From a8020b6275b23436056f882e654744a4a8ddc162 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Wed, 27 Nov 2019 12:37:22 -0500 Subject: [PATCH] AdmissionConfiguration v1 (#17548) --- .../admission-controllers.md | 67 ++++++++++++++++++- .../extensible-admission-controllers.md | 56 +++++++++++----- 2 files changed, 105 insertions(+), 18 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/admission-controllers.md b/content/en/docs/reference/access-authn-authz/admission-controllers.md index e0ab256bf9ad4..2e741afd76c19 100644 --- a/content/en/docs/reference/access-authn-authz/admission-controllers.md +++ b/content/en/docs/reference/access-authn-authz/admission-controllers.md @@ -172,7 +172,20 @@ event requests. The cluster admin can specify event rate limits by: * Referencing an `EventRateLimit` configuration file from the file provided to the API server's command line flag `--admission-control-config-file`: +{{< tabs name="eventratelimit_example" >}} +{{% tab name="apiserver.config.k8s.io/v1" %}} ```yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: EventRateLimit + path: eventconfig.yaml +... +``` +{{% /tab %}} +{{% tab name="apiserver.k8s.io/v1alpha1" %}} +```yaml +# Deprecated in v1.17 in favor of apiserver.config.k8s.io/v1 apiVersion: apiserver.k8s.io/v1alpha1 kind: AdmissionConfiguration plugins: @@ -180,6 +193,8 @@ plugins: path: eventconfig.yaml ... ``` +{{% /tab %}} +{{< /tabs >}} There are four types of limits that can be specified in the configuration: @@ -240,7 +255,20 @@ imagePolicy: Reference the ImagePolicyWebhook configuration file from the file provided to the API server's command line flag `--admission-control-config-file`: +{{< tabs name="imagepolicywebhook_example1" >}} +{{% tab name="apiserver.config.k8s.io/v1" %}} +```yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: ImagePolicyWebhook + path: imagepolicyconfig.yaml +... +``` +{{% /tab %}} +{{% tab name="apiserver.k8s.io/v1alpha1" %}} ```yaml +# Deprecated in v1.17 in favor of apiserver.config.k8s.io/v1 apiVersion: apiserver.k8s.io/v1alpha1 kind: AdmissionConfiguration plugins: @@ -248,22 +276,44 @@ plugins: path: imagepolicyconfig.yaml ... ``` +{{% /tab %}} +{{< /tabs >}} Alternatively, you can embed the configuration directly in the file: +{{< tabs name="imagepolicywebhook_example2" >}} +{{% tab name="apiserver.config.k8s.io/v1" %}} +```yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: ImagePolicyWebhook + configuration: + imagePolicy: + kubeConfigFile: + allowTTL: 50 + denyTTL: 50 + retryBackoff: 500 + defaultAllow: true +``` +{{% /tab %}} +{{% tab name="apiserver.k8s.io/v1alpha1" %}} ```yaml +# Deprecated in v1.17 in favor of apiserver.config.k8s.io/v1 apiVersion: apiserver.k8s.io/v1alpha1 kind: AdmissionConfiguration plugins: - name: ImagePolicyWebhook configuration: imagePolicy: - kubeConfigFile: /path/to/file + kubeConfigFile: allowTTL: 50 denyTTL: 50 retryBackoff: 500 defaultAllow: true ``` +{{% /tab %}} +{{< /tabs >}} The ImagePolicyWebhook config file must reference a [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS. @@ -492,7 +542,20 @@ podNodeSelectorPluginConfig: Reference the `PodNodeSelector` configuration file from the file provided to the API server's command line flag `--admission-control-config-file`: +{{< tabs name="podnodeselector_example1" >}} +{{% tab name="apiserver.config.k8s.io/v1" %}} +```yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: PodNodeSelector + path: podnodeselector.yaml +... +``` +{{% /tab %}} +{{% tab name="apiserver.k8s.io/v1alpha1" %}} ```yaml +# Deprecated in v1.17 in favor of apiserver.config.k8s.io/v1 apiVersion: apiserver.k8s.io/v1alpha1 kind: AdmissionConfiguration plugins: @@ -500,6 +563,8 @@ plugins: path: podnodeselector.yaml ... ``` +{{% /tab %}} +{{< /tabs >}} #### Configuration Annotation Format `PodNodeSelector` uses the annotation key `scheduler.alpha.kubernetes.io/node-selector` to assign node selectors to namespaces. diff --git a/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md b/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md index 2f9b3d0eb199b..8359497e4114d 100644 --- a/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md +++ b/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md @@ -184,24 +184,46 @@ the webhooks. There are three steps to complete the configuration. (yes, the same schema that's used by kubectl), so the field name is `kubeConfigFile`. Here is an example admission control configuration file: - ```yaml - apiVersion: apiserver.k8s.io/v1alpha1 - kind: AdmissionConfiguration - plugins: - - name: ValidatingAdmissionWebhook - configuration: - apiVersion: apiserver.config.k8s.io/v1alpha1 - kind: WebhookAdmission - kubeConfigFile: "" - - name: MutatingAdmissionWebhook - configuration: - apiVersion: apiserver.config.k8s.io/v1alpha1 - kind: WebhookAdmission - kubeConfigFile: "" - ``` +{{< tabs name="admissionconfiguration_example1" >}} +{{% tab name="apiserver.config.k8s.io/v1" %}} +```yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: ValidatingAdmissionWebhook + configuration: + apiVersion: apiserver.config.k8s.io/v1alpha1 + kind: WebhookAdmission + kubeConfigFile: "" +- name: MutatingAdmissionWebhook + configuration: + apiVersion: apiserver.config.k8s.io/v1alpha1 + kind: WebhookAdmission + kubeConfigFile: "" +``` +{{% /tab %}} +{{% tab name="apiserver.k8s.io/v1alpha1" %}} +```yaml +# Deprecated in v1.17 in favor of apiserver.config.k8s.io/v1 +apiVersion: apiserver.k8s.io/v1alpha1 +kind: AdmissionConfiguration +plugins: +- name: ValidatingAdmissionWebhook + configuration: + apiVersion: apiserver.config.k8s.io/v1alpha1 + kind: WebhookAdmission + kubeConfigFile: "" +- name: MutatingAdmissionWebhook + configuration: + apiVersion: apiserver.config.k8s.io/v1alpha1 + kind: WebhookAdmission + kubeConfigFile: "" +``` +{{% /tab %}} +{{< /tabs >}} -The schema of `admissionConfiguration` is defined -[here](https://github.com/kubernetes/kubernetes/blob/v1.13.0/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go#L27). +For more information about `AdmissionConfiguration`, see the +[AdmissionConfiguration schema](https://github.com/kubernetes/kubernetes/blob/v1.17.0/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go#L27). See the [webhook configuration](#webhook-configuration) section for details about each config field. * In the kubeConfig file, provide the credentials: