-
Notifications
You must be signed in to change notification settings - Fork 193
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
lib: Add ValidatingWebhookConfiguration defaulting
This commit will add defaulting of the ValidatingWebhookConfiguration resources. Previously, the CVO would treat these resources as generic resources, and this would cause hotlooping. The default values were set by values described in the Kubernetes documentation [1]. [1] https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#validatingwebhookconfiguration-v1-admissionregistration-k8s-io
- Loading branch information
1 parent
bdac5ff
commit 9c1a30f
Showing
7 changed files
with
649 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| package resourceapply | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "github.com/google/go-cmp/cmp" | ||
| "github.com/openshift/cluster-version-operator/lib/resourcemerge" | ||
| admissionregv1 "k8s.io/api/admissionregistration/v1" | ||
| apierrors "k8s.io/apimachinery/pkg/api/errors" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| admissionregclientv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1" | ||
| "k8s.io/klog/v2" | ||
| "k8s.io/utils/pointer" | ||
| ) | ||
|
|
||
| func ApplyValidatingWebhookConfigurationv1(ctx context.Context, client admissionregclientv1.ValidatingWebhookConfigurationsGetter, required *admissionregv1.ValidatingWebhookConfiguration, reconciling bool) (*admissionregv1.ValidatingWebhookConfiguration, bool, error) { | ||
| existing, err := client.ValidatingWebhookConfigurations().Get(ctx, required.Name, metav1.GetOptions{}) | ||
| if apierrors.IsNotFound(err) { | ||
| klog.V(2).Infof("ValidatingWebhookConfiguration %s/%s not found, creating", required.Namespace, required.Name) | ||
| actual, err := client.ValidatingWebhookConfigurations().Create(ctx, required, metav1.CreateOptions{}) | ||
| return actual, true, err | ||
| } | ||
| if err != nil { | ||
| return nil, false, err | ||
| } | ||
| // if we only create this resource, we have no need to continue further | ||
| if IsCreateOnly(required) { | ||
| return nil, false, nil | ||
| } | ||
|
|
||
| var original admissionregv1.ValidatingWebhookConfiguration | ||
| existing.DeepCopyInto(&original) | ||
| modified := pointer.Bool(false) | ||
| resourcemerge.EnsureValidatingWebhookConfiguration(modified, existing, *required) | ||
| if !*modified { | ||
| return existing, false, nil | ||
| } | ||
| if reconciling { | ||
| if diff := cmp.Diff(&original, existing); diff != "" { | ||
| klog.V(2).Infof("Updating ValidatingWebhookConfiguration %s/%s due to diff: %v", required.Namespace, required.Name, diff) | ||
| } else { | ||
| klog.V(2).Infof("Updating ValidatingWebhookConfiguration %s/%s with empty diff: possible hotloop after wrong comparison", required.Namespace, required.Name) | ||
| } | ||
| } | ||
|
|
||
| actual, err := client.ValidatingWebhookConfigurations().Update(ctx, existing, metav1.UpdateOptions{}) | ||
| return actual, true, err | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| package resourcedelete | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| admissionregv1 "k8s.io/api/admissionregistration/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| admissionregclientv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1" | ||
| ) | ||
|
|
||
| // DeleteValidatingWebhookConfigurationv1 checks the given resource for a valid delete | ||
| // annotation. If found it checks the status of a previously issued delete request. | ||
| // If delete has not been requested and in UpdatingMode it will issue a delete request. | ||
| func DeleteValidatingWebhookConfigurationv1(ctx context.Context, | ||
| client admissionregclientv1.ValidatingWebhookConfigurationsGetter, | ||
| required *admissionregv1.ValidatingWebhookConfiguration, | ||
| updateMode bool) (bool, error) { | ||
|
|
||
| if delAnnoFound, err := ValidDeleteAnnotation(required.Annotations); !delAnnoFound || err != nil { | ||
| return delAnnoFound, err | ||
| } | ||
| existing, err := client.ValidatingWebhookConfigurations().Get(ctx, required.Name, metav1.GetOptions{}) | ||
| resource := Resource{ | ||
| Kind: "validatingwebhookconfiguration", | ||
| Namespace: required.Namespace, | ||
| Name: required.Name, | ||
| } | ||
| if deleteRequested, err := GetDeleteProgress(resource, err); err == nil { | ||
| // Only request deletion when in update mode. | ||
| if !deleteRequested && updateMode { | ||
| if err := client.ValidatingWebhookConfigurations().Delete(ctx, required.Name, metav1.DeleteOptions{}); err != nil { | ||
| return true, fmt.Errorf("Delete request for %s failed, err=%v", resource, err) | ||
| } | ||
| SetDeleteRequested(existing, resource) | ||
| } | ||
| } else { | ||
| return true, fmt.Errorf("Error running delete for %s, err=%v", resource, err) | ||
| } | ||
| return true, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package resourcemerge | ||
|
|
||
| import ( | ||
| admissionregv1 "k8s.io/api/admissionregistration/v1" | ||
| "k8s.io/apimachinery/pkg/api/equality" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/utils/pointer" | ||
| ) | ||
|
|
||
| // EnsureValidatingWebhookConfiguration ensures that the existing matches the required. | ||
| // modified is set to true when existing had to be updated with required. | ||
| func EnsureValidatingWebhookConfiguration(modified *bool, existing *admissionregv1.ValidatingWebhookConfiguration, required admissionregv1.ValidatingWebhookConfiguration) { | ||
| EnsureObjectMeta(modified, &existing.ObjectMeta, required.ObjectMeta) | ||
| ensureValidatingWebhookConfigurationDefaults(&required) | ||
| if !equality.Semantic.DeepEqual(existing.Webhooks, required.Webhooks) { | ||
| *modified = true | ||
| existing.Webhooks = required.Webhooks | ||
| } | ||
| } | ||
|
|
||
| func ensureValidatingWebhookConfigurationDefaults(required *admissionregv1.ValidatingWebhookConfiguration) { | ||
| for i := range required.Webhooks { | ||
| ensureValidatingWebhookDefaults(&required.Webhooks[i]) | ||
| } | ||
| } | ||
|
|
||
| func ensureValidatingWebhookDefaults(required *admissionregv1.ValidatingWebhook) { | ||
| if required.FailurePolicy == nil { | ||
| policy := admissionregv1.Fail | ||
| required.FailurePolicy = &policy | ||
| } | ||
| if required.MatchPolicy == nil { | ||
| policy := admissionregv1.Equivalent | ||
| required.MatchPolicy = &policy | ||
| } | ||
| if required.NamespaceSelector == nil { | ||
| required.NamespaceSelector = &metav1.LabelSelector{} | ||
| } | ||
| if required.ObjectSelector == nil { | ||
| required.ObjectSelector = &metav1.LabelSelector{} | ||
| } | ||
| if required.TimeoutSeconds == nil { | ||
| required.TimeoutSeconds = pointer.Int32(10) | ||
| } | ||
| for i := range required.Rules { | ||
| ensureRuleWithOperationsDefaults(&required.Rules[i]) | ||
| } | ||
| } | ||
|
|
||
| func ensureRuleWithOperationsDefaults(required *admissionregv1.RuleWithOperations) { | ||
| if required.Scope == nil { | ||
| scope := admissionregv1.AllScopes | ||
| required.Scope = &scope | ||
| } | ||
| } | ||
|
|
Oops, something went wrong.