From 7a9ecfd89717419215d1ecb9e438c8f85127afaa Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Mon, 20 May 2019 14:57:44 -0400 Subject: [PATCH] AdmissionReview API changes --- pkg/apis/admission/types.go | 41 +++++++++++++++---- .../src/k8s.io/api/admission/v1beta1/types.go | 41 +++++++++++++++---- 2 files changed, 68 insertions(+), 14 deletions(-) diff --git a/pkg/apis/admission/types.go b/pkg/apis/admission/types.go index f874013e398..52534dceb01 100644 --- a/pkg/apis/admission/types.go +++ b/pkg/apis/admission/types.go @@ -45,17 +45,44 @@ type AdmissionRequest struct { // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. UID types.UID - // Kind is the type of object being manipulated. For example: Pod + // Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) Kind metav1.GroupVersionKind - // Resource is the name of the resource being requested. This is not the kind. For example: pods + // Resource is the fully-qualified resource being requested (for example, v1.pods) Resource metav1.GroupVersionResource - // SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent - // resource, but it may have a different kind. For instance, /pods has the resource "pods" and the kind "Pod", while - // /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on - // pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource - // "binding", and kind "Binding". + // SubResource is the subresource being requested, if any (for example, "status" or "scale") // +optional SubResource string + + // RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). + // If this is specified and differs from the value in "kind", an equivalent match and conversion was performed. + // + // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of + // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`, + // an API request to apps/v1beta1 deployments would be converted and sent to the webhook + // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for), + // and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request). + // + // See documentation for the "matchPolicy" field in the webhook configuration type for more details. + // +optional + RequestKind *metav1.GroupVersionKind + // RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). + // If this is specified and differs from the value in "resource", an equivalent match and conversion was performed. + // + // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of + // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`, + // an API request to apps/v1beta1 deployments would be converted and sent to the webhook + // with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for), + // and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request). + // + // See documentation for the "matchPolicy" field in the webhook configuration type. + // +optional + RequestResource *metav1.GroupVersionResource + // RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale") + // If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed. + // See documentation for the "matchPolicy" field in the webhook configuration type. + // +optional + RequestSubResource string + // Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and // rely on the server to generate the name. If that is the case, this method will return the empty string. // +optional diff --git a/staging/src/k8s.io/api/admission/v1beta1/types.go b/staging/src/k8s.io/api/admission/v1beta1/types.go index 9d2884e66fe..e968720e71a 100644 --- a/staging/src/k8s.io/api/admission/v1beta1/types.go +++ b/staging/src/k8s.io/api/admission/v1beta1/types.go @@ -43,17 +43,44 @@ type AdmissionRequest struct { // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"` - // Kind is the type of object being manipulated. For example: Pod + // Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"` - // Resource is the name of the resource being requested. This is not the kind. For example: pods + // Resource is the fully-qualified resource being requested (for example, v1.pods) Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"` - // SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent - // resource, but it may have a different kind. For instance, /pods has the resource "pods" and the kind "Pod", while - // /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on - // pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource - // "binding", and kind "Binding". + // SubResource is the subresource being requested, if any (for example, "status" or "scale") // +optional SubResource string `json:"subResource,omitempty" protobuf:"bytes,4,opt,name=subResource"` + + // RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). + // If this is specified and differs from the value in "kind", an equivalent match and conversion was performed. + // + // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of + // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`, + // an API request to apps/v1beta1 deployments would be converted and sent to the webhook + // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for), + // and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request). + // + // See documentation for the "matchPolicy" field in the webhook configuration type for more details. + // +optional + RequestKind *metav1.GroupVersionKind `json:"requestKind,omitempty" protobuf:"bytes,13,opt,name=requestKind"` + // RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). + // If this is specified and differs from the value in "resource", an equivalent match and conversion was performed. + // + // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of + // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`, + // an API request to apps/v1beta1 deployments would be converted and sent to the webhook + // with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for), + // and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request). + // + // See documentation for the "matchPolicy" field in the webhook configuration type. + // +optional + RequestResource *metav1.GroupVersionResource `json:"requestResource,omitempty" protobuf:"bytes,14,opt,name=requestResource"` + // RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale") + // If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed. + // See documentation for the "matchPolicy" field in the webhook configuration type. + // +optional + RequestSubResource string `json:"requestSubResource,omitempty" protobuf:"bytes,15,opt,name=requestSubResource"` + // Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and // rely on the server to generate the name. If that is the case, this method will return the empty string. // +optional