Support ConfigMaps as paramKind for ValidatingAdmissionPolicy to avoid failure during discovery delays with CRDs

[chobostar]

(AI generated)

Describe the solution you'd like

To avoid dependency on CRD discovery for parameters, allow ConfigMaps (or possibly Secrets) to be used as paramKind for ValidatingAdmissionPolicy.

ConfigMaps (or Secrets) are native core API resources, always available without discovery delays.

Anything else you would like to add:

Currently, ValidatingAdmissionPolicy (VAP) relies on CRDs as paramKind to provide dynamic parameters. However, this approach has some drawbacks:
kubernetes/kubernetes#124237
kubernetes/kubernetes#122658

Environment:

• Gatekeeper version:
• Kubernetes version: (use kubectl version):

[JaydipGabani]

@chobostar as a workaround for this, we have added a default 30s wait for CRD and param resource to be available for parameters in VAP while generating VAP resources in GK. That should solve this issue. Are you still facing this issue even after the wait?

[chobostar]

@JaydipGabani Thank you for the workarounds, I had checked them before creating the issue. However from my perspective there are subtle complexities underlying their behavior:

• There are rate limits that might be involved during the discovery
• CRDs don't load immediately. In our case, full loading of 500+ CRDs during kube-apiserver startup takes 50+ seconds, which makes the timing non-deterministic

From my point of view, decoupling from CRDs as an uncontrollable dependency to improve VAP stability seems like a viable alternative to your quick and simple workaround

[JaydipGabani]

@chobostar 50+ seconds is concerning, we talked about fixing this issue in upstream Kubernetes to address concerns that you are facing around "discovery". We were told at max it takes 30s to get the visibility. hence the "default wait time of 30s". Preferably this should be fixed in K8s, but if not then try to increase wait time to 50+ seconds to see if it solves the problem.

I am not opposed to the idea of using ConfigMap or any available CRD to be used as paramKind. I am a bit concerned about using CongfigMap or Secrets for this purpose because we would need to watch param resource and make sure it is not modified unintentionally or maliciously. Watch on ConfigMap or Secret could be very costly, so most likely a new CRD would be needed for this purpose.