Merge pull request kubernetes#74154 from mbohlool/gimli

Use Request Object interfaces instead of static scheme that is more appropriate for CRDs

cmd/kube-apiserver/app/aggregator.go

@@ -70,7 +70,6 @@ func createAggregatorConfig(
  &genericConfig,
  externalInformers,
  genericConfig.LoopbackClientConfig,
- aggregatorscheme.Scheme,
  pluginInitializers...)
  if err != nil {
  return nil, err

cmd/kube-apiserver/app/apiextensions.go

@@ -52,7 +52,6 @@ func createAPIExtensionsConfig(
  &genericConfig,
  externalInformers,
  genericConfig.LoopbackClientConfig,
- apiextensionsapiserver.Scheme,
  pluginInitializers...)
  if err != nil {
  return nil, err

cmd/kube-apiserver/app/server.go

@@ -491,7 +491,6 @@ func buildGenericConfig(
  genericConfig,
  versionedInformers,
  kubeClientConfig,
- legacyscheme.Scheme,
  pluginInitializers...)
  if err != nil {
  lastErr = fmt.Errorf("failed to initialize admission: %v", err)

pkg/kubeapiserver/admission/initializer_test.go

@@ -24,7 +24,9 @@ import (
 
 type doNothingAdmission struct{}
 
-func (doNothingAdmission) Admit(a admission.Attributes) error { return nil }
+func (doNothingAdmission) Admit(a admission.Attributes, o admission.ObjectInterfaces) error {
+ return nil
+}
 func (doNothingAdmission) Handles(o admission.Operation) bool { return false }
 func (doNothingAdmission) Validate() error { return nil }
 

pkg/kubeapiserver/options/BUILD

@@ -51,7 +51,6 @@ go_library(
  "//plugin/pkg/admission/storage/persistentvolume/resize:go_default_library",
  "//plugin/pkg/admission/storage/storageclass/setdefault:go_default_library",
  "//plugin/pkg/admission/storage/storageobjectinuseprotection:go_default_library",
- "//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",
  "//staging/src/k8s.io/apimachinery/pkg/util/net:go_default_library",
  "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
  "//staging/src/k8s.io/apiserver/pkg/admission:go_default_library",

pkg/kubeapiserver/options/admission.go

@@ -22,7 +22,6 @@ import (
 
  "github.com/spf13/pflag"
 
- "k8s.io/apimachinery/pkg/runtime"
  "k8s.io/apimachinery/pkg/util/sets"
  "k8s.io/apiserver/pkg/admission"
  "k8s.io/apiserver/pkg/server"
@@ -108,7 +107,6 @@ func (a *AdmissionOptions) ApplyTo(
  c *server.Config,
  informers informers.SharedInformerFactory,
  kubeAPIServerClientConfig *rest.Config,
- scheme *runtime.Scheme,
  pluginInitializers ...admission.PluginInitializer,
 ) error {
  if a == nil {
@@ -120,7 +118,7 @@ func (a *AdmissionOptions) ApplyTo(
  a.GenericAdmission.EnablePlugins, a.GenericAdmission.DisablePlugins = computePluginNames(a.PluginNames, a.GenericAdmission.RecommendedPluginOrder)
  }
 
- return a.GenericAdmission.ApplyTo(c, informers, kubeAPIServerClientConfig, scheme, pluginInitializers...)
+ return a.GenericAdmission.ApplyTo(c, informers, kubeAPIServerClientConfig, pluginInitializers...)
 }
 
 // explicitly disable all plugins that are not in the enabled list

plugin/pkg/admission/admit/admission.go

@@ -40,12 +40,12 @@ var _ admission.MutationInterface = alwaysAdmit{}
 var _ admission.ValidationInterface = alwaysAdmit{}
 
 // Admit makes an admission decision based on the request attributes
-func (alwaysAdmit) Admit(a admission.Attributes) (err error) {
+func (alwaysAdmit) Admit(a admission.Attributes, o admission.ObjectInterfaces) (err error) {
  return nil
 }
 
 // Validate makes an admission decision based on the request attributes. It is NOT allowed to mutate.
-func (alwaysAdmit) Validate(a admission.Attributes) (err error) {
+func (alwaysAdmit) Validate(a admission.Attributes, o admission.ObjectInterfaces) (err error) {
  return nil
 }
 

plugin/pkg/admission/admit/admission_test.go

@@ -25,15 +25,15 @@ import (
 
 func TestAdmissionNonNilAttribute(t *testing.T) {
  handler := NewAlwaysAdmit()
- err := handler.(*alwaysAdmit).Admit(admission.NewAttributesRecord(nil, nil, api.Kind("kind").WithVersion("version"), "namespace", "name", api.Resource("resource").WithVersion("version"), "subresource", admission.Create, false, nil))
+ err := handler.(*alwaysAdmit).Admit(admission.NewAttributesRecord(nil, nil, api.Kind("kind").WithVersion("version"), "namespace", "name", api.Resource("resource").WithVersion("version"), "subresource", admission.Create, false, nil), nil)
  if err != nil {
  t.Errorf("Unexpected error returned from admission handler")
  }
 }
 
 func TestAdmissionNilAttribute(t *testing.T) {
  handler := NewAlwaysAdmit()
- err := handler.(*alwaysAdmit).Admit(nil)
+ err := handler.(*alwaysAdmit).Admit(nil, nil)
  if err != nil {
  t.Errorf("Unexpected error returned from admission handler")
  }

plugin/pkg/admission/alwayspullimages/admission.go

@@ -53,7 +53,7 @@ var _ admission.MutationInterface = &AlwaysPullImages{}
 var _ admission.ValidationInterface = &AlwaysPullImages{}
 
 // Admit makes an admission decision based on the request attributes
-func (a *AlwaysPullImages) Admit(attributes admission.Attributes) (err error) {
+func (a *AlwaysPullImages) Admit(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  // Ignore all calls to subresources or resources other than pods.
  if shouldIgnore(attributes) {
  return nil
@@ -75,7 +75,7 @@ func (a *AlwaysPullImages) Admit(attributes admission.Attributes) (err error) {
 }
 
 // Validate makes sure that all containers are set to always pull images
-func (*AlwaysPullImages) Validate(attributes admission.Attributes) (err error) {
+func (*AlwaysPullImages) Validate(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  if shouldIgnore(attributes) {
  return nil
  }

plugin/pkg/admission/alwayspullimages/admission_test.go

@@ -47,7 +47,7 @@ func TestAdmission(t *testing.T) {
  },
  },
  }
- err := handler.Admit(admission.NewAttributesRecord(&pod, nil, api.Kind("Pod").WithVersion("version"), pod.Namespace, pod.Name, api.Resource("pods").WithVersion("version"), "", admission.Create, false, nil))
+ err := handler.Admit(admission.NewAttributesRecord(&pod, nil, api.Kind("Pod").WithVersion("version"), pod.Namespace, pod.Name, api.Resource("pods").WithVersion("version"), "", admission.Create, false, nil), nil)
  if err != nil {
  t.Errorf("Unexpected error returned from admission handler")
  }
@@ -84,7 +84,7 @@ func TestValidate(t *testing.T) {
  },
  }
  expectedError := `pods "123" is forbidden: spec.initContainers[0].imagePullPolicy: Unsupported value: "": supported values: "Always"`
- err := handler.Validate(admission.NewAttributesRecord(&pod, nil, api.Kind("Pod").WithVersion("version"), pod.Namespace, pod.Name, api.Resource("pods").WithVersion("version"), "", admission.Create, false, nil))
+ err := handler.Validate(admission.NewAttributesRecord(&pod, nil, api.Kind("Pod").WithVersion("version"), pod.Namespace, pod.Name, api.Resource("pods").WithVersion("version"), "", admission.Create, false, nil), nil)
  if err == nil {
  t.Fatal("missing expected error")
  }
@@ -139,7 +139,7 @@ func TestOtherResources(t *testing.T) {
  for _, tc := range tests {
  handler := &AlwaysPullImages{}
 
- err := handler.Admit(admission.NewAttributesRecord(tc.object, nil, api.Kind(tc.kind).WithVersion("version"), namespace, name, api.Resource(tc.resource).WithVersion("version"), tc.subresource, admission.Create, false, nil))
+ err := handler.Admit(admission.NewAttributesRecord(tc.object, nil, api.Kind(tc.kind).WithVersion("version"), namespace, name, api.Resource(tc.resource).WithVersion("version"), tc.subresource, admission.Create, false, nil), nil)
 
  if tc.expectError {
  if err == nil {

plugin/pkg/admission/antiaffinity/admission.go

@@ -51,7 +51,7 @@ func NewInterPodAntiAffinity() *Plugin {
 
 // Validate will deny any pod that defines AntiAffinity topology key other than v1.LabelHostname i.e. "kubernetes.io/hostname"
 // in requiredDuringSchedulingRequiredDuringExecution and requiredDuringSchedulingIgnoredDuringExecution.
-func (p *Plugin) Validate(attributes admission.Attributes) (err error) {
+func (p *Plugin) Validate(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  // Ignore all calls to subresources or resources other than pods.
  if len(attributes.GetSubresource()) != 0 || attributes.GetResource().GroupResource() != api.Resource("pods") {
  return nil

plugin/pkg/admission/antiaffinity/admission_test.go

@@ -199,7 +199,7 @@ func TestInterPodAffinityAdmission(t *testing.T) {
  }
  for _, test := range tests {
  pod.Spec.Affinity = test.affinity
- err := handler.Validate(admission.NewAttributesRecord(&pod, nil, api.Kind("Pod").WithVersion("version"), "foo", "name", api.Resource("pods").WithVersion("version"), "", "ignored", false, nil))
+ err := handler.Validate(admission.NewAttributesRecord(&pod, nil, api.Kind("Pod").WithVersion("version"), "foo", "name", api.Resource("pods").WithVersion("version"), "", "ignored", false, nil), nil)
 
  if test.errorExpected && err == nil {
  t.Errorf("Expected error for Anti Affinity %+v but did not get an error", test.affinity)
@@ -267,7 +267,7 @@ func TestOtherResources(t *testing.T) {
  for _, tc := range tests {
  handler := &Plugin{}
 
- err := handler.Validate(admission.NewAttributesRecord(tc.object, nil, api.Kind(tc.kind).WithVersion("version"), namespace, name, api.Resource(tc.resource).WithVersion("version"), tc.subresource, admission.Create, false, nil))
+ err := handler.Validate(admission.NewAttributesRecord(tc.object, nil, api.Kind(tc.kind).WithVersion("version"), namespace, name, api.Resource(tc.resource).WithVersion("version"), tc.subresource, admission.Create, false, nil), nil)
 
  if tc.expectError {
  if err == nil {

plugin/pkg/admission/defaulttolerationseconds/admission.go

@@ -81,7 +81,7 @@ func NewDefaultTolerationSeconds() *Plugin {
 }
 
 // Admit makes an admission decision based on the request attributes
-func (p *Plugin) Admit(attributes admission.Attributes) (err error) {
+func (p *Plugin) Admit(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  if attributes.GetResource().GroupResource() != api.Resource("pods") {
  return nil
  }

plugin/pkg/admission/defaulttolerationseconds/admission_test.go

@@ -263,7 +263,7 @@ func TestForgivenessAdmission(t *testing.T) {
  }
 
  for _, test := range tests {
- err := handler.Admit(admission.NewAttributesRecord(&test.requestedPod, nil, api.Kind("Pod").WithVersion("version"), "foo", "name", api.Resource("pods").WithVersion("version"), "", "ignored", false, nil))
+ err := handler.Admit(admission.NewAttributesRecord(&test.requestedPod, nil, api.Kind("Pod").WithVersion("version"), "foo", "name", api.Resource("pods").WithVersion("version"), "", "ignored", false, nil), nil)
  if err != nil {
  t.Errorf("[%s]: unexpected error %v for pod %+v", test.description, err, test.requestedPod)
  }

plugin/pkg/admission/deny/admission.go

@@ -42,12 +42,12 @@ var _ admission.MutationInterface = alwaysDeny{}
 var _ admission.ValidationInterface = alwaysDeny{}
 
 // Admit makes an admission decision based on the request attributes.
-func (alwaysDeny) Admit(a admission.Attributes) (err error) {
+func (alwaysDeny) Admit(a admission.Attributes, o admission.ObjectInterfaces) (err error) {
  return admission.NewForbidden(a, errors.New("admission control is denying all modifications"))
 }
 
 // Validate makes an admission decision based on the request attributes. It is NOT allowed to mutate.
-func (alwaysDeny) Validate(a admission.Attributes) (err error) {
+func (alwaysDeny) Validate(a admission.Attributes, o admission.ObjectInterfaces) (err error) {
  return admission.NewForbidden(a, errors.New("admission control is denying all modifications"))
 }
 

plugin/pkg/admission/deny/admission_test.go

@@ -25,7 +25,7 @@ import (
 
 func TestAdmission(t *testing.T) {
  handler := NewAlwaysDeny()
- err := handler.(*alwaysDeny).Admit(admission.NewAttributesRecord(nil, nil, api.Kind("kind").WithVersion("version"), "namespace", "name", api.Resource("resource").WithVersion("version"), "subresource", admission.Create, false, nil))
+ err := handler.(*alwaysDeny).Admit(admission.NewAttributesRecord(nil, nil, api.Kind("kind").WithVersion("version"), "namespace", "name", api.Resource("resource").WithVersion("version"), "subresource", admission.Create, false, nil), nil)
  if err == nil {
  t.Error("Expected error returned from admission handler")
  }

plugin/pkg/admission/eventratelimit/admission.go

@@ -81,7 +81,7 @@ func newEventRateLimit(config *eventratelimitapi.Configuration, clock flowcontro
 }
 
 // Validate makes admission decisions while enforcing event rate limits
-func (a *Plugin) Validate(attr admission.Attributes) (err error) {
+func (a *Plugin) Validate(attr admission.Attributes, o admission.ObjectInterfaces) (err error) {
  // ignore all operations that do not correspond to an Event kind
  if attr.GetKind().GroupKind() != api.Kind("Event") {
  return nil

plugin/pkg/admission/eventratelimit/admission_test.go

@@ -504,7 +504,7 @@ func TestEventRateLimiting(t *testing.T) {
  clock.Step(rq.delay)
  }
  attributes := attributesForRequest(rq)
- err = eventratelimit.Validate(attributes)
+ err = eventratelimit.Validate(attributes, nil)
  if rq.accepted != (err == nil) {
  expectedAction := "admitted"
  if !rq.accepted {

plugin/pkg/admission/exec/admission.go

@@ -111,7 +111,7 @@ func (d *DenyExec) ValidateInitialization() error {
 }
 
 // Validate makes an admission decision based on the request attributes
-func (d *DenyExec) Validate(a admission.Attributes) (err error) {
+func (d *DenyExec) Validate(a admission.Attributes, o admission.ObjectInterfaces) (err error) {
  path := a.GetResource().Resource
  if subresource := a.GetSubresource(); subresource != "" {
  path = path + "/" + subresource

plugin/pkg/admission/exec/admission_test.go

@@ -120,7 +120,7 @@ func testAdmission(t *testing.T, pod *corev1.Pod, handler *DenyExec, shouldAccep
 
  // pods/exec
  {
- err := handler.Validate(admission.NewAttributesRecord(nil, nil, api.Kind("Pod").WithVersion("version"), "test", pod.Name, api.Resource("pods").WithVersion("version"), "exec", admission.Connect, false, nil))
+ err := handler.Validate(admission.NewAttributesRecord(nil, nil, api.Kind("Pod").WithVersion("version"), "test", pod.Name, api.Resource("pods").WithVersion("version"), "exec", admission.Connect, false, nil), nil)
  if shouldAccept && err != nil {
  t.Errorf("Unexpected error returned from admission handler: %v", err)
  }
@@ -131,7 +131,7 @@ func testAdmission(t *testing.T, pod *corev1.Pod, handler *DenyExec, shouldAccep
 
  // pods/attach
  {
- err := handler.Validate(admission.NewAttributesRecord(nil, nil, api.Kind("Pod").WithVersion("version"), "test", pod.Name, api.Resource("pods").WithVersion("version"), "attach", admission.Connect, false, nil))
+ err := handler.Validate(admission.NewAttributesRecord(nil, nil, api.Kind("Pod").WithVersion("version"), "test", pod.Name, api.Resource("pods").WithVersion("version"), "attach", admission.Connect, false, nil), nil)
  if shouldAccept && err != nil {
  t.Errorf("Unexpected error returned from admission handler: %v", err)
  }

plugin/pkg/admission/extendedresourcetoleration/admission.go

@@ -56,7 +56,7 @@ type plugin struct {
 // a toleration with key "example.com/device", operator "Exists" and effect "NoSchedule".
 // The rationale for this is described in:
 // https://github.com/kubernetes/kubernetes/issues/55080
-func (p *plugin) Admit(attributes admission.Attributes) error {
+func (p *plugin) Admit(attributes admission.Attributes, o admission.ObjectInterfaces) error {
  // Ignore all calls to subresources or resources other than pods.
  if len(attributes.GetSubresource()) != 0 || attributes.GetResource().GroupResource() != core.Resource("pods") {
  return nil

plugin/pkg/admission/extendedresourcetoleration/admission_test.go

@@ -354,7 +354,7 @@ func TestAdmit(t *testing.T) {
  },
  }
  for i, test := range tests {
- err := plugin.Admit(admission.NewAttributesRecord(&test.requestedPod, nil, core.Kind("Pod").WithVersion("version"), "foo", "name", core.Resource("pods").WithVersion("version"), "", "ignored", false, nil))
+ err := plugin.Admit(admission.NewAttributesRecord(&test.requestedPod, nil, core.Kind("Pod").WithVersion("version"), "foo", "name", core.Resource("pods").WithVersion("version"), "", "ignored", false, nil), nil)
  if err != nil {
  t.Errorf("[%d: %s] unexpected error %v for pod %+v", i, test.description, err, test.requestedPod)
  }

plugin/pkg/admission/gc/gc_admission.go

@@ -84,7 +84,7 @@ func (a *gcPermissionsEnforcement) isWhiteListed(groupResource schema.GroupResou
  return false
 }
 
-func (a *gcPermissionsEnforcement) Validate(attributes admission.Attributes) (err error) {
+func (a *gcPermissionsEnforcement) Validate(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  // // if the request is in the whitelist, we skip mutation checks for this resource.
  if a.isWhiteListed(attributes.GetResource().GroupResource(), attributes.GetSubresource()) {
  return nil

plugin/pkg/admission/gc/gc_admission_test.go

@@ -100,7 +100,7 @@ func newGCPermissionsEnforcement() (*gcPermissionsEnforcement, error) {
  whiteList: whiteList,
  }
 
- genericPluginInitializer := initializer.New(nil, nil, fakeAuthorizer{}, nil)
+ genericPluginInitializer := initializer.New(nil, nil, fakeAuthorizer{})
  fakeDiscoveryClient := &fakediscovery.FakeDiscovery{Fake: &coretesting.Fake{}}
  fakeDiscoveryClient.Resources = []*metav1.APIResourceList{
  {
@@ -308,7 +308,7 @@ func TestGCAdmission(t *testing.T) {
  user := &user.DefaultInfo{Name: tc.username}
  attributes := admission.NewAttributesRecord(tc.newObj, tc.oldObj, schema.GroupVersionKind{}, metav1.NamespaceDefault, "foo", tc.resource, tc.subresource, operation, false, user)
 
- err = gcAdmit.Validate(attributes)
+ err = gcAdmit.Validate(attributes, nil)
  if !tc.checkError(err) {
  t.Errorf("unexpected err: %v", err)
  }
@@ -611,7 +611,7 @@ func TestBlockOwnerDeletionAdmission(t *testing.T) {
  user := &user.DefaultInfo{Name: tc.username}
  attributes := admission.NewAttributesRecord(tc.newObj, tc.oldObj, schema.GroupVersionKind{}, metav1.NamespaceDefault, "foo", tc.resource, tc.subresource, operation, false, user)
 
- err := gcAdmit.Validate(attributes)
+ err := gcAdmit.Validate(attributes, nil)
  if !tc.checkError(err) {
  t.Errorf("%v: unexpected err: %v", tc.name, err)
  }

plugin/pkg/admission/imagepolicy/admission.go

@@ -131,7 +131,7 @@ func (a *Plugin) webhookError(pod *api.Pod, attributes admission.Attributes, err
 }
 
 // Validate makes an admission decision based on the request attributes
-func (a *Plugin) Validate(attributes admission.Attributes) (err error) {
+func (a *Plugin) Validate(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  // Ignore all calls to subresources or resources other than pods.
  if attributes.GetSubresource() != "" || attributes.GetResource().GroupResource() != api.Resource("pods") {
  return nil

plugin/pkg/admission/imagepolicy/admission_test.go

@@ -487,7 +487,7 @@ func TestTLSConfig(t *testing.T) {
  // Allow all and see if we get an error.
  service.Allow()
 
- err = wh.Validate(attr)
+ err = wh.Validate(attr, nil)
  if tt.wantAllowed {
  if err != nil {
  t.Errorf("expected successful admission")
@@ -509,7 +509,7 @@ func TestTLSConfig(t *testing.T) {
  }
 
  service.Deny()
- if err := wh.Validate(attr); err == nil {
+ if err := wh.Validate(attr, nil); err == nil {
  t.Errorf("%s: incorrectly admitted with DenyAll policy", tt.test)
  }
  })
@@ -526,7 +526,7 @@ type webhookCacheTestCase struct {
 func testWebhookCacheCases(t *testing.T, serv *mockService, wh *Plugin, attr admission.Attributes, tests []webhookCacheTestCase) {
  for _, test := range tests {
  serv.statusCode = test.statusCode
- err := wh.Validate(attr)
+ err := wh.Validate(attr, nil)
  authorized := err == nil
 
  if test.expectedErr && err == nil {
@@ -759,7 +759,7 @@ func TestContainerCombinations(t *testing.T) {
 
  attr := admission.NewAttributesRecord(tt.pod, nil, api.Kind("Pod").WithVersion("version"), "namespace", "", api.Resource("pods").WithVersion("version"), "", admission.Create, false, &user.DefaultInfo{})
 
- err = wh.Validate(attr)
+ err = wh.Validate(attr, nil)
  if tt.wantAllowed {
  if err != nil {
  t.Errorf("expected successful admission: %s", tt.test)
@@ -855,7 +855,7 @@ func TestDefaultAllow(t *testing.T) {
  annotations := make(map[string]string)
  attr = &fakeAttributes{attr, annotations}
 
- err = wh.Validate(attr)
+ err = wh.Validate(attr, nil)
  if tt.wantAllowed {
  if err != nil {
  t.Errorf("expected successful admission")
@@ -963,7 +963,7 @@ func TestAnnotationFiltering(t *testing.T) {
 
  attr := admission.NewAttributesRecord(pod, nil, api.Kind("Pod").WithVersion("version"), "namespace", "", api.Resource("pods").WithVersion("version"), "", admission.Create, false, &user.DefaultInfo{})
 
- err = wh.Validate(attr)
+ err = wh.Validate(attr, nil)
  if err != nil {
  t.Errorf("expected successful admission")
  }
@@ -1055,7 +1055,7 @@ func TestReturnedAnnotationAdd(t *testing.T) {
  annotations := make(map[string]string)
  attr = &fakeAttributes{attr, annotations}
 
- err = wh.Validate(attr)
+ err = wh.Validate(attr, nil)
  if !reflect.DeepEqual(annotations, tt.expectedAnnotations) {
  t.Errorf("got audit annotations: %v; want: %v", annotations, tt.expectedAnnotations)
  }