nhyatt/mutating-webhook
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

order modules

Browse Source 
add configuration to supporting functionality
This commit is contained in:
Hyatt
2023-03-18 14:47:06 -05:00
parent 173957c034
commit d5963a693d
11 changed files with 48 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
internal/operations/deploymentsValidation.go
View File

@ -1,22 +1,24 @@
package operations
import (
"mutating-webhook/internal/config"
admission "k8s.io/api/admission/v1"
)
func DeploymentsValidation() Hook {
return Hook{
// default allow
Create: func(r *admission.AdmissionRequest) (*Result, error) {
Create: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
Delete: func(r *admission.AdmissionRequest) (*Result, error) {
Delete: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
Update: func(r *admission.AdmissionRequest) (*Result, error) {
Update: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
Connect: func(r *admission.AdmissionRequest) (*Result, error) {
Connect: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
}

18
internal/operations/hook.go
View File

@ -5,6 +5,8 @@ package operations
import (
"fmt"
"mutating-webhook/internal/config"
admission "k8s.io/api/admission/v1"
)
@ -16,7 +18,7 @@ type Result struct {
}
// AdmitFunc defines how to process an admission request
type AdmitFunc func(request *admission.AdmissionRequest) (*Result, error)
type AdmitFunc func(request *admission.AdmissionRequest, cfg config.Config) (*Result, error)
// Hook represents the set of functions for each operation in an admission webhook.
type Hook struct {
@ -27,25 +29,25 @@ type Hook struct {
}
// Execute evaluates the request and try to execute the function for operation specified in the request.
func (h *Hook) Execute(r *admission.AdmissionRequest) (*Result, error) {
func (h *Hook) Execute(r *admission.AdmissionRequest, cfg *config.Config) (*Result, error) {
switch r.Operation {
case admission.Create:
return wrapperExecution(h.Create, r)
return wrapperExecution(h.Create, r, *cfg)
case admission.Update:
return wrapperExecution(h.Update, r)
return wrapperExecution(h.Update, r, *cfg)
case admission.Delete:
return wrapperExecution(h.Delete, r)
return wrapperExecution(h.Delete, r, *cfg)
case admission.Connect:
return wrapperExecution(h.Connect, r)
return wrapperExecution(h.Connect, r, *cfg)
}
return &Result{Msg: fmt.Sprintf("Invalid operation: %s", r.Operation)}, nil
}
func wrapperExecution(fn AdmitFunc, r *admission.AdmissionRequest) (*Result, error) {
func wrapperExecution(fn AdmitFunc, r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
if fn == nil {
return nil, fmt.Errorf("operation %s is not registered", r.Operation)
}
return fn(r)
return fn(r, cfg)
}

12
internal/operations/podsMutation.go
View File

@ -3,6 +3,8 @@ package operations
import (
"fmt"
"mutating-webhook/internal/config"
admission "k8s.io/api/admission/v1"
core "k8s.io/api/core/v1"
)
@ -11,20 +13,20 @@ func PodsMutation() Hook {
return Hook{
Create: podMutationCreate(),
// default allow
Delete: func(r *admission.AdmissionRequest) (*Result, error) {
Delete: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
Update: func(r *admission.AdmissionRequest) (*Result, error) {
Update: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
Connect: func(r *admission.AdmissionRequest) (*Result, error) {
Connect: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
}
}
func podMutationCreate() AdmitFunc {
return func(r *admission.AdmissionRequest) (*Result, error) {
return func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
var operations []PatchOperation
pod, err := parsePod(r.Object.Raw)
if err != nil {
@ -32,7 +34,7 @@ func podMutationCreate() AdmitFunc {
}
// if pod is administratively exempt
if func(pod *core.Pod) bool {
if cfg.AllowAdminNoMutate && func(pod *core.Pod) bool {
for label, value := range pod.Annotations {
if label == "AdminNoMutate" && value == "true" {
return false

10
internal/operations/podsValidation.go
View File

@ -4,6 +4,8 @@ import (
"log"
"strings"
"mutating-webhook/internal/config"
admission "k8s.io/api/admission/v1"
)
@ -11,20 +13,20 @@ func PodsValidation() Hook {
return Hook{
Create: podValidationCreate(),
// default allow
Delete: func(r *admission.AdmissionRequest) (*Result, error) {
Delete: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
Update: func(r *admission.AdmissionRequest) (*Result, error) {
Update: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
Connect: func(r *admission.AdmissionRequest) (*Result, error) {
Connect: func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
return &Result{Allowed: true}, nil
},
}
}
func podValidationCreate() AdmitFunc {
return func(r *admission.AdmissionRequest) (*Result, error) {
return func(r *admission.AdmissionRequest, cfg config.Config) (*Result, error) {
pod, err := parsePod(r.Object.Raw)
if err != nil {
return &Result{Msg: err.Error()}, nil