builder

Documentation

Overview

Package builder provides methods to build admission webhooks.

The following are 2 examples for building mutating webhook and validating webhook.

webhook1, err := NewWebhookBuilder().
	Mutating().
	Operations(admissionregistrationv1beta1.Create).
	ForType(&corev1.Pod{}).
	WithManager(mgr).
	Handlers(mutatingHandler11, mutatingHandler12).
	Build()
if err != nil {
	// handle error
}

webhook2, err := NewWebhookBuilder().
	Validating().
	Operations(admissionregistrationv1beta1.Create, admissionregistrationv1beta1.Update).
	ForType(&appsv1.Deployment{}).
	WithManager(mgr).
	Handlers(validatingHandler21).
	Build()
if err != nil {
	// handle error
}

Note: To build a webhook for a CRD, you need to ensure the manager uses the scheme that understands your CRD. This is necessary, because if the scheme doesn't understand your CRD types, the decoder won't be able to decode the CR object from the admission review request.

The following snippet shows how to register CRD types with manager's scheme.

mgr, err := manager.New(cfg, manager.Options{})
if err != nil {
	// handle error
}
// SchemeGroupVersion is group version used to register these objects
SchemeGroupVersion = schema.GroupVersion{Group: "crew.k8s.io", Version: "v1"}
// SchemeBuilder is used to add go types to the GroupVersionKind scheme
SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
// Register your CRD types.
SchemeBuilder.Register(&Kraken{}, &KrakenList{})
// Register your CRD types with the manager's scheme.
err = SchemeBuilder.AddToScheme(mgr.GetScheme())
if err != nil {
	// handle error
}

There are more options for configuring a webhook. e.g. Name, Path, FailurePolicy, NamespaceSelector. Here is another example:

webhook3, err := NewWebhookBuilder().
	Name("foo.example.com").
	Path("/mutatepods").
	Mutating().
	Operations(admissionregistrationv1beta1.Create).
	ForType(&corev1.Pod{}).
	FailurePolicy(admissionregistrationv1beta1.Fail).
	WithManager(mgr).
	Handlers(mutatingHandler31, mutatingHandler32).
	Build()
if err != nil {
	// handle error
}

For most users, we recommend to use Operations and ForType instead of Rules to construct a webhook, since it is more intuitive and easier to pass the target operations to Operations method and a empty target object to ForType method than passing a complex RuleWithOperations struct to Rules method.

Rules may be useful for some more advanced use cases like subresources, wildcard resources etc. Here is an example:

webhook4, err := NewWebhookBuilder().
	Validating().
	Rules(admissionregistrationv1beta1.RuleWithOperations{
		Operations: []admissionregistrationv1beta1.OperationType{admissionregistrationv1beta1.Create},
		Rule: admissionregistrationv1beta1.Rule{
			APIGroups:   []string{"apps", "batch"},
			APIVersions: []string{"v1"},
			Resources:   []string{"*"},
		},
	}).
	WithManager(mgr).
	Handlers(validatingHandler41).
	Build()
if err != nil {
	// handle error
}

Index

• type WebhookBuilder
  • func NewWebhookBuilder() *WebhookBuilder
  • func (b *WebhookBuilder) Build() (*admission.Webhook, error)
  • func (b *WebhookBuilder) FailurePolicy(policy admissionregistrationv1beta1.FailurePolicyType) *WebhookBuilder
  • func (b *WebhookBuilder) ForType(obj runtime.Object) *WebhookBuilder
  • func (b *WebhookBuilder) Handlers(handlers ...admission.Handler) *WebhookBuilder
  • func (b *WebhookBuilder) Mutating() *WebhookBuilder
  • func (b *WebhookBuilder) Name(name string) *WebhookBuilder
  • func (b *WebhookBuilder) NamespaceSelector(namespaceSelector *metav1.LabelSelector) *WebhookBuilder
  • func (b *WebhookBuilder) Operations(ops ...admissionregistrationv1beta1.OperationType) *WebhookBuilder
  • func (b *WebhookBuilder) Path(path string) *WebhookBuilder
  • func (b *WebhookBuilder) Rules(rules ...admissionregistrationv1beta1.RuleWithOperations) *WebhookBuilder
  • func (b *WebhookBuilder) SideEffects(effect admissionregistrationv1beta1.SideEffectClass) *WebhookBuilder
  • func (b *WebhookBuilder) Validating() *WebhookBuilder
  • func (b *WebhookBuilder) WithManager(mgr manager.Manager) *WebhookBuilder

Types

type WebhookBuilder

type WebhookBuilder struct {
	// contains filtered or unexported fields
}

WebhookBuilder builds a webhook based on the provided options.

func NewWebhookBuilder

func NewWebhookBuilder() *WebhookBuilder

NewWebhookBuilder creates an empty WebhookBuilder.

func (*WebhookBuilder) Build

func (b *WebhookBuilder) Build() (*admission.Webhook, error)

Build creates the Webhook based on the options provided.

func (*WebhookBuilder) FailurePolicy

func (b *WebhookBuilder) FailurePolicy(policy admissionregistrationv1beta1.FailurePolicyType) *WebhookBuilder

FailurePolicy sets the FailurePolicy of the webhook. If not set, it will be defaulted by the server. This is optional

func (*WebhookBuilder) ForType

func (b *WebhookBuilder) ForType(obj runtime.Object) *WebhookBuilder

ForType sets the type of resources that the webhook will operate. It will be overridden by Rules if Rules are not empty.

func (*WebhookBuilder) Handlers

func (b *WebhookBuilder) Handlers(handlers ...admission.Handler) *WebhookBuilder

Handlers sets the handlers of the webhook.

func (*WebhookBuilder) Mutating

func (b *WebhookBuilder) Mutating() *WebhookBuilder

Mutating sets the type to mutating admission webhook Only one of Mutating and Validating can be invoked.

func (*WebhookBuilder) Name

func (b *WebhookBuilder) Name(name string) *WebhookBuilder

Name sets the name of the webhook. This is optional

func (*WebhookBuilder) NamespaceSelector

func (b *WebhookBuilder) NamespaceSelector(namespaceSelector *metav1.LabelSelector) *WebhookBuilder

NamespaceSelector sets the NamespaceSelector for the webhook. This is optional

func (*WebhookBuilder) Operations

func (b *WebhookBuilder) Operations(ops ...admissionregistrationv1beta1.OperationType) *WebhookBuilder

Operations sets the operations that this webhook cares. It will be overridden by Rules if Rules are not empty. This is optional

func (*WebhookBuilder) Path

func (b *WebhookBuilder) Path(path string) *WebhookBuilder

Path sets the path for the webhook. Path needs to be unique among different webhooks. This is optional. If not set, it will be built from the type and resource name. For example, a webhook that mutates pods has a default path of "/mutate-pods" If the defaulting logic can't find a unique path for it, user need to set it manually.

func (*WebhookBuilder) Rules

func (b *WebhookBuilder) Rules(rules ...admissionregistrationv1beta1.RuleWithOperations) *WebhookBuilder

Rules sets the RuleWithOperations for the webhook. It overrides ForType and Operations. This is optional and for advanced user.

func (*WebhookBuilder) SideEffects

func (b *WebhookBuilder) SideEffects(effect admissionregistrationv1beta1.SideEffectClass) *WebhookBuilder

SideEffects *admissionregistrationv1beta1.SideEffectClass

func (*WebhookBuilder) Validating

func (b *WebhookBuilder) Validating() *WebhookBuilder

Validating sets the type to validating admission webhook Only one of Mutating and Validating can be invoked.

func (*WebhookBuilder) WithManager

func (b *WebhookBuilder) WithManager(mgr manager.Manager) *WebhookBuilder

WithManager set the manager for the webhook for provisioning various dependencies. e.g. client etc.