admissionreview

Documentation

Overview

Package admissionreview provides methods to handle Kubernetes admission review requests for webhook microservices

Index

• func Contains(slice []*metav1.GroupVersionKind, obj *metav1.GroupVersionKind) bool
• func GetErrorStatus(httpStatus int32, errDiscription string, err error) *metav1.Status
• func Handle(reviewer Reviewer, w http.ResponseWriter, r *http.Request)
• type Patch
• type ResourceMutater
• type ResourceValidator
• type Reviewer
• type ReviewerHandler
  • func MutatingReviewer[T any](mutater ResourceMutater[T], ...) ReviewerHandler
  • func ReviewFunc(reviewFunc func(*admissionv1.AdmissionRequest) *admissionv1.AdmissionResponse) ReviewerHandler
  • func ValidatingReviewer[T any](validator ResourceValidator[T], ...) ReviewerHandler
• type ValidateResult
  • func UnmarshallAdmissionRequest[T any](rawRequest []byte, compatibleGroupVersionKinds []*metav1.GroupVersionKind, ...) (request *T, validateResult *ValidateResult)

Functions

func Contains

func Contains(slice []*metav1.GroupVersionKind, obj *metav1.GroupVersionKind) bool

Contains checks if the obj argument is contained in the slice argument

func GetErrorStatus

func GetErrorStatus(httpStatus int32, errDiscription string, err error) *metav1.Status

GetErrorStatus receives a suggested HTTP (error) status code, an error description as well as an underlying error and constructs a Failure metav1.Status from this information

func Handle

func Handle(reviewer Reviewer, w http.ResponseWriter, r *http.Request)

Handle receives a Reviewer interface and the ResponseWriter and Request from the http.Handler interface. This covers the IO part as well as error logging, HTTP response code handling and the construction of the AdmissionReview response object. Do not use if you do not wish to use zerolog for logging. GetAdmissionReviewFromHttp is an alternative that provides the relevant IO handling toolings and let the caller handle the HTTP and logging part.

Types

type Patch

type Patch[T any] struct {
	// Request is the unmarshalled original request object. Returning nil here will yield an empty JSON patch response.
	Request *T
	// Response is the modified request object. Returning nil here will yield an empty JSON patch response.
	Response *T
}

Patch is used to construct the relevant JSON Patch operations.

type ResourceMutater

type ResourceMutater[T any] func(request *T) (*ValidateResult, *Patch[T])

ResourceMutater receives the raw request JSON representation as []byte. Unmarshalls this and returns the extracted request object. Furthermore, relevant modifications are applied and the modified response object returned. The patches struct pointer might be nil. If it is present all patches have to be processed for the validate result to hold.

type ResourceValidator

type ResourceValidator[T any] func(request *T) *ValidateResult

ResourceValidator receives the raw request JSON representation as []byte. Unmarshalls this and returns the extracted request object. Furthermore, relevant modifications are applied and the modified response object returned. Errors should be handled internally and modify the resulting ValidateResult accordingly.

type Reviewer

type Reviewer interface {
	Review(*admissionv1.AdmissionRequest) *admissionv1.AdmissionResponse
}

Reviewer receives a Kubernetes AdmissionRequest and returns the corresponding admissionResponse Errors should be handled internally and modify the resulting admissionResponse accordingly

type ReviewerHandler

type ReviewerHandler interface {
	Reviewer
	http.Handler
}

ReviewerHandler combines the Reviewer and http.Handler interfaces. Used for functions which provides a reviewer combined with an already setup handler for easy use in combination with the http package.

func MutatingReviewer

func MutatingReviewer[T any](mutater ResourceMutater[T], compatibleGroupVersionKinds ...*metav1.GroupVersionKind) ReviewerHandler

MutatingReviewer is the implementation of the ReviewerHandler interface. Checks the GroupVersionKind of the receives request against what the given reviewer.Modifier supports. A miss match will result in a non-modifying response and the allow value set to the value given by reviewer.AllowOnModifierMiss. Otherwise the Patch function of the Modifier interface is called, a JSON Patch is constructed from the result and wrapped into an admissionResponse.

func ReviewFunc

func ReviewFunc(reviewFunc func(*admissionv1.AdmissionRequest) *admissionv1.AdmissionResponse) ReviewerHandler

ReviewFunc is a helper function to wrap a review function into a corresponding object

func ValidatingReviewer

func ValidatingReviewer[T any](validator ResourceValidator[T], compatibleGroupVersionKinds ...*metav1.GroupVersionKind) ReviewerHandler

ValidatingReviewer is the implementation of the ReviewerHandler interface. Checks the GroupVersionKind of the receives request against what the given reviewer.Modifier supports. A miss match will result in a non-modifying response and the allow value set to the value given by reviewer.AllowOnModifierMiss. Otherwise the Patch function of the Modifier interface is called, a JSON Patch is constructed from the result and wrapped into an admissionResponse.

type ValidateResult

type ValidateResult struct {
	// Status gives detailed information in the case of failure.
	// +optional
	Status *metav1.Status
	// Allow determines whether to allow the given API request at all.
	Allow bool
}

ValidateResult is the returned result from the validation process.

func UnmarshallAdmissionRequest

func UnmarshallAdmissionRequest[T any](rawRequest []byte, compatibleGroupVersionKinds []*metav1.GroupVersionKind, requestGroupVersionKind *metav1.GroupVersionKind) (request *T, validateResult *ValidateResult)

UnmarshallAdmissionRequest checks if the requestGroupVersionKind fits to the provided selector and unmarshalls the raw request into a the result pointer if this is the case. The presence of the validateResult implies that the skip condition has been fulfilled (Allow is true) or an error occurred during unmarshalling (Allow is false and Status contains the error).