Personally the explanation was quite difficult to understand without looking into the code.
I hope I managed to simplify it a bit and added an example how to add annotations to a
namespace so they can be consumed by the PodTolerationRestriction admission
controller.
Signed-off-by: Manuel Rüger <manuel@rueg.eu>
It is not clear that the 'caBundle' field in the Mutating/Validating webhook object is used for client-side validation from the admission controller itself.
The comment which appears at the source code is much more clear --> https://github.com/kubernetes/api/blob/master/admissionregistration/v1beta1/types.go#L534-L537
My suggestion is to change the description to match the documentation which is IMO much more clear
In 203391835d, an explicit anchor '#noderestriction' was added to the
NodeRestriction section of the Admission Controllers reference document,
which caused the link to the '#NodeRestriction' anchor in the Node
Authorization document to break and lead to the top of the Admission
Controllers document instead of to the NodeRestriction section further
down the page. This change fixes the link to point to the intended
section instead of to the whole page in general.
* feat: graduate TaintNodesByCondition to GA (#17073)
* Promote StartupProbe to beta (enabled by default). (#17164)
* Watch bookmarks to GA (#17026)
* feat: graduate ScheduleDaemonSetPods to GA (#17350)
* Update Docker installation instructions (#17405)
* Use exact version numbers for installing Docker in Ubuntu (#17428)
* Move CSIMigration and CSIMigrationGCE to Beta in Kubernetes v1.17 (#17478)
* Promote NodeLease feature to GA (#17189)
* Update docs for csi topology ga (#17408)
* Update RunAsUsername to beta (#17460)
* doc:Update RunAsUsername to beta
* doc: update samples - kubernetes.io/os is no longer beta
* Updating based on review feedback
* Promote Node-specific volume limits to GA (#17432)
* Promote PodShareProcessNamespace to stable (#17192)
* Promote PodShareProcessNamespace to stable
* Add for_k8s_version to feature-state label
Co-Authored-By: Tim Bannister <tim@scalefactory.com>
* Readd version-check to shareProcessNamespace task
* Update service load balancer finalizer doc for GA (#17438)
* Update Topology Manager docs (#17451)
* Added information on how device plugins can take advantage
of Topology Manager
* Updated the Topology Manager documentation to include additionalinformation and update some out of date sections
* Fix broken Topology Manager link (#17746)
Part of What's Next Device Plugin section
* Update CRD defaulting docs for GA (#17450)
* Add documentation for VolumeSnapshot Beta (#17233)
* Updating EndpointSlice documentation for beta release in 1.17 (#17411)
* (docs/dualstack): v1.17 updates (#17457)
* Add placehold doc updates for dualstack in 1.17
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* Add Downward API and /etc/hosts Pod IP validation
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* remove addressed known issue via k/k pr 85246
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* Remove known issue and add flag as part of k/k 79993
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* remove follow up placeholders
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* Update verbiage
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* Make IP addressing consistent throughout the task
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* Update to status.podIPs
Signed-off-by: Lachlan Evenson <lachlan.evenson@microsoft.com>
* Update content/en/docs/tasks/network/validate-dual-stack.md
Use set instead of env
Co-Authored-By: Khaled Henidak (Kal) <khnidk@outlook.com>
* add topology.kubernetes.io/zone, topology.kubernetes.io/region and node.kubernetes.io/instance-type labels to docs (#17498)
Signed-off-by: Andrew Sy Kim <kiman@vmware.com>
* Service topology alpha documentation (#17459)
* Update list of feature flags for in-tree plugins migrated to CSI (#17533)
Signed-off-by: Deep Debroy <ddebroy@docker.com>
* Update Node concept for TaintNodesByCondition going GA (#17577)
* feat: graduate ResourceQuotaScopeSelectors to GA in 1.17 (#17554)
* kubeadm: update the upgrade documentation for 1.17 (#17587)
* doc: Simplify Windows deployments with RuntimeClass (#16697)
* doc: Simplify Windows deployments with RuntimeClass
* Updating on review feedback
* doc: Adding windows-build label from enhancement 1301
* update doc for kubelet option --reserved-cpus (#17648)
* feat: update TaintNodesByCondition in feature gates table (#17377)
* Update docs for v1 resource quota configuration (#17547)
* AdmissionConfiguration v1 (#17548)
* Update WebhookAdmissionConfiguration examples (#17549)
* Update AWS EBS Migration Feature state (#16126)
* Add resource version section to api-concepts documentation (#16910)
* Add Resource Version semantics section to api concepts
* Clarify risks of going back in time, add details about compaction and watch cache sizes
* Apply suggestions from liggitt
Co-Authored-By: Jordan Liggitt <jordan@liggitt.net>
* remove pesudocode, apply feedback
* Fix typo
* Clarify equality rules
* Cleanup kubectl generators docs (#17609)
* Write ReplicationController without a space
* Drop mentioning unsupported cluster versions
* Fix capitalization for “API group”
* Tweak wording
* Avoid using deprecated generator in example
* add Antrea description in dev-1.17 (#17919)
* Promote VolumeSubpathEnvExpansion to GA
* Reference Documentation for the Kubernetes API for 1.17 (#18019)
* Update feature-gates.md (#18033)
* Reference Documentation for kubectl Commands for 1.17 (#18017)
* Update for v1.17 (#18034)
* Update config.toml(release-1.17) for 1.17 (#18031)
* Change the full link in the document to an inline link.
grep -r "https \: \ / \ / kubernetes \ .io" content/en/docs
Changed to inline link except the following list.
- URLs are mentioned directly in the body
- release note
- url to blog
- url to community
- Url to be redirected
* Apply suggestions from code review
Co-Authored-By: June Yi <june.yi@samsung.com>
The content describing authorization modes used the term "authorization
modules" erroneously. This patch uses the term "mode" as is appropriate
but keeps the section link header the old "authorization-modules" in
order not to break older links.
All admission control plugins support two modes for specifying their
configuration: linking to an external file using the `path` key in the
shared admission configuration file, or directly embedding the
configuration using the `configuration` key in the shared admission
configuration file.
This commit makes the ImagePolicyWebhook documentation mention the
embedded configuration option.
inductor