ADR-0101: A pod mutator can refuse the pod - #598
Merged
Conversation
ADR-0100 told the app hook which app it is shaping. It still cannot decline one: the signature returns nothing, so an operator whose per-app policy lookup fails must either guess, which fails open, or poison the pod spec so the API server rejects it. Poisoning does fail closed, and it is only half of failing closed. What surfaces is an admission complaint about a malformed name carrying a smuggled string, and it spends the API server's validation as an error channel, so the behaviour is a property of the cluster rather than of this code. The app hook gains an error return. A nil return behaves exactly as before; a non-nil one stops the write, and the object is assembled in memory and dropped rather than sent. A refusal is not a conflict, so the retry loop returns it instead of calling the hook again. WithPodMutator and WithPlatformPodMutator are untouched, and ADR-0061 §3 still holds. The break is taken on the widened spelling, which has been released once with no adopters, rather than adding a fourth name for one seam. Lands Proposed. Signed-off-by: Nicholas Phillips <nsphilli@gmail.com>
The maintainer accepted the record. Status and index row move to Accepted, which unblocks the implementation in #597. Signed-off-by: Nicholas Phillips <nsphilli@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR-0101 — a pod mutator can refuse the pod.
It gives the app hook an
errorreturn, so an operator whose per-app policy lookup fails can decline a deploy instead of guessing or poisoning the spec. Refines ADR-0100 §1 and leaves its §2, §3 and §4 standing.Lands 🟡 Proposed. It needs a decision, not a merge.
Implemented by #597, which is open and waits on this.