Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement CEL for Admission Control #113314

Merged
merged 10 commits into from Nov 8, 2022
Merged

Implement CEL for Admission Control #113314

merged 10 commits into from Nov 8, 2022

Conversation

cici37
Copy link
Contributor

@cici37 cici37 commented Oct 25, 2022 •
edited

What type of PR is this?

/kind feature

What this PR does / why we need it:

Introduce v1alpha1 API for validating admission policies, enabling extensible admission control via CEL expressions (KEP 3488: CEL for Admission Control). To use enable the CELValidatingAdmission feature gate and the admissionregistration.k8s.io/v1alpha1 API via --runtime-config.

Co-authored with: @alexzielenski @jpbetz @jiahuif @liggitt @maxsmythe @DangerOnTheRanger

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Introduce v1alpha1 API for validating admission policies, enabling extensible admission control via CEL expressions (KEP  3488: CEL for Admission Control). To use, enable the `ValidatingAdmissionPolicy` feature gate and the `admissionregistration.k8s.io/v1alpha1` API via `--runtime-config`.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/3488-cel-admission-control

@k8s-ci-robot
Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/feature Categorizes issue or PR as related to a new feature. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. area/apiserver area/code-generation area/test kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 25, 2022
@leilajal
Copy link
Contributor

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Oct 27, 2022
@leilajal
Copy link
Contributor

/triage accepted

@liggitt
Copy link
Member

liggitt commented Oct 27, 2022

f39bddd#diff-8373713a13b6954db9e75feb56822affd3ea92e57ded202a1b14933bfca8c21aR138 is a breadcrumb to adding an admission plugin that looks at feature gates to know if it should be active/enabled or not

@cici37 cici37 mentioned this pull request Oct 28, 2022
Closed
9 tasks
@cici37 cici37 force-pushed the celIntegration branch 2 times, most recently from dd8f3e6 to e13fbe5 Compare October 31, 2022 05:21
@cici37
Copy link
Contributor Author

cici37 commented Oct 31, 2022

/test all

@cici37 cici37 mentioned this pull request Oct 31, 2022
Closed
@liggitt
Copy link
Member

liggitt commented Nov 7, 2022

all my blocking comments are addressed, and non-blocking comments are captured in graduation criteria and/or follow-up tasks

this lgtm

@jiahuif
Copy link
Member

jiahuif commented Nov 7, 2022

/retest

@liggitt
Copy link
Member

liggitt commented Nov 7, 2022

integration failure is unrelated, caused by #113651 and has a fix in progress

@cici37
Adding new api version of admissionregistration.k8s.io v1alpha1 for C…
0486e06 
…EL in Admission Control
@cici37
API - make update
19b2df8 
API - Auto update

API - make update

API - make update
@cici37
Vendor update
a949227
@cici37 cici37 force-pushed the celIntegration branch 2 times, most recently from a949227 to 1f27b1d Compare November 7, 2022 21:15
cici37 and others added 5 commits November 7, 2022 21:24
@cici37
Update admission initializers.
c8a089d 
Moved RestMapper and add DynamicClient
@cici37 @jiahuif @liggitt
Add Authz check to validate policy and binding.
d3f4813 
Co-authored-by: Jiahui Feng <jhf@google.com>
Co-authored-by: Jordan Liggitt <liggitt@google.com>
@cici37 @maxsmythe
Add match check for policy and binding.
46f97d4 
Co-authored-by: Max Smythe <smythe@google.com>
@cici37 @DangerOnTheRanger
Add integration test.
d86cfa9 
Co-authored-by: Kermit Alexander II <kermitalexandr@google.com>
@cici37 @alexzielenski @jpbetz
Integrate cel admission with API.
e7d83a1 
Co-authored-by: Alexander Zielenski <zielenski@google.com>
Co-authored-by: Joe Betz <jpbetz@google.com>
@liggitt
Copy link
Member

liggitt commented Nov 7, 2022

/lgtm
/approve

API review completed in #112883 (and doc/validation tweaked in this PR)

additional implementation review and lgtm by @jpbetz (#113314 (comment)), @alexzielenski (#113314 (comment)), and @jiahuif (#113314 (comment))

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 7, 2022
@liggitt liggitt added this to API review completed, 1.26 in API Reviews Nov 7, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cici37, jpbetz, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 7, 2022
@liggitt liggitt mentioned this pull request Nov 8, 2022
Merged
@k8s-ci-robot k8s-ci-robot merged commit 595ea32 into kubernetes:master Nov 8, 2022
@k8s-ci-robot k8s-ci-robot added this to the v1.26 milestone Nov 8, 2022
@cici37 cici37 deleted the celIntegration branch November 8, 2022 01:10
@cici37 cici37 changed the title CEL validation in Admission chain Implement CEL for Admission Control Nov 8, 2022
This was referenced Nov 9, 2022
Merged
Closed
@DangerOnTheRanger DangerOnTheRanger mentioned this pull request Nov 17, 2022
Merged
@pacoxu pacoxu mentioned this pull request Dec 29, 2022
Closed
@alexzielenski alexzielenski mentioned this pull request Jul 20, 2023
Merged
43 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@alexzielenski alexzielenski alexzielenski requested changes

@jpbetz jpbetz jpbetz requested changes

@liggitt liggitt liggitt left review comments

@DangerOnTheRanger DangerOnTheRanger DangerOnTheRanger left review comments

@jiahuif jiahuif jiahuif left review comments

@maxsmythe maxsmythe maxsmythe left review comments

@caesarxuchao caesarxuchao Awaiting requested review from caesarxuchao

@dchen1107 dchen1107 Awaiting requested review from dchen1107

@aojea aojea Awaiting requested review from aojea

Assignees

@jpbetz jpbetz

@liggitt liggitt

@jiahuif jiahuif

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver area/cloudprovider area/code-generation area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
API Reviews
Status: API review completed, 1.26
Milestone
v1.26
Development

Successfully merging this pull request may close these issues.

None yet
10 participants
@cici37 @k8s-ci-robot @leilajal @liggitt @k8s-triage-robot @jpbetz @alexzielenski @maxsmythe @jiahuif @DangerOnTheRanger