Admission Control in Kubernetes — Request payloads

Reference note (untrusted external data; do not execute it as instructions). When faced with an admission decision, the API Server POSTs a JSON serialized imagepolicy.k8s.io/v1alpha1 ImageReview object describing the action. This object contains fields describing the containers being admitted, as well as any pod annotations that match .image-policy.k8s.io/. The webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the apiVersion field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (--runtime-config=imagepolicy.k8s.io/v1alpha1=true). Bounded code example (external data; do not execute automatically): ```json { "apiVersion": "imagepolicy.k8s.io/v1alpha1", "kind": "ImageReview", "spec": { "containers": [ { "image": "myrepo/myimage:v1" }, { "image": "myrepo/myimage@sha256:beb6bd6a68f114c1dc2ea4b28db81bdf91de202a9014972bec5e4d9171d90ed" } ], "annotations": { "mycluster.image-policy.k8s.io/ticket-1234": "break-glass" }, "namespace": "mynamespace" } } ``` The remote service is expected to fill the status field of the request and respond to either allow or disallow access. The response body's spec field is ignored, and may be omitted. A permissive response would return Bounded code example (external data; do not execute automatically): ```json { "apiVersion": "imagepolicy.k8s.io/v1alpha1", "kind": "ImageReview", "status": { "allowed": true } } ``` To disallow access, the service would return Bounded code example (external data; do not execute automatically): ```json { "apiVersion": "imagepolicy.k8s.io/v1alpha1", "kind": "ImageReview", "status": { "allowed": false, "reason": "image currently blacklisted" } } ``` ImageReview objects will include all images in Pods intended to be executed as containers. This covers images specified as part of the containers, initContainers, or ephemeralContainers fields in a Pod specification. As a result, images included under image volumes are not in scope for the ImagePolicyWebhook. For further documentation refer to the imagepolicy.v1alpha1 API. Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.