webhook

Documentation

Index

• Constants
• Variables
• func GenerateWebhookManifests(...) (*admissionregistration.ValidatingWebhookConfiguration, ...)
• func NewContainerAnnotationHandler(smLoader *servicemappingloader.ServiceMappingLoader, ...) *containerAnnotationHandler
• func NewGenericDefaulter() *genericDefaulter
• func NewIAMDefaulter(smLoader *servicemappingloader.ServiceMappingLoader, ...) *iamDefaulter
• func NewIAMValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader, ...) *iamValidatorHandler
• func NewImmutableFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader, ...) *immutableFieldsValidatorHandler
• func NewManagementConflictAnnotationDefaulter(smLoader *servicemappingloader.ServiceMappingLoader, ...) *managementConflictAnnotationDefaulter
• func NewNoUnknownFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader) *noUnknownFieldsValidatorHandler
• func NewResourceValidatorHandler() *resourceValidatorHandler
• func RegisterAbandonOnUninstallWebhook(mgr manager.Manager, nocacheClient client.Client) error
• func RegisterCommonWebhooks(mgr manager.Manager, nocacheClient client.Client) error
• type RequestLoggingHandler
  • func NewRequestLoggingHandler(handler admission.Handler, handlerName string) *RequestLoggingHandler
  • func (a *RequestLoggingHandler) Handle(ctx context.Context, req admission.Request) admission.Response
  • func (a *RequestLoggingHandler) InjectClient(c client.Client) error
• type WebhookConfig
  • func GetCommonWebhookConfigs() ([]WebhookConfig, error)

Constants

const (
	ControllerManagerServiceAccountRegex = "system:serviceaccount:[a-z0-9.-]+:cnrm-controller-manager"
	// ServicePort is the port that the webhook binary will bind to, as well as use as the service port.
	//
	// must be 443 as private GKE clusters have opened up 443 specifically
	// as a port that GKE masters can send requests to nodes to, and the requests are sent
	// directly to the targetPort of the pod rather than the service port.
	// see b/180354275
	//
	// Since the TargetPort is effectively being used as a public port,
	// standardizing public ports removes ambiguity.
	ServicePort = 443
)

const (
	Mutating   webhookType = "Mutating"
	Validating webhookType = "Validating"
)

Variables

var (
	ValidatingWebhookConfigurationName = "validating-webhook.cnrm.cloud.google.com"
	MutatingWebhookConfigurationName   = "mutating-webhook.cnrm.cloud.google.com"
	CommonWebhookServiceName           = "cnrm-validating-webhook"
)

var (
	TFSchemaNotFound = fmt.Errorf("schema does not exist")
)

Functions

func GenerateWebhookManifests

func GenerateWebhookManifests(validatingWebhookConfigurationName, mutatingWebhookConfigurationName,
	serviceName string, whCfgs []WebhookConfig) (*admissionregistration.ValidatingWebhookConfiguration, *admissionregistration.MutatingWebhookConfiguration)

func NewContainerAnnotationHandler

func NewContainerAnnotationHandler(smLoader *servicemappingloader.ServiceMappingLoader, dclSchemaLoader dclschemaloader.DCLSchemaLoader, serviceMetadataLoader dclmetadata.ServiceMetadataLoader) *containerAnnotationHandler

func NewGenericDefaulter

func NewGenericDefaulter() *genericDefaulter

func NewIAMDefaulter

func NewIAMDefaulter(smLoader *servicemappingloader.ServiceMappingLoader,
	serviceMetadataLoader metadata.ServiceMetadataLoader) *iamDefaulter

func NewIAMValidatorHandler

func NewIAMValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader,
	serviceMetadataLoader metadata.ServiceMetadataLoader,
	schemaLoader dclschemaloader.DCLSchemaLoader) *iamValidatorHandler

func NewImmutableFieldsValidatorHandler

func NewImmutableFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader, dclSchemaLoader dclschemaloader.DCLSchemaLoader, serviceMetadataLoader dclmetadata.ServiceMetadataLoader) *immutableFieldsValidatorHandler

func NewManagementConflictAnnotationDefaulter

func NewManagementConflictAnnotationDefaulter(smLoader *servicemappingloader.ServiceMappingLoader, dclSchemaLoader dclschemaloader.DCLSchemaLoader, serviceMetadataLoader dclmetadata.ServiceMetadataLoader) *managementConflictAnnotationDefaulter

func NewNoUnknownFieldsValidatorHandler

func NewNoUnknownFieldsValidatorHandler(smLoader *servicemappingloader.ServiceMappingLoader) *noUnknownFieldsValidatorHandler

func NewResourceValidatorHandler

func NewResourceValidatorHandler() *resourceValidatorHandler

func RegisterAbandonOnUninstallWebhook

func RegisterAbandonOnUninstallWebhook(mgr manager.Manager, nocacheClient client.Client) error

func RegisterCommonWebhooks

func RegisterCommonWebhooks(mgr manager.Manager, nocacheClient client.Client) error

Types

type RequestLoggingHandler

type RequestLoggingHandler struct {
	// contains filtered or unexported fields
}

func NewRequestLoggingHandler

func NewRequestLoggingHandler(handler admission.Handler, handlerName string) *RequestLoggingHandler

func (*RequestLoggingHandler) Handle

func (a *RequestLoggingHandler) Handle(ctx context.Context, req admission.Request) admission.Response

func (*RequestLoggingHandler) InjectClient

func (a *RequestLoggingHandler) InjectClient(c client.Client) error

InjectClient is called by controller-runtime to inject a client into the handler

type WebhookConfig

type WebhookConfig struct {
	Type          webhookType
	Name          string
	Path          string
	Handler       admission.Handler
	FailurePolicy admissionregistration.FailurePolicyType
	Rules         []admissionregistration.RuleWithOperations
	SideEffects   admissionregistration.SideEffectClass
}

func GetCommonWebhookConfigs

func GetCommonWebhookConfigs() ([]WebhookConfig, error)