webhooks

Documentation

Index

• Constants
• type ArrayFlags
  • func (i *ArrayFlags) Set(value string) error
  • func (i *ArrayFlags) String() string
• type WebhookServer
  • func NewWebhookServer(kyvernoClient *kyvernoclient.Clientset, client *client.Client, ...) (*WebhookServer, error)
  • func (ws *WebhookServer) HandleGenerate(request *v1beta1.AdmissionRequest, policies []*kyverno.ClusterPolicy, ...) (bool, string)
  • func (ws *WebhookServer) HandleMutation(request *v1beta1.AdmissionRequest, resource unstructured.Unstructured, ...) []byte
  • func (ws *WebhookServer) HandleValidation(request *v1beta1.AdmissionRequest, policies []*kyverno.ClusterPolicy, ...) (bool, string)
  • func (ws *WebhookServer) RunAsync(stopCh <-chan struct{})
  • func (ws *WebhookServer) Stop(ctx context.Context)

Constants

const (
	Enforce = "enforce" // blocks the request on failure
	Audit   = "audit"   // dont block the request on failure, but report failiures as policy violations
)

Policy Reporting Modes

Types

type ArrayFlags

type ArrayFlags []string

ArrayFlags to store filterkinds

func (*ArrayFlags) Set

func (i *ArrayFlags) Set(value string) error

Set setter for array flags

func (*ArrayFlags) String

func (i *ArrayFlags) String() string

type WebhookServer

type WebhookServer struct {
	// contains filtered or unexported fields
}

WebhookServer contains configured TLS server with MutationWebhook.

func NewWebhookServer

func NewWebhookServer(
	kyvernoClient *kyvernoclient.Clientset,
	client *client.Client,
	tlsPair *tlsutils.TlsPemPair,
	pInformer kyvernoinformer.ClusterPolicyInformer,
	rbInformer rbacinformer.RoleBindingInformer,
	crbInformer rbacinformer.ClusterRoleBindingInformer,
	eventGen event.Interface,
	webhookRegistrationClient *webhookconfig.WebhookRegistrationClient,
	statusSync policystatus.Listener,
	configHandler config.Interface,
	pvGenerator policyviolation.GeneratorInterface,
	grGenerator *generate.Generator,
	resourceWebhookWatcher *webhookconfig.ResourceWebhookRegister,
	cleanUp chan<- struct{},
	log logr.Logger,
	openAPIController *openapi.Controller,
) (*WebhookServer, error)

NewWebhookServer creates new instance of WebhookServer accordingly to given configuration Policy Controller and Kubernetes Client should be initialized in configuration

func (*WebhookServer) HandleGenerate

func (ws *WebhookServer) HandleGenerate(request *v1beta1.AdmissionRequest, policies []*kyverno.ClusterPolicy, ctx *context.Context, userRequestInfo kyverno.RequestInfo) (bool, string)

HandleGenerate handles admission-requests for policies with generate rules

func (*WebhookServer) HandleMutation

func (ws *WebhookServer) HandleMutation(
	request *v1beta1.AdmissionRequest,
	resource unstructured.Unstructured,
	policies []*kyverno.ClusterPolicy,
	ctx *context.Context,
	userRequestInfo kyverno.RequestInfo) []byte

HandleMutation handles mutating webhook admission request return value: generated patches

func (*WebhookServer) HandleValidation

func (ws *WebhookServer) HandleValidation(
	request *v1beta1.AdmissionRequest,
	policies []*kyverno.ClusterPolicy,
	patchedResource []byte,
	ctx *context.Context,
	userRequestInfo kyverno.RequestInfo) (bool, string)

HandleValidation handles validating webhook admission request If there are no errors in validating rule we apply generation rules patchedResource is the (resource + patches) after applying mutation rules

func (*WebhookServer) RunAsync

func (ws *WebhookServer) RunAsync(stopCh <-chan struct{})

RunAsync TLS server in separate thread and returns control immediately

func (*WebhookServer) Stop

func (ws *WebhookServer) Stop(ctx context.Context)

Stop TLS server and returns control after the server is shut down