webhook

Documentation

Index

• Constants
• Variables
• func GenerateWebhookManifests(...) (*admissionregistration.ValidatingWebhookConfiguration, ...)
• func RegisterAbandonOnUninstallWebhook(mgr manager.Manager, nocacheClient client.Client) error
• func RegisterCommonWebhooks(mgr manager.Manager, nocacheClient client.Client) error
• type Config
  • func GetCommonWebhookConfigs() ([]Config, error)
  • func (c *Config) BuildAdmission(mgr manager.Manager) *webhook.Admission
• type HandlerFunc
  • func NewAbandonOnCRDUninstallWebhook() HandlerFunc
  • func NewContainerAnnotationHandler(smLoader *servicemappingloader.ServiceMappingLoader, ...) HandlerFunc
  • func NewGenericDefaulter() HandlerFunc
  • func NewIAMDefaulter(smLoader *servicemappingloader.ServiceMappingLoader, ...) HandlerFunc
  • func NewIAMValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader, ...) HandlerFunc
  • func NewImmutableFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader, ...) HandlerFunc
  • func NewManagementConflictAnnotationDefaulter(smLoader *servicemappingloader.ServiceMappingLoader, ...) HandlerFunc
  • func NewNoUnknownFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader) HandlerFunc
  • func NewRequestLoggingHandler(handlerFunc HandlerFunc, handlerName string) HandlerFunc
  • func NewResourceValidatorHandler() HandlerFunc
• type RequestLoggingHandler
  • func (a *RequestLoggingHandler) Handle(ctx context.Context, req admission.Request) admission.Response

Constants

const (
	ControllerManagerServiceAccountRegex = "system:serviceaccount:[a-z0-9.-]+:cnrm-controller-manager"
	// ServicePort is the port that the webhook binary will bind to, as well as use as the service port.
	//
	// must be 443 as private GKE clusters have opened up 443 specifically
	// as a port that GKE masters can send requests to nodes to, and the requests are sent
	// directly to the targetPort of the pod rather than the service port.
	// see b/180354275
	//
	// Since the TargetPort is effectively being used as a public port,
	// standardizing public ports removes ambiguity.
	ServicePort = 443
)

const (
	Mutating   webhookType = "Mutating"
	Validating webhookType = "Validating"
)

Variables

var (
	ValidatingWebhookConfigurationName = "validating-webhook.cnrm.cloud.google.com"
	MutatingWebhookConfigurationName   = "mutating-webhook.cnrm.cloud.google.com"
	CommonWebhookServiceName           = "cnrm-validating-webhook"
)

var (
	ErrTFSchemaNotFound = fmt.Errorf("schema does not exist")
)

Functions

func GenerateWebhookManifests

func GenerateWebhookManifests(validatingWebhookConfigurationName, mutatingWebhookConfigurationName,
	serviceName string, whCfgs []Config) (*admissionregistration.ValidatingWebhookConfiguration, *admissionregistration.MutatingWebhookConfiguration)

func RegisterAbandonOnUninstallWebhook

func RegisterAbandonOnUninstallWebhook(mgr manager.Manager, nocacheClient client.Client) error

func RegisterCommonWebhooks

func RegisterCommonWebhooks(mgr manager.Manager, nocacheClient client.Client) error

Types

type Config

type Config struct {
	Type           webhookType
	Name           string
	Path           string
	HandlerFunc    func(mgr manager.Manager) admission.Handler
	FailurePolicy  admissionregistration.FailurePolicyType
	ObjectSelector *metav1.LabelSelector
	Rules          []admissionregistration.RuleWithOperations
	SideEffects    admissionregistration.SideEffectClass
}

func GetCommonWebhookConfigs

func GetCommonWebhookConfigs() ([]Config, error)

func (*Config) BuildAdmission

func (c *Config) BuildAdmission(mgr manager.Manager) *webhook.Admission

type HandlerFunc

type HandlerFunc func(mgr manager.Manager) admission.Handler

func NewAbandonOnCRDUninstallWebhook

func NewAbandonOnCRDUninstallWebhook() HandlerFunc

func NewContainerAnnotationHandler

func NewContainerAnnotationHandler(smLoader *servicemappingloader.ServiceMappingLoader, dclSchemaLoader dclschemaloader.DCLSchemaLoader, serviceMetadataLoader dclmetadata.ServiceMetadataLoader) HandlerFunc

func NewGenericDefaulter

func NewGenericDefaulter() HandlerFunc

func NewIAMDefaulter

func NewIAMDefaulter(smLoader *servicemappingloader.ServiceMappingLoader,
	serviceMetadataLoader metadata.ServiceMetadataLoader) HandlerFunc

func NewIAMValidatorHandler

func NewIAMValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader,
	serviceMetadataLoader metadata.ServiceMetadataLoader,
	schemaLoader dclschemaloader.DCLSchemaLoader) HandlerFunc

func NewImmutableFieldsValidatorHandler

func NewImmutableFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader, dclSchemaLoader dclschemaloader.DCLSchemaLoader, serviceMetadataLoader dclmetadata.ServiceMetadataLoader) HandlerFunc

func NewManagementConflictAnnotationDefaulter

func NewManagementConflictAnnotationDefaulter(smLoader *servicemappingloader.ServiceMappingLoader, dclSchemaLoader dclschemaloader.DCLSchemaLoader, serviceMetadataLoader dclmetadata.ServiceMetadataLoader) HandlerFunc

func NewNoUnknownFieldsValidatorHandler

func NewNoUnknownFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader) HandlerFunc

func NewRequestLoggingHandler

func NewRequestLoggingHandler(handlerFunc HandlerFunc, handlerName string) HandlerFunc

func NewResourceValidatorHandler

func NewResourceValidatorHandler() HandlerFunc

type RequestLoggingHandler

type RequestLoggingHandler struct {
	// contains filtered or unexported fields
}

func (*RequestLoggingHandler) Handle

func (a *RequestLoggingHandler) Handle(ctx context.Context, req admission.Request) admission.Response