<commit_before># Dynamic admission control configuration

## Background

The extensible admission control
[proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/admission_control_extension.md)
proposed making admission control extensible. In the proposal, the `initializer
admission controller` and the `generic webhook admission controller` are the two
controllers that set default initializers and external admission hooks for
resources newly created. These two admission controllers are in the same binary
as the apiserver. This
[section](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/admission_control_extension.md#dynamic-configuration)
gave a preliminary design of the dynamic configuration of the list of the
default admission controls. This document hashes out the implementation details.

## Goals

* Admin is able to predict what initializers/webhooks will be applied to newly
  created objects.

* Admin needs to be able to ensure initializers/webhooks config will be applied within some bound

* As a fallback, admin can always restart an apiserver and guarantee it sees the latest config

* Do not block the entire cluster if the intializers/webhooks are not ready
  after registration.

## Specification

We assume initializers could be "fail open". We need to update the extensible
admission control
[proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/admission_control_extension.md)
if this is accepted.

The schema is evolved from the prototype in
[#132](https://github.com/kubernetes/community/pull/132).

```golang
// InitializerConfiguration describes the configuration of intializers.
type InitializerConfiguration struct {
    metav1.TypeMeta

    v1.ObjectMeta

    // Initializers is a list of resources and their default initializers
    // Order-sensitive.
    // When merging multiple InitializerConfigurations, we sort the intializers
    // from different InitializerConfigurations by the name of the
    // InitializerConfigurations; the order of the intializers from the same
    // InitializerConfiguration is preserved.
    // +optional
    Initializers []Initializer `json:"initializers,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
}

// Initializer describes the name and the failure policy of an initializer, and
// what resources it applies to.
type Initializer struct {
    // Name is the identifier of the initializer. It will be added to the
    // object that needs to be initialized.
    // Name should be fully qualified.
    // Required
    Name string `json:"name"`

    // Rules describes what resources/subresources the initializer cares about.
    // The intializer cares about an operation if it matches _any_ Rule.
    Rules []Rule `json:"rules,omitempty"`

    // FailurePolicy defines what happens if the responsible initializer controller
    // fails to takes action. Allowed values are Ignore, or Fail. If "Ignore" is
    // set, initializer is removed from the initializers list of an object if
    // the timeout is reached; If "Fail" is set, apiserver returns timeout error
    // if the timeout is reached. The default timeout for each initializer is
    // 5s.
    FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty"`
}

// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended 
// to make sure that all the tuple expansions are valid.
type Rule struct {
    // APIGroups is the API groups the resources belong to. '*' is all groups.
    // If '*' is present, the length of the slice must be one.
    // Required.
    APIGroups []string `json:"apiGroups,omitempty"`

    // APIVersions is the API versions the resources belong to. '*' is all versions.
    // If '*' is present, the length of the slice must be one.
    // Required.
    APIVersions []string `json:"apiVersions,omitempty"`

    // Resources is a list of resources this rule applies to.
    //
    // For example:
    // 'pods' means pods.
    // 'pods/log' means the log subresource of pods.
    // '*' means all resources, but not subresources.
    // 'pods/*' means all subresources of pods.
    // '*/scale' means all scale subresources.
    // '*/*' means all resources and their subresources.
    //
    // If '*' or '*/*' is present, the length of the slice must be one.
    // Required.
    Resources []string `json:"resources,omitempty"`
}

type FailurePolicyType string

const (
    // Ignore means the initilizer is removed from the initializers list of an
    // object if the initializer is timed out.
    Ignore FailurePolicyType = "Ignore"
    // For 1.7, only "Ignore" is allowed. "Fail" will be allowed when the
    // extensible admission feature is beta.
    Fail FailurePolicyType = "Fail"
)

// ExternalAdmissionHookConfiguration describes the configuration of intializers.
type ExternalAdmissionHookConfiguration struct {
    metav1.TypeMeta

    v1.ObjectMeta
    // ExternalAdmissionHooks is a list of external admission webhooks and the
    // affected resources and operations.
    // +optional
    ExternalAdmissionHooks []ExternalAdmissionHook `json:"externalAdmissionHooks,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
}

// ExternalAdmissionHook describes an external admission webhook and the
// resources and operations it applies to.
type ExternalAdmissionHook struct {
    // The name of the external admission webhook.
    // Name should be fully qualified.
    // Required.
    Name string `json:"name"`

    // ClientConfig defines how to communicate with the hook.
    // Required
    ClientConfig AdmissionHookClientConfig `json:"clientConfig"`

    // Rules describes what operations on what resources/subresources the webhook cares about.<commit_msg>address lavalamp's comment<commit_after>
## Background

The extensible admission control
[proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/admission_control_extension.md)
proposed making admission control extensible. In the proposal, the `initializer
admission controller` and the `generic webhook admission controller` are the two
controllers that set default initializers and external admission hooks for
resources newly created. These two admission controllers are in the same binary
as the apiserver. This
[section](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/admission_control_extension.md#dynamic-configuration)
gave a preliminary design of the dynamic configuration of the list of the
default admission controls. This document hashes out the implementation details.

## Goals

* Admin is able to predict what initializers/webhooks will be applied to newly
  created objects.

* Admin needs to be able to ensure initializers/webhooks config will be applied within some bound

* As a fallback, admin can always restart an apiserver and guarantee it sees the latest config

* Do not block the entire cluster if the intializers/webhooks are not ready
  after registration.

## Specification

We assume initializers could be "fail open". We need to update the extensible
admission control
[proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/admission_control_extension.md)
if this is accepted.

The schema is evolved from the prototype in
[#132](https://github.com/kubernetes/community/pull/132).

```golang
// InitializerConfiguration describes the configuration of intializers.
type InitializerConfiguration struct {
    metav1.TypeMeta

    v1.ObjectMeta

    // Initializers is a list of resources and their default initializers
    // Order-sensitive.
    // When merging multiple InitializerConfigurations, we sort the intializers
    // from different InitializerConfigurations by the name of the
    // InitializerConfigurations; the order of the intializers from the same
    // InitializerConfiguration is preserved.
    // +optional
    Initializers []Initializer `json:"initializers,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
}

// Initializer describes the name and the failure policy of an initializer, and
// what resources it applies to.
type Initializer struct {
    // Name is the identifier of the initializer. It will be added to the
    // object that needs to be initialized.
    // Name should be fully qualified, e.g., alwayspullimages.kubernetes.io, where
    // "alwayspullimages" is the name of the webhook, and kubernetes.io is the name
    // of the organization.
    // Required
    Name string `json:"name"`

    // Rules describes what resources/subresources the initializer cares about.
    // The intializer cares about an operation if it matches _any_ Rule.
    Rules []Rule `json:"rules,omitempty"`

    // FailurePolicy defines what happens if the responsible initializer controller
    // fails to takes action. Allowed values are Ignore, or Fail. If "Ignore" is
    // set, initializer is removed from the initializers list of an object if
    // the timeout is reached; If "Fail" is set, apiserver returns timeout error
    // if the timeout is reached. The default timeout for each initializer is
    // 5s.
    FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty"`
}

// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended 
// to make sure that all the tuple expansions are valid.
type Rule struct {
    // APIGroups is the API groups the resources belong to. '*' is all groups.
    // If '*' is present, the length of the slice must be one.
    // Required.
    APIGroups []string `json:"apiGroups,omitempty"`

    // APIVersions is the API versions the resources belong to. '*' is all versions.
    // If '*' is present, the length of the slice must be one.
    // Required.
    APIVersions []string `json:"apiVersions,omitempty"`

    // Resources is a list of resources this rule applies to.
    //
    // For example:
    // 'pods' means pods.
    // 'pods/log' means the log subresource of pods.
    // '*' means all resources, but not subresources.
    // 'pods/*' means all subresources of pods.
    // '*/scale' means all scale subresources.
    // '*/*' means all resources and their subresources.
    //
    // If '*' or '*/*' is present, the length of the slice must be one.
    // Required.
    Resources []string `json:"resources,omitempty"`
}

type FailurePolicyType string

const (
    // Ignore means the initilizer is removed from the initializers list of an
    // object if the initializer is timed out.
    Ignore FailurePolicyType = "Ignore"
    // For 1.7, only "Ignore" is allowed. "Fail" will be allowed when the
    // extensible admission feature is beta.
    Fail FailurePolicyType = "Fail"
)

// ExternalAdmissionHookConfiguration describes the configuration of intializers.
type ExternalAdmissionHookConfiguration struct {
    metav1.TypeMeta

    v1.ObjectMeta
    // ExternalAdmissionHooks is a list of external admission webhooks and the
    // affected resources and operations.
    // +optional
    ExternalAdmissionHooks []ExternalAdmissionHook `json:"externalAdmissionHooks,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
}

// ExternalAdmissionHook describes an external admission webhook and the
// resources and operations it applies to.
type ExternalAdmissionHook struct {
    // The name of the external admission webhook.
    // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
    // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
    // of the organization.
    // Required.
    Name string `json:"name"`

    // ClientConfig defines how to communicate with the hook.
    // Required
    ClientConfig AdmissionHookClientConfig `json:"clientConfig"`

    // Rules describes what operations on what resources/subresources the webhook cares about.
{'fraction_non_alphanumeric': 0.07620174030582073, 'fraction_numerical': 0.00219650249218552, 'mean_word_length': 3.631455399061033, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2498768', 'n_tokens_mistral': 3059, 'n_tokens_neox': 2960, 'n_words': 1299}