|
| 1 | +/* |
| 2 | +Copyright 2025 The KubeFleet Authors. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +// Package clusterresourceplacementeviction provides a validating webhook for the clusterresourceplacementeviction custom resource in the KubeFleet API group. |
| 18 | +package clusterresourceplacementeviction |
| 19 | + |
| 20 | +import ( |
| 21 | + "context" |
| 22 | + "fmt" |
| 23 | + "net/http" |
| 24 | + |
| 25 | + k8serrors "k8s.io/apimachinery/pkg/api/errors" |
| 26 | + "k8s.io/apimachinery/pkg/types" |
| 27 | + "k8s.io/klog/v2" |
| 28 | + "sigs.k8s.io/controller-runtime/pkg/client" |
| 29 | + "sigs.k8s.io/controller-runtime/pkg/manager" |
| 30 | + "sigs.k8s.io/controller-runtime/pkg/webhook" |
| 31 | + "sigs.k8s.io/controller-runtime/pkg/webhook/admission" |
| 32 | + |
| 33 | + fleetv1beta1 "go.goms.io/fleet/apis/placement/v1beta1" |
| 34 | + "go.goms.io/fleet/pkg/utils" |
| 35 | + "go.goms.io/fleet/pkg/utils/condition" |
| 36 | + "go.goms.io/fleet/pkg/utils/validator" |
| 37 | +) |
| 38 | + |
| 39 | +var ( |
| 40 | + // ValidationPath is the webhook service path which admission requests are routed to for validating clusterresourceplacementeviction resources. |
| 41 | + ValidationPath = fmt.Sprintf(utils.ValidationPathFmt, fleetv1beta1.GroupVersion.Group, fleetv1beta1.GroupVersion.Version, "clusterresourceplacementeviction") |
| 42 | +) |
| 43 | + |
| 44 | +type clusterResourcePlacementEvictionValidator struct { |
| 45 | + client client.Client |
| 46 | + decoder webhook.AdmissionDecoder |
| 47 | +} |
| 48 | + |
| 49 | +// Add registers the webhook for K8s bulit-in object types. |
| 50 | +func Add(mgr manager.Manager) error { |
| 51 | + hookServer := mgr.GetWebhookServer() |
| 52 | + hookServer.Register(ValidationPath, &webhook.Admission{Handler: &clusterResourcePlacementEvictionValidator{mgr.GetClient(), admission.NewDecoder(mgr.GetScheme())}}) |
| 53 | + return nil |
| 54 | +} |
| 55 | + |
| 56 | +// Handle clusterResourcePlacementEvictionValidator checks to see if resource override is valid. |
| 57 | +func (v *clusterResourcePlacementEvictionValidator) Handle(ctx context.Context, req admission.Request) admission.Response { |
| 58 | + var crpe fleetv1beta1.ClusterResourcePlacementEviction |
| 59 | + klog.V(2).InfoS("Validating webhook handling cluster resource placement eviction", "operation", req.Operation, "clusterResourcePlacementEviction", req.Name) |
| 60 | + if err := v.decoder.Decode(req, &crpe); err != nil { |
| 61 | + klog.ErrorS(err, "Failed to decode cluster resource placement eviction object for validating fields", "userName", req.UserInfo.Username, "groups", req.UserInfo.Groups, "clusterResourcePlacementEviction", req.Name) |
| 62 | + return admission.Errored(http.StatusBadRequest, err) |
| 63 | + } |
| 64 | + |
| 65 | + // Get the ClusterResourcePlacement object |
| 66 | + var crp fleetv1beta1.ClusterResourcePlacement |
| 67 | + if err := v.client.Get(ctx, types.NamespacedName{Name: crpe.Spec.PlacementName}, &crp); err != nil { |
| 68 | + if k8serrors.IsNotFound(err) { |
| 69 | + klog.V(2).InfoS(condition.EvictionInvalidMissingCRPMessage, "clusterResourcePlacementEviction", crpe.Name, "clusterResourcePlacement", crpe.Spec.PlacementName) |
| 70 | + return admission.Denied(err.Error()) |
| 71 | + } |
| 72 | + return admission.Errored(http.StatusBadRequest, fmt.Errorf("failed to get clusterResourcePlacement %s for clusterResourcePlacementEviction %s: %w", crpe.Spec.PlacementName, crpe.Name, err)) |
| 73 | + } |
| 74 | + |
| 75 | + if err := validator.ValidateClusterResourcePlacementForEviction(crp); err != nil { |
| 76 | + klog.V(2).ErrorS(err, "ClusterResourcePlacement has invalid fields, request is denied", "operation", req.Operation, "clusterResourcePlacementEviction", crpe.Name) |
| 77 | + return admission.Denied(err.Error()) |
| 78 | + } |
| 79 | + |
| 80 | + klog.V(2).InfoS("ClusterResourcePlacementEviction has valid fields", "clusterResourcePlacementEviction", crpe.Name) |
| 81 | + return admission.Allowed("clusterResourcePlacementEviction has valid fields") |
| 82 | +} |
0 commit comments