AdmissionWebhookMatchConditions feature documentation #40058

tallclair · 2023-03-16T19:06:28Z

Documentation for the AdmissionWebhookMatchConditions (alpha) feature.

KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/3716-admission-webhook-match-conditions

/cc @ivelichkovich @maxsmythe @liggitt

k8s-ci-robot · 2023-03-16T19:06:33Z

@tallclair: GitHub didn't allow me to request PR reviews from the following users: maxsmythe.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

Documentation for the AdmissionWebhookMatchConditions (alpha) feature.

KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/3716-admission-webhook-match-conditions

/cc @ivelichkovich @maxsmythe @liggitt

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

sftim

Thanks. Some thoughts / feedback.

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

tallclair · 2023-03-17T00:16:05Z

Thanks for the feedback, comments addressed.

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

sftim

LGTM for docs; ready for tech review.

content/en/examples/access/admission-webhook-match-conditions.yaml

jpbetz

Looks good! I left a few small comments but I'm happy with how this looks.

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

jpbetz · 2023-03-20T23:17:04Z

content/en/examples/access/admission-webhook-match-conditions.yaml

+  - name: 'breakglass'
+    # Skip requests made by users authorized to 'breakglass' on this webhook.
+    # The 'breakglass' API verb does not need to exist outside this check.
+    expression: 'authorizer.group('admissionregistration.k8s.io').resource('validatingwebhookconfigurations').name('my-webhook.example.com').check('breakglass').denied()'


I love everything about this example.

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

jpbetz · 2023-03-20T23:49:03Z

/lgtm
For technical content

k8s-ci-robot · 2023-03-20T23:49:10Z

LGTM label has been added.

Git tree hash: 3edc1fa69c704cff8764d7e211237a07f0bf9830

liggitt · 2023-03-21T13:57:27Z

content/en/examples/access/admission-webhook-match-conditions.yaml

+    expression: '!(request.resource.group == "coordination.k8s.io" && request.resource.resource == "leases")' # Match non-lease resources.
+  - name: 'exclude-kubelet-requests'
+    expression: '!("system:nodes" in request.userInfo.groups)' # Match requests made by non-node users.
+  - name: 'breakglass'


I know this is just an example, but I would hate to see people mimic putting an authorizer condition on an admission policy that matches */*/* ... doesn't this mean we run another authorization check on every API request?

edit: I guess the part I consider an anti-pattern is matching */*/*, not necessarily the authz check, but I worry that people who previously wouldn't dream of matching */*/* will think it's ok to do so if they guard it with an authz check, which can be somewhat expensive depending on webhook authz config

To narrow it, how about changing it to be a restriction on RBAC changes? That's a believable-enough story and something often worth protecting.

Narrowing the rules weakens the "everything except leases" example. How about this: use short-circuiting to scope just the authorization check to RBAC? Is that getting too convoluted?

Narrowing the rules weakens the "everything except leases" example.

I agree

How about this: use short-circuiting to scope just the authorization check to RBAC? Is that getting too convoluted?

Maybe a little? Would two different examples be easier to follow?

A */*/* policy that excludes leases, and node requests using conditions

A policy on something important like RBAC or networkpolicies that has an authorization-based breakglass

How's this? I put the RBAC check on a separate webhook (and also added a couple missing fields)

I like that better, thanks

content/en/examples/access/admission-webhook-match-conditions.yaml

liggitt · 2023-03-21T14:07:52Z

lgtm overall

tallclair · 2023-03-21T15:41:58Z

/label tide/merge-method-squash

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

content/en/docs/reference/command-line-tools-reference/feature-gates.md

content/en/examples/access/admission-webhook-match-conditions.yaml

sftim · 2023-03-21T17:07:28Z

content/en/examples/access/admission-webhook-match-conditions.yaml

+  sideEffects: None
+  clientConfig: {} # Omitted for this example
+  matchConditions:
+  - name: 'breakglass'


Suggested change

- name: 'breakglass'

- name: 'breakglass' # again, each match condition must have a unique name

They don't need to be globally unique. This feels superfluous here?

content/en/docs/reference/command-line-tools-reference/feature-gates.md

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

netlify · 2023-03-28T20:26:27Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`d481c4e`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/64234d6ea076d60008ca608d

tengqm · 2023-03-31T05:56:37Z

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

+{{< feature-state state="alpha" for_k8s_version="v1.27" >}}
+
+{{< note >}}
+Use of `matchConditions` requires the [featuregate](/docs/reference/command-line-tools-reference/feature-gates/)


Suggested change

Use of `matchConditions` requires the [featuregate](/docs/reference/command-line-tools-reference/feature-gates/)

Use of `matchConditions` requires the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/)

tengqm · 2023-03-31T05:56:57Z

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

+`AdmissionWebhookMatchConditions` to be explicitly enabled on the kube-apiserver before this feature can be used.
+{{< /note >}}
+
+You can define _match conditions_for webhooks if you need fine-grained request filtering. These


Suggested change

You can define _match conditions_for webhooks if you need fine-grained request filtering. These

You can define _match conditions_ for webhooks if you need fine-grained request filtering. These

tengqm · 2023-03-31T05:57:33Z

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

+{{< /note >}}
+
+You can define _match conditions_for webhooks if you need fine-grained request filtering. These
+conditions are useful if you find that match rules, `objectSelectors` and `namespaceSelectors` still


Suggested change

conditions are useful if you find that match rules, `objectSelectors` and `namespaceSelectors` still

conditions are useful if you find that match rules, `objectSelectors` and `namespaceSelectors`, still

tengqm · 2023-03-31T06:00:22Z

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

+    - for [`failurePolicy: Fail`](#failure-policy), reject the request (without calling the webhook).
+    - for [`failurePolicy: Ignore`](#failure-policy), proceed with the request but skip the webhook.


Nit: Avoid 4-spaces indentation when possible. Sometimes the YAML parser may treat it as a code snippet.

Suggested change

- for [`failurePolicy: Fail`](#failure-policy), reject the request (without calling the webhook).

- for [`failurePolicy: Ignore`](#failure-policy), proceed with the request but skip the webhook.

- for [`failurePolicy: Fail`](#failure-policy), reject the request (without calling the webhook).

- for [`failurePolicy: Ignore`](#failure-policy), proceed with the request but skip the webhook.

tengqm · 2023-03-31T06:00:52Z

content/en/docs/reference/command-line-tools-reference/feature-gates.md

@@ -56,6 +56,7 @@ For a reference to old feature gates that are removed, please refer to

 | Feature | Default | Stage | Since | Until |
 |---------|---------|-------|-------|-------|
+| `AdmissionWebhookMatchConditions` | Alpha | `false` | 1.27 | |


Move this before line 70?

tengqm · 2023-03-31T06:01:11Z

content/en/docs/reference/command-line-tools-reference/feature-gates.md

@@ -368,6 +369,7 @@ A *General Availability* (GA) feature is also referred to as a *stable* feature.

 Each feature gate is designed for enabling/disabling a specific feature:

+- `AdmissionWebhookMatchConditions`: Enable [match conditions](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions) on mutating & validating admission webhooks.


Suggested change

- `AdmissionWebhookMatchConditions`: Enable [match conditions](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions) on mutating & validating admission webhooks.

- `AdmissionWebhookMatchConditions`: Enable [match conditions](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions)

on mutating & validating admission webhooks.

tengqm · 2023-03-31T06:02:14Z

/approve
There are some nits to fix if there is another commit.

k8s-ci-robot · 2023-03-31T06:02:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tengqm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [tengqm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

reylejano · 2023-04-03T15:22:29Z

/lgtm

k8s-ci-robot · 2023-04-03T15:22:38Z

LGTM label has been added.

Git tree hash: 2628295bcd8762d7e6eb0e1f43ef79cd409b38fe

* AdmissionWebhookMatchConditions feature documentation * #squash ivelichkovich feedback * #squash sftim feedback * Correct statement about request.object * #squash: sftim feedback * #squash jpbetz feedback * #squash: denied function removed * #squash fix match conditions example * #squash fix expression quoting * #squash scope authorizatoin check example * #squash separate RBAC webhook example * #squash sftim feedback * #squash add shared client config for example * Don't use yaml anchors in example

k8s-ci-robot added this to the 1.27 milestone Mar 16, 2023

k8s-ci-robot requested review from liggitt and ivelichkovich March 16, 2023 19:06

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 16, 2023

AdmissionWebhookMatchConditions feature documentation

b1e6989

tallclair force-pushed the match-conditions-1.27 branch from c0fd4cb to b1e6989 Compare March 16, 2023 19:08

tallclair mentioned this pull request Mar 16, 2023

CEL-based admission webhook match conditions kubernetes/enhancements#3716

Closed

12 tasks

ivelichkovich reviewed Mar 16, 2023

View reviewed changes

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md Outdated Show resolved Hide resolved

ivelichkovich reviewed Mar 16, 2023

View reviewed changes

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md Show resolved Hide resolved

ivelichkovich reviewed Mar 16, 2023

View reviewed changes

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md Outdated Show resolved Hide resolved

sftim reviewed Mar 16, 2023

View reviewed changes

tallclair added 2 commits March 16, 2023 17:15

#squash ivelichkovich feedback

4b8c069

#squash sftim feedback

78211e8

tallclair force-pushed the match-conditions-1.27 branch from 9f8fb44 to 78211e8 Compare March 17, 2023 00:15

sftim reviewed Mar 17, 2023

View reviewed changes

content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md Outdated Show resolved Hide resolved

sftim reviewed Mar 17, 2023

View reviewed changes

content/en/examples/access/admission-webhook-match-conditions.yaml Outdated Show resolved Hide resolved

tallclair added 2 commits March 17, 2023 16:07

Correct statement about request.object

eab18a7

#squash: sftim feedback

3c9e5ae

jpbetz reviewed Mar 20, 2023

View reviewed changes

#squash jpbetz feedback

cc8311b

k8s-ci-robot assigned jpbetz Mar 20, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 20, 2023

#squash: denied function removed

734f7d2

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 21, 2023

k8s-ci-robot requested a review from jpbetz March 21, 2023 01:15

#squash fix match conditions example

57cbcee

liggitt reviewed Mar 21, 2023

View reviewed changes

content/en/examples/access/admission-webhook-match-conditions.yaml Outdated Show resolved Hide resolved

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Mar 21, 2023

tallclair added 3 commits March 21, 2023 09:03

#squash fix expression quoting

57905e9

#squash scope authorizatoin check example

eb46678

#squash separate RBAC webhook example

d62ec37

sftim reviewed Mar 21, 2023

View reviewed changes

tallclair added 2 commits March 21, 2023 10:23

#squash sftim feedback

9a01d12

#squash add shared client config for example

ccd2e0a

jpbetz mentioned this pull request Mar 24, 2023

CEL for Admission Control kubernetes/enhancements#3488

Open

16 tasks

Don't use yaml anchors in example

d481c4e

tengqm reviewed Mar 31, 2023

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 31, 2023

k8s-ci-robot assigned reylejano Apr 3, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 3, 2023

k8s-ci-robot merged commit 27460b2 into kubernetes:dev-1.27 Apr 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AdmissionWebhookMatchConditions feature documentation #40058

AdmissionWebhookMatchConditions feature documentation #40058

tallclair commented Mar 16, 2023

k8s-ci-robot commented Mar 16, 2023

sftim left a comment

tallclair commented Mar 17, 2023

sftim left a comment

jpbetz left a comment

jpbetz Mar 20, 2023

jpbetz commented Mar 20, 2023

k8s-ci-robot commented Mar 20, 2023

liggitt Mar 21, 2023 •

edited

Loading

sftim Mar 21, 2023

tallclair Mar 21, 2023

liggitt Mar 21, 2023 •

edited

Loading

tallclair Mar 21, 2023

liggitt Mar 21, 2023

liggitt commented Mar 21, 2023

tallclair commented Mar 21, 2023

sftim Mar 21, 2023

tallclair Mar 21, 2023

netlify bot commented Mar 28, 2023

tengqm Mar 31, 2023

tengqm Mar 31, 2023

tengqm Mar 31, 2023

tengqm Mar 31, 2023

tengqm Mar 31, 2023

tengqm Mar 31, 2023

tengqm commented Mar 31, 2023

k8s-ci-robot commented Mar 31, 2023

reylejano commented Apr 3, 2023

k8s-ci-robot commented Apr 3, 2023

	- name: 'breakglass'
	- name: 'breakglass' # again, each match condition must have a unique name

	Use of `matchConditions` requires the [featuregate](/docs/reference/command-line-tools-reference/feature-gates/)
	Use of `matchConditions` requires the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/)

	You can define _match conditions_for webhooks if you need fine-grained request filtering. These
	You can define _match conditions_ for webhooks if you need fine-grained request filtering. These

	conditions are useful if you find that match rules, `objectSelectors` and `namespaceSelectors` still
	conditions are useful if you find that match rules, `objectSelectors` and `namespaceSelectors`, still

		- for [`failurePolicy: Fail`](#failure-policy), reject the request (without calling the webhook).
		- for [`failurePolicy: Ignore`](#failure-policy), proceed with the request but skip the webhook.

		@@ -368,6 +369,7 @@ A General Availability (GA) feature is also referred to as a stable feature.

		Each feature gate is designed for enabling/disabling a specific feature:

		- `AdmissionWebhookMatchConditions`: Enable [match conditions](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions) on mutating & validating admission webhooks.

	- `AdmissionWebhookMatchConditions`: Enable [match conditions](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions) on mutating & validating admission webhooks.
	- `AdmissionWebhookMatchConditions`: Enable [match conditions](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions)
	on mutating & validating admission webhooks.

AdmissionWebhookMatchConditions feature documentation #40058

AdmissionWebhookMatchConditions feature documentation #40058

Conversation

tallclair commented Mar 16, 2023

k8s-ci-robot commented Mar 16, 2023

sftim left a comment

Choose a reason for hiding this comment

tallclair commented Mar 17, 2023

sftim left a comment

Choose a reason for hiding this comment

jpbetz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jpbetz commented Mar 20, 2023

k8s-ci-robot commented Mar 20, 2023

liggitt Mar 21, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt Mar 21, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Mar 21, 2023

tallclair commented Mar 21, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

netlify bot commented Mar 28, 2023

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tengqm commented Mar 31, 2023

k8s-ci-robot commented Mar 31, 2023

reylejano commented Apr 3, 2023

k8s-ci-robot commented Apr 3, 2023

liggitt Mar 21, 2023 •

edited

Loading

liggitt Mar 21, 2023 •

edited

Loading