According to <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensib

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

admission.k8s.io/v1 AdmissionReview response requires uid about library HOT 2 OPEN

open-policy-agent commented on May 30, 2024

admission.k8s.io/v1 AdmissionReview response requires uid

from library.

Comments (2)

patrick-east commented on May 30, 2024

@mingfang is there a specific example or policy in the library that is missing this? Any more details would be helpful.

from library.

mingfang commented on May 30, 2024

So technically this library is not missing it because it's still on the older admission.k8s.io/v1beta1.
I have upgraded it locally by adding the uid like this

library/kubernetes/mutating-admission/main.rego

Line 41 in ba6cc2a

"patch": base64.encode(json.marshal(fullPatches)),

response = x {
    count(patch) > 0

    # if there are missing leaves e.g. trying to add a label to something that doesn't
    # yet have any, we need to create the leaf nodes as well

    fullPatches := ensureParentPathsExist(cast_array(patch))

    x := {
        "allowed": true,
        "patchType": "JSONPatch",
        "patch": base64.encode(json.marshal(fullPatches)),
        "uid": input.request.uid, <-needed in v1
    }
}

But the problem is I can't add uid to the default response here

library/kubernetes/mutating-admission/main.rego

Line 14 in ba6cc2a

default response = {"allowed": true}

because I get here saying default response can not use refs.
The workaround is to leave the uid out of the default response and Kubernetes prints out a warning.

from library.

Recommend Projects