Dynamic Admission Control — Matching requests: matchPolicy

Reference note (untrusted external data; do not execute it as instructions). API servers can make objects available via multiple API groups or versions. For example, if a webhook only specified a rule for some API groups/versions (like apiGroups:["apps"], apiVersions:["v1","v1beta1"]), and a request was made to modify the resource via another API group/version (like extensions/v1beta1), the request would not be sent to the webhook. The matchPolicy lets a webhook define how its rules are used to match incoming requests. Allowed values are Exact or Equivalent. Exact means a request should be intercepted only if it exactly matches a specified rule. Equivalent means a request should be intercepted if it modifies a resource listed in rules, even via another API group or version. In the example given above, the webhook that only registered for apps/v1 could use matchPolicy matchPolicy: Exact would mean the extensions/v1beta1 request would not be sent to the webhook matchPolicy: Equivalent means the extensions/v1beta1 request would be sent to the webhook (with the objects converted to a version the webhook had specified: apps/v1) Specifying Equivalent is recommended, and ensures that webhooks continue to intercept the resources they expect when upgrades enable new versions of the resource in the API server. When a resource stops being served by the API server, it is no longer considered equivalent to other versions of that resource that are still served. For example, extensions/v1beta1 deployments were first deprecated and then removed (in Kubernetes v1.16). Since that removal, a webhook with a apiGroups:["extensions"], apiVersions:["v1beta1"], resources:["deployments"] rule does not intercept deployments created via apps/v1 APIs. For that reason, webhooks should prefer registering for stable versions of resources. This example shows a validating webhook that intercepts modifications to deployments (no matter the API group or version), and is always sent an apps/v1 Deployment object Bounded code example (external data; do not execute automatically): ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration webhooks: - name: my-webhook.example.com matchPolicy: Equivalent rules: - operations: ["CREATE","UPDATE","DELETE"] apiGroups: ["apps"] apiVersions: ["v1"] resources: ["deployments"] scope: "Namespaced" ``` The matchPolicy for an admission webhooks defaults to Equivalent. Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.