07f85565a2
Automatic merge from submit-queue Add initializer support to admission and uninitialized filtering to rest storage Initializers are the opposite of finalizers - they allow API clients to react to object creation and populate fields prior to other clients seeing them. High level description: 1. Add `metadata.initializers` field to all objects 2. By default, filter objects with > 0 initializers from LIST and WATCH to preserve legacy client behavior (known as partially-initialized objects) 3. Add an admission controller that populates .initializer values per type, and denies mutation of initializers except by certain privilege levels (you must have the `initialize` verb on a resource) 4. Allow partially-initialized objects to be viewed via LIST and WATCH for initializer types 5. When creating objects, the object is "held" by the server until the initializers list is empty 6. Allow some creators to bypass initialization (set initializers to `[]`), or to have the result returned immediately when the object is created. The code here should be backwards compatible for all clients because they do not see partially initialized objects unless they GET the resource directly. The watch cache makes checking for partially initialized objects cheap. Some reflectors may need to change to ask for partially-initialized objects. ```release-note Kubernetes resources, when the `Initializers` admission controller is enabled, can be initialized (defaulting or other additive functions) by other agents in the system prior to those resources being visible to other clients. An initialized resource is not visible to clients unless they request (for get, list, or watch) to see uninitialized resources with the `?includeUninitialized=true` query parameter. Once the initializers have completed the resource is then visible. Clients must have the the ability to perform the `initialize` action on a resource in order to modify it prior to initialization being completed. ```
81 lines
3.2 KiB
Go
81 lines
3.2 KiB
Go
/*
|
|
Copyright 2014 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package app
|
|
|
|
// This file exists to force the desired plugin implementations to be linked.
|
|
// This should probably be part of some configuration fed into the build for a
|
|
// given binary target.
|
|
import (
|
|
// Cloud providers
|
|
_ "k8s.io/kubernetes/pkg/cloudprovider/providers"
|
|
|
|
// Admission policies
|
|
"k8s.io/apiserver/pkg/admission"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/admit"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/alwayspullimages"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/antiaffinity"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/defaulttolerationseconds"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/deny"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/exec"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/gc"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/imagepolicy"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/initialization"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/initialresources"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/limitranger"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/namespace/autoprovision"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/namespace/exists"
|
|
noderestriction "k8s.io/kubernetes/plugin/pkg/admission/noderestriction"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/persistentvolume/label"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/podnodeselector"
|
|
podpreset "k8s.io/kubernetes/plugin/pkg/admission/podpreset"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/podtolerationrestriction"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/resourcequota"
|
|
podsecuritypolicy "k8s.io/kubernetes/plugin/pkg/admission/security/podsecuritypolicy"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/securitycontext/scdeny"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/serviceaccount"
|
|
storagedefault "k8s.io/kubernetes/plugin/pkg/admission/storageclass/default"
|
|
"k8s.io/kubernetes/plugin/pkg/admission/webhook"
|
|
)
|
|
|
|
// registerAllAdmissionPlugins registers all admission plugins
|
|
func registerAllAdmissionPlugins(plugins *admission.Plugins) {
|
|
admit.Register(plugins)
|
|
alwayspullimages.Register(plugins)
|
|
antiaffinity.Register(plugins)
|
|
defaulttolerationseconds.Register(plugins)
|
|
deny.Register(plugins)
|
|
exec.Register(plugins)
|
|
gc.Register(plugins)
|
|
imagepolicy.Register(plugins)
|
|
initialization.Register(plugins)
|
|
initialresources.Register(plugins)
|
|
limitranger.Register(plugins)
|
|
autoprovision.Register(plugins)
|
|
exists.Register(plugins)
|
|
noderestriction.Register(plugins)
|
|
label.Register(plugins)
|
|
podnodeselector.Register(plugins)
|
|
podpreset.Register(plugins)
|
|
podtolerationrestriction.Register(plugins)
|
|
resourcequota.Register(plugins)
|
|
podsecuritypolicy.Register(plugins)
|
|
scdeny.Register(plugins)
|
|
serviceaccount.Register(plugins)
|
|
storagedefault.Register(plugins)
|
|
webhook.Register(plugins)
|
|
}
|