What's the difference between input.review and input.request?

[anderseknert]

When looking at Kubernetes admission controller policies, you'll sometimes see them using input.request and sometimes input.review. These seem to reference the request data as provided by the Kubernetes API, so why is there a difference?

[anderseknert]

As this question comes up every now and then, I'm posting it here with the answer for posterity.

OPA Gatekeeper modifies the incoming request from the Kubernetes API server before it is provided to your policy. When doing so, it changes input.request to be input.review and it also populates input.parameters based on parameters provided by the constraint template.

When using "regular" OPA for admission control, as described in the OPA docs, your policies will see the input exactly as it is provided by the Kubernetes API server. In that format the request object will be found under input.request.

So to summarize:

• OPA Gatekeeper: input.review
• Standard OPA: input.request