Skip to content

Commit 2f077ab

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #42618 from tengqm/fix-examples-test-1.28
Update test cases for v1.28
2 parents c96fb77 + 60bf42a commit 2f077ab

File tree

5 files changed

+263
-338
lines changed

5 files changed

+263
-338
lines changed

‎content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -731,7 +731,57 @@ webhook to be called.
731731

732732
Here is an example illustrating a few different uses for match conditions:
733733

734-
{{< codenew file="access/validating-webhook-configuration-match-conditions.yaml" >}}
734+
```yaml
735+
apiVersion: admissionregistration.k8s.io/v1
736+
kind: ValidatingWebhookConfiguration
737+
webhooks:
738+
- name: my-webhook.example.com
739+
matchPolicy: Equivalent
740+
rules:
741+
- operations: ['CREATE','UPDATE']
742+
apiGroups: ['*']
743+
apiVersions: ['*']
744+
resources: ['*']
745+
failurePolicy: 'Ignore' # Fail-open (optional)
746+
sideEffects: None
747+
clientConfig:
748+
service:
749+
namespace: my-namespace
750+
name: my-webhook
751+
caBundle: '<omitted>'
752+
# You can have up to 64 matchConditions per webhook
753+
matchConditions:
754+
- name: 'exclude-leases' # Each match condition must have a unique name
755+
expression: '!(request.resource.group == "coordination.k8s.io" && request.resource.resource == "leases")' # Match non-lease resources.
756+
- name: 'exclude-kubelet-requests'
757+
expression: '!("system:nodes" in request.userInfo.groups)' # Match requests made by non-node users.
758+
- name: 'rbac' # Skip RBAC requests, which are handled by the second webhook.
759+
expression: 'request.resource.group != "rbac.authorization.k8s.io"'
760+
761+
# This example illustrates the use of the 'authorizer'. The authorization check is more expensive
762+
# than a simple expression, so in this example it is scoped to only RBAC requests by using a second
763+
# webhook. Both webhooks can be served by the same endpoint.
764+
- name: rbac.my-webhook.example.com
765+
matchPolicy: Equivalent
766+
rules:
767+
- operations: ['CREATE','UPDATE']
768+
apiGroups: ['rbac.authorization.k8s.io']
769+
apiVersions: ['*']
770+
resources: ['*']
771+
failurePolicy: 'Fail' # Fail-closed (the default)
772+
sideEffects: None
773+
clientConfig:
774+
service:
775+
namespace: my-namespace
776+
name: my-webhook
777+
caBundle: '<omitted>'
778+
# You can have up to 64 matchConditions per webhook
779+
matchConditions:
780+
- name: 'breakglass'
781+
# Skip requests made by users authorized to 'breakglass' on this webhook.
782+
# The 'breakglass' API verb does not need to exist outside this check.
783+
expression: '!authorizer.group("admissionregistration.k8s.io").resource("validatingwebhookconfigurations").name("my-webhook.example.com").check("breakglass").allowed()'
784+
```
735785

736786
{{< note >}}
737787
You can define up to 64 elements in the `matchConditions` field per webhook.

‎content/en/examples/access/validating-webhook-configuration-match-conditions.yaml

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎content/en/examples/examples_test.go

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,6 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) {
159159
podValidationOptions := validation.PodValidationOptions{
160160
AllowInvalidPodDeletionCost: false,
161161
AllowIndivisibleHugePagesValues: true,
162-
AllowExpandedDNSConfig: true,
163162
}
164163
netValidationOptions := networking_validation.NetworkPolicyValidationOptions{
165164
AllowInvalidLabelValueInSelector: false,
@@ -400,6 +399,7 @@ func TestExampleObjectSchemas(t *testing.T) {
400399
"access": {
401400
"deployment-replicas-policy": {&admissionregistration.ValidatingAdmissionPolicy{}},
402401
"endpoints-aggregated": {&rbac.ClusterRole{}},
402+
"image-matches-namespace-environment.policy": {&admissionregistration.ValidatingAdmissionPolicy{}},
403403
"validating-admission-policy-audit-annotation": {&admissionregistration.ValidatingAdmissionPolicy{}},
404404
"validating-admission-policy-match-conditions": {&admissionregistration.ValidatingAdmissionPolicy{}},
405405
},
@@ -477,6 +477,7 @@ func TestExampleObjectSchemas(t *testing.T) {
477477
"deployment-patch": {&apps.Deployment{}},
478478
"deployment-retainkeys": {&apps.Deployment{}},
479479
"deployment-scale": {&apps.Deployment{}},
480+
"deployment-sidecar": {&apps.Deployment{}},
480481
"deployment-update": {&apps.Deployment{}},
481482
"nginx-app": {&api.Service{}, &apps.Deployment{}},
482483
"nginx-with-request": {&apps.Deployment{}},
@@ -502,6 +503,7 @@ func TestExampleObjectSchemas(t *testing.T) {
502503
},
503504
"application/job": {
504505
"cronjob": {&batch.CronJob{}},
506+
"job-sidecar": {&batch.Job{}},
505507
"job-tmpl": {&batch.Job{}},
506508
"indexed-job": {&batch.Job{}},
507509
"indexed-job-vol": {&batch.Job{}},
@@ -556,11 +558,13 @@ func TestExampleObjectSchemas(t *testing.T) {
556558
},
557559
"controllers": {
558560
"daemonset": {&apps.DaemonSet{}},
561+
"daemonset-label-selector": {&apps.DaemonSet{}},
559562
"fluentd-daemonset": {&apps.DaemonSet{}},
560563
"fluentd-daemonset-update": {&apps.DaemonSet{}},
561564
"frontend": {&apps.ReplicaSet{}},
562565
"hpa-rs": {&autoscaling.HorizontalPodAutoscaler{}},
563566
"job": {&batch.Job{}},
567+
"job-backoff-limit-per-index-example": {&batch.Job{}},
564568
"job-pod-failure-policy-config-issue": {&batch.Job{}},
565569
"job-pod-failure-policy-example": {&batch.Job{}},
566570
"job-pod-failure-policy-failjob": {&batch.Job{}},
@@ -697,9 +701,10 @@ func TestExampleObjectSchemas(t *testing.T) {
697701
"podsecurity-restricted": {&api.Namespace{}},
698702
},
699703
"service": {
700-
"nginx-service": {&api.Service{}},
701-
"load-balancer-example": {&apps.Deployment{}},
702-
"pod-with-graceful-termination": {&apps.Deployment{}},
704+
"nginx-service": {&api.Service{}},
705+
"load-balancer-example": {&apps.Deployment{}},
706+
"pod-with-graceful-termination": {&apps.Deployment{}},
707+
"explore-graceful-termination-nginx": {&api.Service{}},
703708
},
704709
"service/access": {
705710
"backend-deployment": {&apps.Deployment{}},

‎go.mod

Lines changed: 79 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -3,64 +3,63 @@ module k8s.io/website
33
go 1.20
44

55
require (
6-
k8s.io/apimachinery v0.27.0
6+
k8s.io/apimachinery v0.28.0
77
k8s.io/kubernetes v0.0.0
88
)
99

1010
require (
1111
github.com/NYTimes/gziphandler v1.1.1 // indirect
12-
github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
12+
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
1313
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
1414
github.com/beorn7/perks v1.0.1 // indirect
1515
github.com/blang/semver/v4 v4.0.0 // indirect
16-
github.com/cenkalti/backoff/v4 v4.1.3 // indirect
17-
github.com/cespare/xxhash/v2 v2.1.2 // indirect
18-
github.com/coreos/go-semver v0.3.0 // indirect
19-
github.com/coreos/go-systemd/v22 v22.4.0 // indirect
16+
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
17+
github.com/cespare/xxhash/v2 v2.2.0 // indirect
18+
github.com/coreos/go-semver v0.3.1 // indirect
19+
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
2020
github.com/davecgh/go-spew v1.1.1 // indirect
21-
github.com/docker/distribution v2.8.1+incompatible // indirect
21+
github.com/docker/distribution v2.8.2+incompatible // indirect
2222
github.com/emicklei/go-restful/v3 v3.9.0 // indirect
23-
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
23+
github.com/evanphx/json-patch v5.6.0+incompatible // indirect
2424
github.com/felixge/httpsnoop v1.0.3 // indirect
2525
github.com/fsnotify/fsnotify v1.6.0 // indirect
26-
github.com/go-logr/logr v1.2.3 // indirect
26+
github.com/go-logr/logr v1.2.4 // indirect
2727
github.com/go-logr/stdr v1.2.2 // indirect
2828
github.com/go-openapi/jsonpointer v0.19.6 // indirect
29-
github.com/go-openapi/jsonreference v0.20.1 // indirect
29+
github.com/go-openapi/jsonreference v0.20.2 // indirect
3030
github.com/go-openapi/swag v0.22.3 // indirect
3131
github.com/gogo/protobuf v1.3.2 // indirect
3232
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
3333
github.com/golang/protobuf v1.5.3 // indirect
34-
github.com/google/cel-go v0.12.6 // indirect
35-
github.com/google/gnostic v0.5.7-v3refs // indirect
34+
github.com/google/cel-go v0.16.0 // indirect
35+
github.com/google/gnostic-models v0.6.8 // indirect
3636
github.com/google/go-cmp v0.5.9 // indirect
37-
github.com/google/gofuzz v1.1.0 // indirect
37+
github.com/google/gofuzz v1.2.0 // indirect
3838
github.com/google/uuid v1.3.0 // indirect
3939
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
4040
github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
4141
github.com/imdario/mergo v0.3.6 // indirect
42-
github.com/inconshreveable/mousetrap v1.0.1 // indirect
42+
github.com/inconshreveable/mousetrap v1.1.0 // indirect
4343
github.com/josharian/intern v1.0.0 // indirect
4444
github.com/json-iterator/go v1.1.12 // indirect
4545
github.com/mailru/easyjson v0.7.7 // indirect
46-
github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
47-
github.com/mitchellh/mapstructure v1.4.1 // indirect
46+
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
4847
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
4948
github.com/modern-go/reflect2 v1.0.2 // indirect
5049
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
5150
github.com/opencontainers/go-digest v1.0.0 // indirect
5251
github.com/pkg/errors v0.9.1 // indirect
53-
github.com/prometheus/client_golang v1.14.0 // indirect
54-
github.com/prometheus/client_model v0.3.0 // indirect
55-
github.com/prometheus/common v0.37.0 // indirect
56-
github.com/prometheus/procfs v0.8.0 // indirect
52+
github.com/prometheus/client_golang v1.16.0 // indirect
53+
github.com/prometheus/client_model v0.4.0 // indirect
54+
github.com/prometheus/common v0.44.0 // indirect
55+
github.com/prometheus/procfs v0.10.1 // indirect
5756
github.com/robfig/cron/v3 v3.0.1 // indirect
58-
github.com/spf13/cobra v1.6.0 // indirect
57+
github.com/spf13/cobra v1.7.0 // indirect
5958
github.com/spf13/pflag v1.0.5 // indirect
6059
github.com/stoewer/go-strcase v1.2.0 // indirect
61-
go.etcd.io/etcd/api/v3 v3.5.7 // indirect
62-
go.etcd.io/etcd/client/pkg/v3 v3.5.7 // indirect
63-
go.etcd.io/etcd/client/v3 v3.5.7 // indirect
60+
go.etcd.io/etcd/api/v3 v3.5.9 // indirect
61+
go.etcd.io/etcd/client/pkg/v3 v3.5.9 // indirect
62+
go.etcd.io/etcd/client/v3 v3.5.9 // indirect
6463
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0 // indirect
6564
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1 // indirect
6665
go.opentelemetry.io/otel v1.10.0 // indirect
@@ -71,70 +70,74 @@ require (
7170
go.opentelemetry.io/otel/sdk v1.10.0 // indirect
7271
go.opentelemetry.io/otel/trace v1.10.0 // indirect
7372
go.opentelemetry.io/proto/otlp v0.19.0 // indirect
74-
go.uber.org/atomic v1.7.0 // indirect
75-
go.uber.org/multierr v1.6.0 // indirect
73+
go.uber.org/atomic v1.10.0 // indirect
74+
go.uber.org/multierr v1.11.0 // indirect
7675
go.uber.org/zap v1.19.0 // indirect
77-
golang.org/x/crypto v0.1.0 // indirect
78-
golang.org/x/net v0.8.0 // indirect
79-
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
80-
golang.org/x/sync v0.1.0 // indirect
81-
golang.org/x/sys v0.6.0 // indirect
82-
golang.org/x/term v0.6.0 // indirect
83-
golang.org/x/text v0.8.0 // indirect
84-
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
76+
golang.org/x/crypto v0.11.0 // indirect
77+
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
78+
golang.org/x/net v0.13.0 // indirect
79+
golang.org/x/oauth2 v0.8.0 // indirect
80+
golang.org/x/sync v0.2.0 // indirect
81+
golang.org/x/sys v0.10.0 // indirect
82+
golang.org/x/term v0.10.0 // indirect
83+
golang.org/x/text v0.11.0 // indirect
84+
golang.org/x/time v0.3.0 // indirect
8585
google.golang.org/appengine v1.6.7 // indirect
86-
google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
87-
google.golang.org/grpc v1.51.0 // indirect
88-
google.golang.org/protobuf v1.28.1 // indirect
86+
google.golang.org/genproto v0.0.0-20230526161137-0005af68ea54 // indirect
87+
google.golang.org/genproto/googleapis/api v0.0.0-20230525234035-dd9d682886f9 // indirect
88+
google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 // indirect
89+
google.golang.org/grpc v1.54.0 // indirect
90+
google.golang.org/protobuf v1.30.0 // indirect
8991
gopkg.in/inf.v0 v0.9.1 // indirect
90-
gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
92+
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
9193
gopkg.in/yaml.v2 v2.4.0 // indirect
9294
gopkg.in/yaml.v3 v3.0.1 // indirect
93-
k8s.io/api v0.27.0 // indirect
94-
k8s.io/apiserver v0.27.0 // indirect
95-
k8s.io/client-go v0.27.0 // indirect
95+
k8s.io/api v0.28.0 // indirect
96+
k8s.io/apiextensions-apiserver v0.0.0 // indirect
97+
k8s.io/apiserver v0.28.0 // indirect
98+
k8s.io/client-go v0.28.0 // indirect
9699
k8s.io/cloud-provider v0.0.0 // indirect
97-
k8s.io/component-base v0.27.0 // indirect
98-
k8s.io/component-helpers v0.27.0 // indirect
99-
k8s.io/controller-manager v0.27.0 // indirect
100-
k8s.io/klog/v2 v2.90.1 // indirect
101-
k8s.io/kms v0.27.0 // indirect
102-
k8s.io/kube-openapi v0.0.0-20230308215209-15aac26d736a // indirect
100+
k8s.io/component-base v0.28.0 // indirect
101+
k8s.io/component-helpers v0.28.0 // indirect
102+
k8s.io/controller-manager v0.28.0 // indirect
103+
k8s.io/klog/v2 v2.100.1 // indirect
104+
k8s.io/kms v0.28.0 // indirect
105+
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
103106
k8s.io/kubelet v0.0.0 // indirect
104-
k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
105-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.1 // indirect
107+
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
108+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.2 // indirect
106109
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
107110
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
108111
sigs.k8s.io/yaml v1.3.0 // indirect
109112
)
110113

111114
replace (
112-
k8s.io/api => k8s.io/api v0.27.0
113-
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.0
114-
k8s.io/apimachinery => k8s.io/apimachinery v0.27.0
115-
k8s.io/apiserver => k8s.io/apiserver v0.27.0
116-
k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.0
117-
k8s.io/client-go => k8s.io/client-go v0.27.0
118-
k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.0
119-
k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.0
120-
k8s.io/code-generator => k8s.io/code-generator v0.27.0
121-
k8s.io/component-base => k8s.io/component-base v0.27.0
122-
k8s.io/component-helpers => k8s.io/component-helpers v0.27.0
123-
k8s.io/controller-manager => k8s.io/controller-manager v0.27.0
124-
k8s.io/cri-api => k8s.io/cri-api v0.27.0
125-
k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.0
126-
k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.0
127-
k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.0
128-
k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.0
129-
k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.0
130-
k8s.io/kubectl => k8s.io/kubectl v0.27.0
131-
k8s.io/kubelet => k8s.io/kubelet v0.27.0
115+
k8s.io/api => k8s.io/api v0.28.0
116+
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.28.0
117+
k8s.io/apimachinery => k8s.io/apimachinery v0.28.0
118+
k8s.io/apiserver => k8s.io/apiserver v0.28.0
119+
k8s.io/cli-runtime => k8s.io/cli-runtime v0.28.0
120+
k8s.io/client-go => k8s.io/client-go v0.28.0
121+
k8s.io/cloud-provider => k8s.io/cloud-provider v0.28.0
122+
k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.28.0
123+
k8s.io/code-generator => k8s.io/code-generator v0.28.0
124+
k8s.io/component-base => k8s.io/component-base v0.28.0
125+
k8s.io/component-helpers => k8s.io/component-helpers v0.28.0
126+
k8s.io/controller-manager => k8s.io/controller-manager v0.28.0
127+
k8s.io/cri-api => k8s.io/cri-api v0.28.0
128+
k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.28.0
129+
k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.28.0
130+
k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.28.0
131+
k8s.io/kube-proxy => k8s.io/kube-proxy v0.28.0
132+
k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.28.0
133+
k8s.io/kubectl => k8s.io/kubectl v0.28.0
134+
k8s.io/kubelet => k8s.io/kubelet v0.28.0
132135
k8s.io/kubernetes => ../kubernetes
133-
k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.0
134-
k8s.io/metrics => k8s.io/metrics v0.27.0
135-
k8s.io/mount-utils => k8s.io/mount-utils v0.27.0
136-
k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.27.0
137-
k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.0
138-
k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.27.0
139-
k8s.io/sample-controller => k8s.io/sample-controller v0.27.0
136+
k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.28.0
137+
k8s.io/metrics => k8s.io/metrics v0.28.0
138+
k8s.io/mount-utils => k8s.io/mount-utils v0.28.0
139+
k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.28.0
140+
k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.28.0
141+
k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.28.0
142+
k8s.io/sample-controller => k8s.io/sample-controller v0.28.0
140143
)

0 commit comments

Comments
 (0)