-
Notifications
You must be signed in to change notification settings - Fork 215
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
de-dup webhook factory and validator
- Loading branch information
1 parent
a2e2788
commit 3270ed9
Showing
4 changed files
with
43 additions
and
101 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,58 +1,65 @@ | ||
| package validator | ||
|
|
||
| import ( | ||
| "context" | ||
| "net/http" | ||
|
|
||
| conf "github.com/reactiveops/fairwinds/pkg/config" | ||
| appsv1 "k8s.io/api/apps/v1" | ||
| corev1 "k8s.io/api/core/v1" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| "sigs.k8s.io/controller-runtime/pkg/runtime/inject" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission/types" | ||
| ) | ||
|
|
||
| // DeployValidator validates Pods | ||
| type DeployValidator struct { | ||
| // Validator validates Pods | ||
| type Validator struct { | ||
| client client.Client | ||
| decoder types.Decoder | ||
| Config conf.Configuration | ||
| } | ||
|
|
||
| var _ inject.Client = &DeployValidator{} | ||
| var _ inject.Client = &Validator{} | ||
|
|
||
| // InjectClient injects the client. | ||
| func (v *DeployValidator) InjectClient(c client.Client) error { | ||
| func (v *Validator) InjectClient(c client.Client) error { | ||
| v.client = c | ||
| return nil | ||
| } | ||
|
|
||
| var _ inject.Decoder = &DeployValidator{} | ||
| var _ inject.Decoder = &Validator{} | ||
|
|
||
| // InjectDecoder injects the decoder. | ||
| func (v *DeployValidator) InjectDecoder(d types.Decoder) error { | ||
| func (v *Validator) InjectDecoder(d types.Decoder) error { | ||
| v.decoder = d | ||
| return nil | ||
| } | ||
|
|
||
| var _ admission.Handler = &DeployValidator{} | ||
| var _ admission.Handler = &Validator{} | ||
|
|
||
| // Handle for DeployValidator admits a deploy if validation passes. | ||
| func (v *DeployValidator) Handle(ctx context.Context, req types.Request) types.Response { | ||
| func (v *Validator) Handle(ctx context.Context, req types.Request) types.Response { | ||
| deploy := appsv1.Deployment{} | ||
|
|
||
| err := v.decoder.Decode(req, &deploy) | ||
| if err != nil { | ||
| return admission.ErrorResponse(http.StatusBadRequest, err) | ||
| if err == nil { | ||
| results := ValidateDeploys(v.Config, &deploy, Results{}) | ||
| allowed, reason := results.Format() | ||
| return admission.ValidationResponse(allowed, reason) | ||
| } | ||
|
|
||
| results := ValidateDeploys(v.Config, &deploy, Results{}) | ||
| allowed, reason := results.Format() | ||
|
|
||
| return admission.ValidationResponse(allowed, reason) | ||
| pod := corev1.Pod{} | ||
| err = v.decoder.Decode(req, &pod) | ||
| if err == nil { | ||
| results := ValidatePods(v.Config, &pod.Spec, Results{}) | ||
| allowed, reason := results.Format() | ||
| return admission.ValidationResponse(allowed, reason) | ||
| } | ||
| return admission.ErrorResponse(http.StatusBadRequest, err) | ||
| } | ||
|
|
||
| // ValidateDeploys does validates that each deployment conforms to the Fairwinds config. | ||
| // ValidateDeploys validates that each deployment conforms to the Fairwinds config. | ||
| func ValidateDeploys(conf conf.Configuration, deploy *appsv1.Deployment, results Results) Results { | ||
| pod := deploy.Spec.Template.Spec | ||
| return ValidatePods(conf, pod, results) | ||
| return ValidatePods(conf, &pod, results) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,49 +1,34 @@ | ||
| package validator | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
|
|
||
| conf "github.com/reactiveops/fairwinds/pkg/config" | ||
| admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1" | ||
| appsv1 "k8s.io/api/apps/v1" | ||
| corev1 "k8s.io/api/core/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| "sigs.k8s.io/controller-runtime/pkg/manager" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission/builder" | ||
| ) | ||
|
|
||
| // NewDeployWebhook creates a validating admission webhook for deploy creation and updates. | ||
| func NewDeployWebhook(mgr manager.Manager, c conf.Configuration) *admission.Webhook { | ||
| webhook, err := builder.NewWebhookBuilder(). | ||
| Name("deploy.k8s.io"). | ||
| Validating(). | ||
| Path("/validating-deployment"). | ||
| Operations(admissionregistrationv1beta1.Create, admissionregistrationv1beta1.Update). | ||
| WithManager(mgr). | ||
| ForType(&appsv1.Deployment{}). | ||
| Handlers(&DeployValidator{Config: c}). | ||
| Build() | ||
| if err != nil { | ||
| log.Error(err, "unable to setup deploy validating webhook") | ||
| os.Exit(1) | ||
| } | ||
| return webhook | ||
| } | ||
| // NewWebhook creates a validating admission webhook for the apiType. | ||
| func NewWebhook(name string, mgr manager.Manager, validator Validator, apiType runtime.Object) *admission.Webhook { | ||
| name = fmt.Sprintf("%s.k8s.io", name) | ||
| path := fmt.Sprintf("/validating-%s", name) | ||
|
|
||
| // NewPodWebhook creates a validating admission webhook for pod creation and updates. | ||
| func NewPodWebhook(mgr manager.Manager, c conf.Configuration) *admission.Webhook { | ||
| webhook, err := builder.NewWebhookBuilder(). | ||
| Name("pod.k8s.io"). | ||
| Name(name). | ||
| Validating(). | ||
| Path("/validating-pod"). | ||
| Path(path). | ||
| Operations(admissionregistrationv1beta1.Create, admissionregistrationv1beta1.Update). | ||
| WithManager(mgr). | ||
| ForType(&corev1.Pod{}). | ||
| Handlers(&PodValidator{Config: c}). | ||
| ForType(apiType). | ||
| Handlers(&validator). | ||
| Build() | ||
| if err != nil { | ||
| log.Error(err, "unable to setup pod validating webhook") | ||
| log.Error(err, "unable to setup validating webhook:", name) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| return webhook | ||
| } |