-
Notifications
You must be signed in to change notification settings - Fork 38.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
MessageExpression for ValidatingAdmissionPolicy #116397
MessageExpression for ValidatingAdmissionPolicy #116397
Conversation
/triage accepted |
19434f7
to
ff7f5c7
Compare
ff7f5c7
to
1cad54b
Compare
80a2288
to
2ac6120
Compare
2ac6120
to
46fcb76
Compare
// runtimeCELCostBudget was added for testing purpose only. Callers should always use const RuntimeCELCostBudget from k8s.io/apiserver/pkg/apis/cel/config.go as input. | ||
ForInput(ctx context.Context, versionedAttr *admission.VersionedAttributes, request *v1.AdmissionRequest, optionalVars OptionalVariableBindings, runtimeCELCostBudget int64) ([]EvaluationResult, error) | ||
// If cost budget is calculated, the filter should return the remaining budget. | ||
ForInput(ctx context.Context, versionedAttr *admission.VersionedAttributes, request *v1.AdmissionRequest, optionalVars OptionalVariableBindings, runtimeCELCostBudget int64) ([]EvaluationResult, int64, error) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add test case for returned remaining budget?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
added.
159082b
to
51a9c91
Compare
@@ -43,11 +44,17 @@ type fakeCelFilter struct { | |||
throwError bool | |||
} | |||
|
|||
func (f *fakeCelFilter) ForInput(context.Context, *admission.VersionedAttributes, *admissionv1.AdmissionRequest, cel.OptionalVariableBindings, int64) ([]cel.EvaluationResult, error) { | |||
func (f *fakeCelFilter) ForInput(_ context.Context, _ *admission.VersionedAttributes, _ *admissionv1.AdmissionRequest, _ cel.OptionalVariableBindings, costBudget int64) ([]cel.EvaluationResult, int64, error) { | |||
if costBudget <= 0 { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
<0?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not really. the expression itself costs one. Needs at least 1 to cover it.
staging/src/k8s.io/apiserver/pkg/admission/plugin/validatingadmissionpolicy/validator_test.go
Outdated
Show resolved
Hide resolved
7e6fb37
to
327a633
Compare
}, | ||
}, | ||
{ | ||
name: "messageExpression out of budget after successful eval of expression", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great to see the test for budget shared between expression and messageExpression
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
:)
074ac6d
to
e1678f2
Compare
/lgtm Thank you! |
LGTM label has been added. Git tree hash: ddf4f31b9795dc949c3237c87f5daab21dba1a55
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cici37, jiahuif, liggitt The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Thank you all for reviewing. |
What type of PR is this?
/kind feature
/kind api-change
What this PR does / why we need it:
This PR adds support for
messageExpression
to ValidatingAdmissionPolicy, to set a custom message when the policy rejects a request.Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
API REVIEW Please take a look at the first commit labeled
[API REVIEW]
Please note that the API is mirrored from #115969, which already got API approved.
Does this PR introduce a user-facing change?
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.: