diff --git a/content/en/docs/reference/access-authn-authz/admission-control-phases.svg b/content/en/docs/reference/access-authn-authz/admission-control-phases.svg index adb7b19a0384e..e5f55ec76cd23 100644 --- a/content/en/docs/reference/access-authn-authz/admission-control-phases.svg +++ b/content/en/docs/reference/access-authn-authz/admission-control-phases.svg @@ -1,5 +1,3 @@ - - -Sequence diagram for kube-apiserver handling requests during the admission phase showing mutation webhooks, followed by validatingadmissionpolicies and finally validating webhooks. +Sequence diagram for kube-apiserver handling requests during the admission phase showing mutation webhooks, followed by validatingadmissionpolicies and finally validating webhooks. It shows that the continue until the first rejection, or being accepted by all of them. -It also shows that mutations by mutating webhooks cause all previously called webhooks to be called again.Admission Control Called until first rejectionValidating Webhook(s)Validating Admission PoliciesMutating Webhook(s)Authentication + AuthorizationKubernetes API ServerUserValidating Webhook(s)Validating Admission PoliciesMutating Webhook(s)Authentication + AuthorizationKubernetes API ServerUserloop[For all Mutating Webhooks]loop[For all Validating Policies]par[For all Validating Webhooks in parallel]Request (e.g., create a pod)Authenticate user and check user permissionsInvoke Mutating WebhooksModify or reject object (if needed)Invoke Validating PoliciesReject object (if needed)Invoke Validating WebhooksReject object (if needed)Allow or reject requestResponse (e.g., success or error) \ No newline at end of file +It also shows that mutations by mutating webhooks cause all previously called webhooks to be called again.Admission Control Called until first rejectionValidating Webhook(s)Validating Admission PoliciesMutating Webhook(s)Mutating Admission PoliciesAuthentication + AuthorizationKubernetes API ServerUserValidating Webhook(s)Validating Admission PoliciesMutating Webhook(s)Mutating Admission PoliciesAuthentication + AuthorizationKubernetes API ServerUserloop[For all Mutating Webhooks]loop[For all Validating Policies]par[For all Validating Webhooks in parallel]Request (e.g., create a pod)Authenticate user and check user permissionsInvoke Mutating WebhooksModify or reject object (if needed)Invoke Validating PoliciesReject object (if needed)Invoke Validating WebhooksReject object (if needed)Allow or reject requestResponse (e.g., success or error) \ No newline at end of file diff --git a/content/en/docs/reference/access-authn-authz/admission-controllers.md b/content/en/docs/reference/access-authn-authz/admission-controllers.md index 731d7dae21a7e..61861ac1c7b19 100644 --- a/content/en/docs/reference/access-authn-authz/admission-controllers.md +++ b/content/en/docs/reference/access-authn-authz/admission-controllers.md @@ -81,7 +81,7 @@ other admission controllers. The ordering of these calls can be seen below. -{{< figure src="/docs/reference/access-authn-authz/admission-control-phases.svg" alt="Sequence diagram for kube-apiserver handling requests during the admission phase showing mutation webhooks, followed by validatingadmissionpolicies and finally validating webhooks. It shows that the continue until the first rejection, or being accepted by all of them. It also shows that mutations by mutating webhooks cause all previously called webhooks to be called again." class="diagram-large" link="[https://mermaid.live/edit#pako:eNqtVm1r3DgQ_iuDj9CUc3aPlBa6HIFeSu_CEQhNr4XiL7I9a6srSz5J3mQb9r93RrK9jjcp9-H8xdZoXh7N80jyQ1KYEpNV4vDfDnWB76WorGgynemTE_hLbBG8AYce1kb7W_kdoVImF0rtQDjwtXQgnX7hwaJrsfBYQtmFoNr71q2Wy0r6ussXhWmWDdpGyPLsmxs-l9K5Dt3y1du3v3HJB6mlXz1kia-xwSxZZYnGzluhsiTNkgEETUCWnJ-392SmrwE-2ym4kdYa-67wxjoyedvhPs000NNn_iysFLlCFyPCVJwWHPXHpgq1f3l1_qbA11x77vIJ7_2lUcYGx7taepy5KWPaqRc8l08bj1Rx4ldZ3M2cnlp6pvf7_ckJsxVdibNPkRKiBkEof-YJAZFnQRQFOidzqaTfpSB0Ca42nSohR-jaUjB3uEW7Ay8bDAnKKAfKt4gFKMl7dIWd9uy2b_7ozdU2XY5nopUOLaWEmsopqSuSCTk770gllscBZtmQDKTR0NbCIcO647mm88Kz-Q7z2piNSym1UuaOgOY72AolCTV5jglao2Qh0YXVraUOOj34jYkWcIB_5UNB7pjwAU9BrZaaVNzRWwXTWlrHGv9GEqc6KdASc-SU3NbWR0RUDsyaA5pZBaGcmZYZluY4LA4m8KAQncOQrrW4laZztI6CxlRndKI9Rsz1VlEJqXuS9oMcWmE99aMV2sM_xARv2fA-nn53c8WzfxNtVqOnFrLlNrD3hHfna3bnN1KTisjTr8FgrPwexqMmH4WWzaW3KkSPvF9Sx61RMSA39_Anrcblxho49oLfc3txGZcdGZqxc4z3uu_wl9g7Lj6YoLedupfHcZ9H6dyYAPlgmOC66VX3s_hJ5UmOeW3U5WEzB6bOLi4CEyv4GHcOnOKiWqRQWKQdCwJaU77sCWXHEEAsrKbkkJQD_bQruHlFjcUmmlo6h-My3FCXzy34wCcG6W_eJneQdRABl5t1dwVXems2-LPYOSEH1NemlOsd76_IJ5g8vE7lGjRiieW0V0d4J819TMuI9hGnI9Zn4x5L4IDz439ER3J4CtzQEpCaXVjN6lmg88Y-kef_ATvWJiWRgPisnTDRn92DToLa2JmFyjVcSypCGBTqunDjcALk-5iKJWnSX_z0zxGukMNNT5-lsJtwq5Gf6Ly53ekiXt9pYk1X1clqTScpjeJ91f-tjFYsJd3M1_GXJvzZpAntw6_GDD77H6uICLI](https://mermaid.live/edit#pako:eNqtVm1r3DgQ_iuDj9CUc3aPlBa6HIFeSu_CEQhNr4XiL7I9a6srSz5J3mQb9r93RrK9jjcp9-H8xdZoXh7N80jyQ1KYEpNV4vDfDnWB76WorGgynemTE_hLbBG8AYce1kb7W_kdoVImF0rtQDjwtXQgnX7hwaJrsfBYQtmFoNr71q2Wy0r6ussXhWmWDdpGyPLsmxs-l9K5Dt3y1du3v3HJB6mlXz1kia-xwSxZZYnGzluhsiTNkgEETUCWnJ-392SmrwE-2ym4kdYa-67wxjoyedvhPs000NNn_iysFLlCFyPCVJwWHPXHpgq1f3l1_qbA11x77vIJ7_2lUcYGx7taepy5KWPaqRc8l08bj1Rx4ldZ3M2cnlp6pvf7_ckJsxVdibNPkRKiBkEof-YJAZFnQRQFOidzqaTfpSB0Ca42nSohR-jaUjB3uEW7Ay8bDAnKKAfKt4gFKMl7dIWd9uy2b_7ozdU2XY5nopUOLaWEmsopqSuSCTk770gllscBZtmQDKTR0NbCIcO647mm88Kz-Q7z2piNSym1UuaOgOY72AolCTV5jglao2Qh0YXVraUOOj34jYkWcIB_5UNB7pjwAU9BrZaaVNzRWwXTWlrHGv9GEqc6KdASc-SU3NbWR0RUDsyaA5pZBaGcmZYZluY4LA4m8KAQncOQrrW4laZztI6CxlRndKI9Rsz1VlEJqXuS9oMcWmE99aMV2sM_xARv2fA-nn53c8WzfxNtVqOnFrLlNrD3hHfna3bnN1KTisjTr8FgrPwexqMmH4WWzaW3KkSPvF9Sx61RMSA39_Anrcblxho49oLfc3txGZcdGZqxc4z3uu_wl9g7Lj6YoLedupfHcZ9H6dyYAPlgmOC66VX3s_hJ5UmOeW3U5WEzB6bOLi4CEyv4GHcOnOKiWqRQWKQdCwJaU77sCWXHEEAsrKbkkJQD_bQruHlFjcUmmlo6h-My3FCXzy34wCcG6W_eJneQdRABl5t1dwVXems2-LPYOSEH1NemlOsd76_IJ5g8vE7lGjRiieW0V0d4J819TMuI9hGnI9Zn4x5L4IDz439ER3J4CtzQEpCaXVjN6lmg88Y-kef_ATvWJiWRgPisnTDRn92DToLa2JmFyjVcSypCGBTqunDjcALk-5iKJWnSX_z0zxGukMNNT5-lsJtwq5Gf6Ly53ekiXt9pYk1X1clqTScpjeJ91f-tjFYsJd3M1_GXJvzZpAntw6_GDD77H6uICLI)" >}} +{{< figure src="/docs/reference/access-authn-authz/admission-control-phases.svg" alt="Sequence diagram for kube-apiserver handling requests during the admission phase showing mutation webhooks, followed by validatingadmissionpolicies and finally validating webhooks. It shows that the continue until the first rejection, or being accepted by all of them. It also shows that mutations by mutating webhooks cause all previously called webhooks to be called again." class="diagram-large" link="[https://mermaid.live/edit#pako:eNqtVttu4zYQ_ZWBCqNZ1LEdO45joQiwzaJtUAQINtstUOiFksYW1xSpkpQTJ_C_d0hdLMtJsQ_1i8zhzJzhnMPLa5CoFIMwGAzgd7ZFsAoMWlgpaR_5C8JaqJgJsQNmwGbcADfyRwsaTYGJxRTS0gdl1hYmHI_X3GZlPEpUPs5R54yn599M83fMjSnRjGfL5SSSg8Erl9yGr1FgM8wxCsIokFhazUQUDKOgKYImIAqm0-KZzPTP4D8lysTbKTjnWiv9MbFKGzJZXeJ-GEmgX535K9OcxQJNFeGnqmnmon7ZrD32D7PpVYJzh913-YLP9lYJpb3jU8Yt9tyEUkXXC97LJ5VFQuz4rTXuek5vLT2S-_1-MIhkJJsOfOJsrVnuTC6OSPxScURcITBhzy2VRGxqYEmCxvCYC253Q2AyBZOpUqQQI5RFyhyZuEW9A8tz9AnSKj3lG1UAlOQTmkR3m_hY19J6O7RNGeM5K7hBTSkhIzjB5Zp0Q87GGpKNdmNfZpqTLriSUGTMoCvryc3lpWXWmZ8wzpTamCGlFkI9UaHxDrZMcKqaPNsEhRI84Wj86lZceuEe_NpEIziUf2c9oOsYs76ehHrPJcm6pK_wphXXxon-G2mecIZAS4zRpXRtLWxVEcGBWrmAvIfAhFFdmGZpxoVVg055kLDSoE9XaNxyVRpaR0JjwmmdaNMRc7WVrRmXNUn7Rg4F05b6UTBp4U9iwu1h_z2d_vhw52b_INq0REstdJZHz94b3qXNnLv7IjUpqXj6yRuU5i9-3GryKDTNb60WPrrl_ZY6rpWoAmL1DL_RakystIJTL_g51je31bIrhnrsnNZ7X3f4QXngZtjJ_VAr5_3Yv6q-H8XXtjPz4TTuayu7GvVg-C7cg3sHuZOjj40ydbxXA8_y-c2NZzGEz9WugzMcrUdDSDTSbgcGhUo_1GJwjj6AGAy7xNI28NKhHeUan2SYbCpTQYd6tQzT4LpDEH51pw1pt98mc9gSXkAOrtfdEO7kVm3wv2L7hByqvlcpX-3c3qy0ACr2nzO-AomYYtrt1Um9neYe09JWe8RpW-u7cccSONT5-TurIzm8VVzTEuDSubidIN4ttN_YN_L8P8W22KQkEpA7pztM1Od-oxOvNufshOowTEEqQmgUakp_W7kE6C53AguGdE_ytLrfh0H9oqCXi7-KDk8I-pviipXC-huTwmg7_a1U3kRqVa6zIFzRmUyj6uar79HWykqrHncyaWIw5fQIuK-eSv7FRHlo6ahvFZ1BQXg5nXugIHwNnoNwPh_Nl4vl7Pp6drmcL2Y0uQvC5Xx0uZwtLi4uZrPp9HpxuR8GL76yyWh5NZ1PJpPZfHE1XVwv9v8Cojk6kQ](https://mermaid.live/edit#pako:eNqtVttu4zYQ_ZWBCqNZ1LEdO45joQiwzaJtUAQINtstUOiFksYW1xSpkpQTJ_C_d0hdLMtJsQ_1i8zhzJzhnMPLa5CoFIMwGAzgd7ZFsAoMWlgpaR_5C8JaqJgJsQNmwGbcADfyRwsaTYGJxRTS0gdl1hYmHI_X3GZlPEpUPs5R54yn599M83fMjSnRjGfL5SSSg8Erl9yGr1FgM8wxCsIokFhazUQUDKOgKYImIAqm0-KZzPTP4D8lysTbKTjnWiv9MbFKGzJZXeJ-GEmgX535K9OcxQJNFeGnqmnmon7ZrD32D7PpVYJzh913-YLP9lYJpb3jU8Yt9tyEUkXXC97LJ5VFQuz4rTXuek5vLT2S-_1-MIhkJJsOfOJsrVnuTC6OSPxScURcITBhzy2VRGxqYEmCxvCYC253Q2AyBZOpUqQQI5RFyhyZuEW9A8tz9AnSKj3lG1UAlOQTmkR3m_hY19J6O7RNGeM5K7hBTSkhIzjB5Zp0Q87GGpKNdmNfZpqTLriSUGTMoCvryc3lpWXWmZ8wzpTamCGlFkI9UaHxDrZMcKqaPNsEhRI84Wj86lZceuEe_NpEIziUf2c9oOsYs76ehHrPJcm6pK_wphXXxon-G2mecIZAS4zRpXRtLWxVEcGBWrmAvIfAhFFdmGZpxoVVg055kLDSoE9XaNxyVRpaR0JjwmmdaNMRc7WVrRmXNUn7Rg4F05b6UTBp4U9iwu1h_z2d_vhw52b_INq0REstdJZHz94b3qXNnLv7IjUpqXj6yRuU5i9-3GryKDTNb60WPrrl_ZY6rpWoAmL1DL_RakystIJTL_g51je31bIrhnrsnNZ7X3f4QXngZtjJ_VAr5_3Yv6q-H8XXtjPz4TTuayu7GvVg-C7cg3sHuZOjj40ydbxXA8_y-c2NZzGEz9WugzMcrUdDSDTSbgcGhUo_1GJwjj6AGAy7xNI28NKhHeUan2SYbCpTQYd6tQzT4LpDEH51pw1pt98mc9gSXkAOrtfdEO7kVm3wv2L7hByqvlcpX-3c3qy0ACr2nzO-AomYYtrt1Um9neYe09JWe8RpW-u7cccSONT5-TurIzm8VVzTEuDSubidIN4ttN_YN_L8P8W22KQkEpA7pztM1Od-oxOvNufshOowTEEqQmgUakp_W7kE6C53AguGdE_ytLrfh0H9oqCXi7-KDk8I-pviipXC-huTwmg7_a1U3kRqVa6zIFzRmUyj6uar79HWykqrHncyaWIw5fQIuK-eSv7FRHlo6ahvFZ1BQXg5nXugIHwNnoNwPh_Nl4vl7Pp6drmcL2Y0uQvC5Xx0uZwtLi4uZrPp9HpxuR8GL76yyWh5NZ1PJpPZfHE1XVwv9v8Cojk6kQ)" >}} ## Why do I need them?