admission.k8s.io/v1 AdmissionReview response requires uid

[mingfang]

According to https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/ the response needs to look like this

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "response": {
    "uid": "<value from request.uid>",
    "allowed": true
  }
}

[patrick-east]

@mingfang is there a specific example or policy in the library that is missing this? Any more details would be helpful.

[mingfang]

So technically this library is not missing it because it's still on the older admission.k8s.io/v1beta1.
I have upgraded it locally by adding the uid like this

library/kubernetes/mutating-admission/main.rego

Line 41 in ba6cc2a

"patch": base64.encode(json.marshal(fullPatches)),

response = x {
    count(patch) > 0

    # if there are missing leaves e.g. trying to add a label to something that doesn't
    # yet have any, we need to create the leaf nodes as well

    fullPatches := ensureParentPathsExist(cast_array(patch))

    x := {
        "allowed": true,
        "patchType": "JSONPatch",
        "patch": base64.encode(json.marshal(fullPatches)),
        "uid": input.request.uid, <-needed in v1
    }
}

But the problem is I can't add uid to the default response here

library/kubernetes/mutating-admission/main.rego

Line 14 in ba6cc2a

default response = {"allowed": true}

because I get here saying default response can not use refs.
The workaround is to leave the uid out of the default response and Kubernetes prints out a warning.