github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ValidatingAdmissionPolicy controller for Type Checking (#117377)

Browse Source 
* [API REVIEW] ValidatingAdmissionPolicyStatucController config.

worker count.

* ValidatingAdmissionPolicyStatus controller.

* remove CEL typechecking from API server.

* fix initializer tests.

* remove type checking integration tests

from API server integration tests.

* validatingadmissionpolicy-status options.

* grant access to VAP controller.

* add defaulting unit test.

* generated: ./hack/update-codegen.sh

* add OWNERS for VAP status controller.

* type checking test case.
This commit is contained in:
Jiahui Feng
2023-07-13 13:41:50 -07:00
committed by GitHub
parent a9e40bd7c6
commit 049614f884
42 changed files with 2242 additions and 1392 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
View File

@@ -441,6 +441,18 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
eventsRule(),
},
})
if utilfeature.DefaultFeatureGate.Enabled(genericfeatures.ValidatingAdmissionPolicy) {
addControllerRole(&controllerRoles, &controllerRoleBindings, rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "validatingadmissionpolicy-status-controller"},
Rules: []rbacv1.PolicyRule{
rbacv1helpers.NewRule("get", "list", "watch").Groups(admissionRegistrationGroup).
Resources("validatingadmissionpolicies").RuleOrDie(),
rbacv1helpers.NewRule("get", "patch", "update").Groups(admissionRegistrationGroup).
Resources("validatingadmissionpolicies/status").RuleOrDie(),
eventsRule(),
},
})
}
if utilfeature.DefaultFeatureGate.Enabled(genericfeatures.StorageVersionAPI) &&
utilfeature.DefaultFeatureGate.Enabled(genericfeatures.APIServerIdentity) {
addControllerRole(&controllerRoles, &controllerRoleBindings, rbacv1.ClusterRole{

41
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View File

@@ -42,26 +42,27 @@ var (
)
const (
legacyGroup = ""
appsGroup = "apps"
authenticationGroup = "authentication.k8s.io"
authorizationGroup = "authorization.k8s.io"
autoscalingGroup = "autoscaling"
batchGroup = "batch"
certificatesGroup = "certificates.k8s.io"
coordinationGroup = "coordination.k8s.io"
discoveryGroup = "discovery.k8s.io"
extensionsGroup = "extensions"
policyGroup = "policy"
rbacGroup = "rbac.authorization.k8s.io"
resourceGroup = "resource.k8s.io"
storageGroup = "storage.k8s.io"
resMetricsGroup = "metrics.k8s.io"
customMetricsGroup = "custom.metrics.k8s.io"
externalMetricsGroup = "external.metrics.k8s.io"
networkingGroup = "networking.k8s.io"
eventsGroup = "events.k8s.io"
internalAPIServerGroup = "internal.apiserver.k8s.io"
legacyGroup = ""
appsGroup = "apps"
authenticationGroup = "authentication.k8s.io"
authorizationGroup = "authorization.k8s.io"
autoscalingGroup = "autoscaling"
batchGroup = "batch"
certificatesGroup = "certificates.k8s.io"
coordinationGroup = "coordination.k8s.io"
discoveryGroup = "discovery.k8s.io"
extensionsGroup = "extensions"
policyGroup = "policy"
rbacGroup = "rbac.authorization.k8s.io"
resourceGroup = "resource.k8s.io"
storageGroup = "storage.k8s.io"
resMetricsGroup = "metrics.k8s.io"
customMetricsGroup = "custom.metrics.k8s.io"
externalMetricsGroup = "external.metrics.k8s.io"
networkingGroup = "networking.k8s.io"
eventsGroup = "events.k8s.io"
internalAPIServerGroup = "internal.apiserver.k8s.io"
admissionRegistrationGroup = "admissionregistration.k8s.io"
)
func addDefaultMetadata(obj runtime.Object) {