-
Notifications
You must be signed in to change notification settings - Fork 39
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add VM validation webhook * Fix tests * Remove user check * Update tests * Fix lint error * Add comments to explain what the webhooks do * Update pkg/webhook/validatingwebhook/validate_vm_request.go Co-authored-by: Francisc Munteanu <[email protected]> * Consolidate test to use HandleValidate * Fix lint error * Fix mutate webhook apiVersions * Fix test --------- Co-authored-by: Francisc Munteanu <[email protected]>
- Loading branch information
1 parent
6e75b2a
commit 3ec7d15
Showing
7 changed files
with
340 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| package validatingwebhook | ||
|
|
||
| import ( | ||
| "html" | ||
| "io" | ||
| "net/http" | ||
|
|
||
| "github.com/pkg/errors" | ||
| admissionv1 "k8s.io/api/admission/v1" | ||
| "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" | ||
| runtimeClient "sigs.k8s.io/controller-runtime/pkg/client" | ||
| ) | ||
|
|
||
| type VMRequestValidator struct { | ||
| Client runtimeClient.Client | ||
| } | ||
|
|
||
| func (v VMRequestValidator) HandleValidate(w http.ResponseWriter, r *http.Request) { | ||
| var respBody []byte | ||
| body, err := io.ReadAll(r.Body) | ||
| defer func() { | ||
| if err := r.Body.Close(); err != nil { | ||
| log.Error(err, "unable to close the body") | ||
| } | ||
| }() | ||
| if err != nil { | ||
| log.Error(err, "unable to read the body of the request") | ||
| w.WriteHeader(http.StatusInternalServerError) | ||
| respBody = []byte("unable to read the body of the request") | ||
| } else { | ||
| // validate the request | ||
| respBody = v.validate(body) | ||
| w.WriteHeader(http.StatusOK) | ||
| } | ||
| if _, err := io.WriteString(w, string(respBody)); err != nil { | ||
| log.Error(err, "unable to write response") | ||
| } | ||
| } | ||
|
|
||
| func (v VMRequestValidator) validate(body []byte) []byte { | ||
| log.Info("incoming request", "body", string(body)) | ||
| admReview := admissionv1.AdmissionReview{} | ||
| if _, _, err := deserializer.Decode(body, nil, &admReview); err != nil { | ||
| // sanitize the body | ||
| escapedBody := html.EscapeString(string(body)) | ||
| log.Error(err, "unable to deserialize the admission review object", "body", escapedBody) | ||
| return denyAdmissionRequest(admReview, errors.Wrapf(err, "unable to deserialize the admission review object - body: %v", escapedBody)) | ||
| } | ||
|
|
||
| unstructuredRequestObj := &unstructured.Unstructured{} | ||
| if err := unstructuredRequestObj.UnmarshalJSON(admReview.Request.Object.Raw); err != nil { | ||
| log.Error(err, "unable to check runStrategy in VirtualMachine", "VirtualMachine", unstructuredRequestObj) | ||
| return denyAdmissionRequest(admReview, errors.New("failed to validate VirtualMachine request")) | ||
| } | ||
|
|
||
| hasRunStrategy, err := hasRunningStrategy(unstructuredRequestObj) | ||
| if err != nil { | ||
| log.Error(err, "failed to unmarshal VirtualMachine json object", "AdmissionReview", admReview) | ||
| return denyAdmissionRequest(admReview, errors.New("failed to validate VirtualMachine request")) | ||
| } | ||
| if hasRunStrategy { | ||
| log.Info("sandbox user is trying to create a VM with RunStrategy configured", "AdmissionReview", admReview) // not allowed because it interferes with the Dev Sandbox Idler | ||
| return denyAdmissionRequest(admReview, errors.New("this is a Dev Sandbox enforced restriction. Configuring RunStrategy is not allowed")) | ||
| } | ||
| // the user is not creating a VM with the 'runStrategy' configured, allowing the request. | ||
| return allowAdmissionRequest(admReview) | ||
| } | ||
|
|
||
| func hasRunningStrategy(unstructuredObj *unstructured.Unstructured) (bool, error) { | ||
| _, runStrategyFound, err := unstructured.NestedString(unstructuredObj.Object, "spec", "runStrategy") | ||
| if err != nil { | ||
| return runStrategyFound, err | ||
| } | ||
|
|
||
| return runStrategyFound, nil | ||
| } |
Oops, something went wrong.