Unverified Commit 3fc6832a authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub

Merge pull request #62496 from jennybuckley/service-port-docs

Automatic merge from submit-queue (batch tested with PRs 61306, 60270, 62496, 62181, 62234). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Update WebhookClientConfig documentation regarding service ports **What this PR does / why we need it**: Dynamic admission webhooks backed by services [will always use 443](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/config/client.go#L133) no matter what ports are available. Our [current documentation](https://github.com/kubernetes/api/blob/master/admissionregistration/v1beta1/types.go#L257-L259) says that "If there is only one port open for the service, that port will be used." This PR fixes that piece of documentation. In the future we may wish to support specifying ports other than 443, but the documentation should be fixed first. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes #61510 **Release note**: ```release-note NONE ``` /sig api-machinery
parents 0f3de97d 6994a36c
...@@ -70574,7 +70574,7 @@ ...@@ -70574,7 +70574,7 @@
"format": "byte" "format": "byte"
}, },
"service": { "service": {
"description": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nIf there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error.", "description": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nPort 443 will be used if it is open, otherwise it is an error.",
"$ref": "#/definitions/io.k8s.api.admissionregistration.v1beta1.ServiceReference" "$ref": "#/definitions/io.k8s.api.admissionregistration.v1beta1.ServiceReference"
}, },
"url": { "url": {
...@@ -1777,7 +1777,7 @@ ...@@ -1777,7 +1777,7 @@
}, },
"service": { "service": {
"$ref": "v1beta1.ServiceReference", "$ref": "v1beta1.ServiceReference",
"description": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nIf there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error." "description": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nPort 443 will be used if it is open, otherwise it is an error."
}, },
"caBundle": { "caBundle": {
"type": "string", "type": "string",
......
...@@ -1598,7 +1598,7 @@ Attempting to use a user or basic auth e.g. "user:password@" is not allowed. Fra ...@@ -1598,7 +1598,7 @@ Attempting to use a user or basic auth e.g. "user:password@" is not allowed. Fra
<br> <br>
If the webhook is running within the cluster, then you should use <code>service</code>.<br> If the webhook is running within the cluster, then you should use <code>service</code>.<br>
<br> <br>
If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error.</p></td> Port 443 will be used if it is open, otherwise it is an error.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td> <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1beta1_servicereference">v1beta1.ServiceReference</a></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1beta1_servicereference">v1beta1.ServiceReference</a></p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
......
...@@ -298,9 +298,7 @@ type WebhookClientConfig struct { ...@@ -298,9 +298,7 @@ type WebhookClientConfig struct {
// //
// If the webhook is running within the cluster, then you should use `service`. // If the webhook is running within the cluster, then you should use `service`.
// //
// If there is only one port open for the service, that port will be // Port 443 will be used if it is open, otherwise it is an error.
// used. If there are multiple ports open, port 443 will be used if it
// is open, otherwise it is an error.
// //
// +optional // +optional
Service *ServiceReference Service *ServiceReference
......
...@@ -250,9 +250,7 @@ message WebhookClientConfig { ...@@ -250,9 +250,7 @@ message WebhookClientConfig {
// //
// If the webhook is running within the cluster, then you should use `service`. // If the webhook is running within the cluster, then you should use `service`.
// //
// If there is only one port open for the service, that port will be // Port 443 will be used if it is open, otherwise it is an error.
// used. If there are multiple ports open, port 443 will be used if it
// is open, otherwise it is an error.
// //
// +optional // +optional
optional ServiceReference service = 1; optional ServiceReference service = 1;
......
...@@ -254,9 +254,7 @@ type WebhookClientConfig struct { ...@@ -254,9 +254,7 @@ type WebhookClientConfig struct {
// //
// If the webhook is running within the cluster, then you should use `service`. // If the webhook is running within the cluster, then you should use `service`.
// //
// If there is only one port open for the service, that port will be // Port 443 will be used if it is open, otherwise it is an error.
// used. If there are multiple ports open, port 443 will be used if it
// is open, otherwise it is an error.
// //
// +optional // +optional
Service *ServiceReference `json:"service" protobuf:"bytes,1,opt,name=service"` Service *ServiceReference `json:"service" protobuf:"bytes,1,opt,name=service"`
......
...@@ -114,7 +114,7 @@ func (Webhook) SwaggerDoc() map[string]string { ...@@ -114,7 +114,7 @@ func (Webhook) SwaggerDoc() map[string]string {
var map_WebhookClientConfig = map[string]string{ var map_WebhookClientConfig = map[string]string{
"": "WebhookClientConfig contains the information to make a TLS connection with the webhook", "": "WebhookClientConfig contains the information to make a TLS connection with the webhook",
"url": "`url` gives the location of the webhook, in standard URL form (`[scheme://]host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nThe scheme must be \"https\"; the URL must begin with \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.\n\nAttempting to use a user or basic auth e.g. \"user:password@\" is not allowed. Fragments (\"#...\") and query parameters (\"?...\") are not allowed, either.", "url": "`url` gives the location of the webhook, in standard URL form (`[scheme://]host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nThe scheme must be \"https\"; the URL must begin with \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.\n\nAttempting to use a user or basic auth e.g. \"user:password@\" is not allowed. Fragments (\"#...\") and query parameters (\"?...\") are not allowed, either.",
"service": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nIf there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error.", "service": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nPort 443 will be used if it is open, otherwise it is an error.",
"caBundle": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. Required.", "caBundle": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. Required.",
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment