Enhancement request: admission webhook expression filter

[Zombro]

issue

gmsa admission webhook intercepts everything, including pods that have nothing to do with gmsa.

the gmsa mutating webhook has no object selector / match expressions. it may be preferable to incorporate a few filters as this chart moves forward with k8s.

the easy move forward might be something like an objectSelector that matches a label like gmsa-mutate: true

a more hands-free future solution could leverage match conditions testing existence of spec securityContext.windowsOptions.gmsaCredentialSpecName

references

took a look at - https://github.com/kubernetes-sigs/windows-gmsa/pull/145/files. good. this mostly circumvents the issue.

last year k8s added enhancement to support expression filters in webhooks kubernetes/enhancements#3716, marked stable in v1.30+

k8s docs
object filter - start here: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector,
fancy new CEL expressions (1.30+): https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale