Enhancements: Admission webhook

[caesarxuchao]

Feature Description

• One-line feature description (can be used as a release note):

The admission webhook feature now supports both mutating webhook and validation (non-mutating) webhook. The dynamic registration API of webhook is promoted to v1beta1. The admission API is promoted to v1beta1.

• Primary contact (assignee):
  @mbhlool

• Responsible SIGs:
  /sig api-machinery

• Design proposal link (community repo):
  markdown version (latest): https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/00xx-admission-webhooks-to-ga.md

community proposal: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/admission-control-webhooks.md

tasks tracked in https://github.com/orgs/kubernetes/projects/32

• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:

@cheftako @liggitt @deads2k

• Approver (likely from SIG/area to which feature belongs):

@erictune @lavalamp @deads2k

• Feature target (which target equals to which milestone):
  
  
  
  • Alpha release target (x.y)
  
  
  • Beta release target 1.9
  
  
  • Stable release target 1.16
  
  

[caesarxuchao]

/sig api-machinery

[caesarxuchao]

/kind feature

[caesarxuchao]

/milestone 1.9

[deads2k]

Design proposal link (community repo):
https://docs.google.com/document/d/1c4kdkY3ha9rm0OIRbGleCeaHknZ-NR1nNtDp-i8eH8E/edit?ts=59e8c984#

Let's get this in the community repo.

[erictune]

Ack, wil do.

On Tue, Oct 24, 2017 at 5:12 AM, David Eads [e-mail]
wrote:

Design proposal link (community repo):
https://docs.google.com/document/d/1c4kdkY3ha9rm0OIRbGleCeaHknZ-
NR1nNtDp-i8eH8E/edit?ts=59e8c984#

Let's get this in the community repo.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/kubernetes/features/issues/492#issuecomment-338969394,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AHuudrHnp8GGEQi3Xg2_P53JMApTFPMFks5svdQ6gaJpZM4QDoLK
.

[erictune]

Please use area/admission-control label for k/k issues/pulls Applied to a few dozen existing ones. @ae6rt

[zacharysarah]

@caesarxuchao :wave: Please open a documentation PR and add a link to the tracking spreadsheet. Thanks in advance!

[zacharysarah]

@caesarxuchao Bumping for docs ☝️

/cc @idvoretskyi

[lavalamp]

I already have a documentation PR out, will add a link when I am back in
the office on thursday.

On Tue, Nov 28, 2017 at 3:48 PM, Zach Corleissen [e-mail]
wrote:

@caesarxuchao https://github.com/caesarxuchao Bumping for docs
https://github.com/kubernetes/features/issues/492#issuecomment-346478349
☝️

/cc @idvoretskyi https://github.com/idvoretskyi

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/kubernetes/features/issues/492#issuecomment-347703441,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAnglhGCUOaYouOfuzdmaiSO7t12wcbNks5s7JvBgaJpZM4QDoLK
.

[caesarxuchao]

The doc PR @lavalamp started: https://github.com/kubernetes/website/pull/6368

[CaoShuFeng]

Hi, can someone update the doc:
https://github.com/kubernetes/website/blob/master/docs/admin/extensible-admission-controllers.md#external-admission-webhooks

Thanks very much. :)

[tamalsaha]

We are big fans and users of *WebHooks. But one issue is that there is no way to know if *WebHook admission controller is enabled in a cluster or not. This is an ux issue. If *Webhook admission controller is not enabled, hooks just do not get called. This is especially important for manged clusters like GKE, etc. I would like to see some way to resolve this before webhook is considered GA.

A few ideas that come to mind are adding a Status section to Webhook like APIService or CRD objects. The other option may be component config (though that will probably give access to more information that we need).

[hzxuzhonghu]

adding a Status section to Webhook

agree

[liggitt]

adding a Status section to Webhook

agree

that doesn't work well when you have multiple servers (as in the case of extension API servers), most of which you would not allow to write to the webhooks.

[hzxuzhonghu]

adding a Status section to not to Webhook, should be ValidatingWebhookConfiguration and MutatingWebhookConfiguration

that doesn't work well when you have multiple servers (as in the case of extension API servers), most of which you would not allow to write to the webhooks.

That's not a big blocker, servers should have access to configuration and its subresource status

[erictune]

Filed https://github.com/kubernetes/kubernetes/issues/60700 to track need for better debugging of case when admission controller off.

[justaugustus]

@caesarxuchao
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

• Description
• Milestone
• Assignee(s)
• Labels:
  
  
  
  • stage/{alpha,beta,stable}
  
  
  • sig/*
  
  
  • kind/feature
  
  

cc @idvoretskyi

[justaugustus]

This feature current has no milestone, so we'd like to check in and see if there are any plans for this in Kubernetes 1.12.

If so, please ensure that this issue is up-to-date with ALL of the following information:

• One-line feature description (can be used as a release note):
• Primary contact (assignee):
• Responsible SIGs:
• Design proposal link (community repo):
• Link to e2e and/or unit tests:
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:
• Approver (likely from SIG/area to which feature belongs):
• Feature target (which target equals to which milestone):
  
  
  
  • Alpha release target (x.y)
  
  
  • Beta release target (x.y)
  
  
  • Stable release target (x.y)
  
  

Set the following:

• Description
• Assignee(s)
• Labels:
  
  
  
  • stage/{alpha,beta,stable}
  
  
  • sig/*
  
  
  • kind/feature
  
  

Once this feature is appropriately updated, please explicitly ping @justaugustus, @kacole2, @robertsandoval, @rajendar38 to note that it is ready to be included in the Features Tracking Spreadsheet for Kubernetes 1.12.

---

Please note that Features Freeze is tomorrow, July 31st, after which any incomplete Feature issues will require an Exception request to be accepted into the milestone.

In addition, please be aware of the following relevant deadlines:

• Docs deadline (open placeholder PRs): 8/21
• Test case freeze: 8/28

Please make sure all PRs for features have relevant release notes included as well.

Happy shipping!

P.S. This was sent via automation

[kacole2]

Hi
This enhancement has no milestone, so we'd like to check in and see if there are any plans for this to graduate stages in Kubernetes 1.13. This release is targeted to be more ‘stable’ and will have an aggressive timeline. Please only include this enhancement if there is a high level of confidence it will meet the following deadlines:
Docs (open placeholder PRs): 11/8
Code Slush: 11/9
Code Freeze Begins: 11/15
Docs Complete and Reviewed: 11/27

Please take a moment to update the milestones on your original post for future tracking and ping @kacole2 if it needs to be included in the 1.13 Enhancements Tracking Sheet

We are also now encouraging that every new enhancement aligns with a KEP. If a KEP has been created, please link to it in the original post or take the opportunity to develop a KEP.

Thanks!

[caesarxuchao]

I'm not aware of any graduate plan in 1.13.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[erictune]

/remove-lifecycle stale

[claurence]

@caesarxuchao Hello - I’m the enhancement’s lead for 1.14 and I’m checking in on this issue to see what work (if any) is being planned for the 1.14 release. Enhancements freeze is Jan 29th and I want to remind that all enhancements must have a KEP

[caesarxuchao]

Thanks for the reminder @claurence . @mbohlool I think we want to GA the admission webhook in 1.15, not in 1.14, right?

[liggitt]

Continued work in beta is planned for 1.14 and tracked in a KEP at https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/00xx-admission-webhooks-to-ga.md

moving into the milestone ahead of the implementable KEP deadline of 2/4

[liggitt]

I can take API review for this

[marccampbell]

@liggitt I'm interested in shadowing your review of this one.

[liggitt]

@liggitt I'm interested in shadowing your review of this one.

great. there will be several distinct pieces landing over the next few weeks. work items are tracked in https://docs.google.com/spreadsheets/d/16tdSFcYYjGDRNhpK9vTx8m291JMy7qa6TeUXdu3jIHs/edit#gid=109074070 and as PRs get opened will be linked from here. I'll reach out to coordinate a time when items are ready for review

[kacole2]

Hello @caesarxuchao , I'm the Enhancement Lead for 1.15. Is this feature going to be graduating stable stage in 1.15? Please let me know so it can be tracked properly and added to the spreadsheet.

Once coding begins, please list all relevant k/k PRs in this issue so they can be tracked properly.

[caesarxuchao]

Hi, @kacole2. Yes, the plan is GA in 1.15.

Do we need to link to already merged PRs?

[kacole2]

@caesarxuchao it would be very much appreciated for tracking purposes. This way we know what PRs were associated with this enhancement. Thank you!

/milestone v1.15
/stage stable

[caesarxuchao]

https://github.com/kubernetes/kubernetes/pull/76346
https://github.com/kubernetes/kubernetes/pull/74998
https://github.com/kubernetes/kubernetes/pull/74855
https://github.com/kubernetes/kubernetes/pull/74154
https://github.com/kubernetes/kubernetes/pull/74477
https://github.com/kubernetes/kubernetes/pull/74448

@liggitt @mbohlool if you have more to add to the list.

[mbohlool]

/unassign mbohlool

[makoscafee]

Hey, @caesarxuchao @liggitt 👋 I'm the v1.15 docs Lead.
Does this enhancement require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.15) due by Thursday, May 30th. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions

[cheftako]

/assign @jpbetz

[kacole2]

Hi @jpbetz caesarxuchao. Code Freeze is Thursday, May 30th 2019 @ EOD PST. All enhancements going into the release must be code-complete, including tests, and have docs PRs open.

It looks like all these are merged and this is in good shape. Let me know if there are any k/k PRs in flight.
kubernetes/kubernetes#76346
kubernetes/kubernetes#74998
kubernetes/kubernetes#74855
kubernetes/kubernetes#74154
kubernetes/kubernetes#74477
kubernetes/kubernetes#74448

If you know this will slip, please reply back and let us know. Thanks!

[makoscafee]

Hey, @caesarxuchao @liggitt . Deadline for submitting at least Draft/Placeholder PR by May 30th 2019 @ EOD PST. Does this enhancement require any new docs (or modifications)?

[liggitt]

PRs we're tracking for this feature:
https://github.com/kubernetes/kubernetes/pull/78491
https://github.com/kubernetes/kubernetes/pull/78080
https://github.com/kubernetes/kubernetes/pull/78505

[liggitt]

draft docs PR for 1.15 changes at https://github.com/kubernetes/website/pull/14671

[liggitt]

status for 1.15 is still beta, continuing improvements.

/stage beta

[liggitt]

/milestone v1.16
/stage stable

[mariantalla]

Hey @jpbetz / @liggitt / @caesarxuchao - I'm adding this to the tracked enhancements for 1.16 as expected to graduate to stable. Please let me know if I got any of this wrong.

As a reminder, 1.16 milestone dates are Enhancement Freeze 7/30 and Code Freeze 8/29.

Thanks!

[simplytunde]

Hey, @jpbetz @liggitt @caesarxuchao I'm the v1.16 docs release lead.

Does this enhancement (or the work planned for v1.16) require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.16) due by Friday,August 23rd. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions!

[hh]

There is a requirement that GA/stable APIs must have conformance tests:
See: https://github.com/kubernetes/community/pull/1806/files

I created an umbrella issue for missing conformance tests using https://apisnoop.cncf.io:
See: https://github.com/kubernetes/kubernetes/issues/80767

/assign @timothysc

[liggitt]

1.16 WIP docs PR at https://github.com/kubernetes/website/pull/15985

[kacole2]

@liggitt code freeze for 1.16 is on Thursday 8/29. Are there any outstanding k/k PRs that still need to be merged for this to go Stable?

[jpbetz]

I believe there is just two in-progress bug fixes and then everything is ready: https://github.com/kubernetes/kubernetes/pull/81399, https://github.com/kubernetes/kubernetes/pull/81896

[liggitt]

Released as stable in v1.16.0

Post-GA work tracked in https://github.com/orgs/kubernetes/projects/32

/close

[k8s-ci-robot]

@liggitt: Closing this issue.

In response to this:

Released as stable in v1.16.0

Post-GA work tracked in https://github.com/orgs/kubernetes/projects/32

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.