diff --git a/charts/manager/templates/webhooks.yaml b/charts/manager/templates/webhooks.yaml index cdf35f858..ef01c86b1 100644 --- a/charts/manager/templates/webhooks.yaml +++ b/charts/manager/templates/webhooks.yaml @@ -208,6 +208,7 @@ webhooks: operations: - CREATE - UPDATE + - DELETE resources: - clusters sideEffects: None @@ -228,6 +229,7 @@ webhooks: operations: - CREATE - UPDATE + - DELETE resources: - organizations sideEffects: None @@ -248,6 +250,7 @@ webhooks: operations: - CREATE - UPDATE + - DELETE resources: - plugins sideEffects: None @@ -289,6 +292,7 @@ webhooks: operations: - CREATE - UPDATE + - DELETE resources: - pluginpresets sideEffects: None @@ -330,6 +334,7 @@ webhooks: operations: - CREATE - UPDATE + - DELETE resources: - teamrolebindings sideEffects: None @@ -351,6 +356,7 @@ webhooks: operations: - CREATE - UPDATE + - DELETE resources: - secrets sideEffects: None @@ -371,6 +377,7 @@ webhooks: operations: - CREATE - UPDATE + - DELETE resources: - teams sideEffects: None diff --git a/pkg/admission/cluster_webhook.go b/pkg/admission/cluster_webhook.go index 2e3293196..3a5fa8b2b 100644 --- a/pkg/admission/cluster_webhook.go +++ b/pkg/admission/cluster_webhook.go @@ -34,7 +34,7 @@ func DefaultCluster(_ context.Context, _ client.Client, _ runtime.Object) error return nil } -//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-cluster,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=clusters,verbs=create;update,versions=v1alpha1,name=vcluster.kb.io,admissionReviewVersions=v1 +//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-cluster,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=clusters,verbs=create;update;delete,versions=v1alpha1,name=vcluster.kb.io,admissionReviewVersions=v1 func ValidateCreateCluster(_ context.Context, _ client.Client, _ runtime.Object) (admission.Warnings, error) { return nil, nil diff --git a/pkg/admission/organization_webhook.go b/pkg/admission/organization_webhook.go index be0b2600c..8e7f7db45 100644 --- a/pkg/admission/organization_webhook.go +++ b/pkg/admission/organization_webhook.go @@ -45,7 +45,7 @@ func DefaultOrganization(_ context.Context, _ client.Client, o runtime.Object) e return nil } -//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-organization,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=organizations,verbs=create;update,versions=v1alpha1,name=vorganization.kb.io,admissionReviewVersions=v1 +//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-organization,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=organizations,verbs=create;update;delete,versions=v1alpha1,name=vorganization.kb.io,admissionReviewVersions=v1 func ValidateCreateOrganization(_ context.Context, _ client.Client, _ runtime.Object) (admission.Warnings, error) { return nil, nil diff --git a/pkg/admission/plugin_webhook.go b/pkg/admission/plugin_webhook.go index bdf9960aa..0a7d88ba5 100644 --- a/pkg/admission/plugin_webhook.go +++ b/pkg/admission/plugin_webhook.go @@ -78,7 +78,7 @@ func DefaultPlugin(ctx context.Context, c client.Client, obj runtime.Object) err return nil } -//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-plugin,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=plugins,verbs=create;update,versions=v1alpha1,name=vplugin.kb.io,admissionReviewVersions=v1 +//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-plugin,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=plugins,verbs=create;update;delete,versions=v1alpha1,name=vplugin.kb.io,admissionReviewVersions=v1 func ValidateCreatePlugin(ctx context.Context, c client.Client, obj runtime.Object) (admission.Warnings, error) { plugin, ok := obj.(*greenhousev1alpha1.Plugin) diff --git a/pkg/admission/pluginpreset_webhook.go b/pkg/admission/pluginpreset_webhook.go index 87ee8cfc7..f14ac1a5d 100644 --- a/pkg/admission/pluginpreset_webhook.go +++ b/pkg/admission/pluginpreset_webhook.go @@ -37,7 +37,7 @@ func DefaultPluginPreset(_ context.Context, _ client.Client, _ runtime.Object) e return nil } -//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-pluginpreset,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=pluginpresets,verbs=create;update,versions=v1alpha1,name=vpluginpreset.kb.io,admissionReviewVersions=v1 +//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-pluginpreset,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=pluginpresets,verbs=create;update;delete,versions=v1alpha1,name=vpluginpreset.kb.io,admissionReviewVersions=v1 func ValidateCreatePluginPreset(ctx context.Context, c client.Client, o runtime.Object) (admission.Warnings, error) { pluginPreset, ok := o.(*greenhousev1alpha1.PluginPreset) diff --git a/pkg/admission/secret_webhook.go b/pkg/admission/secret_webhook.go index bac230b56..54a09091f 100644 --- a/pkg/admission/secret_webhook.go +++ b/pkg/admission/secret_webhook.go @@ -39,7 +39,7 @@ func DefaultSecret(_ context.Context, _ client.Client, _ runtime.Object) error { return nil } -//+kubebuilder:webhook:path=/validate--v1-secret,mutating=false,failurePolicy=ignore,sideEffects=None,groups="",matchPolicy=Exact,resources=secrets,verbs=create;update,versions=v1,name=vsecret.kb.io,admissionReviewVersions=v1 +//+kubebuilder:webhook:path=/validate--v1-secret,mutating=false,failurePolicy=ignore,sideEffects=None,groups="",matchPolicy=Exact,resources=secrets,verbs=create;update;delete,versions=v1,name=vsecret.kb.io,admissionReviewVersions=v1 func ValidateCreateSecret(_ context.Context, _ client.Client, o runtime.Object) (admission.Warnings, error) { secret, ok := o.(*corev1.Secret) diff --git a/pkg/admission/team_webhook.go b/pkg/admission/team_webhook.go index 58328c3b2..789c64368 100644 --- a/pkg/admission/team_webhook.go +++ b/pkg/admission/team_webhook.go @@ -38,7 +38,7 @@ func DefaultTeam(_ context.Context, _ client.Client, _ runtime.Object) error { return nil } -//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-team,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=teams,verbs=create;update,versions=v1alpha1,name=vteam.kb.io,admissionReviewVersions=v1 +//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-team,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=teams,verbs=create;update;delete,versions=v1alpha1,name=vteam.kb.io,admissionReviewVersions=v1 func ValidateCreateTeam(ctx context.Context, c client.Client, o runtime.Object) (admission.Warnings, error) { team, ok := o.(*greenhousev1alpha1.Team) diff --git a/pkg/admission/teamrolebinding_webhook.go b/pkg/admission/teamrolebinding_webhook.go index 5b82e2335..dfcc59344 100644 --- a/pkg/admission/teamrolebinding_webhook.go +++ b/pkg/admission/teamrolebinding_webhook.go @@ -38,7 +38,7 @@ func DefaultRoleBinding(_ context.Context, _ client.Client, _ runtime.Object) er return nil } -//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-teamrolebinding,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=teamrolebindings,verbs=create;update,versions=v1alpha1,name=vrolebinding.kb.io,admissionReviewVersions=v1 +//+kubebuilder:webhook:path=/validate-greenhouse-sap-v1alpha1-teamrolebinding,mutating=false,failurePolicy=fail,sideEffects=None,groups=greenhouse.sap,resources=teamrolebindings,verbs=create;update;delete,versions=v1alpha1,name=vrolebinding.kb.io,admissionReviewVersions=v1 func ValidateCreateRoleBinding(ctx context.Context, c client.Client, o runtime.Object) (admission.Warnings, error) { rb, ok := o.(*greenhousev1alpha1.TeamRoleBinding) diff --git a/pkg/admission/utils.go b/pkg/admission/utils.go index b0c031beb..b3b11529f 100644 --- a/pkg/admission/utils.go +++ b/pkg/admission/utils.go @@ -73,6 +73,7 @@ func setupCustomValidatorWithManager(mgr ctrl.Manager, webhookFuncs webhookFuncs } func (c *customValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) { + logAdmissionRequest(ctx) if c.validateCreate == nil { return nil, nil } @@ -80,6 +81,7 @@ func (c *customValidator) ValidateCreate(ctx context.Context, obj runtime.Object } func (c *customValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) { + logAdmissionRequest(ctx) if c.validateUpdate == nil { return nil, nil } @@ -87,6 +89,7 @@ func (c *customValidator) ValidateUpdate(ctx context.Context, oldObj, newObj run } func (c *customValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error) { + logAdmissionRequest(ctx) if c.validateDelete == nil { return nil, nil } @@ -99,3 +102,13 @@ func validateImmutableField(oldValue, newValue string, path *field.Path) *field. } return nil } + +// logAdmissionRequest logs the AdmissionRequest. +// This is necessary to audit log the AdmissionRequest independently of the api server audit logs. +func logAdmissionRequest(ctx context.Context) { + admissionRequest, err := admission.RequestFromContext(ctx) + if err != nil { + return + } + ctrl.Log.Info("AdmissionRequest", "Request", admissionRequest) +}