Slide 7
Slide 7 text
@superbrothers
KEP-3962: Mutating Admission Policies
アルファターゲット: v1.31
CEL を使ったリソースの Mutating
▶ Admission Webhook はパフォーマンスが悪く、サーバ運⽤も
必要で管理者の負荷が⾼い
▶ Webhook サーバとして実装しなくて済むので
煩わしいコンテナイメージのビルド、リリースが必要なくなる
7
ちなみに Validating Admission Policy は
V1.30 で GA しました 🎉
apiVersion: admissionregistration.k8s.io/v1alpha1
kind: MutatingAdmissionPolicy
metadata:
name: "sidecar-policy.example.com"
spec:
paramKind:
group: mutations.example.com
kind: Sidecar
version: v1
matchConstraints:
resourceRules:
- apiGroups: [""]
apiVersions: ["v1"]
operations: ["CREATE"]
resources: ["pods"]
matchConditions:
- name: does-not-already-have-sidecar
expression: "!object.spec.initContainers.exists(ic, ic.name == params.name)"
failurePolicy: Fail
reinvocationPolicy: IfNeeded
mutations:
- patchType: "ApplyConfiguration"
mutation: >
Object{
spec: Object.spec{
initContainers: [
Object.spec.initContainers{
name: params.name,
image: params.image,
args: params.args,
restartPolicy: params.restartPolicy
}
]
}
}
apiVersion: admissionregistration.k8s.io/v1alpha1
kind: MutatingAdmissionPolicyBinding
metadata:
name: "sidecar-binding-test.example.com"
spec:
policyName: "sidecar-policy.example.com"
paramRef:
name: "meshproxy-test.example.com"
namespace: default
apiVersion: mutations.example.com
kind: Sidecar
metadata:
name: meshproxy-test.example.com
spec:
name: mesh-proxy
image: mesh/proxy:v1.0.0
args: ["proxy", "sidecar"]
restartPolicy: Always
“Bring Your Own CRD” デザインと
呼ばれている