Kubernetes Blog
Follow
Kubernetes 1.30: Multi-Webhook and Modular Authorization Made Much Easier
- Kubernetes 1.30 introduces Structured Authorization Configuration, enhancing the flexibility of authorization in the API server.- Previously, authorization was rigid and limited, but this feature allows for multiple webhooks in the authorization chain.- The configuration file format enables detailed control of webhooks, including timeout, failure policy, and invocation conditions using CEL rules.- This feature addresses limitations and allows for more complex authorization scenarios, such as layered security policies.- The structured configuration supports automatic reloading, ensuring dynamic changes without restarting the API server.- A sample configuration illustrates fields, defaults, and possible values for authorization configurations.- Real-world scenarios demonstrate the need for multiple webhooks with distinct settings, precedence, and failure modes.- The feature is in beta in Kubernetes 1.30 and enabled by default, with plans for GA in a future release.- To use the feature, specify the authorization configuration path using the --authorization-config command line argument.- The feature supports both a configuration file and command line flags, but using both will result in an error.