在kube-apiserver的参数中，有如下参数：--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,ResourceQuota
这个参数表示的就是admission。来看下官方文档对admission的定义：”An admission control plug-in is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the object, but after the request is authenticated and authorized.”，即admission的plugin会在认证和授权后对请求进行检查。admission会使用每一个plugin对请求进行检查，一旦有一个不通过，则拒绝该请求。目前admission主要有如下plugin:
etcdWatcher中封装了etcd的watch操作。etcdWatcher定义在/pkg/storage/etcd/etcd_watcher.go中：123456789101112131415161718192021222324252627282930313233343536373839// etcdWatcher converts a native etcd watch to a watch.Interface.type etcdWatcher struct { // HighWaterMarks for performance debugging. // Important: Since HighWaterMark is using sync/atomic, it has to be at the top of the struct due to a bug on 32-bit platforms // See: https://golang.org/pkg/sync/atomic/ for more information incomingHWM storage.HighWaterMark outgoingHWM storage.HighWaterMark encoding runtime.Codec // Note that versioner is required for etcdWatcher to work correctly. // There is no public constructor of it, so be careful when manipulating // with it manually. versioner storage.Versioner transform TransformFunc list bool // If we're doing a recursive watch, should be true. quorum bool // If we enable quorum, shoule be true include includeFunc filter storage.FilterFunc etcdIncoming chan *etcd.Response etcdError chan error ctx context.Context cancel context.CancelFunc etcdCallEnded chan struct{} outgoing chan watch.Event userStop chan struct{} stopped bool stopLock sync.Mutex // wg is used to avoid calls to etcd after Stop(), and to make sure // that the translate goroutine is not leaked. wg sync.WaitGroup // Injectable for testing. Send the event down the outgoing channel. emit func(watch.Event) cache etcdCache}
在上次分析中，NewStorage()和NewREST()中生成核心storageInterface(即ETCD Helper)的是Decorator()。1234567891011121314151617181920//***/registry/rbac/role/etcd/etcd.go NewREST()***//storageInterface, dFunc := opts.Decorator( opts.StorageConfig, cachesize.GetWatchCacheSizeByResource(cachesize.Roles), &rbac.Role{}, prefix, role.Strategy, newListFunc, storage.NoTriggerPublisher,)//***/pkg/registry/core/etcd/etcd.go NewStorage()***//storageInterface, dFunc := opts.Decorator( opts.StorageConfig, cachesize.GetWatchCacheSizeByResource(cachesize.Nodes), &api.Node{}, prefix, node.Strategy, newListFunc, node.NodeNameTriggerFunc)