mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-12-24 22:10:23 +00:00
302 lines
8.2 KiB
Go
302 lines
8.2 KiB
Go
|
/*
|
||
|
|
Copyright 2017 The Kubernetes Authors.
|
||
|
|
|
||
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||
|
|
you may not use this file except in compliance with the License.
|
||
|
|
You may obtain a copy of the License at
|
||
|
|
|
||
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
|
|
||
|
|
Unless required by applicable law or agreed to in writing, software
|
||
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
|
|
See the License for the specific language governing permissions and
|
||
|
|
limitations under the License.
|
||
|
|
*/
|
||
|
|
|
||
|
|
package main
|
||
|
|
|
||
|
|
import (
|
||
|
|
"encoding/json"
|
||
|
|
"flag"
|
||
|
|
"fmt"
|
||
|
|
"io/ioutil"
|
||
|
|
"net/http"
|
||
|
|
"strings"
|
||
|
|
|
||
|
|
"github.com/golang/glog"
|
||
|
|
"k8s.io/api/admission/v1beta1"
|
||
|
|
corev1 "k8s.io/api/core/v1"
|
||
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||
|
|
"k8s.io/apimachinery/pkg/runtime"
|
||
|
|
// TODO: try this library to see if it generates correct json patch
|
||
|
|
// https://github.com/mattbaird/jsonpatch
|
||
|
|
)
|
||
|
|
|
||
|
|
const (
|
||
|
|
patch1 string = `[
|
||
|
|
{ "op": "add", "path": "/data/mutation-stage-1", "value": "yes" }
|
||
|
|
]`
|
||
|
|
patch2 string = `[
|
||
|
|
{ "op": "add", "path": "/data/mutation-stage-2", "value": "yes" }
|
||
|
|
]`
|
||
|
|
)
|
||
|
|
|
||
|
|
// Config contains the server (the webhook) cert and key.
|
||
|
|
type Config struct {
|
||
|
|
CertFile string
|
||
|
|
KeyFile string
|
||
|
|
}
|
||
|
|
|
||
|
|
func (c *Config) addFlags() {
|
||
|
|
flag.StringVar(&c.CertFile, "tls-cert-file", c.CertFile, ""+
|
||
|
|
"File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated "+
|
||
|
|
"after server cert).")
|
||
|
|
flag.StringVar(&c.KeyFile, "tls-private-key-file", c.KeyFile, ""+
|
||
|
|
"File containing the default x509 private key matching --tls-cert-file.")
|
||
|
|
}
|
||
|
|
|
||
|
|
func toAdmissionResponse(err error) *v1beta1.AdmissionResponse {
|
||
|
|
return &v1beta1.AdmissionResponse{
|
||
|
|
Result: &metav1.Status{
|
||
|
|
Message: err.Error(),
|
||
|
|
},
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// only allow pods to pull images from specific registry.
|
||
|
|
func admitPods(ar v1beta1.AdmissionReview) *v1beta1.AdmissionResponse {
|
||
|
|
glog.V(2).Info("admitting pods")
|
||
|
|
podResource := metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
|
||
|
|
if ar.Request.Resource != podResource {
|
||
|
|
err := fmt.Errorf("expect resource to be %s", podResource)
|
||
|
|
glog.Error(err)
|
||
|
|
return toAdmissionResponse(err)
|
||
|
|
}
|
||
|
|
|
||
|
|
raw := ar.Request.Object.Raw
|
||
|
|
pod := corev1.Pod{}
|
||
|
|
deserializer := codecs.UniversalDeserializer()
|
||
|
|
if _, _, err := deserializer.Decode(raw, nil, &pod); err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
return toAdmissionResponse(err)
|
||
|
|
}
|
||
|
|
reviewResponse := v1beta1.AdmissionResponse{}
|
||
|
|
reviewResponse.Allowed = true
|
||
|
|
|
||
|
|
var msg string
|
||
|
|
for k, v := range pod.Labels {
|
||
|
|
if k == "webhook-e2e-test" && v == "webhook-disallow" {
|
||
|
|
reviewResponse.Allowed = false
|
||
|
|
msg = msg + "the pod contains unwanted label; "
|
||
|
|
}
|
||
|
|
}
|
||
|
|
for _, container := range pod.Spec.Containers {
|
||
|
|
if strings.Contains(container.Name, "webhook-disallow") {
|
||
|
|
reviewResponse.Allowed = false
|
||
|
|
msg = msg + "the pod contains unwanted container name; "
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if !reviewResponse.Allowed {
|
||
|
|
reviewResponse.Result = &metav1.Status{Message: strings.TrimSpace(msg)}
|
||
|
|
}
|
||
|
|
return &reviewResponse
|
||
|
|
}
|
||
|
|
|
||
|
|
// deny configmaps with specific key-value pair.
|
||
|
|
func admitConfigMaps(ar v1beta1.AdmissionReview) *v1beta1.AdmissionResponse {
|
||
|
|
glog.V(2).Info("admitting configmaps")
|
||
|
|
configMapResource := metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"}
|
||
|
|
if ar.Request.Resource != configMapResource {
|
||
|
|
glog.Errorf("expect resource to be %s", configMapResource)
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
raw := ar.Request.Object.Raw
|
||
|
|
configmap := corev1.ConfigMap{}
|
||
|
|
deserializer := codecs.UniversalDeserializer()
|
||
|
|
if _, _, err := deserializer.Decode(raw, nil, &configmap); err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
return toAdmissionResponse(err)
|
||
|
|
}
|
||
|
|
reviewResponse := v1beta1.AdmissionResponse{}
|
||
|
|
reviewResponse.Allowed = true
|
||
|
|
for k, v := range configmap.Data {
|
||
|
|
if k == "webhook-e2e-test" && v == "webhook-disallow" {
|
||
|
|
reviewResponse.Allowed = false
|
||
|
|
reviewResponse.Result = &metav1.Status{
|
||
|
|
Reason: "the configmap contains unwanted key and value",
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return &reviewResponse
|
||
|
|
}
|
||
|
|
|
||
|
|
func mutateConfigmaps(ar v1beta1.AdmissionReview) *v1beta1.AdmissionResponse {
|
||
|
|
glog.V(2).Info("mutating configmaps")
|
||
|
|
configMapResource := metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"}
|
||
|
|
if ar.Request.Resource != configMapResource {
|
||
|
|
glog.Errorf("expect resource to be %s", configMapResource)
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
raw := ar.Request.Object.Raw
|
||
|
|
configmap := corev1.ConfigMap{}
|
||
|
|
deserializer := codecs.UniversalDeserializer()
|
||
|
|
if _, _, err := deserializer.Decode(raw, nil, &configmap); err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
return toAdmissionResponse(err)
|
||
|
|
}
|
||
|
|
reviewResponse := v1beta1.AdmissionResponse{}
|
||
|
|
reviewResponse.Allowed = true
|
||
|
|
if configmap.Data["mutation-start"] == "yes" {
|
||
|
|
reviewResponse.Patch = []byte(patch1)
|
||
|
|
}
|
||
|
|
if configmap.Data["mutation-stage-1"] == "yes" {
|
||
|
|
reviewResponse.Patch = []byte(patch2)
|
||
|
|
}
|
||
|
|
|
||
|
|
pt := v1beta1.PatchTypeJSONPatch
|
||
|
|
reviewResponse.PatchType = &pt
|
||
|
|
|
||
|
|
return &reviewResponse
|
||
|
|
}
|
||
|
|
|
||
|
|
func mutateCRD(ar v1beta1.AdmissionReview) *v1beta1.AdmissionResponse {
|
||
|
|
glog.V(2).Info("mutating crd")
|
||
|
|
cr := struct {
|
||
|
|
metav1.ObjectMeta
|
||
|
|
Data map[string]string
|
||
|
|
}{}
|
||
|
|
|
||
|
|
raw := ar.Request.Object.Raw
|
||
|
|
err := json.Unmarshal(raw, &cr)
|
||
|
|
if err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
return toAdmissionResponse(err)
|
||
|
|
}
|
||
|
|
|
||
|
|
reviewResponse := v1beta1.AdmissionResponse{}
|
||
|
|
reviewResponse.Allowed = true
|
||
|
|
|
||
|
|
if cr.Data["mutation-start"] == "yes" {
|
||
|
|
reviewResponse.Patch = []byte(patch1)
|
||
|
|
}
|
||
|
|
if cr.Data["mutation-stage-1"] == "yes" {
|
||
|
|
reviewResponse.Patch = []byte(patch2)
|
||
|
|
}
|
||
|
|
pt := v1beta1.PatchTypeJSONPatch
|
||
|
|
reviewResponse.PatchType = &pt
|
||
|
|
return &reviewResponse
|
||
|
|
}
|
||
|
|
|
||
|
|
func admitCRD(ar v1beta1.AdmissionReview) *v1beta1.AdmissionResponse {
|
||
|
|
glog.V(2).Info("admitting crd")
|
||
|
|
cr := struct {
|
||
|
|
metav1.ObjectMeta
|
||
|
|
Data map[string]string
|
||
|
|
}{}
|
||
|
|
|
||
|
|
raw := ar.Request.Object.Raw
|
||
|
|
err := json.Unmarshal(raw, &cr)
|
||
|
|
if err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
return toAdmissionResponse(err)
|
||
|
|
}
|
||
|
|
|
||
|
|
reviewResponse := v1beta1.AdmissionResponse{}
|
||
|
|
reviewResponse.Allowed = true
|
||
|
|
for k, v := range cr.Data {
|
||
|
|
if k == "webhook-e2e-test" && v == "webhook-disallow" {
|
||
|
|
reviewResponse.Allowed = false
|
||
|
|
reviewResponse.Result = &metav1.Status{
|
||
|
|
Reason: "the custom resource contains unwanted data",
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return &reviewResponse
|
||
|
|
}
|
||
|
|
|
||
|
|
type admitFunc func(v1beta1.AdmissionReview) *v1beta1.AdmissionResponse
|
||
|
|
|
||
|
|
func serve(w http.ResponseWriter, r *http.Request, admit admitFunc) {
|
||
|
|
var body []byte
|
||
|
|
if r.Body != nil {
|
||
|
|
if data, err := ioutil.ReadAll(r.Body); err == nil {
|
||
|
|
body = data
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// verify the content type is accurate
|
||
|
|
contentType := r.Header.Get("Content-Type")
|
||
|
|
if contentType != "application/json" {
|
||
|
|
glog.Errorf("contentType=%s, expect application/json", contentType)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
var reviewResponse *v1beta1.AdmissionResponse
|
||
|
|
ar := v1beta1.AdmissionReview{}
|
||
|
|
deserializer := codecs.UniversalDeserializer()
|
||
|
|
if _, _, err := deserializer.Decode(body, nil, &ar); err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
reviewResponse = toAdmissionResponse(err)
|
||
|
|
} else {
|
||
|
|
reviewResponse = admit(ar)
|
||
|
|
}
|
||
|
|
|
||
|
|
response := v1beta1.AdmissionReview{}
|
||
|
|
if reviewResponse != nil {
|
||
|
|
response.Response = reviewResponse
|
||
|
|
response.Response.UID = ar.Request.UID
|
||
|
|
}
|
||
|
|
// reset the Object and OldObject, they are not needed in a response.
|
||
|
|
ar.Request.Object = runtime.RawExtension{}
|
||
|
|
ar.Request.OldObject = runtime.RawExtension{}
|
||
|
|
|
||
|
|
resp, err := json.Marshal(response)
|
||
|
|
if err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
}
|
||
|
|
if _, err := w.Write(resp); err != nil {
|
||
|
|
glog.Error(err)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func servePods(w http.ResponseWriter, r *http.Request) {
|
||
|
|
serve(w, r, admitPods)
|
||
|
|
}
|
||
|
|
|
||
|
|
func serveConfigmaps(w http.ResponseWriter, r *http.Request) {
|
||
|
|
serve(w, r, admitConfigMaps)
|
||
|
|
}
|
||
|
|
|
||
|
|
func serveMutateConfigmaps(w http.ResponseWriter, r *http.Request) {
|
||
|
|
serve(w, r, mutateConfigmaps)
|
||
|
|
}
|
||
|
|
|
||
|
|
func serveCRD(w http.ResponseWriter, r *http.Request) {
|
||
|
|
serve(w, r, admitCRD)
|
||
|
|
}
|
||
|
|
|
||
|
|
func serveMutateCRD(w http.ResponseWriter, r *http.Request) {
|
||
|
|
serve(w, r, mutateCRD)
|
||
|
|
}
|
||
|
|
|
||
|
|
func main() {
|
||
|
|
var config Config
|
||
|
|
config.addFlags()
|
||
|
|
flag.Parse()
|
||
|
|
|
||
|
|
http.HandleFunc("/pods", servePods)
|
||
|
|
http.HandleFunc("/configmaps", serveConfigmaps)
|
||
|
|
http.HandleFunc("/mutating-configmaps", serveMutateConfigmaps)
|
||
|
|
http.HandleFunc("/crd", serveCRD)
|
||
|
|
http.HandleFunc("/mutating-crd", serveMutateCRD)
|
||
|
|
clientset := getClient()
|
||
|
|
server := &http.Server{
|
||
|
|
Addr: ":443",
|
||
|
|
TLSConfig: configTLS(config, clientset),
|
||
|
|
}
|
||
|
|
server.ListenAndServeTLS("", "")
|
||
|
|
}
|