Mutation Enhancements about gatekeeper HOT 2 OPEN

• mutator controller tracking - though it may help with infinite mutation cycles for GK mutations. it won't address mutations that can happen outside of GK, e.g. another mutating webhook

• Allow for more than MustExist and MustNotExistconditions in the path tests, like =, >, <, - I think this could be useful.

@maxsmythe @sozercan thoughts?

from gatekeeper.

Allow for more than MustExist and MustNotExistconditions in the path tests, like =, >, <, - I think this could be useful.

This would definitely allow for infinite cycles:

• Mutator A: if field X = 2 set to 5
• Mutator B: if field X = 1 set to 2
• Mutator C: if field X = 5 set to 1

Cycle: 1 -> 2 -> 1 -> 2 -> 1 -> 2 -> .....

Given that K8s is looking at embedded mutation (e.g. validating admission policy, but for mutation), I'd be hesitant to make too many fundamental changes to mutation until we know what (if any) stance they have on the safety issue.

from gatekeeper.