Kubernetes Admission Controller Concepts: Difference between revisions
| Line 10: | Line 10: | ||
An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the metadata, but after the request is authenticated and authorized. There is a fixed set of admission controller that include [[#AlwaysPullImages| AlwaysPullImages]], [[#PodSecurityPolicy|PodSecurityPolicy]], etc. The controllers are compiled into the [[Kubernetes_Control_Plane_and_Data_Plane_Concepts#API_Server|kube-apiserver binary]], and may only be configured by the [[Kubernetes_Security_Concepts#Cluster_Administrator|cluster administrator]]. | An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the metadata, but after the request is authenticated and authorized. There is a fixed set of admission controller that include [[#AlwaysPullImages| AlwaysPullImages]], [[#PodSecurityPolicy|PodSecurityPolicy]], etc. The controllers are compiled into the [[Kubernetes_Control_Plane_and_Data_Plane_Concepts#API_Server|kube-apiserver binary]], and may only be configured by the [[Kubernetes_Security_Concepts#Cluster_Administrator|cluster administrator]]. | ||
<font color=darkgray>OpenShift content: the admission controller validates requests by processing these requests relative to all applicable [[OpenShift Security Context Constraints|Security Context Constraints]]s. The admission controller first identifies all applicable [[OpenShift Security Context Constraints|SCC]]s based on the user identity and groups the user belongs to. If the pod specifies a service account, the constraints accessible to the [[OpenShift_Security_Context_Constraints#Security_Context_Constraints_and_Service_Accounts|service account]] will be added to the applicable [[OpenShift Security Context Constraints|SCC]] set. It then sorts the SCCs by their [[#priority|priority]] field, highest priority SCCs being placed in front of the list. Nil is considered 0 priority. If the priorities are equal, the SCCs will be sorted from most restrictive to least restrictive. All else being equal, the SCCs will be sorted by name. The field values for the security context settings that were not specified on the request are generated. The final settings are validated against the available constraints. Each field of the security context must be validated against SCCs in order for a request to be successful.</font> | |||
=Admission Controller Types= | =Admission Controller Types= | ||
Revision as of 01:22, 6 September 2020
External
- https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
- https://docs.openshift.org/latest/architecture/additional_concepts/authorization.html#admission
Internal
Overview
An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the metadata, but after the request is authenticated and authorized. There is a fixed set of admission controller that include AlwaysPullImages, PodSecurityPolicy, etc. The controllers are compiled into the kube-apiserver binary, and may only be configured by the cluster administrator.
OpenShift content: the admission controller validates requests by processing these requests relative to all applicable Security Context Constraintss. The admission controller first identifies all applicable SCCs based on the user identity and groups the user belongs to. If the pod specifies a service account, the constraints accessible to the service account will be added to the applicable SCC set. It then sorts the SCCs by their priority field, highest priority SCCs being placed in front of the list. Nil is considered 0 priority. If the priorities are equal, the SCCs will be sorted from most restrictive to least restrictive. All else being equal, the SCCs will be sorted by name. The field values for the security context settings that were not specified on the request are generated. The final settings are validated against the available constraints. Each field of the security context must be validated against SCCs in order for a request to be successful.