]host:port/path</code>). Exactly one of <code>url</code> or <code>service</code> must be specified.<br>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td> <br>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1alpha1_servicereference">v1alpha1.ServiceReference</a></p></td> The <code>host</code> should not refer to a service running in the cluster; use the <code>service</code> field instead. The host might be resolved via external DNS in some apiservers (e.g., <code>kube-apiserver</code> cannot resolve in-cluster DNS as that would be a layering violation). <code>host</code> may also be an IP address.<br>
<br>
Please note that using <code>localhost</code> or <code>127.0.0.1</code> as a <code>host</code> is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.<br>
<br>
If the scheme is present, it must be "https://".<br>
<br>
A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
</tr> </tr>
<tr> <tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">urlPath</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">service</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object.</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>service</code> is a reference to the service for this webhook. Either <code>service</code> or <code>url</code> must be specified.<br>
<br>
If the webhook is running within the cluster, then you should use <code>service</code>.<br>
<br>
If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1alpha1_servicereference">v1alpha1.ServiceReference</a></p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
</tr> </tr>
<tr> <tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">caBundle</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">caBundle</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">CABundle is a PEM encoded CA bundle which will be used to validate webhook&#8217;s server certificate. Required</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>caBundle</code> is a PEM encoded CA bundle which will be used to validate the webhook&#8217;s server certificate. Required.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
...@@ -1070,18 +1082,25 @@ Depending on the enclosing object, subresources might not be allowed. Required.< ...@@ -1070,18 +1082,25 @@ Depending on the enclosing object, subresources might not be allowed. Required.<
<tbody> <tbody>
<tr> <tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">namespace</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Namespace is the namespace of the service Required</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>namespace</code> is the namespace of the service. Required</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
</tr> </tr>
<tr> <tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Name is the name of the service Required</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><code>name</code> is the name of the service. Required</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
</tr> </tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">path</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>path</code> is an optional URL path which will be sent in any request to this service.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody> </tbody>
</table> </table>
......
pkg/apis/admissionregistration/types.go
View file @ e9381904
...@@ -266,26 +266,60 @@ const ( ...@@ -266,26 +266,60 @@ const (
// WebhookClientConfig contains the information to make a TLS // WebhookClientConfig contains the information to make a TLS
// connection with the webhook // connection with the webhook
type WebhookClientConfig struct { type WebhookClientConfig struct {
// Service is a reference to the service for this webhook. If there is only // `url` gives the location of the webhook, in standard URL form
// one port open for the service, that port will be used. If there are multiple // (`[scheme://]host:port/path`). Exactly one of `url` or `service`
// ports open, port 443 will be used if it is open, otherwise it is an error. // must be specified.
// Required //
Service ServiceReference // The `host` should not refer to a service running in the cluster; use
// the `service` field instead. The host might be resolved via external
// DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
// in-cluster DNS as that would be a layering violation). `host` may
// also be an IP address.
//
// Please note that using `localhost` or `127.0.0.1` as a `host` is
// risky unless you take great care to run this webhook on all hosts
// which run an apiserver which might need to make calls to this
// webhook. Such installs are likely to be non-portable, i.e., not easy
// to turn up in a new cluster.
//
// If the scheme is present, it must be "https://".
//
// A path is optional, and if present may be any string permissible in
// a URL. You may use the path to pass an arbitrary string to the
// webhook, for example, a cluster identifier.
//
// +optional
URL *string
// URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object. // `service` is a reference to the service for this webhook. Either
URLPath string // `service` or `url` must be specified.
//
// If the webhook is running within the cluster, then you should use `service`.
//
// If there is only one port open for the service, that port will be
// used. If there are multiple ports open, port 443 will be used if it
// is open, otherwise it is an error.
//
// +optional
Service *ServiceReference
// CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate. // `caBundle` is a PEM encoded CA bundle which will be used to validate
// Required // the webhook's server certificate.
// Required.
CABundle []byte CABundle []byte
} }
// ServiceReference holds a reference to Service.legacy.k8s.io // ServiceReference holds a reference to Service.legacy.k8s.io
type ServiceReference struct { type ServiceReference struct {
// Namespace is the namespace of the service // `namespace` is the namespace of the service.
// Required // Required
Namespace string Namespace string
// Name is the name of the service // `name` is the name of the service.
// Required // Required
Name string Name string
// `path` is an optional URL path which will be sent in any request to
// this service.
// +optional
Path *string
} }
pkg/apis/admissionregistration/v1alpha1/zz_generated.conversion.go
View file @ e9381904
...@@ -227,6 +227,7 @@ func Convert_admissionregistration_RuleWithOperations_To_v1alpha1_RuleWithOperat ...@@ -227,6 +227,7 @@ func Convert_admissionregistration_RuleWithOperations_To_v1alpha1_RuleWithOperat
func autoConvert_v1alpha1_ServiceReference_To_admissionregistration_ServiceReference(in *v1alpha1.ServiceReference, out *admissionregistration.ServiceReference, s conversion.Scope) error { func autoConvert_v1alpha1_ServiceReference_To_admissionregistration_ServiceReference(in *v1alpha1.ServiceReference, out *admissionregistration.ServiceReference, s conversion.Scope) error {
out.Namespace = in.Namespace out.Namespace = in.Namespace
out.Name = in.Name out.Name = in.Name
out.Path = (*string)(unsafe.Pointer(in.Path))
return nil return nil
} }
...@@ -238,6 +239,7 @@ func Convert_v1alpha1_ServiceReference_To_admissionregistration_ServiceReference ...@@ -238,6 +239,7 @@ func Convert_v1alpha1_ServiceReference_To_admissionregistration_ServiceReference
func autoConvert_admissionregistration_ServiceReference_To_v1alpha1_ServiceReference(in *admissionregistration.ServiceReference, out *v1alpha1.ServiceReference, s conversion.Scope) error { func autoConvert_admissionregistration_ServiceReference_To_v1alpha1_ServiceReference(in *admissionregistration.ServiceReference, out *v1alpha1.ServiceReference, s conversion.Scope) error {
out.Namespace = in.Namespace out.Namespace = in.Namespace
out.Name = in.Name out.Name = in.Name
out.Path = (*string)(unsafe.Pointer(in.Path))
return nil return nil
} }
...@@ -323,10 +325,8 @@ func Convert_admissionregistration_Webhook_To_v1alpha1_Webhook(in *admissionregi ...@@ -323,10 +325,8 @@ func Convert_admissionregistration_Webhook_To_v1alpha1_Webhook(in *admissionregi
} }
func autoConvert_v1alpha1_WebhookClientConfig_To_admissionregistration_WebhookClientConfig(in *v1alpha1.WebhookClientConfig, out *admissionregistration.WebhookClientConfig, s conversion.Scope) error { func autoConvert_v1alpha1_WebhookClientConfig_To_admissionregistration_WebhookClientConfig(in *v1alpha1.WebhookClientConfig, out *admissionregistration.WebhookClientConfig, s conversion.Scope) error {
if err := Convert_v1alpha1_ServiceReference_To_admissionregistration_ServiceReference(&in.Service, &out.Service, s); err != nil { out.URL = (*string)(unsafe.Pointer(in.URL))
return err out.Service = (*admissionregistration.ServiceReference)(unsafe.Pointer(in.Service))
}
out.URLPath = in.URLPath
out.CABundle = *(*[]byte)(unsafe.Pointer(&in.CABundle)) out.CABundle = *(*[]byte)(unsafe.Pointer(&in.CABundle))
return nil return nil
} }
...@@ -337,10 +337,8 @@ func Convert_v1alpha1_WebhookClientConfig_To_admissionregistration_WebhookClient ...@@ -337,10 +337,8 @@ func Convert_v1alpha1_WebhookClientConfig_To_admissionregistration_WebhookClient
} }
func autoConvert_admissionregistration_WebhookClientConfig_To_v1alpha1_WebhookClientConfig(in *admissionregistration.WebhookClientConfig, out *v1alpha1.WebhookClientConfig, s conversion.Scope) error { func autoConvert_admissionregistration_WebhookClientConfig_To_v1alpha1_WebhookClientConfig(in *admissionregistration.WebhookClientConfig, out *v1alpha1.WebhookClientConfig, s conversion.Scope) error {
if err := Convert_admissionregistration_ServiceReference_To_v1alpha1_ServiceReference(&in.Service, &out.Service, s); err != nil { out.URL = (*string)(unsafe.Pointer(in.URL))
return err out.Service = (*v1alpha1.ServiceReference)(unsafe.Pointer(in.Service))
}
out.URLPath = in.URLPath
out.CABundle = *(*[]byte)(unsafe.Pointer(&in.CABundle)) out.CABundle = *(*[]byte)(unsafe.Pointer(&in.CABundle))
return nil return nil
} }
......
pkg/apis/admissionregistration/validation/validation.go
View file @ e9381904
...@@ -18,6 +18,7 @@ package validation ...@@ -18,6 +18,7 @@ package validation
import ( import (
"fmt" "fmt"
"net/url"
"strings" "strings"
genericvalidation "k8s.io/apimachinery/pkg/api/validation" genericvalidation "k8s.io/apimachinery/pkg/api/validation"
...@@ -192,29 +193,69 @@ func validateWebhook(hook *admissionregistration.Webhook, fldPath *field.Path) f ...@@ -192,29 +193,69 @@ func validateWebhook(hook *admissionregistration.Webhook, fldPath *field.Path) f
allErrors = append(allErrors, field.NotSupported(fldPath.Child("failurePolicy"), *hook.FailurePolicy, supportedFailurePolicies.List())) allErrors = append(allErrors, field.NotSupported(fldPath.Child("failurePolicy"), *hook.FailurePolicy, supportedFailurePolicies.List()))
} }
if len(hook.ClientConfig.URLPath) != 0 {
allErrors = append(allErrors, validateURLPath(fldPath.Child("clientConfig", "urlPath"), hook.ClientConfig.URLPath)...)
}
if hook.NamespaceSelector != nil { if hook.NamespaceSelector != nil {
allErrors = append(allErrors, metav1validation.ValidateLabelSelector(hook.NamespaceSelector, fldPath.Child("namespaceSelector"))...) allErrors = append(allErrors, metav1validation.ValidateLabelSelector(hook.NamespaceSelector, fldPath.Child("namespaceSelector"))...)
} }
allErrors = append(allErrors, validateWebhookClientConfig(fldPath.Child("clientConfig"), &hook.ClientConfig)...)
return allErrors
}
func validateWebhookClientConfig(fldPath *field.Path, cc *admissionregistration.WebhookClientConfig) field.ErrorList {
var allErrors field.ErrorList
if (cc.URL == nil) == (cc.Service == nil) {
allErrors = append(allErrors, field.Required(fldPath.Child("url"), "exactly one of url or service is required"))
}
if cc.URL != nil {
const form = "; desired format: https://host[/path]"
if u, err := url.Parse(*cc.URL); err != nil {
allErrors = append(allErrors, field.Required(fldPath.Child("url"), "url must be a valid URL: "+err.Error()+form))
} else {
if u.Scheme != "" && u.Scheme != "https" {
allErrors = append(allErrors, field.Required(fldPath.Child("url"), "'https' is the only allowed URL scheme"+form))
}
if len(u.Host) == 0 {
allErrors = append(allErrors, field.Required(fldPath.Child("url"), "host must be provided"+form))
}
}
}
if cc.Service != nil {
allErrors = append(allErrors, validateWebhookService(fldPath.Child("service"), cc.Service)...)
}
return allErrors return allErrors
} }
func validateURLPath(fldPath *field.Path, urlPath string) field.ErrorList { func validateWebhookService(fldPath *field.Path, svc *admissionregistration.ServiceReference) field.ErrorList {
var allErrors field.ErrorList var allErrors field.ErrorList
if len(svc.Name) == 0 {
allErrors = append(allErrors, field.Required(fldPath.Child("name"), "service name is required"))
}
if len(svc.Namespace) == 0 {
allErrors = append(allErrors, field.Required(fldPath.Child("namespace"), "service namespace is required"))
}
if svc.Path == nil {
return allErrors
}
// TODO: replace below with url.Parse + verifying that host is empty?
urlPath := *svc.Path
if urlPath == "/" || len(urlPath) == 0 { if urlPath == "/" || len(urlPath) == 0 {
return allErrors return allErrors
} }
if urlPath == "//" { if urlPath == "//" {
allErrors = append(allErrors, field.Invalid(fldPath, urlPath, "segment[0] may not be empty")) allErrors = append(allErrors, field.Invalid(fldPath.Child("path"), urlPath, "segment[0] may not be empty"))
return allErrors return allErrors
} }
if !strings.HasPrefix(urlPath, "/") { if !strings.HasPrefix(urlPath, "/") {
allErrors = append(allErrors, field.Invalid(fldPath, urlPath, "must start with a '/'")) allErrors = append(allErrors, field.Invalid(fldPath.Child("path"), urlPath, "must start with a '/'"))
} }
urlPathToCheck := urlPath[1:] urlPathToCheck := urlPath[1:]
...@@ -224,12 +265,12 @@ func validateURLPath(fldPath *field.Path, urlPath string) field.ErrorList { ...@@ -224,12 +265,12 @@ func validateURLPath(fldPath *field.Path, urlPath string) field.ErrorList {
steps := strings.Split(urlPathToCheck, "/") steps := strings.Split(urlPathToCheck, "/")
for i, step := range steps { for i, step := range steps {
if len(step) == 0 { if len(step) == 0 {
allErrors = append(allErrors, field.Invalid(fldPath, urlPath, fmt.Sprintf("segment[%d] may not be empty", i))) allErrors = append(allErrors, field.Invalid(fldPath.Child("path"), urlPath, fmt.Sprintf("segment[%d] may not be empty", i)))
continue continue
} }
failures := validation.IsDNS1123Subdomain(step) failures := validation.IsDNS1123Subdomain(step)
for _, failure := range failures { for _, failure := range failures {
allErrors = append(allErrors, field.Invalid(fldPath, urlPath, fmt.Sprintf("segment[%d]: %v", i, failure))) allErrors = append(allErrors, field.Invalid(fldPath.Child("path"), urlPath, fmt.Sprintf("segment[%d]: %v", i, failure)))
} }
} }
......
pkg/apis/admissionregistration/zz_generated.deepcopy.go
View file @ e9381904
...@@ -240,6 +240,15 @@ func (in *RuleWithOperations) DeepCopy() *RuleWithOperations { ...@@ -240,6 +240,15 @@ func (in *RuleWithOperations) DeepCopy() *RuleWithOperations {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ServiceReference) DeepCopyInto(out *ServiceReference) { func (in *ServiceReference) DeepCopyInto(out *ServiceReference) {
*out = *in *out = *in
if in.Path != nil {
in, out := &in.Path, &out.Path
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
return return
} }
...@@ -366,7 +375,24 @@ func (in *Webhook) DeepCopy() *Webhook { ...@@ -366,7 +375,24 @@ func (in *Webhook) DeepCopy() *Webhook {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *WebhookClientConfig) DeepCopyInto(out *WebhookClientConfig) { func (in *WebhookClientConfig) DeepCopyInto(out *WebhookClientConfig) {
*out = *in *out = *in
out.Service = in.Service if in.URL != nil {
in, out := &in.URL, &out.URL
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.Service != nil {
in, out := &in.Service, &out.Service
if *in == nil {
*out = nil
} else {
*out = new(ServiceReference)
(*in).DeepCopyInto(*out)
}
}
if in.CABundle != nil { if in.CABundle != nil {
in, out := &in.CABundle, &out.CABundle in, out := &in.CABundle, &out.CABundle
*out = make([]byte, len(*in)) *out = make([]byte, len(*in))
......
staging/src/k8s.io/api/admissionregistration/v1alpha1/generated.proto
View file @ e9381904
...@@ -22,6 +22,7 @@ syntax = 'proto2'; ...@@ -22,6 +22,7 @@ syntax = 'proto2';
package k8s.io.api.admissionregistration.v1alpha1; package k8s.io.api.admissionregistration.v1alpha1;
import "k8s.io/api/core/v1/generated.proto"; import "k8s.io/api/core/v1/generated.proto";
import "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1/generated.proto";
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto"; import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/generated.proto"; import "k8s.io/apimachinery/pkg/runtime/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto"; import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
...@@ -147,13 +148,18 @@ message RuleWithOperations { ...@@ -147,13 +148,18 @@ message RuleWithOperations {
// ServiceReference holds a reference to Service.legacy.k8s.io // ServiceReference holds a reference to Service.legacy.k8s.io
message ServiceReference { message ServiceReference {
// Namespace is the namespace of the service // `namespace` is the namespace of the service.
// Required // Required
optional string namespace = 1; optional string namespace = 1;
// Name is the name of the service // `name` is the name of the service.
// Required // Required
optional string name = 2; optional string name = 2;
// `path` is an optional URL path which will be sent in any request to
// this service.
// +optional
optional string path = 3;
} }
// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it. // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
...@@ -252,17 +258,46 @@ message Webhook { ...@@ -252,17 +258,46 @@ message Webhook {
// WebhookClientConfig contains the information to make a TLS // WebhookClientConfig contains the information to make a TLS
// connection with the webhook // connection with the webhook
message WebhookClientConfig { message WebhookClientConfig {
// Service is a reference to the service for this webhook. If there is only // `url` gives the location of the webhook, in standard URL form
// one port open for the service, that port will be used. If there are multiple // (`[scheme://]host:port/path`). Exactly one of `url` or `service`
// ports open, port 443 will be used if it is open, otherwise it is an error. // must be specified.
// Required //
optional ServiceReference service = 1; // The `host` should not refer to a service running in the cluster; use
// the `service` field instead. The host might be resolved via external
// DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
// in-cluster DNS as that would be a layering violation). `host` may
// also be an IP address.
//
// Please note that using `localhost` or `127.0.0.1` as a `host` is
// risky unless you take great care to run this webhook on all hosts
// which run an apiserver which might need to make calls to this
// webhook. Such installs are likely to be non-portable, i.e., not easy
// to turn up in a new cluster.
//
// If the scheme is present, it must be "https://".
//
// A path is optional, and if present may be any string permissible in
// a URL. You may use the path to pass an arbitrary string to the
// webhook, for example, a cluster identifier.
//
// +optional
optional string url = 3;
// URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object. // `service` is a reference to the service for this webhook. Either
optional string urlPath = 3; // `service` or `url` must be specified.
//
// If the webhook is running within the cluster, then you should use `service`.
//
// If there is only one port open for the service, that port will be
// used. If there are multiple ports open, port 443 will be used if it
// is open, otherwise it is an error.
//
// +optional
optional ServiceReference service = 1;
// CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate. // `caBundle` is a PEM encoded CA bundle which will be used to validate
// Required // the webhook's server certificate.
// Required.
optional bytes caBundle = 2; optional bytes caBundle = 2;
} }
staging/src/k8s.io/api/admissionregistration/v1alpha1/types.go
View file @ e9381904
...@@ -272,26 +272,60 @@ const ( ...@@ -272,26 +272,60 @@ const (
// WebhookClientConfig contains the information to make a TLS // WebhookClientConfig contains the information to make a TLS
// connection with the webhook // connection with the webhook
type WebhookClientConfig struct { type WebhookClientConfig struct {
// Service is a reference to the service for this webhook. If there is only // `url` gives the location of the webhook, in standard URL form
// one port open for the service, that port will be used. If there are multiple // (`[scheme://]host:port/path`). Exactly one of `url` or `service`
// ports open, port 443 will be used if it is open, otherwise it is an error. // must be specified.
// Required //
Service ServiceReference `json:"service" protobuf:"bytes,1,opt,name=service"` // The `host` should not refer to a service running in the cluster; use
// the `service` field instead. The host might be resolved via external
// DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
// in-cluster DNS as that would be a layering violation). `host` may
// also be an IP address.
//
// Please note that using `localhost` or `127.0.0.1` as a `host` is
// risky unless you take great care to run this webhook on all hosts
// which run an apiserver which might need to make calls to this
// webhook. Such installs are likely to be non-portable, i.e., not easy
// to turn up in a new cluster.
//
// If the scheme is present, it must be "https://".
//
// A path is optional, and if present may be any string permissible in
// a URL. You may use the path to pass an arbitrary string to the
// webhook, for example, a cluster identifier.
//
// +optional
URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"`
// URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object. // `service` is a reference to the service for this webhook. Either
URLPath string `json:"urlPath" protobuf:"bytes,3,opt,name=urlPath"` // `service` or `url` must be specified.
//
// If the webhook is running within the cluster, then you should use `service`.
//
// If there is only one port open for the service, that port will be
// used. If there are multiple ports open, port 443 will be used if it
// is open, otherwise it is an error.
//
// +optional
Service *ServiceReference `json:"service" protobuf:"bytes,1,opt,name=service"`
// CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate. // `caBundle` is a PEM encoded CA bundle which will be used to validate
// Required // the webhook's server certificate.
// Required.
CABundle []byte `json:"caBundle" protobuf:"bytes,2,opt,name=caBundle"` CABundle []byte `json:"caBundle" protobuf:"bytes,2,opt,name=caBundle"`
} }
// ServiceReference holds a reference to Service.legacy.k8s.io // ServiceReference holds a reference to Service.legacy.k8s.io
type ServiceReference struct { type ServiceReference struct {
// Namespace is the namespace of the service // `namespace` is the namespace of the service.
// Required // Required
Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"` Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
// Name is the name of the service // `name` is the name of the service.
// Required // Required
Name string `json:"name" protobuf:"bytes,2,opt,name=name"` Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
// `path` is an optional URL path which will be sent in any request to
// this service.
// +optional
Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"`
} }
staging/src/k8s.io/api/admissionregistration/v1alpha1/types_swagger_doc_generated.go
View file @ e9381904
...@@ -99,8 +99,9 @@ func (RuleWithOperations) SwaggerDoc() map[string]string { ...@@ -99,8 +99,9 @@ func (RuleWithOperations) SwaggerDoc() map[string]string {
var map_ServiceReference = map[string]string{ var map_ServiceReference = map[string]string{
"": "ServiceReference holds a reference to Service.legacy.k8s.io", "": "ServiceReference holds a reference to Service.legacy.k8s.io",
"namespace": "Namespace is the namespace of the service Required", "namespace": "`namespace` is the namespace of the service. Required",
"name": "Name is the name of the service Required", "name": "`name` is the name of the service. Required",
"path": "`path` is an optional URL path which will be sent in any request to this service.",
} }
func (ServiceReference) SwaggerDoc() map[string]string { func (ServiceReference) SwaggerDoc() map[string]string {
...@@ -142,9 +143,9 @@ func (Webhook) SwaggerDoc() map[string]string { ...@@ -142,9 +143,9 @@ func (Webhook) SwaggerDoc() map[string]string {
var map_WebhookClientConfig = map[string]string{ var map_WebhookClientConfig = map[string]string{
"": "WebhookClientConfig contains the information to make a TLS connection with the webhook", "": "WebhookClientConfig contains the information to make a TLS connection with the webhook",
"service": "Service is a reference to the service for this webhook. If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error. Required", "url": "`url` gives the location of the webhook, in standard URL form (`[scheme://]host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nIf the scheme is present, it must be \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.",
"urlPath": "URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object.", "service": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nIf there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error.",
"caBundle": "CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate. Required", "caBundle": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. Required.",
} }
func (WebhookClientConfig) SwaggerDoc() map[string]string { func (WebhookClientConfig) SwaggerDoc() map[string]string {
......
staging/src/k8s.io/api/admissionregistration/v1alpha1/zz_generated.deepcopy.go
View file @ e9381904
...@@ -240,6 +240,15 @@ func (in *RuleWithOperations) DeepCopy() *RuleWithOperations { ...@@ -240,6 +240,15 @@ func (in *RuleWithOperations) DeepCopy() *RuleWithOperations {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ServiceReference) DeepCopyInto(out *ServiceReference) { func (in *ServiceReference) DeepCopyInto(out *ServiceReference) {
*out = *in *out = *in
if in.Path != nil {
in, out := &in.Path, &out.Path
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
return return
} }
...@@ -366,7 +375,24 @@ func (in *Webhook) DeepCopy() *Webhook { ...@@ -366,7 +375,24 @@ func (in *Webhook) DeepCopy() *Webhook {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *WebhookClientConfig) DeepCopyInto(out *WebhookClientConfig) { func (in *WebhookClientConfig) DeepCopyInto(out *WebhookClientConfig) {
*out = *in *out = *in
out.Service = in.Service if in.URL != nil {
in, out := &in.URL, &out.URL
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.Service != nil {
in, out := &in.Service, &out.Service
if *in == nil {
*out = nil
} else {
*out = new(ServiceReference)
(*in).DeepCopyInto(*out)
}
}
if in.CABundle != nil { if in.CABundle != nil {
in, out := &in.CABundle, &out.CABundle in, out := &in.CABundle, &out.CABundle
*out = make([]byte, len(*in)) *out = make([]byte, len(*in))
......
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/admission.go
View file @ e9381904
...@@ -20,6 +20,7 @@ package webhook ...@@ -20,6 +20,7 @@ package webhook
import ( import (
"context" "context"
"encoding/json" "encoding/json"
"errors"
"fmt" "fmt"
"io" "io"
"net" "net"
...@@ -55,6 +56,10 @@ const ( ...@@ -55,6 +56,10 @@ const (
defaultCacheSize = 200 defaultCacheSize = 200
) )
var (
ErrNeedServiceOrURL = errors.New("webhook configuration must have either service or URL")
)
type ErrCallingWebhook struct { type ErrCallingWebhook struct {
WebhookName string WebhookName string
Reason error Reason error
...@@ -395,47 +400,71 @@ func toStatusErr(name string, result *metav1.Status) *apierrors.StatusError { ...@@ -395,47 +400,71 @@ func toStatusErr(name string, result *metav1.Status) *apierrors.StatusError {
func (a *GenericAdmissionWebhook) hookClient(h *v1alpha1.Webhook) (*rest.RESTClient, error) { func (a *GenericAdmissionWebhook) hookClient(h *v1alpha1.Webhook) (*rest.RESTClient, error) {
cacheKey, err := json.Marshal(h.ClientConfig) cacheKey, err := json.Marshal(h.ClientConfig)
if err != nil {
return nil, err
}
if client, ok := a.cache.Get(string(cacheKey)); ok { if client, ok := a.cache.Get(string(cacheKey)); ok {
return client.(*rest.RESTClient), nil return client.(*rest.RESTClient), nil
} }
serverName := h.ClientConfig.Service.Name + "." + h.ClientConfig.Service.Namespace + ".svc" complete := func(cfg *rest.Config) (*rest.RESTClient, error) {
restConfig, err := a.authInfoResolver.ClientConfigFor(serverName) cfg.TLSClientConfig.CAData = h.ClientConfig.CABundle
if err != nil { cfg.ContentConfig.NegotiatedSerializer = a.negotiatedSerializer
return nil, err cfg.ContentConfig.ContentType = runtime.ContentTypeJSON
client, err := rest.UnversionedRESTClientFor(cfg)
if err == nil {
a.cache.Add(string(cacheKey), client)
}
return client, err
} }
cfg := rest.CopyConfig(restConfig) if svc := h.ClientConfig.Service; svc != nil {
host := serverName + ":443" serverName := svc.Name + "." + svc.Namespace + ".svc"
cfg.Host = "https://" + host restConfig, err := a.authInfoResolver.ClientConfigFor(serverName)
cfg.APIPath = h.ClientConfig.URLPath if err != nil {
cfg.TLSClientConfig.ServerName = serverName return nil, err
cfg.TLSClientConfig.CAData = h.ClientConfig.CABundle }
cfg.ContentConfig.NegotiatedSerializer = a.negotiatedSerializer cfg := rest.CopyConfig(restConfig)
cfg.ContentConfig.ContentType = runtime.ContentTypeJSON host := serverName + ":443"
cfg.Host = "https://" + host
delegateDialer := cfg.Dial if svc.Path != nil {
if delegateDialer == nil { cfg.APIPath = *svc.Path
delegateDialer = net.Dial }
} cfg.TLSClientConfig.ServerName = serverName
cfg.Dial = func(network, addr string) (net.Conn, error) { delegateDialer := cfg.Dial
if addr == host { if delegateDialer == nil {
u, err := a.serviceResolver.ResolveEndpoint(h.ClientConfig.Service.Namespace, h.ClientConfig.Service.Name) delegateDialer = net.Dial
if err != nil { }
return nil, err cfg.Dial = func(network, addr string) (net.Conn, error) {
if addr == host {
u, err := a.serviceResolver.ResolveEndpoint(svc.Namespace, svc.Name)
if err != nil {
return nil, err
}
addr = u.Host
} }
addr = u.Host return delegateDialer(network, addr)
} }
return delegateDialer(network, addr)
return complete(cfg)
}
if h.ClientConfig.URL == nil {
return nil, &ErrCallingWebhook{WebhookName: h.Name, Reason: ErrNeedServiceOrURL}
}
u, err := url.Parse(*h.ClientConfig.URL)
if err != nil {
return nil, &ErrCallingWebhook{WebhookName: h.Name, Reason: fmt.Errorf("Unparsable URL: %v", err)}
} }
client, err := rest.UnversionedRESTClientFor(cfg) restConfig, err := a.authInfoResolver.ClientConfigFor(u.Host)
if err == nil { if err != nil {
a.cache.Add(string(cacheKey), client) return nil, err
} }
return client, err
cfg := rest.CopyConfig(restConfig)
cfg.Host = u.Host
cfg.APIPath = u.Path
// TODO: test if this is needed: cfg.TLSClientConfig.ServerName = u.Host
return complete(cfg)
} }
test/e2e/apimachinery/webhook.go
View file @ e9381904
...@@ -218,6 +218,8 @@ func deployWebhookAndService(f *framework.Framework, image string, context *cert ...@@ -218,6 +218,8 @@ func deployWebhookAndService(f *framework.Framework, image string, context *cert
framework.ExpectNoError(err, "waiting for service %s/%s have %d endpoint", namespace, serviceName, 1) framework.ExpectNoError(err, "waiting for service %s/%s have %d endpoint", namespace, serviceName, 1)
} }
func strPtr(s string) *string { return &s }
func registerWebhook(f *framework.Framework, context *certContext) { func registerWebhook(f *framework.Framework, context *certContext) {
client := f.ClientSet client := f.ClientSet
By("Registering the webhook via the AdmissionRegistration API") By("Registering the webhook via the AdmissionRegistration API")
...@@ -239,11 +241,11 @@ func registerWebhook(f *framework.Framework, context *certContext) { ...@@ -239,11 +241,11 @@ func registerWebhook(f *framework.Framework, context *certContext) {
}, },
}}, }},
ClientConfig: v1alpha1.WebhookClientConfig{ ClientConfig: v1alpha1.WebhookClientConfig{
Service: v1alpha1.ServiceReference{ Service: &v1alpha1.ServiceReference{
Namespace: namespace, Namespace: namespace,
Name: serviceName, Name: serviceName,
Path: strPtr("/pods"),
}, },
URLPath: "/pods",
CABundle: context.signingCert, CABundle: context.signingCert,
}, },
}, },
...@@ -268,11 +270,11 @@ func registerWebhook(f *framework.Framework, context *certContext) { ...@@ -268,11 +270,11 @@ func registerWebhook(f *framework.Framework, context *certContext) {
}, },
}, },
ClientConfig: v1alpha1.WebhookClientConfig{ ClientConfig: v1alpha1.WebhookClientConfig{
Service: v1alpha1.ServiceReference{ Service: &v1alpha1.ServiceReference{
Namespace: namespace, Namespace: namespace,
Name: serviceName, Name: serviceName,
Path: strPtr("/configmaps"),
}, },
URLPath: "/configmaps",
CABundle: context.signingCert, CABundle: context.signingCert,
}, },
}, },
......
test/integration/etcd/etcd_storage_path_test.go
View file @ e9381904
...@@ -382,11 +382,11 @@ var etcdStorageData = map[schema.GroupVersionResource]struct { ...@@ -382,11 +382,11 @@ var etcdStorageData = map[schema.GroupVersionResource]struct {
expectedEtcdPath: "/registry/initializerconfigurations/ic1", expectedEtcdPath: "/registry/initializerconfigurations/ic1",
}, },
gvr("admissionregistration.k8s.io", "v1alpha1", "validatingwebhookconfigurations"): { gvr("admissionregistration.k8s.io", "v1alpha1", "validatingwebhookconfigurations"): {
stub: `{"metadata":{"name":"hook1","creationTimestamp":null},"webhooks":[{"name":"externaladmissionhook.k8s.io","clientConfig":{"service":{"namespace":"","name":""},"caBundle":null},"rules":[{"operations":["CREATE"],"apiGroups":["group"],"apiVersions":["version"],"resources":["resource"]}],"failurePolicy":"Ignore"}]}`, stub: `{"metadata":{"name":"hook1","creationTimestamp":null},"webhooks":[{"name":"externaladmissionhook.k8s.io","clientConfig":{"service":{"namespace":"ns","name":"n"},"caBundle":null},"rules":[{"operations":["CREATE"],"apiGroups":["group"],"apiVersions":["version"],"resources":["resource"]}],"failurePolicy":"Ignore"}]}`,
expectedEtcdPath: "/registry/validatingwebhookconfigurations/hook1", expectedEtcdPath: "/registry/validatingwebhookconfigurations/hook1",
}, },
gvr("admissionregistration.k8s.io", "v1alpha1", "mutatingwebhookconfigurations"): { gvr("admissionregistration.k8s.io", "v1alpha1", "mutatingwebhookconfigurations"): {
stub: `{"metadata":{"name":"hook1","creationTimestamp":null},"webhooks":[{"name":"externaladmissionhook.k8s.io","clientConfig":{"service":{"namespace":"","name":""},"caBundle":null},"rules":[{"operations":["CREATE"],"apiGroups":["group"],"apiVersions":["version"],"resources":["resource"]}],"failurePolicy":"Ignore"}]}`, stub: `{"metadata":{"name":"hook1","creationTimestamp":null},"webhooks":[{"name":"externaladmissionhook.k8s.io","clientConfig":{"service":{"namespace":"ns","name":"n"},"caBundle":null},"rules":[{"operations":["CREATE"],"apiGroups":["group"],"apiVersions":["version"],"resources":["resource"]}],"failurePolicy":"Ignore"}]}`,
expectedEtcdPath: "/registry/mutatingwebhookconfigurations/hook1", expectedEtcdPath: "/registry/mutatingwebhookconfigurations/hook1",
}, },
// -- // --
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment