From 40173a2774bf1f61920a54f07bd8aec73a80e306 Mon Sep 17 00:00:00 2001 From: ermias19 Date: Wed, 25 Feb 2026 02:38:59 +0100 Subject: [PATCH 1/3] admission: mark review fields optional --- hack/golangci-hints.yaml | 2 +- hack/golangci.yaml | 2 +- hack/kube-api-linter/exceptions.yaml | 2 +- staging/src/k8s.io/api/admission/v1/types.go | 7 +++++++ staging/src/k8s.io/api/admission/v1beta1/types.go | 7 +++++++ 5 files changed, 17 insertions(+), 3 deletions(-) diff --git a/hack/golangci-hints.yaml b/hack/golangci-hints.yaml index 384cba034d6..4244d967a5f 100644 --- a/hack/golangci-hints.yaml +++ b/hack/golangci-hints.yaml @@ -215,7 +215,7 @@ linters: # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group. - text: "must be marked as optional or required|is a non-pointer struct with no required fields." - path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" + path: "staging/src/k8s.io/api/(apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/hack/golangci.yaml b/hack/golangci.yaml index 2b26406cd03..dbc42dd8983 100644 --- a/hack/golangci.yaml +++ b/hack/golangci.yaml @@ -230,7 +230,7 @@ linters: # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group. - text: "must be marked as optional or required|is a non-pointer struct with no required fields." - path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" + path: "staging/src/k8s.io/api/(apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/hack/kube-api-linter/exceptions.yaml b/hack/kube-api-linter/exceptions.yaml index 55e8f2823b1..f0ef9bb800f 100644 --- a/hack/kube-api-linter/exceptions.yaml +++ b/hack/kube-api-linter/exceptions.yaml @@ -91,7 +91,7 @@ # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group. - text: "must be marked as optional or required|is a non-pointer struct with no required fields." - path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" + path: "staging/src/k8s.io/api/(apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/staging/src/k8s.io/api/admission/v1/types.go b/staging/src/k8s.io/api/admission/v1/types.go index 395672c390c..34cbf2f59bd 100644 --- a/staging/src/k8s.io/api/admission/v1/types.go +++ b/staging/src/k8s.io/api/admission/v1/types.go @@ -43,10 +43,13 @@ type AdmissionRequest struct { // otherwise identical (parallel requests, requests when earlier requests did not modify etc) // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. + // +optional UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"` // kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) + // +optional Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"` // resource is the fully-qualified resource being requested (for example, v1.pods) + // +optional Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"` // subResource is the subresource being requested, if any (for example, "status" or "scale") // +optional @@ -91,8 +94,10 @@ type AdmissionRequest struct { Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"` // operation is the operation being performed. This may be different than the operation // requested. e.g. a patch can result in either a CREATE or UPDATE Operation. + // +optional Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"` // userInfo is information about the requesting user + // +optional UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"` // object is the object from the incoming request. // +optional @@ -117,9 +122,11 @@ type AdmissionRequest struct { type AdmissionResponse struct { // uid is an identifier for the individual request/response. // This must be copied over from the corresponding AdmissionRequest. + // +optional UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"` // allowed indicates whether or not the admission request was permitted. + // +optional Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"` // status is the result contains extra details into why an admission request was denied. diff --git a/staging/src/k8s.io/api/admission/v1beta1/types.go b/staging/src/k8s.io/api/admission/v1beta1/types.go index 81941eb325e..015dc8ba3eb 100644 --- a/staging/src/k8s.io/api/admission/v1beta1/types.go +++ b/staging/src/k8s.io/api/admission/v1beta1/types.go @@ -47,10 +47,13 @@ type AdmissionRequest struct { // otherwise identical (parallel requests, requests when earlier requests did not modify etc) // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. + // +optional UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"` // kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) + // +optional Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"` // resource is the fully-qualified resource being requested (for example, v1.pods) + // +optional Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"` // subResource is the subresource being requested, if any (for example, "status" or "scale") // +optional @@ -95,8 +98,10 @@ type AdmissionRequest struct { Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"` // operation is the operation being performed. This may be different than the operation // requested. e.g. a patch can result in either a CREATE or UPDATE Operation. + // +optional Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"` // userInfo is information about the requesting user + // +optional UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"` // object is the object from the incoming request. // +optional @@ -121,9 +126,11 @@ type AdmissionRequest struct { type AdmissionResponse struct { // uid is an identifier for the individual request/response. // This should be copied over from the corresponding AdmissionRequest. + // +optional UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"` // allowed indicates whether or not the admission request was permitted. + // +optional Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"` // status is the result contains extra details into why an admission request was denied. From 0678b48e885927e9fac50d5f11450e0cd4271cca Mon Sep 17 00:00:00 2001 From: ermias19 Date: Wed, 25 Feb 2026 10:29:28 +0100 Subject: [PATCH 2/3] narrowing the lint through adding admissionregistration. --- hack/golangci-hints.yaml | 2 +- hack/golangci.yaml | 2 +- hack/kube-api-linter/exceptions.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hack/golangci-hints.yaml b/hack/golangci-hints.yaml index 4244d967a5f..68a56bbc9fc 100644 --- a/hack/golangci-hints.yaml +++ b/hack/golangci-hints.yaml @@ -215,7 +215,7 @@ linters: # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group. - text: "must be marked as optional or required|is a non-pointer struct with no required fields." - path: "staging/src/k8s.io/api/(apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" + path: "staging/src/k8s.io/api/(admissionregistration|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/hack/golangci.yaml b/hack/golangci.yaml index dbc42dd8983..4f44df20cc1 100644 --- a/hack/golangci.yaml +++ b/hack/golangci.yaml @@ -230,7 +230,7 @@ linters: # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group. - text: "must be marked as optional or required|is a non-pointer struct with no required fields." - path: "staging/src/k8s.io/api/(apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" + path: "staging/src/k8s.io/api/(admissionregistration|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/hack/kube-api-linter/exceptions.yaml b/hack/kube-api-linter/exceptions.yaml index f0ef9bb800f..fe2705e5e93 100644 --- a/hack/kube-api-linter/exceptions.yaml +++ b/hack/kube-api-linter/exceptions.yaml @@ -91,7 +91,7 @@ # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group. - text: "must be marked as optional or required|is a non-pointer struct with no required fields." - path: "staging/src/k8s.io/api/(apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" + path: "staging/src/k8s.io/api/(admissionregistration|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" From dfba43ef6f991ce2b4115cc81ef9558fa293c99a Mon Sep 17 00:00:00 2001 From: ermias19 Date: Wed, 25 Feb 2026 11:17:09 +0100 Subject: [PATCH 3/3] make update swagger --- staging/src/k8s.io/api/admission/v1/generated.proto | 7 +++++++ staging/src/k8s.io/api/admission/v1beta1/generated.proto | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/staging/src/k8s.io/api/admission/v1/generated.proto b/staging/src/k8s.io/api/admission/v1/generated.proto index cd5c88badc8..38a0fcea60d 100644 --- a/staging/src/k8s.io/api/admission/v1/generated.proto +++ b/staging/src/k8s.io/api/admission/v1/generated.proto @@ -35,12 +35,15 @@ message AdmissionRequest { // otherwise identical (parallel requests, requests when earlier requests did not modify etc) // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. + // +optional optional string uid = 1; // kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) + // +optional optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2; // resource is the fully-qualified resource being requested (for example, v1.pods) + // +optional optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3; // subResource is the subresource being requested, if any (for example, "status" or "scale") @@ -90,9 +93,11 @@ message AdmissionRequest { // operation is the operation being performed. This may be different than the operation // requested. e.g. a patch can result in either a CREATE or UPDATE Operation. + // +optional optional string operation = 7; // userInfo is information about the requesting user + // +optional optional .k8s.io.api.authentication.v1.UserInfo userInfo = 8; // object is the object from the incoming request. @@ -121,9 +126,11 @@ message AdmissionRequest { message AdmissionResponse { // uid is an identifier for the individual request/response. // This must be copied over from the corresponding AdmissionRequest. + // +optional optional string uid = 1; // allowed indicates whether or not the admission request was permitted. + // +optional optional bool allowed = 2; // status is the result contains extra details into why an admission request was denied. diff --git a/staging/src/k8s.io/api/admission/v1beta1/generated.proto b/staging/src/k8s.io/api/admission/v1beta1/generated.proto index 5af234993a4..9514719baf2 100644 --- a/staging/src/k8s.io/api/admission/v1beta1/generated.proto +++ b/staging/src/k8s.io/api/admission/v1beta1/generated.proto @@ -35,12 +35,15 @@ message AdmissionRequest { // otherwise identical (parallel requests, requests when earlier requests did not modify etc) // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. + // +optional optional string uid = 1; // kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) + // +optional optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2; // resource is the fully-qualified resource being requested (for example, v1.pods) + // +optional optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3; // subResource is the subresource being requested, if any (for example, "status" or "scale") @@ -90,9 +93,11 @@ message AdmissionRequest { // operation is the operation being performed. This may be different than the operation // requested. e.g. a patch can result in either a CREATE or UPDATE Operation. + // +optional optional string operation = 7; // userInfo is information about the requesting user + // +optional optional .k8s.io.api.authentication.v1.UserInfo userInfo = 8; // object is the object from the incoming request. @@ -121,9 +126,11 @@ message AdmissionRequest { message AdmissionResponse { // uid is an identifier for the individual request/response. // This should be copied over from the corresponding AdmissionRequest. + // +optional optional string uid = 1; // allowed indicates whether or not the admission request was permitted. + // +optional optional bool allowed = 2; // status is the result contains extra details into why an admission request was denied.